On-prem uses the same scanner as the clouds, on a Linux machine you provide. The Terraform module creates no instance, network or cloud resource. It renders the scanner settings, a systemd service and timer, and an equivalent Compose file. The timer starts one scanner tick every 15 minutes. The scanner reads the targets you configure in the console, with credential files that stay on the machine.

​
Before you start

  • A Linux host with systemd and Docker 20.10 or later, or Podman 4 or later. The image is published for amd64 and arm64. Start with about 4 vCPU and 8 GiB of memory, plus disk for the state directory (roughly 200 bytes per scanned object or table) and spill space for large listings.
  • Outbound HTTPS (443) to the TigerGate API host of your region, directly or through https_proxy, and to the image registry (Docker Hub or your mirror). Nothing connects in.
  • Network reach to the targets from the host: each database port (for example 5432, 3306, 1433, 1521, 27017) and each file share (SMB 445, NFS 2049).
  • Read-only credentials for each target: database users with SELECT on the schemas to classify, and share accounts.
  • A synchronized clock (NTP). TLS and token checks fail on a skewed clock.
  • An organization API key (tg_). See Before you deploy.

​
Deploy

1

Create the deployment

In TigerGate, go to DSPM → Deployments → Add deployment and choose On-prem. Enter a Site name (1 to 63 letters, digits, dots, underscores or hyphens, for example dc-frankfurt-1), the TigerGate region and the scan settings, then select Create deployment and enrollment token. Copy the token: it is shown once.
2

Render the files

The wizard’s Terraform step shows the module block. Tick both options that keep the key and the token out of Terraform state to get the form below, then apply it on the scanner host, as root or with sudo:
module "tigergate_dspm" {
  source = "https://releases.tigergate.dev/dspm/<version>/tigergate-dspm-onprem.zip"

  tigergate_api_url = "https://api.tigergate.dev"
  site_name         = "dc-frankfurt-1"
  output_dir        = "./tigergate-dspm"
}

output "install_commands" {
  value = module.tigergate_dspm.install_commands
}
3

Install

Export the API key and the token, then run the install commands:
terraform init && terraform apply
export TIGERGATE_DSPM_API_KEY='tg_...'     # your organization's API key; never written by Terraform
export TIGERGATE_DSPM_TOKEN='tgdspm_...'   # from the console; never written by Terraform
terraform output -raw install_commands | sh -x
The install commands copy the files to /etc/tigergate-dspm, write api-key.env and enrollment.env (mode 0600, without putting either value on the command line), create the state directory owned by uid 65532, pull the image, enable the timer and run the first tick. That tick registers the site and posts its preflight checks.
4

Add the targets

Open the deployment in the console, go to Configuration and add each target (see below). Put each target’s credential file in the host’s credentials_dir. Save the settings. The scanner checks every target at its next preflight and shows the result beside it.
You can run Terraform on another machine instead: keep the default output_dir, copy the directory to the host, and run the install commands there. If TIGERGATE_DSPM_API_KEY is empty, the install commands say so and write no key file, and the unit fails until you write it.

​
Targets

Targets are managed per deployment on the Configuration tab, up to 150 per deployment.
KindDefault portNotes
PostgreSQL, MySQL, MariaDB, SQL Server, Oracle5432, 3306, 3306, 1433, 1521TLS is required by default.
SAP HANA, Trino, Presto, Hive30015, 8080, 8080, 10000
MongoDB27017The credential file may give a uri.
Kafka9092The host is a broker list. TLS is off by default.
SMB share, CIFS share445A share, an optional folder and an optional domain.
NFS export2049The share is the export path.
Each target names a credential file, never a credential. The file lives in the host’s credentials_dir, which is mounted read-only into the container. It holds JSON or the password alone: 
{"username": "tigergate_ro", "password": "<password>"}
Make each file readable only by uid 65532 (mode 0600, or 0640 with the group). TigerGate never receives target credentials: the console refuses a target with a password, secret, token, key, uri or private_key field.

​
What the module renders

FileContent
scanner.envNon-secret settings: the API URL, the site name, the state directory, concurrency, log level and proxy.
enrollment.envDSPM_ENROLLMENT_TOKEN=..., mode 0600. Only the first tick needs it; the scanner then keeps its own credential in the state directory. The file must stay, because the unit reads it, but you can empty it.
api-key.envDSPM_API_KEY=..., mode 0600. Every call needs it.
<name>.serviceA oneshot unit that runs one tick with a read-only root filesystem, every capability dropped, no-new-privileges, uid 65532, CPU and memory limits, and the state directory as the only writable mount.
<name>.timerStarts the unit every 15 minutes (schedule). systemd never starts a second copy while one runs.
docker-compose.ymlThe same container for hosts managed with Compose: docker compose run --rm scanner.
To have Terraform create the container itself, use the docker/ submodule (see the module’s examples/docker-host). That container does not read the env files, so give the API key as api_key_file (a host file mounted read-only, which keeps the key out of Terraform state) or as tigergate_api_key.
If you pass enrollment_token or tigergate_api_key to the module, the value is also kept in Terraform state, because a local file has no write-only form. The install-commands path keeps both out of state.

​
Edge cases

  • Proxies: https_proxy applies to the TigerGate API. Keep your databases and file servers in no_proxy.
  • TLS interception: a proxy that re-signs TLS needs its CA trusted. Put a CA bundle in credentials_dir and set SSL_CERT_FILE in extra_env.
  • Podman: set container_cli = "/usr/bin/podman". Rootless Podman needs the state directory owned by the mapped uid.
  • SELinux: label the state and credentials directories for containers, for example chcon -Rt container_file_t /var/lib/tigergate-dspm.
  • Targets only reachable through the host’s routes or DNS: set network_mode = "host".
  • Several sites on one host: use a different name_prefix, site_name and state_dir for each.
  • Backups: the state directory holds the scanner credential and the incremental state (object keys, sizes, hashes and classes found, never contents). Keep it at mode 0700. Back it up to avoid a full rescan after a host rebuild.

​
Operate the deployment

  • Check a target or the connection: run the command that terraform output -raw preflight_command prints. It checks TigerGate and every target, prints the results and posts them to the console.
  • Logs: journalctl -u tigergate-dspm.service -n 100 --no-pager (the unit is named after name_prefix).
  • Rotate the API key: rewrite api-key.env. The next tick reads it.
  • Remove: select Revoke on the deployment, then disable the timer and delete the files.