On-prem deployment

On the Enterprise plan you can run the whole Lookout stack inside your own network — the control plane and the agents — so your monitoring data never leaves your infrastructure. On-prem is a paid deployment option; contact sales to get the on-prem distribution and license.

The shape of it

  • Run one control plane somewhere your servers can reach (a small VM is plenty).
  • Install the agent on each server you want to watch.
  • Put the dashboard behind TLS so it’s encrypted and access-controlled.

Recommended: Cloudflare in front

The cleanest setup keeps the control plane private and lets Cloudflare handle TLS, DNS, access control, and ingress — with no open inbound ports on your box:

  • Cloudflare Tunnel connects your control plane outbound to Cloudflare; no port forwarding, no firewall holes.
  • Cloudflare Access puts SSO + MFA in front of the dashboard, so only your team can open it.
  • DNS + TLS are automatic at monitor.yourcompany.com.
# on the control-plane host
./lookout-server                      # listens on localhost:8080
cloudflared tunnel --url http://localhost:8080

A full, step-by-step Cloudflare setup guide ships with the on-prem distribution.

Keep your data yours

  • Reports and state never leave the control plane you run.
  • Agents send only the inventory needed to assess health — never secrets or file contents.
  • You hold the enrollment token; rotate it any time and re-deploy agents.

Updating

Replace the control-plane binary with the latest release from your customer downloads page, then restart the service:

sudo cp lookout-server /usr/local/bin/lookout-server
sudo systemctl restart lookout-server   # if you run it as a service

Prefer not to run servers?

Our managed plans run all of the above for you, with no infrastructure to maintain — see pricing.