Self-hosted remote

The v3 HTTP protocol supports capability discovery, ref discovery, missing-object negotiation, filtered or shallow fetch, resumable pack upload, and compare-and-swap ref updates.

Terminal

export TINE_REMOTE_TOKEN="$(openssl rand -hex 32)"
export TINE_KMS_KEY="$(openssl rand -base64 32)"

tine serve --root /srv/opentine --cert cert.pem --key key.pem

tine push https://runs.example --tenant team --repo .
tine clone https://runs.example ./clone --tenant team

Reference deployment

The bundled server uses encrypted filesystem objects, SQLite metadata, tenant-scoped reader/writer/admin authorization, bounded requests and uploads, and hash-chained audit records with an authenticated head outside SQLite. TLS is required unless --insecure-dev is explicit.

Enterprise foundation, not turnkey SaaS

The enterprise claim applies to the repository and extension interfaces: object storage, indexes, identity, authorization, key management, audit, retention, and admission. The bundled bounded WSGI server targets development and small self-hosted deployments. It is not turnkey high availability, a hosted control plane, billing/payment infrastructure, or a bundled S3/PostgreSQL deployment.

Identity and key boundaries

tine serve uses a static bearer token for development. OIDC/JWKS verification and pluggable identity interfaces exist for custom deployments; an OIDC token without roles grants no roles by default. Production key providers must derive a stable external audit key or receive one explicitly, otherwise the reference app fails closed.

Transport limits

Pack transfer and decompression are capped at 256 MiB; the reference server defaults individual requests to 16 MiB, 16 worker threads, a 30-second inactivity timeout, and a 60-second absolute deadline. Clients require HTTPS except for literal loopback addresses or explicit --allow-insecure, and authenticated clients ignore ambient proxy variables.

Audit responsibility

Protect the audit key, external head, and backups. Legacy audit rows require explicit trust-on-migration and remain marked legacy-unverified. Arbitrary recovery requires the exact dedicated re-anchor value; verification itself is read-only.