Sites

What a site is, the source URL, URL placeholders, and onboarding clients.

What a site is

A site is a named context, not a tenant or a piece of installed software:

Field	What it's for
Name	A human-readable label (e.g. a building or region).
Token	The URL segment clients use to reach this source.
Location	Resolves the `$LOCATION` placeholder.
Default locale	Resolves the `$LANG` placeholder.
Repository URL	Resolves the `$REPO_URL` placeholder.

The source URL

Every site has its own source URL: https://your-origin/api/<site-token>. Add it on a client exactly like any winget REST source:

winget source add --name kvellman --type Microsoft.Rest --arg "https://your-origin/api/<site-token>"

The API implements the winget Source REST contract directly — no client-side plugin or agent is involved.

Placeholders

An installer URL in a manifest can reference the current site:

Placeholder	Resolves from
`$REPO_URL`	The site's repository URL
`$SITE`	The site's name
`$LOCATION`	The site's location
`$LANG`	The site's default locale

Example: one manifest, InstallerUrl: $REPO_URL/software/$ARCH/App.msi, resolved for two sites:

Site munich with repository URL https://files.munich.internal → https://files.munich.internal/software/x64/App.msi
Site austin with repository URL https://files.austin.internal → https://files.austin.internal/software/x64/App.msi

Same package, same manifest, the correct file for each location.

The admin UI's Instructions page renders the exact winget source add command for a given site — send that link rather than typing the token by hand. To remove a source on a client: winget source remove --name kvellman.

Rotating and revoking tokens

Admin → Site tokens. Add the replacement source on clients before you revoke the old token — revoking breaks every client still using that URL immediately.

What selects a site

Clients select a site purely by the URL they use — there's no separate subnet- or certificate-based selection today. If you need different behaviour per network segment, control that at your reverse proxy or firewall, and give each segment its own site token and URL.

Who can reach it

The site token is an address, not a credential — the winget Source API has to stay reachable without a login, because winget itself sends no authentication. Anyone who can reach the URL can search the source and download its installers. If that's not acceptable for a given site, restrict it at the network layer or your reverse proxy, not by treating the token as secret.