Install and upgrade

Installation overview

Before you start

Prepare the following:

• A promoted release containing Setup.ps1 and a drop-<version> folder with API.zip, UI.zip, Queue.zip and TEE.zip.
• A Windows server and local administrator access, plus installation, log and configuration-backup locations.
• SQL Server connection details for the API's application and audit-log databases. Grant database access only to the API service identity.
• DNS names, ports and a trusted TLS certificate for the UI and API.
• A service account with access to the installation and log directories, certificate private key and backup storage.
• Any vendor software needed by adapters on the TEE machine, and provider details if using an external identity provider or integration.

The installer opens firewall ports 80, 443, 5050, 5051, 5055, 5060, 5075 and 5000–5010 by default. Expose only what the environment needs; actor ports normally need access only between OT Backup services and TEE agents.

Install

1. Open PowerShell as Administrator and run the released setup script. For example:

   .\Setup.ps1 `
     -SourceBasePath 'C:\Install\TRUE OT Backup\drop-2026-07' `
     -DestinationPath 'C:\Empir Industry\OTBackup' `
     -LogsPath 'C:\Empir Industry\Logs'
   

2. At the startup prompt, configure the services as described in Configuration, including authentication. Do not use -IgnoreConfirmation unless configuration is already prepared.

3. Press Enter to start the services. Check the API log for successful startup and database migration.

4. Provision the first administrator, sign in, and configure Configuration → Settings → Backup Storage. Save the settings and run Test Connection. See Backup Storage settings.

5. Complete the checks below. Set up any integrations separately; Setup.ps1 does not install them.

Upgrade

The script removes application directories before extracting the new release. Back up the application database, configuration and Data Protection recovery set before upgrading. Preserve all appsettings*.json files, including machine-specific files containing the API key:

.\Setup.ps1 `
  -SourceBasePath 'C:\Install\TRUE OT Backup\drop-2026-07' `
  -SaveConfiguration `
  -RestoreConfiguration

For a separate backup step, use the same explicit -BackupPath for both runs:

.\Setup.ps1 -SaveConfiguration -BackupPath 'C:\OTBackupConfigBackup'
.\Setup.ps1 -SourceBasePath 'C:\Install\TRUE OT Backup\drop-2026-07' `
  -RestoreConfiguration -BackupPath 'C:\OTBackupConfigBackup'

Keep the backup until the system and integrations are verified. Do not rotate the API key during an upgrade unless all integrations are updated together.

To update one service, add -AppName 'OTB API' (or OTB UI, OTB Queue, OTB TEE) and confirm compatibility with the other installed services first.

Verify the installation

Confirm the services are running:

Get-Service 'OTB API', 'OTB UI', 'OTB Queue', 'OTB TEE'

• Check the API log for startup and migration, and the Queue and TEE logs for connectivity.
• Open the UI over HTTPS, sign in, and confirm it can load data from the API.
• Test backup storage and run a controlled test job through the TEE.
• Verify each installed integration and confirm logs are being written without secrets.

Record the version, paths, service accounts, URLs, database servers, certificate expiry and backup location in the site's handover. Do not record secret values.