Add Chocolatey and winget packages for the Windows installer

.gitignore

@@ -28,6 +28,9 @@ Nelsar.Axia.Api/appsettings*.json
 *.userprefs
 artifacts/
 
+# The Chocolatey package, built by `choco pack` in deploy/chocolatey.
+*.nupkg
+
 # Node / Vite
 node_modules/
 dist/

CHANGELOG.md

@@ -7,6 +7,14 @@ configuration or the API in ways that need action on upgrade; its entry says wha
 
 How a release is cut is in [CONTRIBUTING.md](CONTRIBUTING.md#releasing).
 
+## [Unreleased]
+
+### Added
+
+- A Chocolatey package, `nelsar-axia`, in `deploy/chocolatey`: it installs the x64 MSI of its
+  version, checked against its SHA-256, with the MSI's properties as package parameters. See
+  [Windows installer → Through Chocolatey](docs/installation-windows.md#through-chocolatey).
+
 ## [0.3.0] - 2026-10-23
 
 PostgreSQL for the API's own state, Samba AD, and a Windows installer. Accounts and groups created
@@ -240,6 +248,7 @@ Read before deploying: [SECURITY.md](SECURITY.md#known-limitations) and
 [Not in scope yet](README.md#not-in-scope-yet). Above all, a session cannot be ended before its
 token expires, and directory certificates are not checked for revocation.
 
+[Unreleased]: https://github.com/Nelsar/Axia/compare/v0.3.0...HEAD
 [0.3.0]: https://github.com/Nelsar/Axia/releases/tag/v0.3.0
 [0.2.1]: https://github.com/Nelsar/Axia/releases/tag/v0.2.1
 [0.2.0]: https://github.com/Nelsar/Axia/releases/tag/v0.2.0

CONTRIBUTING.md

@@ -173,3 +173,16 @@ inherits, `frontend/package.json`, and the image tags the quick start runs in `d
    section to the release notes: the edit is also what makes SourceForge, which copied the release
    when it was published, copy the installers too. Should it fail, run it again from the Actions
    tab with the tag as its input; the section is added once.
+
+6. Once the installers are attached, bring the Chocolatey package in `deploy/chocolatey` to the
+   release in a pull request: the version in `nelsar-axia.nuspec` and its `releaseNotes` link, and
+   in `tools/chocolateyinstall.ps1` the version and the x64 installer's SHA-256, which
+   `gh release view vx.y.z --json assets` prints as its `digest`. Then build and push it from that
+   folder:
+
+   ```bash
+   choco pack
+   choco push nelsar-axia.x.y.z.nupkg --source https://push.chocolatey.org/
+   ```
+
+   The community repository holds each version for moderation before it is listed.

deploy/chocolatey/nelsar-axia.nuspec

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>nelsar-axia</id>
+    <version>0.3.0</version>
+    <title>Nelsar.Axia</title>
+    <authors>Nelsar</authors>
+    <owners>Nelsar</owners>
+    <projectUrl>https://github.com/Nelsar/Axia</projectUrl>
+    <packageSourceUrl>https://github.com/Nelsar/Axia/tree/main/deploy/chocolatey</packageSourceUrl>
+    <docsUrl>https://nelsar.github.io/Axia/</docsUrl>
+    <bugTrackerUrl>https://github.com/Nelsar/Axia/issues</bugTrackerUrl>
+    <projectSourceUrl>https://github.com/Nelsar/Axia</projectSourceUrl>
+    <licenseUrl>https://github.com/Nelsar/Axia/blob/main/LICENSE</licenseUrl>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <iconUrl>https://raw.githubusercontent.com/Nelsar/Axia/v0.3.0/docs/brand/avatar.png</iconUrl>
+    <copyright>Nelsar</copyright>
+    <tags>active-directory ldap openldap samba admin web-interface rest-api helpdesk foss</tags>
+    <summary>Self-hosted web interface and REST API for Active Directory and OpenLDAP.</summary>
+    <description><![CDATA[Nelsar.Axia is a self-hosted web interface and REST API for managing Active Directory, Samba AD, OpenLDAP and other LDAP directories from the browser: users, groups, organizational units and computer accounts, with role-based access mapped from directory groups, an audit log and bulk provisioning.
+
+This package installs the Windows service `NelsarAxia` from the official MSI. The API and its console are served on one port, 8080 by default. Settings, keys, the database and logs live in `%ProgramData%\Nelsar.Axia` and are kept on upgrade and uninstall.
+
+## Package parameters
+
+Each parameter is passed to the MSI as the property of the same meaning. A parameter that is not given leaves the setting as it is.
+
+* `/Port:` - the port the service listens on (default 8080)
+* `/LdapServer:` - the directory server, such as `dc01.corp.example.com`
+* `/LdapBaseDn:` - the base DN, such as `DC=corp,DC=example,DC=com`
+* `/LdapUsername:` - the bind account, such as `svc-axia@corp.example.com`
+* `/AdminGroup:` - the DN of the directory group that gets the Admin role
+* `/DatabaseProvider:` - `Sqlite` (default) or `PostgreSql`
+* `/StartService` - start the service when the install finishes
+
+Example: `choco install nelsar-axia --params "'/LdapServer:dc01.corp.example.com /LdapBaseDn:DC=corp,DC=example,DC=com /StartService'"`
+
+The bind password is never taken as a parameter, because command lines end up in logs. Add it to `%ProgramData%\Nelsar.Axia\appsettings.json` after installing; see https://nelsar.github.io/Axia/installation-windows/.
+
+64-bit Windows only.]]></description>
+    <releaseNotes>https://github.com/Nelsar/Axia/releases/tag/v0.3.0</releaseNotes>
+  </metadata>
+  <files>
+    <file src="tools\**" target="tools" />
+  </files>
+</package>

deploy/chocolatey/tools/chocolateyinstall.ps1

@@ -0,0 +1,37 @@
+$ErrorActionPreference = 'Stop'
+
+$version = '0.3.0'
+$pp = Get-PackageParameters
+
+# Package parameters map to the MSI's own properties. One that is not given is not passed, so an
+# upgrade without parameters keeps the settings an earlier install wrote.
+$properties = [ordered]@{
+  Port             = 'PORT'
+  LdapServer       = 'LDAP_SERVER'
+  LdapBaseDn       = 'LDAP_BASEDN'
+  LdapUsername     = 'LDAP_USERNAME'
+  AdminGroup       = 'ADMIN_GROUP'
+  DatabaseProvider = 'DATABASE_PROVIDER'
+}
+
+$silentArgs = "/qn /norestart /l*v `"$($env:TEMP)\$($env:ChocolateyPackageName).$($version).MsiInstall.log`""
+foreach ($name in $properties.Keys) {
+  if ($pp[$name]) {
+    $silentArgs += " $($properties[$name])=`"$($pp[$name])`""
+  }
+}
+if ($pp['StartService']) {
+  $silentArgs += ' START_SERVICE=1'
+}
+
+$packageArgs = @{
+  packageName    = $env:ChocolateyPackageName
+  fileType       = 'msi'
+  url64bit       = "https://github.com/Nelsar/Axia/releases/download/v$version/Nelsar.Axia-$version-x64.msi"
+  checksum64     = '76d9730fdc2b7e0154b81dcf56e9168db4af1cf1d382b3f11683d9e5bfcd7b36'
+  checksumType64 = 'sha256'
+  silentArgs     = $silentArgs
+  validExitCodes = @(0, 3010, 1641)
+}
+
+Install-ChocolateyPackage @packageArgs

docs/installation-windows.md

@@ -26,6 +26,36 @@ the release's tag. With the [GitHub CLI](https://cli.github.com/):
 gh attestation verify Nelsar.Axia-x.y.z-x64.msi --repo Nelsar/Axia
 ```
 
+### Through Chocolatey
+
+[`deploy/chocolatey`](https://github.com/Nelsar/Axia/tree/main/deploy/chocolatey) holds a
+[Chocolatey](https://chocolatey.org/) package, `nelsar-axia`, for 64-bit Intel and AMD. It
+downloads the x64 MSI of its version from the release, refuses it unless its SHA-256 matches, and
+installs it the [unattended](#unattended) way. Package parameters stand for the MSI's properties:
+
+| Parameter | Property |
+| --- | --- |
+| `/Port:` | `PORT` |
+| `/LdapServer:` | `LDAP_SERVER` |
+| `/LdapBaseDn:` | `LDAP_BASEDN` |
+| `/LdapUsername:` | `LDAP_USERNAME` |
+| `/AdminGroup:` | `ADMIN_GROUP` |
+| `/DatabaseProvider:` | `DATABASE_PROVIDER` |
+| `/StartService` | `START_SERVICE=1` |
+
+Until it is published to the Chocolatey community repository, build it from a checkout, in an
+elevated PowerShell:
+
+```powershell
+cd deploy\chocolatey
+choco pack
+choco install nelsar-axia --source . -y --params "'/LdapServer:dc01.corp.example.com /LdapBaseDn:DC=corp,DC=example,DC=com /StartService'"
+```
+
+As with the MSI, the bind password is not a parameter: [finish the
+configuration](#finishing-the-configuration) afterwards. `choco upgrade` installs the newer MSI over
+the older one, and `choco uninstall nelsar-axia` removes it like an [uninstall](#uninstalling) does.
+
 ## What goes where
 
 | Where | What | On upgrade | On uninstall |