Skip to main content

Design Partner Setup

Get the full Watchlight Beacon platform running in under 10 minutes.

Register as a Design Partner

You must be a registered design partner to access Watchlight Beacon. Apply for the Early Preview Program to get started.

Prerequisites​

RequirementDetails
Design Partner registrationRegister for the Early Preview
Docker Engine 24+Install Docker
Docker Compose v2Included with Docker Desktop; or install separately
4 GB RAM minimum8 GB recommended for production-like evaluation
GHCR access tokenGitHub Personal Access Token — provided after registration
License key (optional)JWT license file — provided after registration

Step 1: Get Your Credentials​

Once accepted into the Early Preview Program, your Watchlight AI contact will provide:

  1. A GitHub Personal Access Token (classic PAT) with read:packages scope
  2. A license key (JWT file) — optional for evaluation; services run in read-only mode without it

Step 2: Install​

cd design-partner/

# Place your license file (optional)
cp /path/to/license.jwt ./license.jwt

# Run the bootstrap script
./bootstrap.sh

The bootstrap script will interactively prompt for configuration, then:

  1. Validate prerequisites (Docker version, Compose)
  2. Authenticate to GHCR and pull all container images
  3. Generate secrets in memory (database password, vault token, admin key, session secret)
  4. Start infrastructure (OpenBao for secret management, PostgreSQL)
  5. Store secrets in OpenBao's KV engine (never written to disk)
  6. Start all Beacon services (registry, authorization, discovery, frontends)
  7. Seed a sample Cedar policy
  8. Register a discovery scanner
  9. Start the discovery daemon
  10. Configure Caddy TLS reverse proxy
  11. Verify all 8 containers are healthy

Configuration Prompts​

PromptDefaultDescription
DomainlocalhostSet to a real domain for Let's Encrypt auto-TLS
Image version0.3.0-previewDocker image tag to pull
Log levelinfodebug, info, warn, error
Agent registration modeopenopen, token_required, disabled
HTTPS port443HTTPS port for Caddy
HTTP port80HTTP port (redirects to HTTPS)
License file path./license.jwtPath to your license JWT

TLS Options​

ModeConfiguration
Self-signed (default)Leave domain as localhost. Caddy generates self-signed certs.
Let's EncryptSet domain to beacon.yourcompany.com and ensure ports 443/80 are publicly accessible.
Self-signed certs

The bootstrap exports a CA certificate to ./beacon-ca.crt and prints instructions to trust it in your OS keychain.

Non-Interactive Mode​

export BEACON_DOMAIN=localhost
export VERSION=0.3.0-preview
export GHCR_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
./bootstrap.sh

Step 3: Verify​

Health check​

curl -k https://localhost/health

Expected response: healthy

Access dashboards​

URLDescription
https://localhostPolicy Manager (WL-APDP Dashboard)
https://localhost:8443AI Agent and MCP Registry Dashboard
https://localhost:8443/topologyInteractive Topology Graph
https://localhost:8443/api/v1/serversRegistry API (JSON)

Register a test agent​

curl -k -X POST https://localhost:8443/api/v1/agents/register \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "test-agent",
    "agent_type": "autonomous",
    "description": "Test agent for verification"
  }'

You should receive a JSON response with the agent's id, api_key, and trust_state: "unverified".

What's Running​

ServiceContainerDescription
Caddybeacon-caddyTLS reverse proxy (ports 443/80, 8443)
WL-Registrybeacon-registryMCP server and AI agent registry API
WL-Registry Frontendbeacon-registry-frontendRegistry dashboard SPA
WL-APDPbeacon-apdpCedar-based authorization engine
WL-APDP Frontendbeacon-apdp-frontendPolicy management dashboard SPA
WL-Discoverbeacon-discoverBackground discovery daemon
OpenBaobeacon-openbaoRuntime secret management (in-memory)
PostgreSQLbeacon-postgresDatabase

Common Operations​

# View logs (all services)
docker compose -f docker-compose.yml logs -f

# View logs for a specific service
docker compose -f docker-compose.yml logs -f wl-registry

# Stop all services (preserves data)
docker compose -f docker-compose.yml down

# Restart after reboot
docker compose -f docker-compose.yml up -d

# Full reset (destroys all data)
./bootstrap.sh --reset

Upgrading​

When Watchlight AI releases a new version:

  1. Stop the current deployment: docker compose -f docker-compose.yml down
  2. Re-run bootstrap with the new version: VERSION=0.3.0-preview ./bootstrap.sh
note

Upgrading regenerates secrets and re-bootstraps the environment. Export any policies or agent configurations you want to keep before upgrading.

Uninstalling​

# Stop and remove all containers, volumes, and networks
./bootstrap.sh --reset

# Or manually:
docker compose -f docker-compose.yml down -v

# Remove container images
docker rmi $(docker images "ghcr.io/watchlight-ai-beacon/*" -q) 2>/dev/null

Security Notes​

  • Secrets: All secrets are generated at install time and stored exclusively in OpenBao (in-memory). Never written to disk.
  • GHCR token: Used only during image pull, then cleared from the environment.
  • TLS: All external traffic encrypted via Caddy. Internal service-to-service communication uses the Docker bridge network.
  • Non-root containers: All application containers run as non-root users.
  • Network isolation: Backend services (PostgreSQL, OpenBao) are on an internal-only Docker network.

Troubleshooting​

IssueSolution
docker login returns unauthorizedVerify your GHCR token has read:packages scope
Port conflict (443/80)Set custom ports during bootstrap prompts
License expiredContact sales@watchlight.ai for renewal
Services won't startCheck logs: docker compose -f docker-compose.yml logs
Browser certificate warningTrust the CA cert (see bootstrap output) or use curl -k
wl-discover not finding serversCheck that targets are on the beacon-partner Docker network
Database connection errorsVerify PostgreSQL: docker inspect beacon-postgres --format='{{.State.Health.Status}}'

Support​