Packaging Tesseras for Debian

2026-02-16

Tesseras now ships a .deb package for Debian and Ubuntu. This post walks +through building and installing the package from source using cargo-deb.

Prerequisites

You need a working Rust toolchain and the required system libraries:

sudo apt install build-essential pkg-config libsqlite3-dev
+rustup toolchain install stable
+cargo install cargo-deb
+

Building

Clone the repository and run the just deb recipe:

git clone https://git.sr.ht/~ijanc/tesseras
+cd tesseras
+just deb
+

This recipe does three things:

Compiles tesd (the daemon) and tes (the CLI) in release mode with +cargo build --release
Generates shell completions for bash, zsh, and fish from the tes binary
Packages everything into a .deb file with +cargo deb -p tesseras-daemon --no-build

The result is a .deb file in target/debian/.

Installing

sudo dpkg -i target/debian/tesseras-daemon_*.deb
+

If there are missing dependencies, fix them with:

sudo apt install -f
+

Post-install setup

The postinst script automatically creates a tesseras system user and the +data directory /var/lib/tesseras. To use the CLI without sudo, add yourself to +the group:

sudo usermod -aG tesseras $USER
+

Log out and back in, then start the daemon:

sudo systemctl enable --now tesd
+

What the package includes

+ + + + + + +

Path	Description
`/usr/bin/tesd`	Full node daemon
`/usr/bin/tes`	CLI client
`/etc/tesseras/config.toml`	Default configuration (marked as conffile)
`/lib/systemd/system/tesd.service`	Systemd unit with security hardening
Shell completions	bash, zsh, and fish

How cargo-deb works

The packaging metadata lives in crates/tesseras-daemon/Cargo.toml under +[package.metadata.deb]. This section defines:

depends — runtime dependencies: libc6 and libsqlite3-0
assets — files to include in the package (binaries, config, systemd unit, +shell completions)
conf-files — files treated as configuration (preserved on upgrade)
maintainer-scripts — postinst and postrm scripts in +packaging/debian/scripts/
systemd-units — automatic systemd integration

The postinst script creates the tesseras system user and data directory on +install. The postrm script cleans up the user, group, and data directory only +on purge (not on simple removal).

Systemd hardening

The tesd.service unit includes security hardening directives:

NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/tesseras
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+MemoryDenyWriteExecute=true
+

The daemon runs as the unprivileged tesseras user and can only write to +/var/lib/tesseras.

Deploying to a remote server

The justfile includes a deploy recipe for pushing the .deb to a remote host:

just deploy bootstrap1.tesseras.net
+

This builds the .deb, copies it via scp, installs it with dpkg -i, and +restarts the tesd service.

Updating

After pulling new changes, simply run just deb again and reinstall:

git pull
+just deb
+sudo dpkg -i target/debian/tesseras-daemon_*.deb
+

+ +