Installation

Installing Tessera is two independent pieces:

1. The controller — the server that brokers access. Run it once, on a VM, with Docker Compose, or on Kubernetes.
2. The desktop client — what each engineer installs on their workstation to connect.

Most deployments start with the controller, then hand out the desktop client (or the CLI) to users.

Install the controller

Pick one path:

1. VM (Debian/Ubuntu) — apt package + systemd. The simplest path; keys are generated for you on install.
2. Docker Compose — one container against your own PostgreSQL.
3. Kubernetes (Helm) — the official secure-by-default chart for ingress-nginx, Traefik, or Gateway API.

Then follow the initial setup walkthrough — first login, license, SSO, first target — and harden it with the Operations guides.

Install the desktop client

Every engineer installs the desktop client (Windows, macOS or Linux) and adds your controller address as an account. Headless and CI users can use the CLI instead.