Deploy

Tetrapus ships four supported install paths. Pick one based on where you are running, then follow the matching reference page. The same binaries underpin all four — the only thing that changes is the orchestrator wrapping them.

Decision tree

graph TD Q1{"Running in<br/>Kubernetes?"} Q2{"systemd-managed<br/>Linux?"} Q3{"Air-gapped<br/>environment?"} HELM["Helm chart<br/>/docs/deploy/helm"] SYSD["systemd units<br/>/docs/deploy/systemd"] AIR["Signed bundle<br/>/docs/deploy/air-gap"] CLI["tetrapus-admin<br/>/docs/deploy/admin-cli"] Q1 -->|yes| HELM Q1 -->|no| Q2 Q2 -->|yes| Q3 Q2 -->|no| HELM Q3 -->|yes| AIR Q3 -->|no| SYSD HELM -.->|day-2| CLI SYSD -.->|day-2| CLI AIR -.->|day-2| CLI

Install paths

Helm chart

Recommended for Kubernetes. Bundles control plane, gateway, operator, CRDs, RBAC, optional SIEM sidecar and ingress.

systemd units

Process-per-Org on bare metal or VMs. Hardened sandboxing flags shipped (ProtectSystem=strict, MemoryDenyWriteExecute).

Air-gap install

Signed bundle distribution. .tar.zst + manifest + signature. Verify before install.

tetrapus-admin CLI

Day-2 operator workflows: bootstrap, keys, audit verify, attestation, break-glass, backup, SBOM, tenant-plane.

Across-the-board defaults

  • Database — Postgres 14+ for the control plane; SQLite or Postgres for each data plane.
  • TLS — required for the gateway. The chart and the systemd units never ship private keys.
  • Audit — hash-chained NDJSON log on every node. See Audit Trail.
  • Region — every Org pins a region_code; the gateway returns 421 if it sees a misrouted request.

Related

Questions?

Reach out for help with integration, deployment, or custom domain codecs.

Get Started Request a Demo