Deploy Tessera

Tessera on Railway

Deploy and Host

Deploy Tessera from the published container image ghcr.io/limatura/tessera:latest and host a private file-sharing service on Railway. The template includes the service variables and a persistent volume mounted at /data.

About Hosting

Railway runs Tessera as a single image-based service. The included 500 MB volume stores the SQLite database, encryption key, logs, and local uploads. Increase the volume size or configure an external storage backend as your instance grows.

Why Deploy

Tessera gives you privacy-preserving, self-hosted sharing without relying on a third-party file transfer service. Railway provides managed deployments, public networking, logs, and persistent storage while the application remains open source and portable.

Common Use Cases

• Share files, folders, notes, code snippets, and URLs with expiring links.
• Run a private transfer service for a small team or household.
• Host a controlled public upload endpoint with quotas and upload limits.
• Provide an API-backed file sharing service for internal tools and automation.

Dependencies for Tessera

Deployment Dependencies

• A Railway service using ghcr.io/limatura/tessera:latest.
• A persistent Railway volume mounted at /data.
• RAILWAY_RUN_UID=0 so Railway can initialize the volume for the image's non-root runtime user.
• TESSERA_SERVER__PORT=12923, matching the image's exposed HTTP port.

Tessera is a self-hosted file and note sharing service that creates short-lived links for files, folders, code snippets, and URLs.

It is designed for privacy-conscious individuals, teams, and public sharing instances. Shares can expire automatically, require a password, or be limited by download count.

Features

• Self-hosted file, folder, note, code, and link sharing
• Expiring share links
• Optional passwords and download limits
• Anonymous uploads or authenticated accounts
• Image, code, SVG, and Mermaid previews
• SQLite support out of the box
• PostgreSQL and MySQL support for larger deployments
• Persistent storage through Railway volumes
• Built-in administration panel at /admin
• API and command-line client support
• Optional object storage backends
• English, Traditional Chinese, and Japanese interfaces
• Single Rust binary with the web application embedded

Deploy on Railway

1. Click the Deploy on Railway button above.
2. Select or create a Railway project.
3. Review the generated variables.
4. Add a persistent volume mounted at /data.
5. Deploy the service.
6. Open the generated Railway domain.

The service runs the published container image ghcr.io/limatura/tessera:latest. Tessera listens on the Railway-provided PORT value and stores its database, encryption key, and local files under /data.

The template does not build the application from source. Railway pulls the published GHCR image directly, so deployments are fast and reproducible.

Railway Configuration

Recommended values:

TESSERA_SERVER__HOST=0.0.0.0
TESSERA_SERVER__PORT=12923
TESSERA_DATABASE__URL=sqlite:///data/tessera.db?mode=rwc
TESSERA_SERVER__DATA_DIR=/data
RAILWAY_RUN_UID=0
TESSERA_TELEMETRY__FORMAT=json
TESSERA_TELEMETRY__ANSI=false
TESSERA_FEATURES__DOCS=false

Persistent Storage

Add a Railway volume mounted at /data. The volume is required for production use. Without it, the SQLite database, uploaded files, generated encryption key, and other local data will be lost when the service is redeployed or restarted.

Administrator Access

On the first deployment, Tessera creates an administrator account. If TESSERA_AUTH__ADMIN_PASSWORD is not set, Tessera generates a password and prints it once in the deployment logs. Store the password securely and change it after signing in.

For predictable deployments, set TESSERA_AUTH__ADMIN_PASSWORD in Railway's variable configuration instead of committing it to source control.

Security Recommendations

• Set a strong TESSERA_SECURITY__SECRET_KEY.
• Attach a persistent /data volume.
• Set TESSERA_FEATURES__DOCS=false unless the API documentation is required.
• Configure upload size and storage limits.
• Consider disabling anonymous uploads.
• Use PostgreSQL for multi-instance deployments.
• Configure an external malware scanner for untrusted uploads.
• Never commit passwords, database credentials, or secret keys to Git.

Optional Database Configuration

SQLite is the simplest option for a single Railway service:

TESSERA_DATABASE__URL=sqlite:///data/tessera.db?mode=rwc

For a larger or multi-instance deployment, use PostgreSQL:

TESSERA_DATABASE__URL=postgres://USER:PASSWORD@HOST:5432/DATABASE

Keep database credentials in Railway variables or Railway references. Do not place them in the repository.

Troubleshooting

The service is not reachable

Confirm that TESSERA_SERVER__HOST=0.0.0.0 and TESSERA_SERVER__PORT=12923 are configured, and that the Railway service domain targets port 12923.

Data disappeared after redeployment

Verify that a Railway volume is mounted at /data.

The administrator password is unavailable

Check the first deployment logs. If a password was generated automatically, Tessera prints it only once. For a new installation, set TESSERA_AUTH__ADMIN_PASSWORD before deploying.

License

Tessera is licensed under the AGPL-3.0 license.