Install the data service without a user interface

For software distribution, a repeatable setup, or a server without a desktop, install the package with its properties on the command line. The installation program accepts the same properties with /quiet.

The package only collects the choices and calls the program itself (setup-host): data folder, permissions, master key, configuration file, certificate, firewall rule. An installation never creates people, keys, or passwords; init-admin creates the first administrator afterwards. All properties with their defaults are in the installation package reference.

1. Install as an administrator, for example standalone with HTTPS and access only from the corporate networks:

   msiexec /i Wkl.Data.Gateway-1.0.0.msi /qn /l*v install.log GW_CERTIFICATE=daten.example.com GW_NETWORKS=10.0.0.0/8

   Also reachable from the internet, administration from outside only with a second factor:

   msiexec /i Wkl.Data.Gateway-1.0.0.msi /qn GW_CERTIFICATE=daten.example.com GW_ACCESS=internet GW_NETWORKS=10.0.0.0/8 GW_ADMIN_OUTSIDE=totp

2. Check the return value: 0 means set up. With any other value, the package rolls back; the message from setup-host is in the log (/l*v).
3. Create the first administrator (Start menu Ersten Administrator anlegen (Create first administrator) or Wkl.Data.Gateway init-admin --name "…"); see Create the first administrator.

Result: The Windows service runs under NT SERVICE\Wkl.Data.Gateway, responds on /health/live, and the firewall rule admits only the networks named.

• License terms: an installation without windows doesn't show the license terms. By installing unattended, you accept them; read them beforehand in LICENSE.md (binding, English) or in the translations LICENSE.de.md and LICENSE.sl.md, which are in the program folder.
• Change: msiexec /i … GW_RECONFIGURE=1 <new properties> on an installed service runs setup-host again and restarts the service. The package remembers the choices under HKLM\SOFTWARE\Wkl\Data Gateway\Setup; a value on the command line wins. Changing the access (GW_ACCESS, GW_NETWORKS, GW_ADMIN_OUTSIDE) updates the firewall rule but not the sign-in rules of an existing administration store; the log says so. Check the rules with Wkl.Data.Gateway list-sign-in-rules.
• Update: a new version keeps the choices and backs up the store to <DATAFOLDER>\sicherungen before the first start; no backup, no update.
• Remove: msiexec /x … GW_REMOVE_DATA=1 also deletes the data folder with the master key and administration store, irrevocably: without a backup of both, data sources, people, personal keys, and second factors are lost, and a later reinstallation starts empty. To guard against a wrongly specified folder, the package deletes it only if it can be recognized as a data folder, that is, if it contains a master key or a store. Without the property, the folder stays.
• No secret on the command line: the master key is created as a file in the data folder and is never output; no property takes a password.

• Installation package (reference)
• Install the data service—with a user interface
• Commands: setup-host