Open source · Self-hosted · Zero-trust

Your firewall shouldn't
be a blind spot.

WatchDog deploys lightweight agents inside your network to monitor internal services, databases, and APIs that external tools can't reach. Real-time dashboard. Instant alerts. Zero configuration.

Deploy Free See How It Works

terminal

$ curl -sSL https://watchdog.sixwords.tech/install | sh

API Key: ••••••••••••

Done! Your agent will appear in the dashboard shortly.

dashboard

Monitors

Healthy

Uptime

99.9%

Service Status

Response Time (ms)

The blind spot in your monitoring

The problem

Most monitoring tools run checks from a single external server. If your service is behind a firewall, NAT, or VPC — they can't see it. You're flying blind on the infrastructure that matters most.

The WatchDog approach

WatchDog flips the model. A lightweight agent runs inside your network, checking services locally and reporting back to a central hub. No inbound ports. No VPN tunnels. No blind spots.

How it works

1. Deploy an agent

Single Go binary. Run it inside your network — a VPC, a homelab, behind a NAT. No config file needed.

2. Agent runs checks

HTTP, TCP, DNS, TLS, Docker, database, and system metrics. The hub pushes monitor configs to the agent over WebSocket. The agent reports back.

3. Get alerted

Three consecutive failures trigger an incident. Get notified via Discord, Slack, Email, Telegram, PagerDuty, or webhooks.

Features

What you get out of the box.

Agent-based monitoring

The agent runs inside your network, so it can reach things that external monitoring tools can't — internal databases, Docker containers, private APIs, services behind a firewall or NAT.

Live dashboard

Real-time status via SSE. Latency sparklines, uptime bars, system metric charts, and incident timeline. No page refresh.

Smart alerts

3-strike rule before firing. Supports Discord, Slack, Email, Telegram, PagerDuty, and webhooks.

Eight check types

HTTP with content validation, TCP, Ping, DNS, TLS certificate expiry tracking, Docker containers, database connectivity (PostgreSQL, MySQL, Redis), and system metrics with threshold alerts.

[OK] api.internal/health .... 12ms

[OK] postgres:5432 ......... 2ms

[OK] redis:6379 ............ 1ms

[FAIL] vault:8200 ........... timeout

Zero config agent

The agent takes a hub URL and an API key. That's it. Monitor configs are pushed from the hub over WebSocket — no config files, no restarts.

$ ./watchdog-agent \

--hub https://hub.example.com \

--key wdg_a8f29c...

[connected] receiving 6 monitors...

Incident tracking

Incidents are created automatically on failure. Acknowledge, resolve, and track time-to-resolution. Full history per monitor.

#1042 postgres:5432 ● open

├─ Failure detected 09:41:03

├─ Acknowledged 09:42:18

└─ Resolved 09:44:51

TTR: 3m 48s

Public status pages

Share real-time service health with your team or customers. 90-day uptime history, incident timeline, and custom URLs. No authentication required to view.

REST API

Token-authenticated API for programmatic access. Manage monitors, agents, and incidents from your own scripts or CI/CD pipelines.

Audit trail

Every login, monitor change, and incident action is logged with timestamps, user IDs, and IP addresses. Full event history for compliance and debugging.

Why WatchDog

How agent-based monitoring compares to traditional tools.

Architecture

Before: Single external server

WatchDog: Distributed agents inside your network

Internal services

Before: Requires VPN or tunnels

WatchDog: Direct access — agent runs locally

Inbound ports

Before: Required for checks

WatchDog: None — agent connects outbound

Configuration

Before: Config files per check

WatchDog: Zero-config — hub pushes over WebSocket

Alert verification

Before: Often single-check

WatchDog: 3-strike rule — no false alarms

Network exposure

Before: Open inbound ports for probes

WatchDog: Zero inbound ports — outbound-only

Data path

Before: Credentials sent to third-party SaaS

WatchDog: Self-hosted — credentials never leave your infra

	Traditional Monitoring	WatchDog
Architecture	Single external server	Distributed agents inside your network
Internal services	Requires VPN or tunnels	Direct access — agent runs locally
Inbound ports	Required for checks	None — agent connects outbound
Configuration	Config files per check	Zero-config — hub pushes over WebSocket
Alert verification	Often single-check	3-strike rule — no false alarms
Network exposure	Open inbound ports for probes	Zero inbound ports — outbound-only
Data path	Credentials sent to third-party SaaS	Self-hosted — credentials never leave your infra

Architecture

Three components. One binary each.

Hub

Central server. Stores configs, processes heartbeats, serves the dashboard, fires alerts. Go + PostgreSQL + TimescaleDB.

Agent

Lightweight Go binary that runs inside your network. Connects to the hub over WebSocket. Receives check configs, reports results.

Dashboard

Real-time web UI served by the hub. Live updates via SSE. Public status pages. HTMX + Alpine.js — no SPA framework.

Built with: Go PostgreSQL TimescaleDB WebSocket HTMX

Security by design

Your infrastructure credentials never leave your network.

Zero inbound ports

The agent connects outbound to the hub over WebSocket. No listening ports, no attack surface on your network.

Minimal attack surface

Single static Go binary. No runtime dependencies, no interpreters, no package managers. Agent fingerprinting detects impersonation.

Credentials stay local

Self-hosted hub means your database passwords, API keys, and service endpoints never leave your infrastructure.

Your firewall shouldn't be a blind spot.

The blind spot in your monitoring

The problem

The WatchDog approach

How it works

1. Deploy an agent

2. Agent runs checks

3. Get alerted

Features

Agent-based monitoring

Live dashboard

Smart alerts

Eight check types

Zero config agent

Incident tracking

Public status pages

REST API

Audit trail

Why WatchDog

Architecture

Hub

Agent

Dashboard

Security by design

Zero inbound ports

Minimal attack surface

Credentials stay local

Deploy your first agent

Your firewall shouldn't
be a blind spot.