From 36d02cab10450575eb4a52444cf51792b5589063 Mon Sep 17 00:00:00 2001
From: Jos Vooges | STH <jos@sthbv.nl>
Date: Wed, 23 Sep 2026 00:36:40 +0200
Subject: [PATCH] Add Token Tray NSIS installer hosting and /agent download
 page.

Serve the Windows setup via /install, ship deploy/agent in Master, and document volume upload for the gitignored exe.
---
 apps/admin-ui/src/app/agent/page.tsx          | 151 ++++++++++++++++++
 apps/admin-ui/src/app/settings/page.tsx       |   5 +-
 apps/master-api/src/install/routes.ts         |  67 +++++++-
 apps/token-tray/.gitignore                    |   5 +
 apps/token-tray/README.md                     |  36 ++++-
 apps/token-tray/package.json                  |  30 +++-
 apps/token-tray/scripts/publish-installer.cjs |  40 +++++
 apps/token-tray/src/main.ts                   |   8 +
 deploy/agent/.gitignore                       |  20 +++
 deploy/agent/.gitkeep                         |   0
 deploy/agent/token-tray.json                  |   9 ++
 deploy/docker/Dockerfile.master-api           |   1 +
 deploy/docker/docker-compose.dokploy.yml      |   3 +
 13 files changed, 362 insertions(+), 13 deletions(-)
 create mode 100644 apps/admin-ui/src/app/agent/page.tsx
 create mode 100644 apps/token-tray/.gitignore
 create mode 100644 apps/token-tray/scripts/publish-installer.cjs
 create mode 100644 deploy/agent/.gitignore
 create mode 100644 deploy/agent/.gitkeep
 create mode 100644 deploy/agent/token-tray.json

diff --git a/apps/admin-ui/src/app/agent/page.tsx b/apps/admin-ui/src/app/agent/page.tsx
new file mode 100644
index 0000000..28c5d85
--- /dev/null
+++ b/apps/admin-ui/src/app/agent/page.tsx
@@ -0,0 +1,151 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import Link from "next/link";
+import { Nav, useAuth } from "@/components/Nav";
+
+const MASTER_URL = "https://master.vonas.nl";
+
+type TrayMeta = {
+  available?: boolean;
+  version?: string | null;
+  filename?: string;
+  sizeBytes?: number;
+  builtAt?: string | null;
+  productName?: string;
+  downloadUrl?: string;
+  note?: string;
+};
+
+function formatBytes(n: number): string {
+  if (!n || n <= 0) return "—";
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(0)} KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+export default function AgentPage() {
+  useAuth();
+  const [meta, setMeta] = useState<TrayMeta | null>(null);
+  const [err, setErr] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setErr(null);
+    try {
+      const res = await fetch(`${MASTER_URL}/install/token-tray.json`, {
+        cache: "no-store",
+      });
+      if (!res.ok) throw new Error(`Meta ophalen mislukt (${res.status})`);
+      const data = (await res.json()) as TrayMeta;
+      setMeta(data);
+    } catch (e) {
+      setErr(e instanceof Error ? e.message : String(e));
+      setMeta(null);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const available = Boolean(meta?.available);
+  const downloadHref =
+    meta?.downloadUrl?.trim() || `${MASTER_URL}/install/token-tray-setup.exe`;
+
+  return (
+    <>
+      <Nav />
+      <main className="container">
+        <header className="page-header">
+          <div>
+            <p className="page-kicker">Windows agent</p>
+            <h1>Token Tray</h1>
+            <p className="page-lead">
+              Installeer de tray-app op een Windows-PC. Die vernieuwt Viaplay- en F1TV-tokens
+              stil via Chrome/Edge — hands-off zolang de PC aan staat.
+            </p>
+          </div>
+          <button type="button" onClick={() => void load()} disabled={loading}>
+            {loading ? "Laden…" : "Vernieuwen"}
+          </button>
+        </header>
+
+        {err && <div className="error">{err}</div>}
+
+        <div className="section-head">
+          <h2 className="section-title">Download</h2>
+          <p className="muted">NSIS-installer (x64). SmartScreen kan waarschuwen — lokaal gebouwd, niet Store-gesigned.</p>
+        </div>
+        <div className="card">
+          {loading && !meta ? (
+            <p className="muted">Status ophalen…</p>
+          ) : available ? (
+            <>
+              <p style={{ marginTop: 0 }}>
+                <strong>{meta?.productName || "Media Cluster Token Tray"}</strong>
+                {meta?.version ? (
+                  <span className="muted"> · v{meta.version}</span>
+                ) : null}
+              </p>
+              <p className="muted" style={{ fontSize: "0.9rem" }}>
+                {formatBytes(meta?.sizeBytes ?? 0)}
+                {meta?.builtAt
+                  ? ` · gebouwd ${new Date(meta.builtAt).toLocaleString("nl-NL")}`
+                  : ""}
+              </p>
+              <a className="btn" href={downloadHref} style={{ display: "inline-block", marginTop: 8 }}>
+                Download installer
+              </a>
+            </>
+          ) : (
+            <>
+              <p style={{ marginTop: 0 }}>Installer nog niet beschikbaar op Master.</p>
+              <p className="muted" style={{ fontSize: "0.9rem" }}>
+                {meta?.note ||
+                  "Bouw op Windows: apps/token-tray → pack:win → publish:installer, plaats token-tray-setup.exe in het agent-volume (of rebuild image met deploy/agent/), daarna deze pagina vernieuwen."}
+              </p>
+            </>
+          )}
+        </div>
+
+        <div className="section-head" style={{ marginTop: "1.5rem" }}>
+          <h2 className="section-title">Na installatie</h2>
+        </div>
+        <div className="card">
+          <ol className="install-ol" style={{ margin: 0, paddingLeft: "1.25rem" }}>
+            <li>Run de installer → tray-icoon in het systeemvak.</li>
+            <li>
+              Open <strong>Instellingen…</strong> in het tray-menu.
+            </li>
+            <li>
+              Plak <strong>API URL</strong> + <strong>Tray key</strong> uit{" "}
+              <Link href="/settings">Instellingen → Token Tray</Link>.
+            </li>
+            <li>
+              Zorg dat Viaplay/F1TV-accounts een <strong>wachtwoord</strong> hebben onder{" "}
+              <Link href="/scripts">Scripts</Link>.
+            </li>
+            <li>
+              Laat de tray draaien (start mee met Windows). Poll elke 10 min; tokens &lt; 90 min
+              worden stil vernieuwd.
+            </li>
+          </ol>
+        </div>
+
+        <div className="section-head" style={{ marginTop: "1.5rem" }}>
+          <h2 className="section-title">Vereisten</h2>
+        </div>
+        <div className="card">
+          <ul style={{ margin: 0, paddingLeft: "1.25rem" }}>
+            <li>Windows 10/11 x64</li>
+            <li>Google Chrome of Microsoft Edge (Playwright channel)</li>
+            <li>Netwerk naar {MASTER_URL}</li>
+          </ul>
+        </div>
+      </main>
+    </>
+  );
+}
diff --git a/apps/admin-ui/src/app/settings/page.tsx b/apps/admin-ui/src/app/settings/page.tsx
index 7d6ee1f..30cc379 100644
--- a/apps/admin-ui/src/app/settings/page.tsx
+++ b/apps/admin-ui/src/app/settings/page.tsx
@@ -784,8 +784,9 @@ export default function SettingsPage() {
             <div className="section-head" style={{ marginTop: "1.5rem" }}>
               <h2 className="section-title">Token Tray</h2>
               <p className="muted">
-                Key voor de Windows Token Tray-app (<code>apps/token-tray</code>). Plak API-URL +
-                key in de tray-instellingen.
+                Key voor de Windows Token Tray-app. Download de installer op{" "}
+                <Link href="/agent">/agent</Link>, plak daarna API-URL + key in de
+                tray-instellingen.
               </p>
             </div>
             <div className="card">
diff --git a/apps/master-api/src/install/routes.ts b/apps/master-api/src/install/routes.ts
index 0e5d18d..eef4ad4 100644
--- a/apps/master-api/src/install/routes.ts
+++ b/apps/master-api/src/install/routes.ts
@@ -13,7 +13,9 @@ function installDir(): string {
     if (
       fs.existsSync(path.join(dir, "unraid.sh")) ||
       fs.existsSync(path.join(dir, "synology.sh")) ||
-      fs.existsSync(path.join(dir, "upgrade-node.sh"))
+      fs.existsSync(path.join(dir, "upgrade-node.sh")) ||
+      fs.existsSync(path.join(dir, "token-tray-setup.exe")) ||
+      fs.existsSync(path.join(dir, "agent", "token-tray-setup.exe"))
     ) {
       return dir;
     }
@@ -21,6 +23,20 @@ function installDir(): string {
   return candidates[0];
 }
 
+function tokenTrayPaths(dir: string): { exe: string; meta: string } {
+  const nested = path.join(dir, "agent");
+  if (fs.existsSync(path.join(nested, "token-tray-setup.exe"))) {
+    return {
+      exe: path.join(nested, "token-tray-setup.exe"),
+      meta: path.join(nested, "token-tray.json"),
+    };
+  }
+  return {
+    exe: path.join(dir, "token-tray-setup.exe"),
+    meta: path.join(dir, "token-tray.json"),
+  };
+}
+
 function sendInstallScript(
   reply: { header: (k: string, v: string) => unknown; status: (c: number) => { send: (b: string) => unknown }; send: (b: string) => unknown },
   dir: string,
@@ -67,4 +83,53 @@ export async function registerInstallRoutes(app: FastifyInstance, config: Config
       return reply.send(fs.createReadStream(file));
     });
   }
+
+  app.get("/install/token-tray.json", async (_request, reply) => {
+    const { exe, meta } = tokenTrayPaths(dir);
+    const available = fs.existsSync(exe);
+    let body: Record<string, unknown> = {
+      available,
+      version: null,
+      filename: "token-tray-setup.exe",
+      sizeBytes: 0,
+      downloadUrl: `${publicUrl.replace(/\/$/, "")}/install/token-tray-setup.exe`,
+      productName: "Media Cluster Token Tray",
+    };
+    if (fs.existsSync(meta)) {
+      try {
+        const parsed = JSON.parse(fs.readFileSync(meta, "utf8")) as Record<string, unknown>;
+        body = { ...body, ...parsed, available };
+      } catch {
+        /* ignore */
+      }
+    }
+    if (available) {
+      body.sizeBytes = fs.statSync(exe).size;
+      body.available = true;
+    } else {
+      body.available = false;
+      body.sizeBytes = 0;
+    }
+    reply.header("Content-Type", "application/json; charset=utf-8");
+    reply.header("Cache-Control", "no-store");
+    return reply.send(body);
+  });
+
+  app.get("/install/token-tray-setup.exe", async (_request, reply) => {
+    const { exe } = tokenTrayPaths(dir);
+    if (!fs.existsSync(exe)) {
+      return reply
+        .status(404)
+        .send(
+          "Token Tray installer not found — build with apps/token-tray pack:win + publish:installer, then redeploy."
+        );
+    }
+    reply.header("Content-Type", "application/octet-stream");
+    reply.header(
+      "Content-Disposition",
+      'attachment; filename="Media-Cluster-Token-Tray-Setup.exe"'
+    );
+    reply.header("Cache-Control", "no-store");
+    return reply.send(fs.createReadStream(exe));
+  });
 }
diff --git a/apps/token-tray/.gitignore b/apps/token-tray/.gitignore
new file mode 100644
index 0000000..63f9a0c
--- /dev/null
+++ b/apps/token-tray/.gitignore
@@ -0,0 +1,5 @@
+node_modules/
+dist/
+release/
+*.log
+.DS_Store
diff --git a/apps/token-tray/README.md b/apps/token-tray/README.md
index 5d496a4..7e5aa88 100644
--- a/apps/token-tray/README.md
+++ b/apps/token-tray/README.md
@@ -2,22 +2,43 @@
 
 Windows system-tray helper: **stille browser-UI login** voor Viaplay + F1TV (geen HTTP-login → geen cmd-CAPTCHA).
 
-## Admin
+## Gebruikers (productie)
 
-1. **Instellingen → Admin → Token Tray** → genereer key + kopieer API URL  
-2. **Scripts → Viaplay / F1TV** → account met **e-mail + wachtwoord**  
-3. Tokens plakken is optioneel (tray vult die)
+1. Open **https://admin.vonas.nl/agent** → download NSIS-installer  
+2. Installeer → tray start mee met Windows  
+3. **Instellingen → Token Tray** → kopieer API URL + key naar de tray  
+4. **Scripts → Viaplay / F1TV** → accounts met e-mail + wachtwoord  
 
-## Tray
+## Dev (zonder installer)
 
 ```powershell
 cd apps\token-tray
 pnpm.cmd install
-pnpm.cmd exec playwright install chromium
 pnpm.cmd run build
 pnpm.cmd run start
 ```
 
+## Installer bouwen + publiceren
+
+```powershell
+cd apps\token-tray
+pnpm.cmd install
+pnpm.cmd run pack:win
+pnpm.cmd run publish:installer
+```
+
+Dat schrijft:
+
+- `deploy/agent/token-tray-setup.exe`
+- `deploy/agent/token-tray.json`
+
+Master serveert:
+
+- `GET /install/token-tray-setup.exe`
+- `GET /install/token-tray.json`
+
+De `.exe` staat in `.gitignore`. Op Dokploy: mount/upload naar volume `agent_install` → `/app/install/agent/`, of force-add + rebuild image.
+
 ## Auto-modus (hands-off)
 
 Zolang de tray op de Windows-PC draait:
@@ -25,12 +46,13 @@ Zolang de tray op de Windows-PC draait:
 1. Server onthoudt JWT-expiry per account  
 2. Tray pollt elke **10 min** `GET /api/v1/agent/refresh-due`  
 3. Alleen als een token **&lt; 90 min** geldig is (of ontbreekt): stille Chrome-login + push  
-4. Jij hoeft niets te klikken — alleen PC/tray aan laten
+4. Jij hoeft niets te klikken — alleen PC/tray aan laten  
 
 Handmatig blijft beschikbaar: *Nu checken* / *Alles vernieuwen*.
 
 ## API (tray-key)
 
 - `GET /api/v1/agent/accounts` — accounts + wachtwoorden  
+- `GET /api/v1/agent/refresh-due`  
 - `POST /api/v1/agent/viaplay/tokens`  
 - `POST /api/v1/agent/f1tv/tokens`
diff --git a/apps/token-tray/package.json b/apps/token-tray/package.json
index 870ae98..7c2f9ee 100644
--- a/apps/token-tray/package.json
+++ b/apps/token-tray/package.json
@@ -3,13 +3,16 @@
   "version": "0.1.0",
   "private": true,
   "description": "Windows system tray helper to refresh Viaplay/F1TV session tokens",
+  "author": "Vonas Media Cluster",
   "main": "dist/main.js",
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json && electron .",
     "start": "electron .",
     "postinstall": "node -e \"try{require('child_process').execSync('playwright install chromium',{stdio:'inherit'})}catch(e){console.warn('playwright chromium download skipped — tray gebruikt system Chrome/Edge')}\"",
-    "pack:win": "npm run build && electron-builder --win dir"
+    "pack:win": "pnpm run build && electron-builder --win nsis",
+    "pack:win:dir": "pnpm run build && electron-builder --win dir",
+    "publish:installer": "node scripts/publish-installer.cjs"
   },
   "dependencies": {
     "playwright": "^1.49.1"
@@ -23,6 +26,7 @@
   "build": {
     "appId": "nl.vonas.mediacluster.token-tray",
     "productName": "Media Cluster Token Tray",
+    "copyright": "Copyright © Vonas",
     "directories": {
       "output": "release"
     },
@@ -30,9 +34,29 @@
       "dist/**/*",
       "package.json"
     ],
+    "extraMetadata": {
+      "main": "dist/main.js"
+    },
     "win": {
-      "target": ["dir"],
-      "signAndEditExecutable": false
+      "target": [
+        {
+          "target": "nsis",
+          "arch": ["x64"]
+        }
+      ],
+      "signAndEditExecutable": false,
+      "artifactName": "token-tray-setup.${ext}"
+    },
+    "nsis": {
+      "oneClick": true,
+      "perMachine": false,
+      "allowToChangeInstallationDirectory": false,
+      "createDesktopShortcut": false,
+      "createStartMenuShortcut": true,
+      "shortcutName": "Media Cluster Token Tray",
+      "runAfterFinish": true,
+      "uninstallDisplayName": "Media Cluster Token Tray",
+      "deleteAppDataOnUninstall": false
     }
   }
 }
diff --git a/apps/token-tray/scripts/publish-installer.cjs b/apps/token-tray/scripts/publish-installer.cjs
new file mode 100644
index 0000000..4a635eb
--- /dev/null
+++ b/apps/token-tray/scripts/publish-installer.cjs
@@ -0,0 +1,40 @@
+/**
+ * Copy NSIS installer → deploy/agent/ for Docker/Dokploy serving via /install/token-tray-setup.exe
+ */
+const fs = require("fs");
+const path = require("path");
+
+const root = path.join(__dirname, "..");
+const releaseDir = path.join(root, "release");
+const outDir = path.join(root, "..", "..", "deploy", "agent");
+const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+
+const candidates = [
+  path.join(releaseDir, "token-tray-setup.exe"),
+  ...fs
+    .readdirSync(releaseDir)
+    .filter((f) => /setup.*\.exe$/i.test(f) || /token-tray.*\.exe$/i.test(f))
+    .map((f) => path.join(releaseDir, f)),
+];
+
+const src = candidates.find((f) => fs.existsSync(f));
+if (!src) {
+  console.error("Geen installer gevonden in apps/token-tray/release/ — run: pnpm pack:win");
+  process.exit(1);
+}
+
+fs.mkdirSync(outDir, { recursive: true });
+const destExe = path.join(outDir, "token-tray-setup.exe");
+fs.copyFileSync(src, destExe);
+const stat = fs.statSync(destExe);
+const meta = {
+  version: pkg.version,
+  filename: "token-tray-setup.exe",
+  sizeBytes: stat.size,
+  builtAt: new Date().toISOString(),
+  productName: "Media Cluster Token Tray",
+  available: true,
+};
+fs.writeFileSync(path.join(outDir, "token-tray.json"), JSON.stringify(meta, null, 2));
+console.log("Published:", destExe);
+console.log(meta);
diff --git a/apps/token-tray/src/main.ts b/apps/token-tray/src/main.ts
index 47b9076..bb3a97e 100644
--- a/apps/token-tray/src/main.ts
+++ b/apps/token-tray/src/main.ts
@@ -254,6 +254,14 @@ function startPolling() {
 }
 
 app.whenReady().then(() => {
+  try {
+    app.setLoginItemSettings({
+      openAtLogin: true,
+      openAsHidden: true,
+    });
+  } catch {
+    /* ignore — niet op alle platforms beschikbaar */
+  }
   cfg = loadConfig();
   createTray();
   if (!cfg.trayKey) openSettings();
diff --git a/deploy/agent/.gitignore b/deploy/agent/.gitignore
new file mode 100644
index 0000000..8df0074
--- /dev/null
+++ b/deploy/agent/.gitignore
@@ -0,0 +1,20 @@
+# Token Tray Windows installer (NSIS)
+#
+# Build on Windows:
+#   cd apps/token-tray
+#   pnpm.cmd install
+#   pnpm.cmd run pack:win
+#   pnpm.cmd run publish:installer
+#
+# That writes:
+#   deploy/agent/token-tray-setup.exe
+#   deploy/agent/token-tray.json
+#
+# Master serves:
+#   GET /install/token-tray-setup.exe
+#   GET /install/token-tray.json
+# Admin page: https://admin.vonas.nl/agent
+
+*.exe
+*.blockmap
+!.gitkeep
diff --git a/deploy/agent/.gitkeep b/deploy/agent/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/deploy/agent/token-tray.json b/deploy/agent/token-tray.json
new file mode 100644
index 0000000..13d334d
--- /dev/null
+++ b/deploy/agent/token-tray.json
@@ -0,0 +1,9 @@
+{
+  "version": "0.0.0",
+  "filename": "token-tray-setup.exe",
+  "sizeBytes": 0,
+  "builtAt": null,
+  "productName": "Media Cluster Token Tray",
+  "available": false,
+  "note": "Run apps/token-tray pack:win + publish:installer on Windows, copy token-tray-setup.exe into the Dokploy agent_install volume (/app/install/agent/), then refresh /agent."
+}
diff --git a/deploy/docker/Dockerfile.master-api b/deploy/docker/Dockerfile.master-api
index 71bf03e..8c8834b 100644
--- a/deploy/docker/Dockerfile.master-api
+++ b/deploy/docker/Dockerfile.master-api
@@ -49,6 +49,7 @@ COPY --from=node-build /media-node-linux-arm64 /app/install/media-node-linux-arm
 COPY deploy/node/install-unraid.sh /app/install/unraid.sh
 COPY deploy/node/install-synology.sh /app/install/synology.sh
 COPY deploy/node/upgrade-node.sh /app/install/upgrade-node.sh
+COPY deploy/agent/ /app/install/agent/
 COPY apps/master-api/scripts/odido_cdm.py /app/scripts/odido_cdm.py
 
 # Remove workspace protocol deps before npm install
diff --git a/deploy/docker/docker-compose.dokploy.yml b/deploy/docker/docker-compose.dokploy.yml
index 86bd908..66ba3ae 100644
--- a/deploy/docker/docker-compose.dokploy.yml
+++ b/deploy/docker/docker-compose.dokploy.yml
@@ -72,6 +72,8 @@ services:
     volumes:
       # Persist Odido WVD.wvd (admin-upload → /data/odido/WVD.wvd)
       - odido_data:/data/odido
+      # Optional: mount/upload Token Tray NSIS installer here as token-tray-setup.exe
+      - agent_install:/app/install/agent
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/health"]
       interval: 15s
@@ -106,6 +108,7 @@ volumes:
   postgres_data:
   redis_data:
   odido_data:
+  agent_install:
 
 networks:
   media-cluster: