Packaging Tesseras for Debian

2026-02-16

Tesseras now ships a .deb package for Debian and Ubuntu. This post walks -through building and installing the package from source using cargo-deb.

Prerequisites

You need a working Rust toolchain and the required system libraries:

sudo apt install build-essential pkg-config libsqlite3-dev
-rustup toolchain install stable
-cargo install cargo-deb
-

Building

Clone the repository and run the just deb recipe:

git clone https://git.sr.ht/~ijanc/tesseras
-cd tesseras
-just deb
-

This recipe does three things:

Compiles tesd (the daemon) and tes (the CLI) in release mode with -cargo build --release
Generates shell completions for bash, zsh, and fish from the tes binary
Packages everything into a .deb file with -cargo deb -p tesseras-daemon --no-build

The result is a .deb file in target/debian/.

Installing

sudo dpkg -i target/debian/tesseras-daemon_*.deb
-

If there are missing dependencies, fix them with:

sudo apt install -f
-

Post-install setup

The postinst script automatically creates a tesseras system user and the -data directory /var/lib/tesseras. To use the CLI without sudo, add yourself to -the group:

sudo usermod -aG tesseras $USER
-

Log out and back in, then start the daemon:

sudo systemctl enable --now tesd
-

What the package includes

- - - - - - -

Path	Description
`/usr/bin/tesd`	Full node daemon
`/usr/bin/tes`	CLI client
`/etc/tesseras/config.toml`	Default configuration (marked as conffile)
`/lib/systemd/system/tesd.service`	Systemd unit with security hardening
Shell completions	bash, zsh, and fish

How cargo-deb works

The packaging metadata lives in crates/tesseras-daemon/Cargo.toml under -[package.metadata.deb]. This section defines:

depends — runtime dependencies: libc6 and libsqlite3-0
assets — files to include in the package (binaries, config, systemd unit, -shell completions)
conf-files — files treated as configuration (preserved on upgrade)
maintainer-scripts — postinst and postrm scripts in -packaging/debian/scripts/
systemd-units — automatic systemd integration

The postinst script creates the tesseras system user and data directory on -install. The postrm script cleans up the user, group, and data directory only -on purge (not on simple removal).

Systemd hardening

The tesd.service unit includes security hardening directives:

NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/var/lib/tesseras
-PrivateTmp=true
-PrivateDevices=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-MemoryDenyWriteExecute=true
-

The daemon runs as the unprivileged tesseras user and can only write to -/var/lib/tesseras.

Deploying to a remote server

The justfile includes a deploy recipe for pushing the .deb to a remote host:

just deploy bootstrap1.tesseras.net
-

This builds the .deb, copies it via scp, installs it with dpkg -i, and -restarts the tesd service.

Updating

After pulling new changes, simply run just deb again and reinstall:

git pull
-just deb
-sudo dpkg -i target/debian/tesseras-daemon_*.deb
-

- -