Reference · v0.44.0
Remote
From the pinned CLI source. Read upstream.
Self-hosted remote
The minimal HTTP remote provides capability discovery, missing-object negotiation, filtered/shallow fetch, resumable pack upload, and CAS ref updates. The reference backend uses encrypted filesystem object storage and SQLite metadata/audit records.
export TINE_REMOTE_TOKEN="$(openssl rand -hex 32)"
export TINE_KMS_KEY="$(openssl rand -base64 32)"
tine repo serve --root /srv/opentine --cert cert.pem --key key.pem
TLS is mandatory unless --insecure-dev is explicit, and --insecure-dev
binds a loopback --host only (--insecure-dev-any-host to override). Static bearer tokens are
for development; OIDC, reader/writer/admin RBAC, tenant namespaces, KMS key
providers, authorization, retention, audit, and admission-policy interfaces are
pluggable. The repository and extension seams are the enterprise foundation;
the bundled WSGI server is a bounded reference deployment for development and
small self-hosted installations, not a turnkey HA service, hosted control plane,
or payment product.
Audit rows use a serialized HMAC chain and authenticated head outside SQLite;
legacy rows require explicit trust-on-migration and remain reported as
legacy-unverified. The reference app derives the audit key from its local KMS
master. A custom KMS adapter must provide stable external audit-key derivation
(or an explicit audit key); startup fails closed rather than falling back to a
key beside the database. Interrupted post-commit anchor writes heal one step
forward only after the committed row authenticates; a cross-process lock spans
the commit and checkpoint update. Other anchor recovery requires an exact
--reanchor-audit-head value.
Protect the audit key, checkpoint, and backups.
tine share push https://runs.example --tenant team --repo .
tine share clone https://runs.example ./clone --tenant team