Self-host Guard

Prepare a Linux installation, initialize security controls, and verify local and connected services.

Self-hosting runs Guard's management, local assessment, endpoint policy, and access services on infrastructure you operate. DDoS mitigation uses the Solarius edge through an optional Connector; other local capabilities do not depend on that Connector.

Requirements and dependenciesCopy link

The management host and its dependencies must meet these minimums:

Minimums are prerequisites, not throughput guarantees. 13 months of telemetry can exceed 100 GB depending on volume. Monitor ingestion lag, storage, scanner queues, and database load before increasing scope. See deployment configuration.

Install and initializeCopy link

Obtain the signed Guard release bundle from the deployment portal, verify its manifest and checksums, and extract it on the Linux management host. Choose a stable HTTPS origin, trusted TLS termination, persistent data path, database, secrets, and backup destination before enrollment.

Run the installation commands from the extracted release directory on the Linux management host. Your account must be authorized to run Docker. The required secret files must already be mounted and readable by the service account.

1. Copy the release's environment template:

   cp guard.env.example guard.env

2. Restrict access to the configuration file:

   chmod 600 guard.env

3. Edit guard.env using the environment inventory. Validate the resulting Compose configuration:

   docker compose --env-file guard.env config --quiet

   Validation succeeds with no output. If it reports an error, correct the named setting before starting services.

4. Start the deployment:

   docker compose --env-file guard.env up -d

5. Inspect the service states:

   docker compose --env-file guard.env ps

   Confirm the required services are running. If a service exits or remains unhealthy, inspect its startup diagnostics and correct the reported configuration or dependency before setup.

6. Generate the one-time setup token:

   ./guard-admin setup-token

7. On the configured HTTPS origin, open /setup and enter the token. Create an organization and recovery Owner, then set authentication, evidence retention, and privacy defaults.

8. Sign in with the recovery Owner and confirm the organization opens. Setup disables after initialization. Store the account's recovery material in its approved location; the setup token is not a management API credential.

Connect and verifyCopy link

At Installation → Health, verify API readiness, database, workers, storage, time, and enabled synchronization services. Follow getting started with a pilot device and scan target. Verify applied policy, actual scan authentication, and notification delivery separately.

Enable SOC collaboration only for approved shared telemetry. Add a Connector when using edge DDoS protection. Direct outbound feed sync does not require a Connector. A restricted network needs staged signed updates and a documented freshness gap when synchronization is unavailable.

Operate and removeCopy link

Set up backups and upgrades, monitor health, and test recovery before broad enrollment. Database or control-plane outage does not automatically remove local endpoint or gateway enforcement.

Before permanent removal, migrate protected routes, revoke access sessions, release or transfer response controls, retire agents and gateways, export required records, and address retained evidence and backups. Stopping Compose is an availability change, not proof all remote enforcement stopped.