Getting started
Stand up your own cloud in an afternoon.
Watchtower is an open blueprint, not a signup. If you're comfortable in a terminal, here's the whole path — from bare servers to a running, self-healing cloud. If you're not, it's a friendly weekend project to grow into.
What you'll need
Three things, and none of them exotic.
A few servers
Three fresh Ubuntu servers (2 cores, 2–4 GB RAM each) with public IPs. Rented VPSes, home mini-PCs, or a mix. Want to just try it? Start with one.
A domain
A free DuckDNS domain and its API token. That's what your apps live under and how certificates are issued automatically.
A control machine
Your laptop — macOS, Linux, or Windows with WSL2. It runs the blueprint and holds one vault password. Nothing is installed on it permanently.
The four steps
Configure once, deploy with one command.
Everything is driven by declarative Ansible, so the same commands work the first time and every time after.
Prepare the control machine
Clone the repo (it pulls in the platform it sits on) and install Ansible and its dependencies. On Windows, do this inside WSL2.
# clone the blueprint (--recursive pulls in the platform it sits on) $ git clone --recursive https://gitlab.com/jesusacruzwood/watchtower.git $ cd watchtower $ make -C platform bootstrap # Ansible, collections, an SSH key
Point it at your servers
List your servers and give each one two addresses: its public IP (for the first connection) and its private mesh address (the encrypted road the cluster talks on).
$ cp platform/inventory/hosts.ini.example platform/inventory/hosts.ini # set each node's public ansible_host and its mesh wg_ip
Set your domain and secrets
Fill in your domain and DuckDNS token, then put your passwords and tokens in an encrypted vault. The vault is safe to commit — it travels with the repo, so a second machine only needs the one vault password.
$ cp platform/inventory/group_vars/all/vars.yml.example platform/inventory/group_vars/all/vars.yml $ cp platform/inventory/group_vars/all/vault.yml.example platform/inventory/group_vars/all/vault.yml $ ansible-vault encrypt platform/inventory/group_vars/all/vault.yml
Deploy
Bring up the platform foundation first — the mesh, cluster, database and front door — then run the same commands here to layer every app on top. A dry run shows exactly what will change before anything does.
$ make check # dry run — shows the diff, changes nothing $ make deploy # build it
Two layers, same tooling
Watchtower is the apps layer. It rides on lcl-infra — the platform that provides the mesh, the cluster, the database and the front door — and deploys right after it with the very same commands. Deploy the platform first, then Watchtower on top.
Go deeper
The full guide is open.
These steps are the shape of it. The complete runbook — prerequisites, scaling, backups, disaster recovery and day-2 operations — lives with the code.
Ready to build it?
Own your cloud.
Clone the repo, bring three small servers and a domain, and you're an afternoon away from a cloud that's entirely your own.