Run Netwarden entirely on
your own hardware.
One binary. SQLite by default. Air-gappable. The same security wedge, alerts, dashboards, and agent integrations as the cloud. No phoning home, no telemetry beacons, no license keys for the Community tier.
Linux ARM64, macOS, and Windows builds below. The self-hosted binary is in active development. Expect rough edges and weekly releases.
Built for the people who actually self-host.
Homelab
Proxmox, TrueNAS, Unraid, a Pi cluster on a shelf. Runs on a Raspberry Pi 4 with around 150 MB of RAM. No subscription, no cloud account, no telemetry.
Small business
On-prem visibility without sending host metrics to a SaaS. A single admin can install, configure, and operate it. Email alerts work out of the box once SMTP is set.
Air-gapped & regulated
Designed for air-gapped operation: zero outbound connections you didn't configure. Mirror the CVE feeds locally and the binary keeps doing security work without internet egress.
What's in the binary
The whole product, in one file.
Everything that ships in our cloud also ships in the self-hosted build. No feature flags, no “contact sales” gates on the Community tier.
One binary, ~50 MB
Compiled with Bun. No runtime to install, no dependencies to chase. Compressed Linux x64 build is around 50 MB.
SQLite by default
Zero database setup. The binary creates ./data/netwarden.db on first run. No Postgres, no Redis, no message broker.
Web UI on port 3000
Full dashboard, hosts, alerts, dashboards, security wedge. Bind to a different port or interface via config.
Same Go agent
curl -sSL get.netwarden.com | bash on each host. Point --api-url at your self-hosted instance. The agent doesn't know it's not SaaS.
Auto-discovery
Detects Docker, Podman, MySQL, PostgreSQL, and WordPress (via plugin) without manual config on each host.
CVE matching
Pulls Ubuntu USN, Debian DSA, and Red Hat advisories on a daily cron. Mirror the feeds locally for air-gapped environments.
GeoIP failed-login
Surfaces failed SSH and web logins by country and ASN. Bring your own MaxMind GeoLite2 mmdb. No data leaves the box.
Mobile push (optional)
FCM push to the iOS/Android app if you provide Firebase credentials. Email alerts work standalone with no extra setup.
Download. Run. Open localhost:3000.
SQLite is built in, so no database to install and no config files to write. The first-run setup wizard creates your admin tenant and user. You are on the dashboard in a couple of minutes.
Prefer to verify before you run? Every release ships with SHA256 checksums and a signed manifest, both linked from the downloads section below.
$ curl -sSL get.netwarden.com/selfhosted/install.sh | bash
Downloading Netwarden v2.5.0 (linux-x64)...
Installed to /opt/netwarden/server
Starting Netwarden v2.5.0...
Database: SQLite (./data/netwarden.db)
✓ Web UI ready at http://localhost:3000
✓ First-run setup at http://localhost:3000/auth/setup
Self-hosted vs cloud
Two ways to run the same product.
SaaS wins when you want us to run it. Self-hosted wins when your data shouldn't leave your network. Both ship the full feature set.
Community Self-hosted · Free | Pro Self-hosted · Private beta | Cloud $9.90 / $29.90 mo | |
|---|---|---|---|
| Hosts included | Up to 5 | Unlimited | Solo: 5 · Pro: 50+ |
| Metric retention | 365 days | 365 days | 90 days |
| Alerts & dashboards | Unlimited | Unlimited | |
| Auto-discovery (Docker, MySQL, Postgres, WP) | |||
| Security wedge (CVE, GeoIP, weekly digest) | |||
| Automatic CVE feed updates | Daily, internet | Daily or mirror | Managed |
| Mobile push (FCM) | Bring your own | Bring your own | Managed |
| Postgres backend | SQLite only | Roadmap | Managed |
| Hosting & uptime | You run it | You run it | We run it |
| Data sovereignty | Your network | Your network | Our cloud |
| Support | Community | Email | Email |
Self-hosted pricing
Community
For homelabs and small teams
Free
forever · up to 5 hosts
- Up to 5 hosts
- 365-day metric retention
- Unlimited alerts and dashboards
- CVE, GeoIP, and weekly digest included
- Email alerts (SMTP) out of the box
- Community support on GitHub & Discord
Private beta
Pro
For unlimited hosts and larger fleets
Pricing in beta
request access for a quote
- Unlimited hosts
- Everything in Community
- Postgres backend (roadmap)
- Email support
- Priority on roadmap input
Downloads
Pick your platform.
Single binary, no installer. Make it executable, run it, open localhost:3000.
Verify the binary before running.
Each release ships with SHA256 checksums and a signed manifest at
https://get.netwarden.com/selfhosted/latest/SHA256SUMS. The install script (https://get.netwarden.com/selfhosted/install.sh) verifies them automatically. Step-by-step instructions are in the docs.FAQ
Honest answers.
Does Netwarden phone home?
No. The self-hosted binary makes zero outbound connections you didn't configure. CVE feed pulls and (optional) FCM push are both opt-in and disabled in air-gapped mode.
Can I migrate from SaaS to self-hosted later?
Yes. A `nw export` data export is in progress. In the meantime both can coexist: install the self-hosted binary, then point each agent's --api-url at the new instance whenever you're ready to switch.
Where do CVE feeds come from?
The binary fetches Ubuntu USN, Debian DSA, and Red Hat advisories on a daily cron. In an air-gapped environment you mirror those feeds inside your network and point Netwarden at the local mirror.
Is Postgres supported?
Roadmap. SQLite is the default for self-hosted and is what powers the SaaS-grade feature set today. The Pro tier will let you point at your own Postgres for larger fleets.
Is the source open?
The Go agent is open source. The platform is source-available for self-hosted use; some Pro features may carry separate licensing terms when Pro lands. Community is and will stay free for homelabs and small teams.
Get started in 60 seconds.
curl -sSL get.netwarden.com/selfhosted/install.sh | bash