Enterprise deployment

This page is for IT administrators.

Machine policy

Precedence: managed policy > user settings > built-in defaults. Locked fields show a lock icon in the console and cannot be edited, and runtime changes to them are refused with POLICY_LOCKED.

File location

The environment variable PRINTLINK_POLICY_PATH overrides the path for tests or unusual deployments.

File structure

{
  "version": 1,
  "policy": {
    "playground_enabled": false,
    "update_channel": "stable"
  },
  "signature": "<base64 ed25519 signature, optional>",
  "keyId": "corp-2026"
}

Any field present in policy is locked. Lockable fields:

An unknown field causes the entire policy to be rejected — so an administrator never believes a mistyped field is in effect.

Signing and verification

• signature is an ed25519 signature (base64) over the canonical JSON of the policy object.
• The verification key comes from the environment variable PRINTLINK_POLICY_PUBKEY (base64, 32 bytes).
• A policy that carries a signature but fails verification (bad signature, tampering, or a missing key) is rejected as a whole and audited; no lock is applied, user settings keep working, and the console shows the reason.
• An unsigned policy is accepted as a "managed file" — the filesystem ACL on the machine-level path is the trust boundary.

Import and export

The Machine policy card in console Settings provides:

• Import: after choosing a file you must confirm a diff (each field shown as "current value → policy value") before it is written to the machine path, and the change is audited.
• Export: save the current policy file through a native dialog, keeping the signature.

Locks on port / listen scope / sites / health switches take full effect on the next service start; other fields apply immediately.

Windows silent installation

# Silent install into the default directory
PrintLink_x.y.z_x64-setup.exe /S

# Silent install into a specific directory (/D= must be last and unquoted)
PrintLink_x.y.z_x64-setup.exe /S /D=C:\Apps\PrintLink

Place policy.json at %ProgramData%\PrintLink\policy.json before or after installation (GPO file distribution or MDM both work). PrintLink re-reads the policy on every start and every settings read, so no reinstall is needed.

Update channel

Package versions are managed centrally at the release end. Check for updates in console Settings or next to the version number fetches the latest version and download link; enterprises can pin the channel (stable / beta) with machine policy.

See also