Install the controller

The controller is a single Go binary backed by PostgreSQL. Pick one deployment path:

1. VM (Debian/Ubuntu) — apt package + systemd. The simplest path; keys are generated for you on install.
2. Docker Compose — one container against your own PostgreSQL.
3. Kubernetes (Helm) — the official secure-by-default chart for ingress-nginx, Traefik, or Gateway API.

Then follow the initial setup walkthrough — first login, license, SSO, first target.

Before production

Any of the three paths above will start and serve traffic without the settings below. Five of them are one-time decisions that are awkward to change later, and one of them is unrecoverable.

Back up the encryption keys, and keep them away from the database. TESSERA_ENC_KEY encrypts every credential the controller stores; TESSERA_JWT_SECRET signs session tokens. Both default to ephemeral values, so left unset they are regenerated on each start and every credential written under the previous key becomes permanently unreadable. Store the backup somewhere other than the database backup — together the two decrypt everything you hold. Restore a key that does not match the database and you get the confusing version of the same failure: the controller starts normally and credential decryption fails. See Backups & upgrades.

Back up the SSH proxy host key with the data directory. Clients pin it on first connection. Wipe /var/lib/tessera, or the container’s data volume, and a new key is generated on the next start — at which point every client that has ever connected refuses to proceed and reports a changed host key. Restore the key as it was rather than letting one be regenerated.

Terminate real TLS at a reverse proxy. With TESSERA_TLS_CERT and TESSERA_TLS_KEY unset the controller serves an in-memory self-signed certificate, in any mode and not only in development. A deployment that appears to work over HTTPS may be working only because somebody turned verification off on the client. The nginx configuration is on the VM page.

Restrict and back up PostgreSQL. It holds the targets, the encrypted credentials, the users and their grants, and the audit log — pg_dump on a schedule, and network access limited to the controller.

Set TESSERA_PUBLIC_URL. It defaults to https://localhost:8443 and is what OIDC redirect URIs and notification links are built from. Left at the default, single sign-on fails at the redirect and every link you send points at the reader’s own machine. See Configuration.

Put a token on the metrics endpoint. TESSERA_METRICS_TOKEN is unset by default, which leaves /metrics readable by anyone who can reach it — see Monitoring & metrics.

The rest of the hardening checklist is in Secure Tessera.