Installation package (reference)
Files, properties and behavior of the installation package for Windows. How to use the setup program is described in the guide (Install the data service); installing without a window is described in Install unattended.
Syntax
msiexec /i Wkl.Data.Gateway-<version>.msi [PROPERTY=value]… /qn Wkl.Data.Gateway-Setup-<version>.exe [PROPERTY=value]… /quiet
Parameters
On Windows, an installation package sets up the service; how to use it is described in the guide (Install the data service). Two files of the same version are built:
| File | Content |
|---|---|
Wkl.Data.Gateway-<version>.msi | The package (installer/Wkl.Data.Gateway.wxs, WiX 7): program (self-contained publish, no .NET runtime needed on the server), Windows service, Start menu, win-acme. Its own simple dialogs for direct invocation; without a window via the properties below |
Wkl.Data.Gateway-Setup-<version>.exe | The setup program (installer/Bundle.wxs, WiX Burn) around the same package with its own user interface (installer/Setup, WPF on .NET Framework 4.6.2, which Windows includes since Windows 10 version 1607 and Windows Server 2016, see Microsoft: .NET Framework versions and dependencies): computer check, certificate selection from the store, Let's Encrypt, summary with the equivalent command line, health probe at the end. Change, repair, upgrade, remove |
Languages. The installation program first asks for the language (German, English, Slovenian;
the Windows display language is preselected) and then shows all pages and messages in that language.
The package contains the same three languages: its dialogs appear in German, with TRANSFORMS=:1033
in English, and with TRANSFORMS=:1060 in Slovenian (embedded language transforms). The language
determines only the texts, not the settings: properties, command line, and result are the same in all
three languages. Only the suggested installation name follows the language (Datendienst (…),
Data service (…), Podatkovni prehod (…)).
Sign-in methods after installation. appsettings.Production.json sets AuthMode to
PersonalKey, Windows: personal keys and Windows account; with GW_MODE=iis only PersonalKey
(see Run the service behind IIS or a proxy). Add service keys (ApiKey) and SQL Server
sign-in (SqlLogin) in appsettings.Local.json in the program folder, not in
appsettings.Production.json, which the installation program rewrites on “Change.” List all methods
there, for example "Gateway": { "Security": { "AuthMode": "PersonalKey, Windows, SqlLogin" } }; the
value replaces the one from the installation, it doesn't add to it.
Division of labor. The package only collects the choices and calls the program itself: setup-host
sets up the data folder and permissions (Administrators, System, service account), the master key (32
random bytes, as a file, never output), the configuration file appsettings.Production.json (without a
secret, only references), the certificate including read permission for the service account on its key,
the firewall rule, the post-quantum key exchange and the event source; setup-remove removes the
firewall rule and configuration again, and with --remove-data also the data folder. This keeps the
logic in the service's C# code instead of in package
scripts, and no secret passes through a package property, which would end up in the installation log.
The installation never creates people, keys or passwords; the first administrator is created by
init-admin outside the installation (Start menu entry “Ersten Administrator anlegen” (Create first
administrator), final page of the setup program).
The setup-host and setup-remove commands are described in the reference Commands.
Package properties (all optional; the setup program accepts the same names with /quiet):
| Property | Default | Meaning |
|---|---|---|
INSTALLFOLDER | %ProgramFiles%\Wkl\Data Gateway\ | program folder |
DATAFOLDER | %ProgramData%\Wkl.Data.Gateway | store, master key (geheim\hauptschluessel.key), backups |
GW_SERVICE_ACCOUNT | NT SERVICE\Wkl.Data.Gateway | service account: virtual account or group managed service account (DOMÄNE\name$); an account with a password isn't intended |
GW_MODE | standalone | standalone: the service speaks HTTPS itself; iis: only 127.0.0.1, IIS in front (trusted proxy 127.0.0.1/::1, template iis\web.config) |
GW_PORT | 8434 | Unencrypted HTTP, only on 127.0.0.1: development, testing, health probe, IIS in front. Never for workstations |
GW_HTTPS_PORT | 8433 | HTTPS on every address (standalone with certificate), modeled on SQL Server's 1433 |
GW_CERTIFICATE | — | name of the certificate in LocalMachine\My; empty: HTTP only on this computer |
GW_SELFSIGNED | 0 | 1: create a self-signed certificate if none exists (one year, for trials only) |
GW_ACCESS | internal | internet: sign-in rules for origins outside GW_NETWORKS (administration according to GW_ADMIN_OUTSIDE, Windows sign-in and SQL Server login with a second factor, service key refused) |
GW_NETWORKS | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 | corporate networks; with internal also the permitted sources of the firewall rule |
GW_ADMIN_OUTSIDE | deny | totp: administration from outside with a second factor |
GW_FIREWALL | 1 | inbound rule Wkl.Data.Gateway HTTPS for the HTTPS port (443 with iis) |
GW_INSTALLATION_NAME | Datendienst (<host-name>) | name under which an authenticator app lists the second factor (Gateway:Store:TotpIssuer); at most 64 characters, without colons and quotation marks. The administration setting installation_name takes precedence |
GW_SQL_SERVER | — | SQL Server on which the service account needs a login (as in a connection string, for example .\SQLEXPRESS): setup-host writes the script dienstkonto-anmeldung.sql to the data folder. Empty: no script. First installation only; the package doesn't remember it |
GW_SQL_DATABASES | — | Databases, comma-separated, in which the script creates a user for the service account |
GW_SQL_ROLES | readwrite | Roles of a new user: readwrite (db_datareader, db_datawriter), read (db_datareader), or none |
GW_PQ | 0 | 1: Enable-TlsEccCurve X25519_MLKEM768 -Position 0 for the whole computer; never reset |
GW_RECONFIGURE | — | 1 on an installed service: “Change”—run setup-host again, restart the service |
GW_REMOVE_DATA | — | 1 on removal: also delete the data folder (only if it contains the master key or store) |
The package remembers the choices under HKLM\SOFTWARE\Wkl\Data Gateway\Setup; “Change” and an upgrade
start from them, and a value on the command line wins. An upgrade removes the old version (the data
folder stays), rewrites the configuration and backs up the store before the new version first starts,
with backup-store --to-folder <DATAFOLDER>\sicherungen—no backup, no upgrade. On removal,
certificates, the Windows post-quantum setting, and win-acme's settings remain in place; setup-remove
deletes win-acme's scheduled task only if it starts the bundled win-acme\wacs.exe.
Packages for download. The build script can optionally include further installation packages, such as the one for the ODBC driver:
pwsh tools\build-installer.ps1 -Version 1.0.0 -Downloads <path>\Wkl.Data.OData.Odbc-<version>.msi
The service package installs them into the downloads folder in the program directory, the default of
Gateway:Downloads:Path; the service offers them there under GET /download/ (see
HTTP contract). Without -Downloads the package
installs none; the folder then belongs to the operator, who can place their own packages there. Because
the service delivers these files without sign-in, only a signed package without secrets belongs
there—no connection data, no keys.
Let's Encrypt. The package includes win-acme v2.2.9.1701 (Apache 2.0) with the plug-ins for
Cloudflare, Azure DNS, Amazon Route 53 and Hetzner. The project publishes no checksums and signs
wacs.exe only with its own certificate; the build script therefore records the SHA-256 values of the
first download and aborts on any other file. Zertifikat-LetsEncrypt.cmd [http|cloudflare|azure|route53|hetzner]
in the program folder requests a certificate for the name from GW_CERTIFICATE, places it in
LocalMachine\My and gives the service account read permission on the key (--acl-read); win-acme
renews it the same way via its scheduled task. This requires a publicly resolvable name: for http,
reachable from the internet on port 80; otherwise, a zone with one of the DNS providers listed.
Wkl.Data.Gateway acme-client decides beforehand which win-acme orders. If the scheduled task
win-acme renew (…) starts another, existing wacs.exe, that one orders and renews; its task and its
settings.json stay unchanged. It needs version 2.2.9 or later (file version of wacs.exe); otherwise
acme-client ends with exit code 1 and names the version, and the order doesn't start. Without such a
task, or if its program is missing, the bundled win-acme orders and creates its task.
Manufacturer and legal notices
The manufacturer of the data service is EMSR DATA, D.O.O. (address and contact in the Overview). An installation carries this information:
| Where | What |
|---|---|
| “Programs and Features” | Publisher EMSR DATA, D.O.O., contact, website https://wvds.it |
File properties of the product's own programs and libraries (Wkl.*) | Company EMSR DATA, D.O.O., copyright © EMSR DATA, D.O.O. All rights reserved., trademark notice |
| Program folder | THIRD-PARTY-NOTICES.txt (third-party components and their licenses), THIRD-PARTY-NOTICES.dotnet.txt and THIRD-PARTY-NOTICES.aspnetcore.txt (third-party components of the included .NET runtimes), LICENSE.md (license terms of EMSR DATA; the English version is binding), SECURITY.md (reporting a vulnerability, supported versions), and MANUFACTURER.md (manufacturer information, end of support), all three also in German (.de.md) and Slovenian (.sl.md), and sbom.cdx.json (software bill of materials, SBOM, in CycloneDX 1.6 format: every installed file with its checksum, and the third-party components it contains with version and license) |
| Signature | The installer, the package and all of the product's own programs and libraries in a delivery are signed with the certificate of EMSR DATA, D.O.O., with a timestamp. Third-party libraries stay as their publisher ships them |
Versions up to 1.0.7 name “The White Knight Labs” as the publisher. An update still recognizes them; afterwards, the entry in “Programs and Features” shows the new publisher.