TStamp install scenarios

Six ways to set up TStamp, from a single PC to a cloud-hosted server. Each diagram shows which machines take part, what is installed where, and how the parts talk to each other.

TStampSetup.exe full bundle TStampClientMsi client only TStampApiSetup.exe API bundle DatabaseOnly DBA scripts Dashed box: one machine

Starter, one PC

One person (or a very small firm) on a single Windows PC. Everything lives on that PC.

Installer: TStampSetup.exe (full bundle, yellow icon). Installs IIS, the .NET hosting bundle, SQL Server Express, the API and the client.
Clients use: http://localhost:5080/ (set up automatically).
Limits: Starter: Windows only, up to 20 active employees, no mobile apps.

Starter, office with several users

A dedicated PC or server in the office runs the API and database. Everyone else installs only the client.

Installer: Server PC: TStampSetup.exe. Every other PC: TStampClientMsi.msi (client only, blue icon).
Clients use: http://<server>:5080/ on the first start (System > System Config > Server Connection). Give the server a fixed IP or a DHCP reservation.
Network: The installer opens TCP 5080 in Windows Firewall on the server. Wi-Fi client isolation and a Public network profile can still block it.

Starter, office plus home office

As scenario 2, with a VPN into the office network for people who work from home. The home PC behaves like an office PC while the VPN is up.

Installer: Same as scenario 2. The home PC also gets TStampClientMsi.msi.
Clients use: The same server address as the office PCs, with the VPN connected first. Check http://<server>:5080/api/health in a browser.
VPN: Provided by the customer's IT (firewall VPN, WireGuard, Tailscale). TStamp does not manage it. Never forward port 5080 to the Internet: it is plain HTTP.

Standard or Pro, API and SQL Express on one server, with mobile

As scenario 2, but registered as Standard or Pro: the same single server runs the API and the database, and phones and remote PCs reach it over HTTPS in addition to the office PCs on the LAN.

Installer: Server: TStampSetup.exe (full bundle, yellow icon): IIS, the .NET hosting bundle, SQL Server Express and the API on the same machine. Every other PC: TStampClientMsi.msi.
Tier: Standard or Pro. Register the installation under System > System Config > Licensing. Mobile apps (Android and iOS) and the unlimited employee count come with these tiers; a Starter installation refuses mobile.
How clients connect: Office PCs: http://<server>:5080/ on the LAN. Phones and tablets: https://<public name>/ with a certificate the phone trusts, forwarded from the router or firewall to the server. Android and iOS release builds refuse plain http. Remote Windows PCs can use the same https address or a VPN.
Keep closed: SQL Express is local to the server: never forward SQL ports. Only the web address for phones is published, never plain http on port 5080.
Open point: The installer binds plain http on port 5080 only. HTTPS for phones is a manual IIS step today; an installer step is planned (see the HTTPS scoping note). For tests only, a Debug build of the Android app can use http.
Required: licensing connection: The server must be able to reach https://licensing.ollam.no (outbound TCP 443) at all times. It checks in about once a day. After 7 days without a successful check-in an admin warning is shown; after 30 days the installation becomes read-only until contact is restored. Starter is exempt.

Standard or Pro, dedicated SQL Server and dedicated IIS server

Larger company: the database lives on its own SQL Server, the API runs on a separate IIS server, and three kinds of client connect to it: office PCs, remote Windows PCs and phones.

Installer: API server: TStampApiSetup.exe (orange icon), pointed at the existing SQL Server with EXISTINGSQLSERVER. Or the DBA runs the DatabaseOnly scripts first. Clients: TStampClientMsi.msi.
How clients connect: Office PCs: the API server's address on the LAN. Remote Windows PCs: the same address through a VPN, or the public https address. Phones and tablets: https://<public name>/ with a certificate the phone trusts. Android and iOS release builds refuse plain http.
Database access: Only the API server talks to SQL Server (Windows or SQL authentication). Clients never connect to the database directly, so the SQL port stays inside the company network.
Open point: The installer binds plain http on port 5080 only. HTTPS for phones is a manual IIS step today; an installer step is planned (see the HTTPS scoping note).
Required: licensing connection: The API server must be able to reach https://licensing.ollam.no (outbound TCP 443) at all times. It checks in about once a day. After 7 days without a successful check-in an admin warning is shown; after 30 days the installation becomes read-only until contact is restored. Starter is exempt.

Standard or Pro, hosted in the cloud

The API runs in Azure App Service (or similar managed hosting) with Azure SQL. There is no Windows server for the installers to run on.

Deployment: Not installer-based. Publish TStampAPI with WebDeploy or a CI/CD pipeline and run the EF Core migrations against the cloud database.
Clients use: The App Service address over HTTPS for both Windows clients (TStampClientMsi.msi) and phones. HTTPS and the certificate come with the platform.
Open point: Azure SQL Database compatibility of the database scripts is not verified. A customer-facing deployment procedure is not written yet.
Required: licensing connection: The API server must be able to reach https://licensing.ollam.no (outbound TCP 443) at all times. It checks in about once a day. After 7 days without a successful check-in an admin warning is shown; after 30 days the installation becomes read-only until contact is restored. Starter is exempt.

Which download for which job

Download	Installs	Used in scenario
TStampSetup.exe	Client, API with IIS and SQL Server Express on one machine. Can also target an existing SQL Server.	1, 2, 3, 4 (the server PC)
TStampClientMsi.msi	The Windows client only. Needs the address of a running TStamp server.	2, 3, 4, 5, 6 (every other PC, home PCs included)
TStampApiSetup.exe	IIS and the API without the client, normally against an existing SQL Server.	5
DatabaseOnly	Scripts a DBA runs to create and migrate the two databases. Not an installer.	5 (optional)
WebDeploy / CI	Publishing the API to managed hosting. No installer.	6

Starter, Standard and Pro use the same software. Standard and Pro must be able to reach licensing.ollam.no (outbound HTTPS, port 443) from the API server: warning to the admin after 7 days without a successful daily check-in, read-only after 30 days; Starter is exempt. A tier change registers the existing installation with Ollam's licensing service and never needs a reinstall. Mobile apps are part of Standard and Pro; a Starter installation refuses them. Enter the server address exactly as the server listens: a standard install uses http:// (port 5080), not https://. The Request access feature (employees ask for an account, confirmed by an e-mailed code) needs an SMTP server set up under System > System Config > Email Settings.