Install on Windows

Sentinel runs as a native Windows service on Windows Server 2019 or newer (x86-64). Make sure the requirements are in place: a PostgreSQL database, DNS names and a TLS certificate (or a TLS-terminating proxy). Run every command in an elevated PowerShell.

1. Extract the package

Verify the download against SHA256SUMS, then extract the zip to C:\Program Files\Klipsu Sentinel\.

(Get-FileHash .\klipsu-sentinel_<version>_windows_amd64.zip -Algorithm SHA256).Hash
Expand-Archive .\klipsu-sentinel_<version>_windows_amd64.zip -DestinationPath $env:TEMP\sentinel
New-Item -ItemType Directory -Force "C:\Program Files\Klipsu Sentinel" | Out-Null
Copy-Item "$env:TEMP\sentinel\klipsu-sentinel_<version>_windows_amd64\*" "C:\Program Files\Klipsu Sentinel" -Recurse

2. Create the configuration

New-Item -ItemType Directory -Force C:\ProgramData\KlipsuSentinel | Out-Null
Copy-Item "C:\Program Files\Klipsu Sentinel\sentinel.example.yaml" C:\ProgramData\KlipsuSentinel\sentinel.yaml
notepad C:\ProgramData\KlipsuSentinel\sentinel.yaml

Set at least database.url, public_url, the listeners and the TLS files (use forward slashes, for example C:/ProgramData/KlipsuSentinel/tls/endpoint.crt). Every key is explained in Configuration. On Windows, --config defaults to C:\ProgramData\KlipsuSentinel\sentinel.yaml, so the commands below don't need it.

3. Register the service and initialise

cd "C:\Program Files\Klipsu Sentinel"
.\sentinel.exe config check
powershell -ExecutionPolicy Bypass -File deploy\install-service.ps1
.\sentinel.exe init

The installer registers the service Klipsu Sentinel (KlipsuSentinel):

• it runs under the virtual account NT SERVICE\KlipsuSentinel, not LocalSystem;
• it starts automatically and restarts after failures (5 s, 5 s, 30 s);
• it restricts C:\ProgramData\KlipsuSentinel to SYSTEM, Administrators and the service account.

init creates the key file sentinel.key, applies the database migrations, creates the organisation and policy signing key, and writes a one-time setup token (valid for 24 hours) to C:\ProgramData\KlipsuSentinel\setup-token.

IMPORTANT

Back up C:\ProgramData\KlipsuSentinel\sentinel.key now, offline and separately from database backups. See Keys and secrets.

4. Start the service

Start-Service KlipsuSentinel
Get-Service KlipsuSentinel
Invoke-WebRequest https://sentinel.example.com/readyz -UseBasicParsing

Logs are written to C:\ProgramData\KlipsuSentinel\logs\sentinel-YYYY-MM-DD.log and kept for 14 days.

Uninstall

powershell -ExecutionPolicy Bypass -File "C:\Program Files\Klipsu Sentinel\deploy\install-service.ps1" -Uninstall

This removes the service and keeps the data directory, including the key file.

Next steps

Continue with First-time setup.