Operating Tricryption
These pages are for the operator who installs Tricryption and keeps it running. They cover the key server, the remote engine (rE), the Console and the REST Gateway. Building against the product is covered in the Integrate guides, starting at Integrating via the API.
| Page | For |
|---|---|
| Installing Tricryption | the support matrix, what a release contains, and how to verify a release before you install it |
| Linux (Ubuntu) | installing, provisioning, upgrading, removing and purging the .deb packages |
| Amazon Web Services | the Ubuntu packages on EC2, the key database on Amazon RDS, and the Gateway and Console on ECS Fargate |
| Google Cloud | the Ubuntu packages on a Compute Engine VM, the key database on Cloud SQL for PostgreSQL over a private address, and administration through IAP |
| Windows Server | the same products from three MSIs, as Windows services |
| Evaluation with Docker Compose | the whole product on one host, for evaluation only |
| Upgrading | the order of an upgrade, and what to re-set after one |
| Release notes | what changed in each release, and what to do when you upgrade to it |
| Security advisory: the Node.js runtime | CVE-2026-111497 and Node.js's October 2026 security release: which artefacts carry the affected runtime, what was measured about exposure, and how to check and upgrade |
| Recovering a key server | what to back up, and how to bring a lost key server back on a replacement host with the same identity |
| Scaling and high availability | several key servers on one key database behind one address: choosing the member count, adding, removing and replacing a member, upgrades, and what to do when a member, a zone or the database fails |
| OpenID Connect Sign-In | letting users sign in to the REST Gateway through an OpenID Connect provider: the configuration file, reloads, the login page link, and the refusal codes |
| Configuring Keycloak for OpenID Connect Sign-In | the provider side of OIDC sign-in, worked through on Keycloak |
| Monitoring the REST Gateway | scraping the Gateway's operational metrics with Prometheus, the seven alerts, and their runbook |
| Exporting security events | the reference implementation that exports the key server's audit rows, the Gateway's refusals and the workflow adapter's outcomes to a SIEM in one versioned envelope |
| Migrating keys from a KMIP key manager | moving symmetric keys out of a KMIP 1.4 key manager into the key server with the KMIP migration client: plan, apply, verify, re-runs, and keys the source will not release |
Where the state lives
Each package or MSI installs its release byte for byte. Provisioning creates the state, and the package does not.
| Payload | State | |
|---|---|---|
| Linux | /opt/pisoft/tricryption/ | /etc/pisoft/ and /var/lib/pisoft/ |
| Windows | C:\Program Files\PiSoft\Tricryption\ | C:\ProgramData\PiSoft\Tricryption\, and sealed secrets under HKLM\Software\PiSoft |
The key database is yours. No remove, purge or upgrade ever drops it. The recovery page explains how to back it up together with the state above.
Qualified at engine master ac4545d27c95.