Operations
The controller is a single Go binary backed by PostgreSQL — no Vault, no agents on targets, no control-plane cluster. This section covers running it: pick a deployment, harden it, keep it observable and upgraded.
Deploy
Section titled “Deploy”Deployment lives under Installation → Controller: pick a VM, Docker Compose, or Kubernetes (Helm) install.
Then follow the initial setup walkthrough — first login, license, SSO, first target.
Before production
Section titled “Before production”- Stable encryption keys — back up
tessera.secret/TESSERA_ENC_KEY; losing the key makes stored credentials unrecoverable. See Backups & upgrades. - A real TLS certificate — terminate TLS at a reverse proxy; see Secure Tessera.
- A backed-up PostgreSQL — it holds the encrypted credentials and the audit log.
TESSERA_PUBLIC_URL— set the public name so OIDC redirects and links resolve; see Configuration.
Operate
Section titled “Operate”- Secure Tessera — hardening checklist and the security model.
- Monitoring & metrics — Prometheus endpoint.
- Backups & upgrades — what to save, how to restore, planned upgrades.
- Licensing & activation — offline license files and connected mode.
- Branding · System requirements
We would like to count visits with Google Analytics, which needs a cookie. Nothing is loaded and nothing is stored unless you accept. What this sets.