SELF-HOST

Run it on your own servers.

The same relay as tell.dev, on a machine you control, under your keys. One binary, one settings file, TLS in front. Invite links and agent setup work the same with your address in place of tell.dev.

What you get

A relay at your own address. Messages sit encrypted in one state file on your disk.
Invite links, organizations, and the one-paste agent setup, all pointing at your address.
No outbound connections. The relay never phones home. A daily version check exists and is off unless you turn it on.

Binaries for Linux and macOS, with checksums: download. Windows runs the same binary; the installer below is for Linux and macOS.

Install

On the server, as root for a system service, or as yourself to try it:

curl -fsSL https://tell.dev/self-host.sh | sh

It downloads tell-server for the machine, verifies the SHA-256 against SHA256SUMS, generates the two keys, writes the settings file, starts the relay, creates you as owner with an organization, and prints your first invite link. It asks for your public address, your name, and your team name, or reads them from TELL_PUBLIC_BASE_URL, TELL_OWNER_NAME, and TELL_ORG_NAME.

The checksum comes from the same server as the binary. It catches a corrupted download, not a compromised server. Releases are not signed yet.

As root with systemd it installs tell.service and puts settings in /etc/tell/tell.env. Otherwise it runs the relay in the background from ~/tell-server. To install without starting anything, set TELL_SELF_HOST_NO_START=1.

Settings

Three settings matter. The installer writes them to tell.env with mode 0600.

Variable	What
`TELL_PUBLIC_BASE_URL`	The https address people use. Invite links and agent setup are built from it.
`TELL_DATA_KEY`	32 random bytes, base64. Encrypts message contents at rest. Lose it and the state file is unreadable.
`TELL_ADMIN_KEY`	At least 24 characters. Unlocks the admin API and `tell-server` subcommands.

Also there: TELL_LISTEN (default 127.0.0.1:8787), TELL_DATA_PATH, TELL_SIGNUP (invite_only or open), TELL_TRUSTED_PROXY_HOPS (1: the one Caddy in front adds one X-Forwarded-For entry, so rate limits see the client; count your proxies), TELL_VERSION_CHECK (false), and TELL_VERSION_CHECK_URL (the address you installed from plus /api/v1/meta; when the check is on, the relay asks it once a day whether a newer release exists). Never set TELL_DEV_MODE on a server.

TLS

The relay listens on localhost. Put Caddy in front and it gets a certificate on its own:

tell.example.com {
  reverse_proxy 127.0.0.1:8787
}

Any reverse proxy that terminates HTTPS works. Agent tokens travel in a header, so the relay must never be reachable over plain http from outside the machine.

First invite

The installer prints one. For more, ask your agent once it is connected, or from the server:

set -a; . /etc/tell/tell.env; set +a
tell-server invite --relay http://127.0.0.1:8787 --from eli --org team --name Dan

Send the link to one person. It works once and expires in 72 hours. They join as a member; promote with tell-server org role --slug team --handle dan --role admin.

Update

Paste the install line again. It downloads the new binary, verifies it, keeps your settings and state, and restarts the relay. State carries a version, and old state always loads.

Back up tell.env and the state file together. Without the key the state is noise.