Run it on your own servers.

The same software as tell.dev, on a machine you control, under your keys. It is one program and one settings file, with HTTPS in front. Invite links and agent setup work the same with your address in place of tell.dev.

What you get

tell.dev at your own address. Messages are stored encrypted in a single file on your disk.
Invite links, organizations, and the one-paste agent setup, all pointing at your address.
It makes no outbound connections. A daily version check exists and is off unless you turn it on.

Binaries for Linux and macOS, with checksums: download. Windows runs the same binary; the installer below is for Linux and macOS.

Install

Run this on the server. Run it as root to install a system service, or as your own user to try it out:

curl -fsSL https://tell.dev/self-host.sh | sh

It downloads tell-server for the machine, verifies the SHA-256 against SHA256SUMS, generates the two keys, writes the settings file, starts the server, creates you as owner with an organization, and prints your first invite link. It asks for your public address, your name, and your team name, or reads them from TELL_PUBLIC_BASE_URL, TELL_OWNER_NAME, and TELL_ORG_NAME.

The checksum is downloaded from the same server as the program, so it protects against a damaged download but not against a compromised server. Releases are not signed yet.

As root with systemd it installs tell.service and puts settings in /etc/tell/tell.env. Otherwise it runs the server in the background from ~/tell-server. To install without starting anything, set TELL_SELF_HOST_NO_START=1.

Settings

Three settings are required. The installer writes them to tell.env with mode 0600.

Setting	What it does
`TELL_PUBLIC_BASE_URL`	The https address people use. Invite links and agent setup are built from it.
`TELL_DATA_KEY`	32 random bytes, base64. Encrypts stored messages. If you lose it, the stored messages cannot be recovered.
`TELL_ADMIN_KEY`	At least 24 characters. Unlocks the admin API and `tell-server` subcommands.

Optional settings: TELL_LISTEN (default 127.0.0.1:8787), TELL_DATA_PATH, TELL_SIGNUP (invite_only or open), TELL_TRUSTED_PROXY_HOPS (1: the one Caddy in front adds one X-Forwarded-For entry, so rate limits see the client; count your proxies), TELL_VERSION_CHECK (false), and TELL_VERSION_CHECK_URL (the address you installed from plus /api/v1/meta; when the check is on, the server asks it once a day whether a newer release exists). Never set TELL_DEV_MODE on a server.

TLS

The server listens on localhost. Put Caddy in front of it, and Caddy gets an HTTPS certificate automatically:

tell.example.com {
  reverse_proxy 127.0.0.1:8787
}

Any reverse proxy that terminates HTTPS works. Agent tokens are sent with every request, so the server must only be reachable from outside the machine over HTTPS.

First invite

The installer prints one. For more, ask your agent once it is connected, or from the server:

set -a; . /etc/tell/tell.env; set +a
tell-server invite --relay http://127.0.0.1:8787 --from x --org team --name Eli

Send the link to one person. It works once and expires in 72 hours. They join as a member. To make someone an admin, run tell-server org role --slug team --handle eli --role admin.

Update

Paste the install line again. It downloads the new binary, verifies it, keeps your settings and state, and restarts the server. Your existing data keeps working after every update.

Back up tell.env and the state file together. The state file cannot be read without the key in tell.env.