Deploy on Windows

Publish SESAR Webhook on a Windows server, on IIS or with Kestrel, over HTTPS.

Server prerequisites

Windows: the application targets net9.0-windows, because its secrets are protected by DPAPI.
The ASP.NET Core 9 runtime. On IIS, install the ASP.NET Core 9 Hosting Bundle, which includes the IIS module.
An HTTPS certificate issued by an authority that the SESAR machine trusts.
If a connector reads the drop's files (as SharePoint does), access to SESAR's storage, at the paths given in the manifest.

Publish

dotnet publish SESARWebHook.API.NetCore\SESARWebHook.API.NetCore.csproj -c Release -o D:\Publish\SESARWebHook

The publish output contains appsettings.json: keep your production version aside, and put it back after each publication. The published folder must not contain any plain-text secrets file.

On IIS

Create an application pool with no managed code ("No Managed Code"), with a dedicated identity.
In its advanced settings, turn on Load User Profile: the CurrentUser DPAPI scope needs it.
Create the site on the published folder, with an HTTPS binding and your certificate. Do not keep an HTTP binding.
Drop the secrets file in plain text, then start the site: it is encrypted for the pool identity.
Give that identity:
- read and modify rights on the secrets file;
- modify rights on the output folder, if you use the File system connector;
- read-only rights on the handlers folder (Handlers).

dotnet publish produces a web.config for the IIS module. The Kestrel section of appsettings.json is then ignored: HTTPS is set in the IIS binding.

With Kestrel

The application can also run on its own. It does not install as a Windows service without code changes: plan a way to start it and restart it.

Declare the certificate in appsettings.json, for example from the machine's certificate store:

{
  "Kestrel": {
    "Endpoints": {
      "Https": {
        "Url": "https://0.0.0.0:443",
        "Certificate": {
          "Subject": "webhook.example.com",
          "Store": "My",
          "Location": "LocalMachine"
        }
      }
    }
  }
}

Never write the password of a PFX file in appsettings.json. Prefer the certificate store.

For development only, dotnet dev-certs https --trust installs the ASP.NET Core development certificate. SESAR, on another machine, would not trust it.

Before production