Installing the Manager

Install the Manager first. Its certificate authority (CA) is created the first time the service starts, and every agent you install afterwards needs that CA's fingerprint and the enrollment token you give the Manager now.

Before you begin

Use a machine running 64-bit Windows Server 2019 or later that is not joined to a domain and has a fixed IP address. See System Requirements.
Make sure TCP ports 5210 and 5211 are free on the machine, and port 80 if you want the HTTP redirect. See Ports and Protocols.
Sign in to the machine with an account that is a local administrator.
Plan to complete the first console sign-in as soon as the installation finishes. See Signing In for the First Time.

Choose an enrollment token

The enrollment token is a shared secret. The Manager is installed with it, and each agent presents it to enroll. Any agent that presents a valid token enrolls immediately, with no approval step, so treat the token like a password:

Make it a long random value, not a word or phrase. Use only letters and digits so that it needs no quoting on a command line.
Record it offline with the other Manager credentials. You need it for every agent you install by hand, and to bring the Manager back on new hardware.
Do not put it anywhere other people can read, such as a script on a file share.

For example, this PowerShell command generates a 64-character random hexadecimal token:

$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
([System.BitConverter]::ToString($bytes) -replace '-', '')

Install the Manager

To install the Manager:

Copy CygnaDR.Manager.msi to the Manager machine.

The package is signed by Cygna Labs Corp. To check it, run Get-AuthenticodeSignature CygnaDR.Manager.msi in PowerShell and expect the status Valid with O=Cygna Labs Corp. in the signer, or open the file's Properties > Digital Signatures tab.
Open an elevated command prompt in the folder that holds the package.
Run the installer with your enrollment token:
```
msiexec /i CygnaDR.Manager.msi /qn ENROLLMENTTOKEN=<token>
```
The installer runs silently, installs the CygnaDRManager service, and starts it.

Note: Windows Installer masks the enrollment token in installer logs, so a log option such as /l*v does not record it. Other property values are still logged. Keep the command with the token out of scripts and command history.

Installer properties

Add any of these properties to the command line to change the defaults. Only ENROLLMENTTOKEN is required.

Property	Default	Description
`ENROLLMENTTOKEN`	None (required)	The secret that agents present to enroll. Kept across upgrades. Giving a new value on an upgrade replaces the stored one.
`RESTPORT`	`5210`	The HTTPS port for the console, the REST API, and the `cdr` command-line tool. Kept across upgrades.
`GRPCPORT`	`5211`	The port agents connect to. Agents are installed with this port in their Manager address. Kept across upgrades.
`LISTENADDRESS`	`0.0.0.0`	The local address the Manager listens on. The default is every interface. On a machine with more than one network adapter, set it to the one address agents and operators use. Kept across upgrades.
`REDIRECTPORT`	`80`	A plain HTTP port that only redirects a browser to the HTTPS console. It serves nothing else. `0` turns it off. Kept across upgrades. If another program already uses the port, the Manager logs a warning and starts without the redirect.

For example, to use different ports and listen on one address only:

msiexec /i CygnaDR.Manager.msi /qn ENROLLMENTTOKEN=<token> RESTPORT=8443 GRPCPORT=8444 LISTENADDRESS=10.0.0.10 REDIRECTPORT=0

What gets installed where

Item	Location and details
Program folder	`%ProgramFiles%\Cygna Labs\Disaster Recovery Suite Manager`. Holds `CygnaDR.Manager.exe`, the `cdr.exe` command-line tool, the console files in `wwwroot`, the PDF renderer in `pdf`, and, in `redist`, the agent packages `CygnaDR.DcAgent.msi`, `CygnaDR.StorageAgent.msi`, and `CygnaDR.HostAgent.msi`. The Manager uses them to push DC agents, to send updates to agents that update themselves, and to offer the packages for download on the Agents screen and with `cdr agent package download`. `cdr.exe` is not added to the `PATH`; run it from this folder. The Manager runs `pdf\CygnaDR.PdfRenderer.exe` as a separate process for each PDF it makes (the recovery report and audit trail exports). It is not a service and opens no port.
Data folder	`%ProgramData%\Cygna Labs\Disaster Recovery Suite Manager`, readable only by SYSTEM and Administrators. Holds the database `cygnadr.db` (including the CA), the daily database snapshots in `snapshots`, and the service logs in `logs`. A configuration backup is built in `config-backup-work` beside the database while it is sent, and removed afterwards.
Service	`CygnaDRManager`, display name Cygna DR Manager. Runs as LocalSystem, starts automatically (delayed start), and restarts after a failure.
Install-time settings	`HKLM\SOFTWARE\Cygna Labs\Disaster Recovery Suite\Manager\Configuration`, including the enrollment token, readable only by SYSTEM and Administrators.
Firewall rules	Inbound rules for the agent port, the console port, and the redirect port (unless it is off), scoped to `CygnaDR.Manager.exe`: Cygna DR Manager (agent gRPC), Cygna DR Manager (console), and Cygna DR Manager (console redirect). The rules apply to every network profile, so the console and agents can connect even when Windows classifies the network of a machine outside a domain as Public.

Find the CA fingerprint

The CA fingerprint identifies this Manager. Every agent is installed with it, and the cdr command-line tool asks you to confirm it the first time it connects. The fingerprint is the SHA-256 hash of the CA certificate, shown as 16 groups of four hexadecimal digits separated by hyphens. It is public, so it does not need to be kept in a safe. Keep a copy with your recovery notes, such as your runbook. After a recovery, it is how you confirm that a rebuilt Manager has the same CA.

The most reliable source of the fingerprint is the Windows Application event log on the Manager machine. At every start, the Manager writes an entry that contains Cygna DR manager CA fingerprint:. To find it with PowerShell:

Get-WinEvent -LogName Application -MaxEvents 500 |
    Where-Object Message -like '*Cygna DR manager CA fingerprint*' |
    Select-Object -First 1 -ExpandProperty Message

For the other places the fingerprint is shown, see Certificates and Trust.

Verify the installation

To verify that the Manager is running:

Check the service status:
```
Get-Service CygnaDRManager
```
The status is Running. The service shows StartPending until the Manager has finished its startup work and is listening, which takes longer than usual the first time after an upgrade. The installer does not wait for it, so a Manager that fails to start does not fail the installation. If the service stops instead, the System log has its error code, the Application log has the reason, and the Manager log names the startup step that failed.
Confirm that the CA fingerprint line is in the Application event log, as described above.
Open https://localhost:5210 in a browser on the Manager machine, or https://<manager address>:5210 from your workstation.

The console shows the Set up this manager page. Continue with Signing In for the First Time now.

If the service does not start or the console does not respond, see Installer Messages and Logs and Diagnostics.