Firewall:
- On service initialize/install, create an idempotent inbound allow rule
("OrchestrAD") for the configured listen port, scoped to RFC 1918 private
ranges plus CGNAT (10/8, 172.16/12, 192.168/16, 100.64/10). The rule is
deleted-then-added so it always reflects the current port, and removed on
service uninstall. Best-effort (needs admin; the MSI custom action and
service run elevated); no-op off Windows. Verified the netsh rule lands
with the expected port and remote-address scoping.
MSI:
- Skip the license/EULA page (Welcome now goes straight to the install
directory), since it was blank. A standard short notice is kept in
license.rtf only so the stock license control resolves at build time.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a WiX UI wizard (WixToolset.UI.wixext): Welcome -> License (GPLv3) ->
Install directory -> Network (listen address + port) -> Ready -> Finish. The
install dir, listen address, and port are recorded in the registry and the
service reads them; the finish page shows https://localhost:<port>/ with the
default admin/admin credentials and an optional 'open in browser' box. Schedule
InitializeService after WriteRegistryValues so the first start binds the chosen
port. CI msi job adds the UI extension. Verified: install to a custom dir + port
binds that port (health OK), registry recorded, upgrade + uninstall clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Record InstallDir and Version under HKLM\Software\Grace Solutions\OrchestrAD and
reuse the install directory on upgrade via a RegistrySearch. Upgrades remove the
old product first (stopping the service) then install the new binary and
re-initialize, so only binaries change and the runtime data directory (SQLite
database) is never touched. Verified: v1->v2 upgrade keeps the DB file and a
sentinel intact, service stays healthy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a WiX v5 installer that installs orchestrad.exe to Program Files\OrchestrAD
(x64) and registers + starts the Windows service via the binary's idempotent
initialize command; uninstall runs remove before deleting files, leaving no
orphaned service. Embeds the app icon in Add/Remove Programs. Validated end to
end on Windows: install -> service Running + healthy, uninstall -> clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Alphaeus Mote