From d297c5b75d56b17c7bfe0a80c92d2b260497f2f0 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Fri, 17 Jul 2026 10:34:52 -0400 Subject: [PATCH] IIS runbook: app pool needs Modify on instance/ The plugin registry (instance/plugins.json), uploaded logos, floor plans, item photos, and print files all write under instance/; with the app pool at read-only, toggling a plugin in Settings surfaces as an internal error and every upload fails. Grant Modify in step 7.3 and add the troubleshooting row. --- docs/INSTALL-WINDOWS-IIS.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/INSTALL-WINDOWS-IIS.md b/docs/INSTALL-WINDOWS-IIS.md index b935d3b..4b01c55 100644 --- a/docs/INSTALL-WINDOWS-IIS.md +++ b/docs/INSTALL-WINDOWS-IIS.md @@ -151,6 +151,8 @@ Two supported deployment methods: ```powershell icacls APP_ROOT /grant "IIS AppPool\shopdbflask:(OI)(CI)RX" /T icacls APP_ROOT\logs /grant "IIS AppPool\shopdbflask:(OI)(CI)M" /T + mkdir APP_ROOT\instance 2>NUL + icacls APP_ROOT\instance /grant "IIS AppPool\shopdbflask:(OI)(CI)M" /T ``` 4. **Unlock the handler sections** (locked server-wide by default; without this IIS returns **HTTP 500.19**): @@ -236,6 +238,7 @@ each gets its own site, app pool, port, and venv. | IIS **500.52** after enabling the rewrite block | `allowedServerVariables` locked at server level - `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`. | | Audit log shows only **127.0.0.1** with the rewrite block active | waitress strips untrusted proxy headers - `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for` missing from the waitress `arguments`. | | **500** with an empty HttpPlatform log | app-pool identity can't read `APP_ROOT` / run the venv (step 7.3), or `.env` missing/invalid. | +| "internal error" toggling plugins, or uploads fail | app pool cannot WRITE `APP_ROOT\instance` (plugin registry, logos, photos, files live there) - step 7.3 grants it Modify. | | "No time zone found with key America/New_York" | `tzdata` not installed (`pip install tzdata`). | | Nav missing Equipment/PCs/... | plugins not installed (step 6 `flask plugin install`), or site not recycled. | | Method B: blank page / assets 404 under `/ops` | frontend `dist` built without `VITE_BASE_PATH=/ops/` (step 7b.1). |