Install StackRegent on Windows Server 2019

What is different on Windows Server 2019#

Windows Server 2019 (build 17763) is a good host for StackRegent when you already have 2019 licenses or images. Compared with the newer releases, the differences are all in the web server's TLS stack:

TLS 1.2 with modern ciphers is accepted by every current browser, so sites work normally. What you lose is the shorter TLS 1.3 handshake and HTTP/3. The panel itself is not affected: it has its own TLS stack, and you can still choose TLS 1.3 only for panel connections under Tools & Settings › Security Policy.

Microsoft's extended support for Windows Server 2019 runs until January 9, 2029. For a server you expect to run beyond that, install on 2022 or 2025 instead.

Git over SSH and the OpenSSH client#

The website Git tool can pull from GitHub, GitLab or any server over HTTPS or SSH. For SSH it uses the OpenSSH client that is part of Windows since Server 2019. It is normally present; check it with:

Get-WindowsCapability -Online -Name OpenSSH.Client*

If the State is NotPresent, add it:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Install Git for Windows under Tools & Settings › Server Components after StackRegent is installed. The client is what the Git tool needs; you do not have to install or start the OpenSSH server.

Prepare the server#

1. Patch it. Install the latest cumulative update for Windows Server 2019 and restart. Older 2019 images take several rounds.
2. Check the release and option:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object ProductName, CurrentBuild, InstallationType

CurrentBuild should be 17763.

1. Expect the Visual C++ runtime to be missing. Fresh 2019 images often lack the Visual C++ 2015–2022 runtime that MariaDB and PHP need. The installer downloads it from Microsoft and installs it quietly, so you only need outbound HTTPS.
2. Set a fixed IP address and a host name with an A record.
3. Open TCP 9443, 80 and 443 in the provider's firewall.

Install StackRegent on Windows Server 2019#

Step 1: Open Windows PowerShell as administrator#

From the Start menu choose Windows PowerShell, right-click and Run as administrator. On Server Core, type powershell in the console.

Step 2: Run the installer with your license key#

[Net.ServicePointManager]::SecurityProtocol='Tls12'; & ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://panel.stackregent.com/get/stackregent.ps1'))) -LicenseKey SR-XXXXX-XXXXX-XXXXX-XXXXX -AdminEmail you@example.com

Keep the TLS 1.2 statement at the start. On Windows PowerShell 5.1 it decides whether the download can connect at all.

Step 3: Let the IIS role finish#

The first stage adds the IIS role and its features. On 2019 this can take several minutes and may report that Windows wants a restart; the installer carries on, and you can restart after the first login.

Step 4: Note the address and password#

The last lines show https://SERVER-IP:9443/, the login admin and the password.

Server Core on Windows Server 2019#

StackRegent works on 2019 Server Core without IIS Manager and without the tray app. Two points specific to this release:

• The sconfig menu handles updates, networking and Remote Desktop. Allow Remote Desktop only if you need it; the panel and the console cover daily work.
• curl.exe is included in Windows Server 2019, so you can test sites from the console with curl.exe -sI https://www.example.com/.

Check the installation#

Get-Service StackRegent, StackRegentTask, StackRegentGuard, StackRegentSQL | Format-Table Name, Status
& "C:\Program Files\StackRegent\bin\stackregent.exe" version

All four services should be running. Then:

1. Log in at https://SERVER-IP:9443/ and open Tools & Settings › License Information to confirm the license.
2. Open Tools & Settings › About StackRegent. The feature table marks Windows Server 2019; TLS 1.3 and HTTP/3 show as not available on this release, which is expected.
3. Run Tools & Settings › Diagnose & Repair › Check Everything.
4. Once a site has a certificate, check it from the console with curl.exe -sI --tlsv1.2 https://www.example.com/. An answer with the site's headers means TLS 1.2 works.

Continue with getting started.

Planning ahead on 2019#

When the time comes to leave 2019, the Migration & Transfer Manager moves subscriptions from this server to a new StackRegent server on 2022 or 2025, one at a time and with the option to copy the latest content again just before you switch DNS. The migration guide gives the overview.