Installing the Gateway Node

The gateway node is the control plane for a multi-node deployment. Install it with the interactive WebStream ACP installer in Gateway + IAM/Metrics mode — not the Core / Marketplace installer, which is single-server only.

Installer to use

Build or obtain the interactive installer. The build target is named Interactive:

.\Installer\build-installer.ps1 -Target Interactive
# Output: Installer\SetupFiles\WebStreamACP-Setup-<version>.exe

Warning

Do not use WebStreamCore-Setup-*.exe for this topology. Core installs a silent single-server layout and has no Gateway or Backend mode.

Wizard steps

Run WebStreamACP-Setup-<version>.exe as Administrator.
Accept the defaults on Welcome, then set the install directory (default C:\WebStream).
On the Installation Mode page, select:
Gateway + IAM/Metrics - Front-end server for multi-server deployments.
The Session Pool Users and Isolation Features pages are skipped in Gateway mode. Choose a client theme if prompted, then finish the wizard.

What the installer runs

Hidden pre-steps (always)

Windows Defender exclusions (setup-defender.ps1)
Bundled PostgreSQL install
Config generation (Configure-Config.ps1 for Gateway mode)
Audio services and ActiveX registration

Post-install checkboxes (run these)

Step	Action	Notes
Step 1	Configure Windows Services	Registers Gateway, Metrics, and Access services. No Backend service on this host.
Step 2	Create SSL Certificate	Unchecked by default. Skip if an external ALB terminates TLS; otherwise enable it for a self-signed or local PFX on the instance.
Step 3	Configure Server Environment	In Gateway mode this configures the Windows Firewall only (ports 443, 9000, 9009, 9008).
Step 4	Start Services or Restart Server	Brings the control plane online.

Warning

Steps 1–4 use skipifsilent. A /SILENT or /VERYSILENT install copies files but does not configure services, firewall, or certificates. Always run the interactive wizard (or the scripts manually) for a gateway node.

Record the internal API key

Gateway mode generates accessManagement/internalApiKey and writes it to C:\WebStream\INSTALL-NOTES.txt. Every backend node must use the identical value. A mismatch or blank key does not stop sessions, but preference roaming (registry and filesystem hives) fails with HTTP 401.

Tip

Copy the key into your secure notes before you start installing backends. You will enter it on the Backend Only wizard’s Gateway Connection Details page.

Licence and verification

Install a licence with enough maxBackendAppHosts for your planned concurrent sessions. See Licence Activation.
Confirm services:
```
Get-Service Webstream-*
```
Expect Gateway, Metrics, and Access running. There should be no Backend service on this host.
Confirm firewall rules: WebStream Gateway HTTPS (443), WebStream Gateway (9000), WebStream Metrics (9009), WebStream Access Management (9008).
Open the admin UI at https://<gateway>/admin (or the HTTP admin path for your install) and confirm login.

Check the empty fleet:

Invoke-RestMethod http://<gateway-private-ip>:9000/gateway/stats

Then confirm entitlements:

Invoke-RestMethod http://<gateway-private-ip>:9000/gateway/license/entitlements

Optional: leave auto-scale off

For a static fleet, leave <gateway><autoScale><enabled>false</enabled> (the installer default). If an external scheduler will drive capacity, you may set mode=external so the gateway reports capacity but never launches or terminates EC2 instances. See Scheduled and Manual Scaling.