# Tactical RMM agent — deployment link (no file to download)

There is no static installer file for Tactical. The installer is generated
on demand by the Tactical server when the deployment link is opened.

## Link pattern

```
https://api-tactical.havenblueshore.cloud/api/v3/clients/<DEPLOYMENT-UID>/deploy/
```

- `<DEPLOYMENT-UID>` is a UUID assigned when the deployment is created.
- Opening the link dynamically generates and downloads
  `trmm-<client>-<site>-<server|workstation>-<amd64|arm64>.exe`
  (the current agent version is baked in at download time, so the link never
  goes stale the way a saved .exe does).
- The generated .exe is a wrapper around the manual install: it downloads
  the Inno Setup installer and runs it with the client/site/token baked in.
- The exe accepts `--silent` (no message boxes) and `--log debug`.
- Installing also installs the MeshCentral agent (external MeshCentral at
  rmm.havenblueshore.cloud), which powers Take Control. Pass `--nomesh` to
  skip it (not recommended — Take Control stops working).

Verified against the live server code (Nov 8, 2026):
- Backend route: `clients/<str:uid>/deploy/` (`GenerateAgent` view,
  `clients/urls.py`), mounted under the API root `/api/v3/` on
  `api-tactical.havenblueshore.cloud`. The view looks up the `Deployment`
  by UID, builds the filename from client/site/type/arch, and returns the
  dynamically generated exe. No login is required to open the link — the
  UID itself is the bearer token, so treat the link as a secret.
- Frontend (Manage Deployments page) copies exactly
  `{apiBase}/clients/{uid}/deploy/` to the clipboard.
- `Deployment` fields: `uid` (UUID), `site`, `mon_type` (server/workstation),
  `goarch` (amd64 default), `expiry` (nullable datetime),
  `install_flags` (rdp/ping/power).

## Steps to create the generic deployment (Robert, in the browser)

1. Log in to https://tactical.havenblueshore.cloud
2. Create a client named **Default** and a site under it named **Default**
   (Clients page; the deployment needs a client/site to attach to).
3. Go to **Agents > Manage Deployments** > create a new deployment:
   - Client: **Default**, Site: **Default**
   - Type: **Workstation** (most client machines; create a second deployment
     with Type **Server** if server installs are needed)
   - Architecture: **amd64** (arm64 only for ARM Windows devices)
   - Expiry: set as far in the future as the UI allows (the docs'
     recommended pattern for a generic installer is "a very long expiry").
   - Install flags: leave RDP/Ping/Power at defaults unless a client needs
     them off.
4. Copy the **download link** from the deployment row and paste it into the
   portal config (see `Install-TacticalAgent.ps1` — replace
   `REPLACE-WITH-DEPLOYMENT-URL`).
5. Any agent installed from that link lands in Default/Default; move it to
   the correct client/site from the web UI after install.

Do NOT create this deployment via API/CLI in this phase — it needs Robert's
browser login (or the Tactical API token, which is a later phase).

## macOS / Linux

- macOS and Linux agents exist but need **Tier 1 sponsorship ($55/mo)** —
  NOT decided, do NOT subscribe. Windows first.
- There are **no deployment links for Linux** agents: install is a shell
  script generated per agent from Agents > Install Agent (contains an
  install token — delete after use if shared). macOS install is also via
  Agents > Install Agent.
- After updating to agent v2.12.0+, macOS agents are code-signed
  (Team ID BNV5D8647R); Full Disk Access / Accessibility must be re-granted
  once per Mac.

## Health note (Nov 8, 2026, ~16:50 UTC)

https://tactical.havenblueshore.cloud and
https://api-tactical.havenblueshore.cloud both returned **504 Gateway
Timeout** (Traefik, ~30s) from two separate vantage points, while
inventory/mon/siem/rmm responded normally. All `trmm-*` containers report
Up and the backend uWSGI workers are alive and spawning. Re-check Tactical
in the browser before creating the deployment — if the UI still 504s, that
is a separate infra issue to fix first (not part of this installer phase).