Install
A one-liner downloads the signed install script, verifies its signature and sets the agent up as its own system service.
Server monitoring
Your servers report in. You open nothing.
A small Rust agent measures CPU, load, memory and swap, disks and inodes, network traffic and uptime – and sends the values to watchr, signed.
Installation (shortened)
curl -fsSL …/install.sh -o install.sh
openssl pkeyutl -verify … -sigfile install.sh.sig
sh install.sh --url https://watchr.example
watchr-agent pair
The web app shows you the full command with signature check.
Pair
The agent shows a code and a QR code. Confirm it in the web app or with Face ID in the iOS app.
Watch
Metrics show up right away; thresholds and “stopped reporting” become incidents with push and email.
Built secure, not bolted on.
watchr stores no credentials for your servers. The agent creates its own key; watchr only knows the public half.
- Outbound connections only, no open port, no command channel
- Every report Ed25519-signed, with timestamp and sequence number against replay
- Static binaries for x86_64 and aarch64, no OpenSSL dependency
- systemd sandbox: its own user, no write access outside its data directory
- Updates only from the signed release manifest
Questions about server monitoring
Does the agent open a port on my server?
No. The agent only sends outbound over HTTPS to watchr. It has no command channel and runs no commands; watchr can only tell it the interval and the desired version.
Does watchr store credentials for my server?
No. watchr only knows the agent's public key. The private key is created on the server and never leaves it.
How do updates reach the server?
You trigger them in the web app. The agent only installs versions from the signed release manifest whose signature matches the release key compiled into it.
Before the next deployment goes wrong.
Create an account, add your first domain and lean back.