Windows Agent & SaaS Backend MVP (No Frontend)
Budget: $750 – $1,500 USD
Agent (C#/.NET 8)
Windows Service (runs on Windows 10/11 and Server 2016+).
On first run, performs enrollment:
Generates a keypair and submits a CSR to the backend (over HTTPS with a one-time bootstrap token).
Receives a signed client certificate (mTLS) + CA chain; stores in Windows Cert Store.
Every 60 seconds:
mTLS check-in/heartbeat to fetch pending tasks.
Sends basic inventory: hostname + IP addresses.
Executes PowerShell tasks and posts exit code, stdout, stderr, duration.
Logging: Info and Error only, to Windows Event Log or a local file.
Reasonable defaults: HTTP timeout 10s; retries with backoff
Backend (C#/.NET 8, ASP.NET Core)
mTLS required for all agent endpoints. Server validates client cert against project CA and maps to agentId.
PostgreSQL + Entity Framework Core for persistence (agents, tasks, results, logs). Include migrations.
Endpoints:
Enrollment
POST /api/v1/enroll (receives CSR + one-time bootstrap token; returns signed client cert + CA chain)
Agent (mTLS)
POST /api/v1/agents/{agentId}/inventory → { hostname, ipAddresses }
POST /api/v1/agents/{agentId}/heartbeat → returns pending tasks
POST /api/v1/tasks/{taskId}/results → { exitCode, stdout, stderr, durationMs }
Admin/Operator
POST /api/v1/agents/{agentId}/tasks → queue PowerShell command, returns { taskId }
GET /api/v1/tasks/{taskId} → status + results
Data model (minimal)
agents(id uuid pk, hostname text, ips text[], last_seen timestamptz, created_at timestamptz, status text, cert_serial text unique)
tasks(id uuid pk, agent_id uuid fk, command text, status text, priority int default 0, created_at, picked_up_at null, finished_at null)
task_results(id uuid pk, task_id uuid fk, exit_code int, stdout text, stderr text, duration_ms int, created_at)
Acceptance Criteria:
Agent installs and runs as a Windows Service; polls once per minute (with backoff on errors).
Backend validates client cert on each agent request and returns JSON tasks.
PowerShell stdout, stderr, exit code are stored and retrievable via API.
Only Info/Error logs are produced by the agent.
No WebSockets—all traffic is HTTPS with mutual TLS for agent calls.
Reproducible setup: migrations/SQL scripts; Dockerfile for backend; sample CA and enrollment script for demo.
Deliverables:
Full source (agent + backend) in a Git repo.
Dockerfile (+ optional docker-compose) for backend.
EF Core migrations (or SQL scripts).
README with: local run, CA/cert generation (e.g., step-ca or scripts), agent enrollment, sample end-to-end test.
Windows Service (runs on Windows 10/11 and Server 2016+).
On first run, performs enrollment:
Generates a keypair and submits a CSR to the backend (over HTTPS with a one-time bootstrap token).
Receives a signed client certificate (mTLS) + CA chain; stores in Windows Cert Store.
Every 60 seconds:
mTLS check-in/heartbeat to fetch pending tasks.
Sends basic inventory: hostname + IP addresses.
Executes PowerShell tasks and posts exit code, stdout, stderr, duration.
Logging: Info and Error only, to Windows Event Log or a local file.
Reasonable defaults: HTTP timeout 10s; retries with backoff
Backend (C#/.NET 8, ASP.NET Core)
mTLS required for all agent endpoints. Server validates client cert against project CA and maps to agentId.
PostgreSQL + Entity Framework Core for persistence (agents, tasks, results, logs). Include migrations.
Endpoints:
Enrollment
POST /api/v1/enroll (receives CSR + one-time bootstrap token; returns signed client cert + CA chain)
Agent (mTLS)
POST /api/v1/agents/{agentId}/inventory → { hostname, ipAddresses }
POST /api/v1/agents/{agentId}/heartbeat → returns pending tasks
POST /api/v1/tasks/{taskId}/results → { exitCode, stdout, stderr, durationMs }
Admin/Operator
POST /api/v1/agents/{agentId}/tasks → queue PowerShell command, returns { taskId }
GET /api/v1/tasks/{taskId} → status + results
Data model (minimal)
agents(id uuid pk, hostname text, ips text[], last_seen timestamptz, created_at timestamptz, status text, cert_serial text unique)
tasks(id uuid pk, agent_id uuid fk, command text, status text, priority int default 0, created_at, picked_up_at null, finished_at null)
task_results(id uuid pk, task_id uuid fk, exit_code int, stdout text, stderr text, duration_ms int, created_at)
Acceptance Criteria:
Agent installs and runs as a Windows Service; polls once per minute (with backoff on errors).
Backend validates client cert on each agent request and returns JSON tasks.
PowerShell stdout, stderr, exit code are stored and retrievable via API.
Only Info/Error logs are produced by the agent.
No WebSockets—all traffic is HTTPS with mutual TLS for agent calls.
Reproducible setup: migrations/SQL scripts; Dockerfile for backend; sample CA and enrollment script for demo.
Deliverables:
Full source (agent + backend) in a Git repo.
Dockerfile (+ optional docker-compose) for backend.
EF Core migrations (or SQL scripts).
README with: local run, CA/cert generation (e.g., step-ca or scripts), agent enrollment, sample end-to-end test.