Installing your own SRM server

1Provide Debian 13

Install a minimal Debian 13 (netinst image from debian.org). In the software selection, “SSH server” and “standard system utilities” are enough – no desktop environment. Assign a fixed IP address (during installation or via a DHCP reservation in your router).

It does not matter whether the machine is a VM or real hardware. The installation sets up the matching hypervisor guest tools itself.

2Install the SRM server

Log in as root via SSH (or on the console) and enter:

cd /root
wget -O srm-server.tar.gz https://srm.tm-nettech.de/download/srm-server
tar xzf srm-server.tar.gz
cd srm-server-*/
bash srm-install.sh

Alternatively, copy the package from the downloads above to /root, e.g. with WinSCP, and start at tar xzf ….

The script does everything else:

• installs the required packages (including Caddy for the built-in proxy with a Let's Encrypt certificate),
• creates the service srmserver (user srm, folder /opt/srm) and starts it,
• sets up the firewall – open are SSH (22), 443 and the SRM ports 7778 and 7779,
• switches on automatic Debian security updates.

At the end it shows the address, the fingerprint and the setup code for the first account. The command srm-info shows this information at any time.

Options: --keine-firewall (your own firewall rules), --keine-autoupdates.

3Set up the SRM client

Unpack the SRM client (download above) into a folder of its own on your Windows PC and start srmclient.exe. As server, enter ws://<IP-of-the-SRM-server>:7779 in the LAN for now.

1. Compare the fingerprint. On the first connection the client shows the server's fingerprint. It must match the one shown by srm-info.

   

2. Create the first administrator. Enter the setup code, choose a user name and a password (at least 8 characters).

   

3. Set up the second factor. Scan the QR code with your authenticator app and enter the 6-digit code it shows. From now on every login asks for it.

   

4. Keep the recovery key safe. Thanks to Zero Knowledge, your customers' credentials are only decrypted on approved PCs. Store the recovery key shown here in a safe place (safe, password manager) – without it the credentials are lost if all approved PCs fail.

   

The screenshots show the German interface; the SRM client can be switched to English in the “Server” tab under “Language”.

4Start trial mode or install a licence

Without a licence, access to customers is blocked. In the “Server” tab, “Licence …” opens this dialog:

• Start trial mode: 14 days, up to 10 customers and 3 technicians logged in at the same time – once per server.
• Buy a licence: choose the right plan on the pricing page. When ordering, enter the fingerprint shown here (you can also submit it later). You receive the licence key (starting with SRM2-) by e-mail, paste it into this dialog and click “Install”.

When the trial mode ends, all customers and settings are kept; as soon as the licence is installed, everything is available again. The licence is bound to this server (fingerprint) and moves with the backup to a new server.

5Make it reachable from the internet

1. DNS: create an A record with your DNS provider, e.g. srm.your-company.com → your public IP address.
2. Router/firewall: forward TCP 443 to the SRM server. Port 80 is not needed.
3. Switch on the built-in proxy: “Server” tab → “Reverse proxy” → “Proxy …”. Tick the box, enter the DNS name, choose “Certificate from Let's Encrypt” and “Apply”. The server obtains the certificate itself, tests the new access and only then switches over.

   

After that these addresses apply:

Your own certificate instead of Let's Encrypt: choose “Own certificate” in the same dialog. Already have your own reverse proxy? Then leave the built-in one off and forward /srm to port 7778 and /techniker to port 7779 of the SRM server.

6Install the app at the customer's

In the SRM client, tab “Customers / Dial In” → “Download app”, choose the package for the firmware version of the customer's App Platform (13r2 … 16r1). The ZIP contains a folder each for arm, arm64 and x86_64 – the AP Manager shows which platform the App Platform has.

1. AP Manager (developer mode): upload srm-remote, srm-remote.png and httpfiles.zip from the matching folder.
2. Create an instance: name srm-remote, domain = system name of the PBX, set an instance password and a database password, start the instance.
3. App object in the PBX: name srm, password = instance password, URL https://<AP>/<domain>/srm/srm. Tick Websocket, PBXSignal and Services and, in the “Apps” tab, tick the AP Manager apps (PBXSignal is needed for Dial In, Services + apps for app updates via the SRM server). With master/slave, enter the master PBX permanently in the app object.
4. Optional for Dial In: create a user with a phone number and hardware ID; enter the same hardware ID in the app.
5. Assign and open the app: assign the app to a user and open it in myApps.

7Pair customers and get started

1. In the app, enter the backend address (wss://srm.your-company.com/srm), the customer name and the targets (one line per device, e.g. PBX = 192.168.0.2:443), click “Apply” and then “Register customer in backend (pair)”. The app shows a check code.

   

2. In the SRM client the customer appears under “Pairing waiting”. Compare the check code (ideally read it out on the phone) and click “Approve pairing”.

   

3. Choose the operating mode (in the app or via the pencil icon in the SRM client): permanent connection or Dial In activation (connection only after a call with a one-time PIN).
4. Maintain remotely: in the “Connections” tab, select the customer and click “Open in browser”.

You create further technicians in the “Technician” tab. The “Client package (ZIP)” icon creates a fully configured SRM client for each technician – all they have to enter is their password.