Download the appliance. Keep the data local.
Tracelet runs as a Windows appliance with local PostgreSQL, a bundled HTTPS proxy, and optional Windows agents. The vendor service handles accounts, licenses, downloads, and signed updates only.
Appliance, agent, and Caddy component metadata are published through Cloudflare and verified locally before use.
Latest release
The Worker reads release metadata from D1 and serves signed artifacts from R2.
Download links are backed by the release manifest and artifact SHA256 metadata.
Update trust boundary
Vendor signs
Cloudflare Worker stores account data and serves artifacts. Signing keys stay in the vendor plane.
Appliance verifies
The appliance receives public keys, manifests, and hashes. It does not receive vendor signing secrets.
Caddy ships inside MSI
The dashboard proxy is packaged and updated with appliance releases, with runtime checksum verification.