diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7614f3cf5..bb8acec62 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,8 @@ Update from Maintenance > Update — Update ITFlow hands the job to cron, which
 - Export Data: the documentation PDF can go out as a secure link, like a login, document or file. Share a link next to Download PDF - or Share the IT documentation on a client's Shared Links - makes the PDF from the parts you tick and gives you a link that works for as long and as many times as you set, with a passphrase or an emailed code first if you like, and tells you when it's downloaded. The PDF is made when the link is, so later changes aren't in it, and it's kept encrypted until the link stops working - then it's deleted. With passwords and 2FA secrets in it, the PDF is locked with a password of its own too, as a download is, and the page the link opens says so.
 - Maintenance > Update is easier to follow. It opens with where your install stands - up to date, an update available, an update running, or the database still to finish - and the one button for it, now Update ITFlow instead of Queue Update. Below it is what's new: the release notes for the versions between yours and the latest, read from the changelog each time ITFlow checks for updates, with the developer notes folded away and the commits behind them a click further. Before you update it lists what to do first, and says whether any of ITFlow's own files have been changed on your install, which updating would put back. Once you click Update ITFlow, the page shows the update running, refreshes itself until it's done, and then says when ITFlow was updated, or what stopped it. Alongside are this install's version, branch, database, when it last checked and updated, whether cron is running, and the command to run the same update from a shell, with the folder and user filled in for your server.
 - Cron: a new install starts with cron switched on, so adding the cron job is the only step - in the crontab, or as a cron job that runs every minute in a hosting control panel such as Jabali, HestiaCP or cPanel - and jobs start as soon as it runs. Before, cron also had to be turned on in Maintenance > Cron, and an install that missed that step ran nothing without saying why. Get started's cron step is now just the cron job, with Turn cron on shown only if someone has switched it off. An install updated to this release keeps the setting it has.
+- Managed mode: setting up an install you host and connecting it is now one command. After Add Instance - which now takes the address it will have - its page gives the command for setting up from the command line, with the connection code and what your ITFlow knows of the client: its company name, address, phone, website, tax ID and currency, and its primary contact as the first admin. Run it in the new install's folder and it asks only for the database and anything it couldn't fill in, makes the first admin's password and shows it once, connects the install and keeps it connected so its admins can't disconnect it. What's left is its cron job, which it shows as a hosting control panel asks for it - every minute, and the command with the full path of PHP. Until that runs, Managed Instances shows the install as Waiting for its cron job, with the command to add, rather than saying it stopped checking in.
+- Setup from the command line: new options. `--ask-missing` asks only for what's needed and wasn't given, and the database password. `--generate-password` makes the account's password and shows it once. `--json` ends with a summary for a script to read. `--manager-code` and `--manager-required` connect the install to the ITFlow that manages it. Any option can come from the environment instead, as `ITFLOW_SETUP_PASSWORD` for `--password`, so passwords needn't be on the command line. The cron job it shows at the end uses the full path of the PHP that ran setup, which on a hosting control panel with several PHP versions is often not the one `php` runs.
 
 ### Bug Fixes
 
@@ -50,6 +52,8 @@ Update from Maintenance > Update — Update ITFlow hands the job to cron, which
 
 ### Developer Updates
 
+- `scripts/setup_cli.php`: `--manager-code` is checked with `managedParseCode()` before anything is done; after setup, `$config_manager_required = true;` (with `--manager-required`) or `$config_enable_managed_by = true;` is appended to `config.php` and set in the process, then `managedEnroll()` connects it after `setupClose()`, so a manager that can't be reached leaves a whole install behind - exit code 3 rather than 1. `--ask-missing` makes `cliAsk()` ask only a required field with no default, or a secret; `ITFLOW_SETUP_<OPTION>` fills any field, `--manager-code` or `--comments` not given; `--json` sends output to standard error through an `ob_start()` callback and writes the summary, or `{ok: false, error}` from `cliStop()`, to standard output. The cron command uses `PHP_BINARY`. `--generate-password` uses `generateReadablePassword()`.
+- Managed mode: `managedSetupCommand($row, $code)` builds the command from the instance and its client (primary location, first contact with an email, primary first). `managedInstanceFromInput()` takes `url`, written to `managed_instance_url` only until the instance connects - then it's the address the instance sends. `managedReport()` sends `cron.command`, with `PHP_BINARY` when run from the command line. `managedInstanceHealth()` has a new state, `waiting`: connected, with a report whose `cron.last_dispatch_at` is empty - only the cron issue is listed then. The Managed Instances job words its notification for a waiting instance.
 - Database 3.6.2 changes `settings.config_enable_cron`'s default to `1` and nothing else - no install's setting is changed, as switching it on would start late fees, overdue reminders and autopay retries on an install that has them stopped. `setup/seed_data.php` sets it too, so both setup paths start with cron on. CONTRIBUTING's master switch section says why it is on by default.
 - Text messaging is `functions/sms.php`. Database 3.6.0 adds `sms_providers` (the service, its SID and secret, the number in E.164 digits, the key in its inbound address), `sms_messages` (every text both ways - `sms_message_direction` `out`/`in`, `sms_message_status` queued/sending/sent/failed/blocked/cancelled going out and ticket/unmatched/code/spam/keyword/dismissed coming in) and `sms_numbers` (a number's name, `sms_number_opted_out_at`, `sms_number_blocked_at`), and `settings.config_ticket_sms_parse`, `config_ticket_sms_unknown_senders` and `config_ticket_sms_acknowledge`, read where they're used by `smsTicketSettings()`.
 - Sending: `smsQueue($e164, $text, $meta)` splits at `SMS_TEXT_LIMIT` and refuses a number that replied STOP (a `blocked` row) unless `force` - only the STOP answer itself. `smsSendQueued()` claims a row before sending, so a request and the new Text Messages job (`cron/sms_queue.php`, `smsQueueRun()`, every minute) can't both send it; a 401 fails at once, a timeout, 403/429 or 5xx is tried again up to `SMS_MAX_ATTEMPTS`. The job keeps under Skyetel's 300 texts in five minutes and a second apart, and `smsTidy()` wipes codes after `SMS_CODE_KEEP_HOURS`, deletes spam and dismissed texts after `SMS_SPAM_KEEP_DAYS` and the rest after `SMS_KEEP_DAYS`. Providers are `smsProviderKinds()` - another service is an entry there with its own send function and `api/sms/<endpoint>.php`.
diff --git a/admin/managed_instance.php b/admin/managed_instance.php
index bc54dc359..6d740098d 100644
--- a/admin/managed_instance.php
+++ b/admin/managed_instance.php
@@ -54,6 +54,7 @@ $worst = $health['issues'][0][0] ?? '';
 $hero = match (true) {
     $removed => ['tone' => 'secondary', 'icon' => 'fa-unlink'],
     $state === 'pending' => ['tone' => 'secondary', 'icon' => 'fa-plug'],
+    $state === 'waiting' => ['tone' => 'warning', 'icon' => 'fa-hourglass-half'],
     $state === 'offline' => ['tone' => 'danger', 'icon' => 'fa-server'],
     $worst === 'danger' => ['tone' => 'danger', 'icon' => 'fa-server'],
     $worst === 'warning' => ['tone' => 'warning', 'icon' => 'fa-server'],
@@ -131,6 +132,16 @@ $size = function ($mb) {
                                 Removed <?= escapeHtml(timeAgo($row['managed_instance_archived_at'])) ?>. It lets go at its next check-in - what this manager set comes off it, and its support user is archived.
                             <?php } elseif ($state === 'pending') { ?>
                                 <?= $row['managed_instance_enrolled_at'] ? 'It disconnected itself. To manage it again, it needs a new connection code.' : 'Waiting to connect - give its admin the connection code below.' ?>
+                            <?php } elseif ($state === 'waiting') {
+                                $cron_command = (string) ($report['cron']['command'] ?? ''); ?>
+                                <span class="text-warning-emphasis"><i class="fas fa-fw fa-hourglass-half me-1"></i>Connected <?= escapeHtml(timeAgo($row['managed_instance_enrolled_at'] ?? $row['managed_instance_last_checkin_at'])) ?> - waiting for its cron job.</span>
+                                It checks in from cron every minute, so add the cron job in its hosting control panel: every minute (<code>* * * * *</code>)<?= $cron_command !== '' ? ', running' : '' ?>
+                                <?php if ($cron_command !== '') { ?>
+                                    <span class="d-flex align-items-center gap-2 mt-2" data-managed-cron-command>
+                                        <code class="text-break"><?= escapeHtml($cron_command) ?></code>
+                                        <button type="button" class="btn btn-sm btn-link p-0 clipboardjs" title="Copy" data-clipboard-text="<?= escapeHtml($cron_command) ?>"><i class="far fa-copy"></i></button>
+                                    </span>
+                                <?php } ?>
                             <?php } elseif ($state === 'offline') { ?>
                                 <span class="text-danger-emphasis"><i class="fas fa-fw fa-exclamation-circle me-1"></i><?= $row['managed_instance_last_checkin_at'] ? 'Not checked in since ' . escapeHtml(timeAgo($row['managed_instance_last_checkin_at'])) : 'Connected, but it hasn\'t checked in' ?>.</span>
                                 It checks in every minute from its own cron - either cron has stopped there, the server is down, or it can't reach this ITFlow.
@@ -226,6 +237,17 @@ $size = function ($mb) {
                             <button type="button" class="btn btn-sm btn-link position-absolute top-0 end-0 m-1 clipboardjs" title="Copy" data-clipboard-text="<?= escapeHtml($new_code) ?>"><i class="far fa-copy"></i></button>
                         </div>
                         <p class="small text-warning-emphasis mb-0"><i class="fas fa-fw fa-eye-slash me-1"></i>Copy it now - it isn't shown again. If it's lost, make a new one.</p>
+
+                        <?php $setup_command = managedSetupCommand($row, $new_code); ?>
+                        <div class="border-top mt-3 pt-3" data-managed-setup-command>
+                            <div class="fw-semibold mb-1"><i class="fas fa-fw fa-terminal me-1"></i>Setting up a new install for it?</div>
+                            <p class="small text-body-secondary mb-2">Run this in the new install's folder, as the user that owns its files - it sets ITFlow up, connects it with this code and keeps it connected. It asks for the database<?= trim((string) ($row['managed_instance_url'] ?? '')) === '' ? ', the address' : '' ?> and anything else it needs<?= $client_id ? ", and fills in the rest from " . escapeHtml((string) $row['client_name']) : '' ?>.</p>
+                            <div class="position-relative">
+                                <pre class="itflow-command bg-body-tertiary border rounded p-3 pe-5 mb-2"><code><?= escapeHtml($setup_command) ?></code></pre>
+                                <button type="button" class="btn btn-sm btn-link position-absolute top-0 end-0 m-1 clipboardjs" title="Copy" data-clipboard-text="<?= escapeHtml($setup_command) ?>"><i class="far fa-copy"></i></button>
+                            </div>
+                            <p class="small text-body-secondary mb-0">When it's done, it shows the password made for the first admin<?= $client_id ? '' : ' (or asks for one)' ?> and the cron job to add in the hosting panel. This page says it's waiting for that cron job until it runs. Leave off <code>--manager-required</code> if its admins should be able to disconnect it.</p>
+                        </div>
                     <?php } elseif (!empty($row['managed_instance_enroll_expires_at']) && strtotime($row['managed_instance_enroll_expires_at']) > time()) { ?>
                         <p class="small text-body-secondary mb-2">The code was shown when it was made - only a fingerprint of it is kept here. If it's lost, make a new one; the old one stops working.</p>
                         <a class="btn btn-sm btn-outline-primary" href="post.php?managed_instance_new_code=<?= $instance_id ?>&csrf_token=<?= $csrf ?>"><i class="fas fa-fw fa-key me-2"></i>New connection code</a>
diff --git a/admin/managed_instances.php b/admin/managed_instances.php
index 3c38e481b..78405a93b 100644
--- a/admin/managed_instances.php
+++ b/admin/managed_instances.php
@@ -114,11 +114,11 @@ $csrf = $_SESSION['csrf_token'];
                 $seat_limit = intval($row['managed_instance_seat_limit']);
                 $update = (array) ($report['update'] ?? []);
                 $url = (string) $row['managed_instance_url'];
-                $dot = ['online' => 'success', 'offline' => 'danger', 'pending' => 'secondary'][$health['state']];
+                $dot = ['online' => 'success', 'offline' => 'danger', 'pending' => 'secondary', 'waiting' => 'warning'][$health['state']];
                 $last = $row['managed_instance_last_checkin_at'];
                 $last_html = $health['state'] === 'pending'
                     ? '<span class="text-body-secondary">Not connected yet</span>'
-                    : ($last ? '<span title="' . escapeHtml($last) . '"><i class="fas fa-circle fa-xs text-' . $dot . ' me-1"></i>' . escapeHtml(timeAgo($last)) . '</span>' : '<span class="text-body-secondary">Never</span>');
+                    : ($health['state'] === 'waiting' ? '<span class="text-warning-emphasis"><i class="fas fa-circle fa-xs text-warning me-1"></i>Waiting for its cron job</span>' : ($last ? '<span title="' . escapeHtml($last) . '"><i class="fas fa-circle fa-xs text-' . $dot . ' me-1"></i>' . escapeHtml(timeAgo($last)) . '</span>' : '<span class="text-body-secondary">Never</span>'));
                 $page = "managed_instance.php?id=$instance_id";
                 ?>
                 <tr data-managed-instance-id="<?= $instance_id ?>" data-managed-state="<?= $health['state'] ?>">
diff --git a/admin/modals/managed_instance/managed_instance_form.php b/admin/modals/managed_instance/managed_instance_form.php
index 26c50428b..f2207ec46 100644
--- a/admin/modals/managed_instance/managed_instance_form.php
+++ b/admin/modals/managed_instance/managed_instance_form.php
@@ -47,7 +47,11 @@ if (!managerEnabled()) { ?>
         'managed_instance_white_label_key' => '',
         'managed_instance_mode' => 'active',
         'managed_instance_mode_message' => '',
+        'managed_instance_url' => '',
+        'managed_instance_secret_hash' => '',
     ];
+    // Its address is typed until it connects - then it's the one it says it has
+    $address_typed = empty($form['managed_instance_secret_hash']);
     $form_id = 'managedInstanceForm' . intval($form['managed_instance_id']);
     $value = function ($key) use ($form) {
         return escapeHtml((string) ($form[$key] ?? ''));
@@ -92,6 +96,17 @@ if (!managerEnabled()) { ?>
                     <div class="form-text">What it's called here - its own company name shows from its reports.</div>
                 </div>
 
+                <?php if ($address_typed) { ?>
+                    <div class="mb-3">
+                        <label class="form-label">Address</label>
+                        <div class="input-group">
+                            <span class="input-group-text"><i class="fas fa-fw fa-globe"></i></span>
+                            <input type="text" class="form-control" name="url" placeholder="e.g. itflow.ravenwooddental.com" maxlength="240" value="<?= escapeHtml(preg_replace('#^https?://#', '', (string) $form['managed_instance_url'])) ?>">
+                        </div>
+                        <div class="form-text">Where it's reached, without https:// - it goes in the command that sets up a new install for it. Once it connects, it's the address it says it has.</div>
+                    </div>
+                <?php } ?>
+
                 <div class="mb-3">
                     <label class="form-label">Client</label>
                     <div class="input-group">
diff --git a/admin/post/managed_instances.php b/admin/post/managed_instances.php
index c8aa49a42..2ceae4d55 100644
--- a/admin/post/managed_instances.php
+++ b/admin/post/managed_instances.php
@@ -74,6 +74,10 @@ if (isset($_POST['edit_managed_instance'])) {
         flashAlert(escapeHtml($error), 'error');
         redirect();
     }
+    // Once it has connected, its address is the one it says it has
+    if (!empty($row['managed_instance_secret_hash'])) {
+        $fields['url'] = null;
+    }
 
     mysqli_query($mysqli, "UPDATE managed_instances SET " . managedInstanceSetSql($fields) . " WHERE managed_instance_id = $instance_id");
 
@@ -97,6 +101,9 @@ if (isset($_POST['edit_managed_instance'])) {
     if (intval($row['managed_instance_client_id']) !== $fields['client_id']) {
         $changes[] = 'client changed';
     }
+    if ($fields['url'] !== null && (string) $row['managed_instance_url'] !== $fields['url']) {
+        $changes[] = $fields['url'] === '' ? 'address taken off' : 'address ' . $fields['url'];
+    }
     if ($changes) {
         logAudit("Managed Instance", "Edit", "$session_name edited managed instance " . escapeSql($fields['name']) . " - " . escapeSql(implode(', ', $changes)), $fields['client_id'], $instance_id);
     }
diff --git a/cron/managed_instances.php b/cron/managed_instances.php
index 9339743b0..339a543e4 100644
--- a/cron/managed_instances.php
+++ b/cron/managed_instances.php
@@ -51,7 +51,7 @@ if ($managed_instances_count === 0) {
 }
 
 // Gone quiet - told once, until it checks in again
-$managed_instances_quiet = mysqli_query($mysqli, "SELECT managed_instance_id, managed_instance_name, managed_instance_client_id, managed_instance_last_checkin_at FROM managed_instances
+$managed_instances_quiet = mysqli_query($mysqli, "SELECT managed_instance_id, managed_instance_name, managed_instance_client_id, managed_instance_last_checkin_at, managed_instance_secret_hash, managed_instance_report FROM managed_instances
     WHERE managed_instance_archived_at IS NULL AND managed_instance_secret_hash IS NOT NULL AND managed_instance_offline_notified_at IS NULL
     AND (managed_instance_last_checkin_at IS NULL OR managed_instance_last_checkin_at < NOW() - INTERVAL " . MANAGED_OFFLINE_MINUTES . " MINUTE)");
 
@@ -59,7 +59,11 @@ while ($managed_instance = mysqli_fetch_assoc($managed_instances_quiet)) {
     $managed_instance_id = intval($managed_instance['managed_instance_id']);
     $managed_instance_last = $managed_instance['managed_instance_last_checkin_at'];
 
-    appNotify("Managed Instance", escapeSql($managed_instance['managed_instance_name'] . " has stopped checking in" . ($managed_instance_last ? " - last " . date('M j, g:i A', strtotime($managed_instance_last)) : '')),
+    // Connected, and its cron has never run - a new install whose cron job isn't in yet
+    $managed_instance_waiting = managedInstanceHealth($managed_instance)['state'] === 'waiting';
+
+    appNotify("Managed Instance", escapeSql($managed_instance['managed_instance_name'] . ($managed_instance_waiting ? " is waiting for its cron job - add it in its hosting control panel"
+        : " has stopped checking in" . ($managed_instance_last ? " - last " . date('M j, g:i A', strtotime($managed_instance_last)) : ''))),
         "/admin/managed_instance.php?id=$managed_instance_id", intval($managed_instance['managed_instance_client_id']), $managed_instance_id);
 
     mysqli_query($mysqli, "UPDATE managed_instances SET managed_instance_offline_notified_at = NOW() WHERE managed_instance_id = $managed_instance_id");
diff --git a/functions/managed.php b/functions/managed.php
index 9fd77aa62..49dfb4a23 100644
--- a/functions/managed.php
+++ b/functions/managed.php
@@ -498,6 +498,8 @@ function managedReport(): array
         'cron' => [
             'enabled' => !empty($settings['config_enable_cron']),
             'last_dispatch_at' => managedIsoTime($settings['config_cron_last_dispatch_at'] ?? null),
+            // Its cron job - with the PHP that runs this when that's the command line (setup, or cron itself)
+            'command' => (PHP_SAPI === 'cli' && PHP_BINARY !== '' && !preg_match('/\s/', PHP_BINARY) ? PHP_BINARY : 'php') . ' ' . dirname(__DIR__) . '/cron/cron.php',
         ],
         'backup' => [
             'last_status' => (string) ($backup['backup_status'] ?? ''),
@@ -944,17 +946,22 @@ function managedInstanceReport(array $row): array
 }
 
 /*
- * How an instance is doing, from its last report - state (pending: never connected,
- * offline, online), what needs a look (issues, worst first, each [tone, text]), and what
- * the list shows of it.
+ * How an instance is doing, from its last report - state (pending: never connected;
+ * waiting: connected, but its cron has never run - a new install whose cron job isn't in
+ * yet; offline; online), what needs a look (issues, worst first, each [tone, text]), and
+ * what the list shows of it.
  */
 function managedInstanceHealth(array $row): array
 {
     $report = managedInstanceReport($row);
     $last = $row['managed_instance_last_checkin_at'] ?? null;
 
+    $cron = (array) ($report['cron'] ?? []);
     if (empty($row['managed_instance_secret_hash'])) {
         $state = 'pending';
+    } elseif ($report && empty($cron['last_dispatch_at'])) {
+        // It checked in as it connected, and its cron has never run since - a new install whose cron job isn't in yet
+        $state = 'waiting';
     } elseif (!$last || strtotime($last) < strtotime('-' . MANAGED_OFFLINE_MINUTES . ' minutes')) {
         $state = 'offline';
     } else {
@@ -962,11 +969,12 @@ function managedInstanceHealth(array $row): array
     }
 
     $issues = [];
-    if ($state === 'offline') {
+    if ($state === 'waiting') {
+        $issues[] = ['warning', 'Waiting for its cron job - add it in its hosting control panel'];
+    } elseif ($state === 'offline') {
         $issues[] = ['danger', $last ? 'Not checked in for ' . str_replace(' ago', '', timeAgo($last)) : 'Connected, but never checked in'];
     }
-    if ($report) {
-        $cron = (array) ($report['cron'] ?? []);
+    if ($report && $state !== 'waiting') {
         if (empty($cron['enabled'])) {
             $issues[] = ['danger', 'Cron is switched off'];
         } elseif (empty($cron['last_dispatch_at']) || strtotime($cron['last_dispatch_at']) < strtotime((string) ($report['reported_at'] ?? 'now')) - 600) {
@@ -1064,11 +1072,19 @@ function managedInstanceFromInput(array $input): array
         'white_label_key' => preg_replace('/\s+/', '', (string) ($input['white_label_key'] ?? '')),
         'mode' => isset(MANAGED_MODES[$input['mode'] ?? '']) ? $input['mode'] : 'active',
         'mode_message' => mb_substr(trim((string) ($input['mode_message'] ?? '')), 0, 500),
+        // Its address, before it connects - its setup command uses it; once connected, it says its own
+        'url' => array_key_exists('url', $input) ? rtrim(preg_replace('#^[a-z][a-z0-9+.-]*://#i', '', trim((string) $input['url'])), '/') : null,
     ];
 
     if ($fields['name'] === '') {
         return [$fields, 'Give it a name.'];
     }
+    if ($fields['url'] !== null && $fields['url'] !== '') {
+        if (preg_match('/[\s"\'<>]/', $fields['url']) || mb_strlen($fields['url']) > 240) {
+            return [$fields, 'Its address is a name like itflow.example.com, without https://.'];
+        }
+        $fields['url'] = 'https://' . $fields['url'];
+    }
     if ($fields['client_id'] && !mysqli_fetch_row(mysqli_query($mysqli, "SELECT 1 FROM clients WHERE client_id = " . $fields['client_id']))) {
         return [$fields, 'That client is gone - pick another.'];
     }
@@ -1096,7 +1112,63 @@ function managedInstanceSetSql(array $fields): string
         managed_instance_update_delay_days = " . intval($fields['update_delay_days']) . ",
         managed_instance_white_label_key = " . $text($fields['white_label_key']) . ",
         managed_instance_mode = '" . $fields['mode'] . "',
-        managed_instance_mode_message = " . $text($fields['mode_message']);
+        managed_instance_mode_message = " . $text($fields['mode_message'])
+        . (($fields['url'] ?? null) !== null ? ", managed_instance_url = " . $text($fields['url']) : '');
+}
+
+/*
+ * The command that sets up a new install for an instance and connects it, in one go
+ * (scripts/setup_cli.php) - with its connection code and what this ITFlow knows: its address,
+ * and its client's name, primary location, phone, website, tax id and currency, with its primary
+ * contact as the first admin and a password made for them. Kept connected (--manager-required),
+ * for an install you host. Run in the new install's folder, as the user that owns its files; it
+ * asks for the database and anything else it has to (--ask-missing).
+ */
+function managedSetupCommand(array $row, string $code): string
+{
+    global $mysqli;
+
+    $client_id = intval($row['managed_instance_client_id']);
+    $client = $client_id ? mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT client_name, client_website, client_currency_code, client_tax_id_number FROM clients WHERE client_id = $client_id")) : null;
+    $location = $client_id ? mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT location_country, location_address, location_city, location_state, location_zip, location_phone_country_code, location_phone
+        FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_primary DESC, location_id ASC LIMIT 1")) : null;
+    $contact = $client_id ? mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts
+        WHERE contact_client_id = $client_id AND contact_archived_at IS NULL AND contact_email <> '' ORDER BY contact_primary DESC, contact_id ASC LIMIT 1")) : null;
+
+    $options = [
+        'base-url' => preg_replace('#^https?://#', '', (string) ($row['managed_instance_url'] ?? '')),
+        'company-name' => $client['client_name'] ?? $row['managed_instance_name'],
+        'country' => $location['location_country'] ?? '',
+        'address' => $location['location_address'] ?? '',
+        'city' => $location['location_city'] ?? '',
+        'state' => $location['location_state'] ?? '',
+        'zip' => $location['location_zip'] ?? '',
+        'phone-country-code' => !empty($location['location_phone']) ? ($location['location_phone_country_code'] ?? '') : '',
+        'phone' => $location['location_phone'] ?? '',
+        'website' => $client['client_website'] ?? '',
+        'tax-id' => $client['client_tax_id_number'] ?? '',
+        'currency' => $client['client_currency_code'] ?? '',
+        'user-name' => $contact['contact_name'] ?? '',
+        'user-email' => $contact['contact_email'] ?? '',
+    ];
+
+    // Quoted only where a shell would read something into it
+    $word = function (string $value) {
+        return preg_match('#^[A-Za-z0-9_./=:@%+-]+$#', $value) ? $value : escapeshellarg($value);
+    };
+    $lines = ['php scripts/setup_cli.php --ask-missing'];
+    foreach ($options as $key => $value) {
+        if (trim((string) $value) !== '') {
+            $lines[] = "--$key=" . $word(trim((string) $value));
+        }
+    }
+    if ($contact) {
+        $lines[] = '--generate-password';
+    }
+    $lines[] = '--manager-code=' . $word($code);
+    $lines[] = '--manager-required';
+
+    return implode(" \\\n  ", $lines);
 }
 
 /* Words for a command */
diff --git a/scripts/setup_cli.php b/scripts/setup_cli.php
index b79bc8973..1971c0552 100644
--- a/scripts/setup_cli.php
+++ b/scripts/setup_cli.php
@@ -13,10 +13,25 @@
  * thing missing or wrong, before the database is touched, and takes the suggestion
  * or the default for the rest.
  *
+ * --ask-missing asks only for what is needed and wasn't given, and the database
+ * password - the rest takes its default or suggestion. Any option can come from
+ * the environment instead, as ITFLOW_SETUP_<OPTION> (ITFLOW_SETUP_PASSWORD for
+ * --password), so a password needn't be on the command line.
+ *
  * Signing in the first time opens Get started, the walk through what is left to
  * set up (functions/getting_started.php). --skip-get-started leaves it in Admin,
  * for an install set up by script or brought up to match another.
  *
+ * For an install another ITFlow manages - one you host for a client - the
+ * connection code from its Admin > Managed Instances page (--manager-code)
+ * connects it as setup finishes, and --manager-required keeps it connected
+ * (functions/managed.php). That page gives the whole command, with what it knows
+ * of the client filled in. --generate-password makes the first account's password
+ * and shows it once at the end; --json ends with a summary for a script to read.
+ *
+ * Exit codes: 0 set up; 1 stopped, nothing set up; 3 set up, but it couldn't
+ * connect to the managing ITFlow - connect it from Admin > Managed By.
+ *
  *   php setup_cli.php --help
  *   php setup_cli.php --host=localhost --username=itflow --password=secret --database=itflow \
  *       --base-url=itflow.example.com --company-name="My Company" --country="United States" \
@@ -67,22 +82,48 @@ $cli_fields = [
         'timezone' => ['Timezone (e.g. America/New_York)', true],
     ],
 ];
+// Given, never asked for - an install another ITFlow manages (functions/managed.php)
+$cli_managed = [
+    'manager-code' => 'The connection code from Admin > Managed Instances on the ITFlow that manages this one - it connects as setup finishes',
+];
 $cli_flags = [
+    'manager-required' => "Keep it managed - its admins can't disconnect it. For an install you host",
+    'generate-password' => 'Make a strong password for your account, shown once at the end, instead of asking for one',
     'skip-get-started' => "Don't open Get started on first signing in, or show Finish setting up on the dashboard - it stays in Admin > Get started",
     'share-telemetry' => 'Tell the ITFlow project about this install, once - its company name, website, city, state, country and currency',
     'comments' => 'Something to tell the ITFlow project with it (optional)',
+    'ask-missing' => 'Ask only for what is needed and not given, and the database password - the rest takes its default or suggestion',
     'non-interactive' => 'Ask for nothing - stop if anything needed is missing or wrong',
+    'json' => 'End with a summary in JSON on standard output - the progress goes to standard error',
     'help' => 'Show this help',
 ];
 
-$longopts = ['help', 'non-interactive', 'share-telemetry', 'skip-get-started', 'comments:'];
+$longopts = ['help', 'non-interactive', 'ask-missing', 'share-telemetry', 'skip-get-started', 'manager-required', 'generate-password', 'json', 'comments:', 'manager-code:'];
 foreach ($cli_fields as $fields) {
     foreach ($fields as $key => $field) {
         $longopts[] = "$key:";
     }
 }
 $options = getopt('', $longopts);
+
+// An option left off can come from the environment - ITFLOW_SETUP_PASSWORD for --password - so no password has to be typed on the command line
+foreach (array_merge(array_keys(array_merge(...array_values($cli_fields))), array_keys($cli_managed), ['comments']) as $key) {
+    $env = getenv('ITFLOW_SETUP_' . strtoupper(str_replace('-', '_', $key)));
+    if (!array_key_exists($key, $options) && $env !== false) {
+        $options[$key] = $env;
+    }
+}
 $non_interactive = isset($options['non-interactive']);
+$ask_missing = !$non_interactive && isset($options['ask-missing']);
+$json = isset($options['json']);
+
+// With --json, everything but the summary goes to standard error
+if ($json && !isset($options['help'])) {
+    ob_start(function ($text) {
+        fwrite(STDERR, $text);
+        return '';
+    }, 1);
+}
 
 if (isset($options['help'])) {
     echo "ITFlow setup from the command line\n\n";
@@ -94,11 +135,20 @@ if (isset($options['help'])) {
         }
         echo "\n";
     }
+    echo "Managed by another ITFlow:\n";
+    foreach ($cli_managed as $key => $what) {
+        echo sprintf("  --%-20s %s\n", $key, $what);
+    }
+    echo "\n";
     foreach ($cli_flags as $key => $what) {
         echo sprintf("  --%-20s %s\n", $key, $what);
     }
     echo "\nLeft out, an option is asked for - unless --non-interactive. The language, currency and timezone\n";
     echo "are suggested from the country, and --non-interactive takes the suggestion when there is one.\n";
+    echo "Any option can be set in the environment instead, as ITFLOW_SETUP_ and its name - ITFLOW_SETUP_PASSWORD\n";
+    echo "for --password, ITFLOW_SETUP_USER_PASSWORD for --user-password.\n\n";
+    echo "Exit codes: 0 set up; 1 stopped, nothing set up; 3 set up, but it couldn't connect to the ITFlow\n";
+    echo "managing it - connect it from Admin > Managed By with a new code.\n";
     exit(0);
 }
 
@@ -123,12 +173,21 @@ require_once "../includes/settings_localization_array.php";
 
 $timezones = DateTimeZone::listIdentifiers();
 
-/* Stop, saying why - to stderr, with a failing exit code. */
+/* Stop, saying why - to stderr, with a failing exit code. With --json, said in the summary too. */
 function cliStop($message) {
+    global $json;
     fwrite(STDERR, "\n$message\n");
+    if ($json) {
+        fwrite(STDOUT, json_encode(['ok' => false, 'error' => $message], JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT) . "\n");
+    }
     exit(1);
 }
 
+/* A path for a command line - as it is, or quoted when it has anything a shell would read. */
+function cliShellWord($text) {
+    return preg_match('#^[A-Za-z0-9_./=:@%+-]+$#', $text) ? $text : escapeshellarg($text);
+}
+
 /* A setup hint is written for the page - as plain text. */
 function cliText($html) {
     return html_entity_decode(strip_tags((string) $html), ENT_QUOTES, 'UTF-8');
@@ -159,10 +218,11 @@ function cliPrompt($label, $secret = false) {
 /*
  * One answer - the option given, or else asked for (with its default) until
  * $check, which says what is wrong with a value or '', is happy. With
- * --non-interactive, a missing or wrong one stops setup.
+ * --non-interactive, a missing or wrong one stops setup. With --ask-missing,
+ * only what is needed with no default, or a secret, is asked for.
  */
 function cliAsk($key, $label, $required, $default = '', $check = null, $secret = false) {
-    global $options, $non_interactive;
+    global $options, $non_interactive, $ask_missing;
 
     // What was given rather than typed, said back
     $given = function ($value) use ($label, $secret) {
@@ -192,7 +252,7 @@ function cliAsk($key, $label, $required, $default = '', $check = null, $secret =
             cliStop("--$key: $error");
         }
         echo "  --$key: $error\n";
-    } elseif ($non_interactive) {
+    } elseif ($non_interactive || ($ask_missing && !$secret && !($required && (string) $default === ''))) {
         if ($required && (string) $default === '') {
             cliStop("--$key is needed - $label.");
         }
@@ -246,11 +306,28 @@ if (setupChecksFailed($checks['required'])) {
     cliStop("Fix what is marked [!!], then run this again.");
 }
 
+// The managing ITFlow's code - a code that can't work stops setup before anything is done
+$manager_code = trim((string) ($options['manager-code'] ?? ''));
+$manager_required = isset($options['manager-required']);
+$manager = $manager_code !== '' ? managedParseCode($manager_code) : null;
+if ($manager_code !== '' && !$manager) {
+    cliStop("--manager-code: that isn't a connection code - copy it again from Admin > Managed Instances on the ITFlow that manages this one. It starts ITFLOW-MANAGE:");
+}
+if ($manager || $manager_required) {
+    echo "\n== Managed ==\n";
+    echo $manager ? "  Connects to {$manager['manager_url']} once it is set up" . ($manager_required ? ", and stays connected - its admins can't disconnect it" : '') . ".\n"
+        : "  Kept managed - connect it from Admin > Managed By with a code from the ITFlow that manages it.\n";
+}
+if (isset($options['generate-password']) && trim((string) ($options['user-password'] ?? '')) !== '') {
+    cliStop('Give --user-password or --generate-password, not both.');
+}
+
 // Asking nothing, all that has no default or suggestion has to be given - said before anything is done
 if ($non_interactive) {
     foreach ($cli_fields as $fields) {
         foreach ($fields as $key => $field) {
-            if ($field[1] && !isset($field[2]) && !in_array($key, ['locale', 'currency', 'timezone'], true) && trim((string) ($options[$key] ?? '')) === '') {
+            if ($field[1] && !isset($field[2]) && !in_array($key, ['locale', 'currency', 'timezone'], true) && trim((string) ($options[$key] ?? '')) === ''
+                && !($key === 'user-password' && isset($options['generate-password']))) {
                 cliStop("--$key is needed - {$field[0]}.");
             }
         }
@@ -308,7 +385,12 @@ $user = [
     'email' => cliAsk('user-email', 'Your email - what you sign in with', true, '', $user_field('email')),
 ];
 $password_given = array_key_exists('user-password', $options);
-while (true) {
+$password_generated = isset($options['generate-password']);
+if ($password_generated) {
+    $user['password'] = generateReadablePassword();
+    echo "  Password: made for it - shown at the end, once.\n";
+}
+while (!$password_generated) {
     $user['password'] = cliAsk('user-password', 'Password (at least ' . USER_PASSWORD_MIN . ' characters)', true, '', 'userPasswordProblem', true);
     if ($password_given || $non_interactive) {
         break;
@@ -365,7 +447,7 @@ $region = [
 // ---------- Telling the ITFlow project ----------
 $share = isset($options['share-telemetry']);
 $comments = is_string($options['comments'] ?? null) ? trim($options['comments']) : '';
-if (!$share && !$non_interactive) {
+if (!$share && !$non_interactive && !$ask_missing) {
     echo "\n== Tell the ITFlow project about this install? ==\n";
     echo "  Once, now: the company's name, website, city, state, country and currency, and this install's id.\n";
     $share = cliConfirm('Share them');
@@ -408,6 +490,17 @@ if ($skip_get_started) {
     echo "  Get started won't open on signing in - it is in Admin > Get started.\n";
 }
 
+// Managed by another ITFlow - turned on in config.php, as by hand (functions/managed.php)
+if ($manager || $manager_required) {
+    $managed_line = $manager_required ? '$config_manager_required = true;' : '$config_enable_managed_by = true;';
+    if (@file_put_contents('../config.php', "\n// Managed by another ITFlow - its admins " . ($manager_required ? "can't disconnect it" : 'can disconnect it in Admin > Managed By') . "\n$managed_line\n", FILE_APPEND | LOCK_EX) === false) {
+        cliStop("Setup is done, but config.php could not be written to. Add these lines to the end of it: $managed_line \$config_enable_setup = 0;");
+    }
+    $config_enable_managed_by = true;
+    $config_manager_required = $manager_required;
+    echo "  Managed mode is on in config.php.\n";
+}
+
 if (!setupClose('../config.php')) {
     cliStop("Setup is done, but config.php could not be written to. Add this line to the end of it: \$config_enable_setup = 0;");
 }
@@ -416,15 +509,57 @@ if (!setupClose('../config.php')) {
 $config_backup_key = null;
 $backup_key = backupEncryptionKey();
 
+// Connected last, so an ITFlow that can't be reached leaves a whole install behind
+$manager_result = null;
+if ($manager) {
+    $enroll_error = '';
+    if (managedEnroll($manager_code, "https://$base_url", $enroll_error)) {
+        $manager_result = ['connected' => true, 'name' => managedManagerName(), 'url' => $manager['manager_url']];
+        echo "  Connected to {$manager_result['name']} - it checks in every minute once its cron job runs.\n";
+    } else {
+        $manager_result = ['connected' => false, 'url' => $manager['manager_url'], 'error' => $enroll_error];
+        echo "  Not connected to {$manager['manager_url']}: $enroll_error\n";
+    }
+}
+
 $itflow_path = realpath(__DIR__ . '/..');
+$cron_command = cliShellWord(PHP_BINARY !== '' ? PHP_BINARY : 'php') . ' ' . cliShellWord("$itflow_path/cron/cron.php") . ' >/dev/null';
+
 echo "\nITFlow is set up. Sign in at https://$base_url/login.php" . ($skip_get_started ? '' : " - Get started opens and walks you through the rest") . "\n";
+if ($password_generated) {
+    echo "\nPassword for {$user['email']} - it isn't shown again:\n\n";
+    echo "     {$user['password']}\n";
+}
 if ($backup_key !== '') {
     echo "\nBackup key - keep a copy somewhere safe, away from this server; a backup can't be restored without it:\n\n";
     echo "     $backup_key\n";
 }
-echo "\nNext, before ITFlow can send mail, parse tickets or bill anyone, add this single entry\n";
-echo "to the crontab of the user that owns the ITFlow files:\n\n";
-echo "     * * * * * php $itflow_path/cron/cron.php >/dev/null\n\n";
-echo "Jobs start as soon as it runs. Their schedules are in Maintenance > Cron.\n\n";
+echo "\nNext, add its cron job - nothing is emailed, turned into tickets, billed or backed up until it runs.\n";
+echo "In the crontab of the user that owns the ITFlow files:\n\n";
+echo "     * * * * * $cron_command\n\n";
+echo "Or in a hosting control panel such as Jabali, HestiaCP or cPanel, a cron job that runs every minute\n";
+echo "(* * * * *) with this command:\n\n";
+echo "     $cron_command\n\n";
+echo "Jobs start as soon as it runs. Their schedules are in Maintenance > Cron.\n";
+if ($manager_result && $manager_result['connected']) {
+    echo "Until then, {$manager_result['name']} shows it as waiting for its cron job.\n";
+} elseif ($manager_result) {
+    echo "\nIt isn't connected to the ITFlow that manages it. Make a new connection code there, in Admin > Managed\n";
+    echo "Instances, and paste it into Admin > Managed By here.\n";
+}
+echo "\n";
 
-exit(0);
+if ($json) {
+    ob_end_flush();
+    fwrite(STDOUT, json_encode([
+        'ok' => true,
+        'url' => "https://$base_url",
+        'sign_in' => "https://$base_url/login.php",
+        'account' => ['name' => $user['name'], 'email' => $user['email']] + ($password_generated ? ['password' => $user['password']] : []),
+        'backup_key' => $backup_key,
+        'cron' => ['schedule' => '* * * * *', 'command' => $cron_command],
+        'manager' => $manager_result ?? ($manager_required ? ['connected' => false, 'error' => 'No connection code was given - connect it from Admin > Managed By'] : null),
+    ], JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT) . "\n");
+}
+
+exit($manager_result && !$manager_result['connected'] ? 3 : 0);