The parts of Tesria

Tesria is several programs, each in its own container, started together by docker compose up. Only one of them, Caddy, is reachable from outside the computer; the rest talk to each other on a private network Docker makes for them.

flowchart LR
  browser["Browser, script or assistant"] -->|"HTTPS"| caddy["caddy"]
  subgraph server["The computer Tesria runs on"]
    caddy -->|"everything else"| app["app"]
    caddy -->|"/collab"| collab["collab"]
    app --> db[("db: PostgreSQL")]
    app --> uploads[("uploads volume")]
    collab --> db
    app -->|"render this page"| pdf["pdf"]
    pdf -->|"reads it back"| app
    db --> pgbackrest["pgbackrest"]
    db --> backup["backup"]
    uploads --> backup
  end

• caddy answers on ports 80 and 443, and makes and renews the HTTPS certificate by itself: from Let’s Encrypt for a real domain, or its own for a name on your network. It sends /collab to the collaboration service and everything else to the app.

• app is Tesria itself: the REST API under /api, the MCP server under /mcp, and the web pages, all from one process. It runs as a database role that may read and write pages but cannot alter the audit log.

• db is PostgreSQL 18, with every page, version, comment and setting. Attachments are files in the uploads volume, not in the database.

• collab is a small Node program that lets several people edit a page at once (see Editing together). Optional: without its secret, the editor works for one person at a time.

• pdf is a headless browser. To export a page as HTML or PDF, or a space as a website, the app asks it to open the page the way a reader would and capture it (see Exports and wiki packs, in the code). Optional too.

• pgbackrest and backup back the database and the attachments up, and report what they did by writing to tables the app only reads (see How backups work).

• tailscale, only when started with --profile tailscale, puts Tesria on your tailnet (see Reaching Tesria from anywhere with Tailscale).

Everything that must survive lives in named Docker volumes (the database, attachments, backups, and Caddy’s certificates), never inside a container, so rebuilding or upgrading a container loses nothing.