Deploying on Windows Server

Prerequisites ​

• Windows Server with IIS installed and running
• Administrator access
• .NET 11 ASP.NET Core Hosting Bundle
• A TLS/SSL certificate (self-signed is acceptable for internal deployments)

Installation ​

1. Generate the encryption key ​

Machine-level environment variable, set before the first start:

$bytes = New-Object byte[] 48
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
[Environment]::SetEnvironmentVariable("PORTWAY_ENCRYPTION_KEY", [Convert]::ToBase64String($bytes), "Machine")

2. Deploy application files ​

Extract the release (<tag>-Windows_x64.zip or <tag>-Windows_arm64.zip) to the target directory (e.g. C:\Apps\Portway).

3. Configure IIS ​

1. Open IIS Manager
2. Create an Application Pool:
   • Name: PortwayAppPool
   • .NET CLR version: No Managed Code
   • Pipeline mode: Integrated
   • Start Mode: AlwaysRunning
   • Idle Time-out: 0
3. Create a new Website:
   • Application pool: PortwayAppPool
   • Physical path: C:\Apps\Portway
   • HTTPS binding with your certificate
4. Set directory permissions:
   cmd

   icacls "C:\Apps\Portway" /grant "IIS AppPool\PortwayAppPool:(OI)(CI)M" /T

4. Start and verify ​

The first start creates tokens/, log/ and auth.db. Checks:

• https://localhost/health/live returns Alive
• https://localhost/docs serves the API reference

Troubleshooting ​

Startup errors outside the application log are captured with stdout logging in web.config:

<aspNetCore stdoutLogEnabled="true" stdoutLogFile=".\log\stdout" />

Security configuration ​

• Enforce HTTPS using URL Rewrite rules (IIS Rewrite Module)
• Restrict tokens/ read access to the Application Pool identity
• Disable directory browsing in web.config
• Restrict client addresses in IIS Manager (IP Address and Domain Restrictions)
• Use a dedicated domain service account with minimum SQL permissions

Details: Security.

Backup ​

Files to back up: Upgrading Portway.

Next: Record the access token.