me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs: document activated .lic packages, mTLS license sync, and renewal seat expansion

Browse Source
This commit is contained in:
me0nline
2026-09-24 17:37:59 +02:00
parent 5670965e9d
commit 4171649bd3
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -9
View File
@@ -104,13 +104,14 @@ graph TB
- `OID_LOGAR_SEATS (1.3.6.1.4.1.59999.1.1)`: Embeds the exact licensed seat quota directly inside the signed Subordinate CA certificate.
- `OID_LOGAR_LICENSE_ID (1.3.6.1.4.1.59999.1.2)`: Uniquely tracks enterprise license entitlement.
- `OID_LOGAR_ISSUER_URL (1.3.6.1.4.1.59999.1.3)`: Embedded endpoint coordinate (`https://logar.eibl.tech`).
- **Exportable `.lic` Request Files**:
- The LOGAR server generates its Subordinate CA private key (`certs/ca.key`), Certificate Signing Request (`certs/ca.csr`), and packages them into an exportable `logar_server.lic` file containing the CSR, server fingerprint, and license authority coordinate.
- Exportable directly from the WebUI or via CLI (`python src/Server.py --export-lic server.lic`).
- **One-Time Pass & Zero-Touch mTLS Renewals**:
- The signed CA certificate only needs to be imported **once** into the LOGAR Server (via WebUI or CLI `--import-ca`).
- Once imported, the server hub's background watchdog monitors `ca.crt` expiration (< 30 days).
- Renewals are performed **automatically over mTLS**: the LOGAR Server authenticates directly against `https://logar.eibl.tech/api/license/renew` using its existing active certificate and key, receives the renewed Subordinate CA certificate preserving its seat quota, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services.
- **Exportable `.lic` Request & Activated `.lic` Packages**:
- **Request**: The LOGAR server generates its Subordinate CA private key (`certs/ca.key`), Certificate Signing Request (`certs/ca.csr`), and packages them into an exportable `logar_server.lic` file.
- **Activation Package**: The master license authority issues an activated `.lic` package containing the signed Subordinate CA, granted seat quota, server metadata, and the Master Root CA (`upstream_ca.crt`).
- Importable via WebUI or CLI (`python src/Server.py --import-lic activated.lic` or `--import-ca`).
- **Self-Updating Client Servers & Dynamic Seat Expansion**:
- Client servers update themselves against the master authority (`logar.eibl.tech`) over mTLS (`python src/Server.py --sync-license` or via WebUI / automated watchdog).
- Seat quotas can be increased with each renewal or updated on-demand on the master authority.
- The client server automatically detects the higher seat count in the signed certificate's OID, updates its database and runtime configuration, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services.
### 3. Integrated Fleet Licensing & WebUI Dashboard
- **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`).
@@ -118,8 +119,8 @@ graph TB
- **Licensing Actions**:
- 1-click **Export .lic Request** file download.
- Interactive **View & Copy CA CSR** modal.
- Drag-and-drop or paste **Import Signed CA Certificate** modal.
- **Renew via mTLS Now** button for immediate upstream renewal.
- Drag-and-drop or paste **Import License (.lic / ca.crt)** modal.
- **Sync & Renew via mTLS** button for immediate upstream synchronization and seat expansion.
- **Seat Management & Revocation Table**:
- Lists all connected Windows and Linux edge forwarders.
- **Revoke Seat**: Instantly drops and blocks the client at the TLS socket handshake layer.