# AFMP On-Prem Server Install

AFMP supports on-prem installs that run as a shared browser-accessible server. The intended production setup is:

1. A company admin installs AFMP once on a server, VM, or stable office computer.
2. The installer creates a background service.
3. Employees open the shared AFMP URL from their own browsers.
4. Users log in through BEPA cloud login at `app.bepa-se.com`.
5. Product data, runs, inputs, outputs, and logs stay in the customer-controlled machine-level data directory.

## Which Installer Should Customers Use?

Windows / non-technical customer:

- Use `AFMP-by-BEPA-Installer-1.0.0.exe`.
- Installs a Windows Service.
- Best for a Windows server, VM, or office computer.

Linux / terminal / VM customer:

- Use `sudo ./installer/linux/install.sh`.
- Installs a systemd service named `afmp.service`.
- Best for Ubuntu/Debian/RHEL-style VMs or internal Linux servers.

Both routes install the same shared on-prem server. Neither requires each employee to install a separate local app.

## Install Choices

The Windows installer asks for:

- Install location: application files, default `C:\Program Files\AFMP`.
- Data location: SQLite database and logs, default `C:\ProgramData\BEPA\AFMP`.
- Port: default `8787`.
- LAN access: enabled by default for shared on-prem installs. Disable it only for a deliberately local-only install.
- Windows Firewall rule: enabled by default for shared LAN access and limited to the local subnet.
- Cloud auth URL: default `https://app.bepa-se.com/sso/authorize`.
- Organization/workspace ID: optional placeholder for future customer binding.

The Linux installer asks for the same values in the terminal. Its defaults are:

```text
Install: /opt/afmp
Data:    /var/lib/afmp
Port:    8787
LAN:     disabled
Auth:    https://app.bepa-se.com/sso/authorize
```

## Modes

Local-only mode:

- Binds the web server to `127.0.0.1:<port>`.
- Only the installed machine can open AFMP.
- No Windows Firewall rule is needed.
- This is the safest default.

Shared server mode:

- Binds the web server to `0.0.0.0:<port>`.
- Other computers on the same private network can open `http://COMPUTER-NAME:<port>/app`.
- A Windows Firewall inbound TCP rule is usually required. The Windows installer can add this automatically for the local subnet.
- This is the intended company on-prem server mode.

## URLs

After install, the installer shows:

- Local URL: `http://localhost:PORT/app`
- LAN URL: `http://COMPUTER-NAME:PORT/app` when LAN access is enabled
- Data location
- Logs location
- Service name and port

The same details are written to:

```text
C:\Program Files\AFMP\OnPrem-Status.html
```

## Service

The Windows installer uses WinSW to install:

```text
AFMP On-Prem Server
```

The Linux installer uses systemd to install:

```text
afmp.service
```

The service starts automatically after reboot. It runs the AFMP Application Server directly as the server process; a browser window is only a client and is not required for the server to keep running.

## Data

Default data location:

Windows:

```text
C:\ProgramData\BEPA\AFMP
```

Linux:

```text
/var/lib/afmp
```

Important files:

```text
C:\ProgramData\BEPA\AFMP\database\afmp.sqlite
C:\ProgramData\BEPA\AFMP\logs
/var/lib/afmp/database/afmp.sqlite
/var/lib/afmp/logs
```

Uninstall removes the application and service, but it does not delete company data unless the uninstall checkbox is explicitly selected.

## Cloud Login

The on-prem server runs in central-auth mode. When a user opens AFMP:

1. Local AFMP redirects the browser to `app.bepa-se.com/sso/authorize`.
2. BEPA cloud login authenticates the user.
3. The cloud service redirects back to the on-prem URL with a short-lived signed token.
4. Local AFMP verifies the token with the configured BEPA public key.
5. Local AFMP creates or updates the local user record and stores AFMP data locally.

For shared LAN mode, BEPA cloud login must allow private network callback hosts such as `localhost`, private IPv4 ranges, single-label Windows hostnames, and `.local` hostnames.

## Manual Test Checklist

Windows:

- Install on a Windows machine using `AFMP-by-BEPA-Installer-1.0.0.exe`.
- Choose default local-only mode and confirm `http://localhost:8787` opens on the installed machine.
- Reinstall, run the Start Menu `Enable LAN Access` shortcut, or configure with LAN access enabled.
- Keep the Windows Firewall rule enabled during install.
- Confirm `http://COMPUTER-NAME:8787` opens on the installed machine.
- Open `http://COMPUTER-NAME:8787` from another computer on the same network.
- Log in with a cloud user from `app.bepa-se.com`.
- Create or edit a run from one computer.
- Log in from a second computer and confirm the same run/data is visible.
- Confirm multiple users can access the same instance at the same time.
- Restart the Windows machine and confirm the AFMP service starts automatically.
- Confirm `C:\ProgramData\BEPA\AFMP\database\afmp.sqlite` persists after restart.
- Uninstall AFMP and confirm the service is removed.
- Confirm company data remains unless the uninstall data-deletion checkbox is explicitly selected.
- Reinstall and point to the same data location; confirm previous data is still available.

Linux / VM:

- Install on a Linux VM or server using `sudo ./installer/linux/install.sh`.
- Confirm `systemctl status afmp.service` is running.
- Open `http://localhost:8787`, using an SSH tunnel if the VM is headless.
- Enable LAN access and open `http://SERVER-NAME:8787/app` from another computer on the same network.
- Log in with a cloud user from `app.bepa-se.com`.
- Restart the VM and confirm `afmp.service` starts automatically.
- Confirm multiple users can access the same instance.
- Confirm data is shared and persistent in `/var/lib/afmp`.
- Run `sudo ./installer/linux/uninstall.sh` and confirm the service is removed.
- Confirm data is preserved unless `sudo ./installer/linux/uninstall.sh --delete-data` is used.

## Troubleshooting

If local access works but another computer cannot connect:

- Confirm LAN access was enabled during install.
- Confirm the Windows Firewall rule exists for the configured TCP port and is limited to the local subnet.
- Confirm both computers are on the same private network or VPN.
- Try the server's private IP address, for example `http://192.168.1.50:8787`.
- Check logs in the configured data directory under `logs`.

If login redirects back to the wrong machine:

- Confirm the installer was run with LAN access enabled.
- Confirm the generated app URL in `config\config.php` uses `http://COMPUTER-NAME:PORT`, not `http://localhost:PORT`.