Installing the server

Installation and first start

Answers the question What happens once the package is installed?

Installation

The server ships as the Debian package wyrd-mdm. Install it from the package repository or from the archive in the Downloads section of the cabinet.

This installs the server and the log store. Tor is taken from the Debian repository.

Package repository

An On-Premise account with an active license has access to the repository. The login is the account identifier. The password is the key of any license of that account. After a renewal the password stays the same.

We recommend connecting to the repository over Tor.

sudo apt install apt-transport-tor curl gpg

# Over Tor:
curl -fsS -x socks5h://127.0.0.1:9050 http://wyrd7hhkoh3gwhoyyxb5yzm3oqx34mzjm7nuobpzufky42ktusyszhqd.onion/apt/wyrd-release.asc | sudo gpg --dearmor -o /usr/share/keyrings/wyrd-release.gpg
# Without Tor:
# curl -fsS https://files.wyrd.link/apt/wyrd-release.asc | sudo gpg --dearmor -o /usr/share/keyrings/wyrd-release.gpg

sudo tee /etc/apt/sources.list.d/wyrd.sources > /dev/null << 'END'
Types: deb
# Over Tor:
URIs: tor+http://wyrd7hhkoh3gwhoyyxb5yzm3oqx34mzjm7nuobpzufky42ktusyszhqd.onion/apt
# Without Tor:
# URIs: https://files.wyrd.link/apt
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/wyrd-release.gpg
END

sudo tee /etc/apt/auth.conf.d/wyrd.conf > /dev/null << 'END'
machine http://wyrd7hhkoh3gwhoyyxb5yzm3oqx34mzjm7nuobpzufky42ktusyszhqd.onion/apt
login <account identifier>
password <license key>
END
sudo chmod 600 /etc/apt/auth.conf.d/wyrd.conf

sudo apt update
sudo apt install wyrd-mdm

Without Tor the first line of auth.conf is machine files.wyrd.link/apt.

To update from the repository, run sudo apt update && sudo apt upgrade.

Archive

The archive is in the Downloads section of the cabinet for an On-Premise account with an active license.

tar -xzf wyrd-latest-debian-amd64.tar.gz
cd wyrd-*-debian-amd64
gpg --show-keys --with-fingerprint wyrd-release.asc

On an arm64 server the archive is wyrd-latest-debian-arm64.tar.gz and the directory inside is wyrd-*-debian-arm64.

Integrity checks are described on the "Verifying the package" page.

Install the packages:

sudo apt install ./*.deb

An update is installed the same way, over the old version. A new version appears on the downloads page.

Updates and removal

An update leaves the device database, settings, certificate, server key and the logs already collected where they are.

apt remove wyrd-mdm leaves the database, the settings and the server key on disk. Only apt purge wyrd-mdm deletes them, and that is irreversible: without the server key every phone has to be enrolled again.

First sign-in

On first start the server creates the admin account, generates a random 24-character password and writes it to the service log once.

sudo journalctl -u wyrd --no-pager | grep -A3 'Generated initial admin'

Generated initial admin credentials ([admin] password was not set):
  username: admin
  password: ...
Save this NOW — it will not be shown again. Change it via the dashboard.

The console requires this password to be replaced at the first sign-in.

The server behind a reverse proxy

The installer checks whether ports 80 and 443 are already taken on the machine. Free, and the server takes them itself. Taken, and it is set up to sit behind the proxy that holds them: it listens on 127.0.0.1:8080 in the clear and takes the client address from the X-Forwarded-For header.

The proxy then has to do three things:

• pass X-Forwarded-For on, or every action in the console is recorded at the proxy's address;
• allow WebSockets at /api/ws and /device-api/ws. The console receives changes over the first, and the server keeps in touch with the phones over the second;
• raise the request body size limit to at least 260 MB: work-profile apps are uploaded through the console, and the phones send batches of logs.

The address browsers and phones use to reach the Wyrd server is the public_url setting in /etc/wyrd/wyrd.toml. The installer puts the machine's name there. Check it before the first phone is enrolled, and after a change run sudo systemctl restart wyrd.

Traffic between the Wyrd server and the phones is encrypted on top of TLS. The proxy can neither read nor forge it.

The certificate

The Wyrd server reads the certificate and key from /etc/wyrd/tls/cert.pem and /etc/wyrd/tls/key.pem. The installer puts a self-signed certificate valid for 15 days there. Before it expires, issue a real one and put it at the same paths:

sudo certbot certonly --webroot -w /var/lib/wyrd/acme -d <server name>

New files are loaded without a restart. Behind a proxy the certificate is the proxy's.