# Self-host the dashboard

> Plan a licensed independent installation and connect CLI devices to its own API and browser origin.

Source: https://docs.agentbeam.com/agent-cli/self-hosting

The self-host bundle runs Dashboard v1 behind Caddy with PostgreSQL and an installation-bound license. It is independent of Beam Cloud. Use a tested release with matched dashboard and maintenance image digests, and keep deployment secrets outside source control.

## Prepare the installation

Your operator needs a stable HTTPS hostname, the release images, an issued license, an installation ID, and securely generated application/bootstrap secrets. The bundle is in `deploy/self-host` and includes the Compose file, environment template, proxy configuration, and maintenance instructions.

Database setup and upgrades are explicit operator maintenance steps. Ordinary application startup does not change schema. Review release changes and back up an existing installation before any schema operation. The bundled application liveness endpoint does not establish schema readiness.

## Bootstrap workspace access

After the operator initializes the installation, open `/onboarding` using the configured bootstrap email and private bootstrap token. Create the workspace, invite a second administrator, and test a lower-privilege account. Rotate the bootstrap token after setup.

Subsequent registrations require private invitation links. Protect them as credentials and verify domain and seat restrictions. Platform staff access is separate from workspace ownership.

## Connect the CLI

```sh
npm install -g @agent-beam/beam@0.2.2
export BEAM_API_URL=https://beam.example.com
export BEAM_DASHBOARD_URL=https://beam.example.com
beam connect
```

Replace the hostname with your installation and keep both variables in the environment used by the CLI. Re-enroll devices when moving from Cloud to this independent workspace. Do not replace the local loopback collector URL with the remote hostname.

The MCP server remains a local stdio process. Its scanning tools do not automatically upload results; connecting a self-hosted dashboard does not turn it into a hosted MCP HTTP endpoint.

## Configure App monitoring

[App monitoring](https://docs.agentbeam.com/agent-cli/app-monitoring) works without extra settings. These optional dashboard environment variables keep its data inside your network:

| Variable | Purpose |
| --- | --- |
| `APP_MONITOR_LLM_BASE_URL` | OpenAI-compatible gateway for LLM review by the dashboard, such as Azure OpenAI, vLLM, or a LiteLLM or Bedrock proxy |
| `APP_MONITOR_LLM_API_KEY` | Key for that gateway; falls back to `OPENAI_API_KEY` |
| `APP_MONITOR_LLM_MODEL` | Model name; defaults to `gpt-4.1-nano` |
| `APP_MONITOR_ALLOW_PRIVATE_WEBHOOKS` | Set to `1` to allow integrations to send to private addresses, such as an internal SIEM |
| `APP_MONITOR_CVE_FEED_URL` | Mirror of the CVE feed for networks without internet access; defaults to `https://agentbeam.com/cve/feed.json` |
| `APP_MONITOR_ENCRYPTION_KEY` | Key for encrypting stored integration URLs and keys; falls back to `AUTH_SECRET` |

The monthly App monitoring allowance follows the license. Without an `appMonitor` claim it is unlimited. Servers and apps can also review findings with their own LLM key instead (`beam monitor --llm openai`, or `createAppMonitor({ llm: "openai" })` in the SDK); the key stays with them. A managed settings file can lock that choice for every server; see [settings files](https://docs.agentbeam.com/agent-cli/app-monitoring#settings-files).

## License, backup, and upgrades

License verification is offline and checks the installation binding, edition, expiry, and seats. Back up PostgreSQL, deployment secrets, license, and proxy identity volumes under your encryption and access policy. Test restoring to an isolated environment.

For upgrades, preserve data, review schema compatibility, deploy matching release images, apply the explicit maintenance procedure, and verify login, roles, pairing, ingestion, audit export, and revocation. Roll back images only when compatible with the resulting schema; otherwise restore matching backups and images together. Do not remove data volumes as a troubleshooting shortcut.

## Verify operational requirements

The bundle does not implement enterprise SSO, SCIM, MFA, automated retention, or high availability. Alert workflows can deliver App monitoring findings and device alerts to a SIEM; other audit data is not pushed. Authenticated multi-user behavior and your production storage/restore procedures require deployment acceptance. MDM services are deployed and activated separately.