Skip to content
Tessera Tessera Docs

Install the controller

The controller is a single Go binary backed by PostgreSQL. Pick one deployment path:

  1. VM (Debian/Ubuntu) — apt package + systemd. The simplest path; keys are generated for you on install.
  2. Docker Compose — one container against your own PostgreSQL.
  3. Kubernetes (Helm) — the official secure-by-default chart for ingress-nginx, Traefik, or Gateway API.

Then follow the initial setup walkthrough — first login, license, SSO, first target.

Before production

Section titled “Before production”
  • Stable encryption keys — back up tessera.secret / TESSERA_ENC_KEY; losing the key makes stored credentials unrecoverable. See Backups & upgrades.
  • A real TLS certificate — terminate TLS at a reverse proxy; see Secure Tessera.
  • A backed-up PostgreSQL — it holds the encrypted credentials and the audit log.
  • TESSERA_PUBLIC_URL — set the public name so OIDC redirects and links resolve; see Configuration.

Cookies