docs: add release notes for v3.0.1
This commit is contained in:
+11
-88
@@ -1,90 +1,13 @@
|
|||||||
# LOGAR Release v3.0.0
|
# LOGAR Release v3.0.1
|
||||||
|
|
||||||
Major architectural release introducing the centralized **Master Licensing Authority** (logar.eibl.tech), Subordinate CA hierarchy, live seat synchronization over mTLS, authenticated Hermes AI Bearer token integrations, and streamlined WebUI dashboard controls.
|
### 🛡️ Security Fixes & Defensive Hardening
|
||||||
|
- **Mandatory Admin Authentication**: Enforced strict administrator authentication across all fleet management endpoints (`/api/clients`, `/api/clients/approve`, `/api/clients/revoke`, `/api/clients/delete`, `/api/client/export-profile`) and license management APIs.
|
||||||
### Key Highlights & Changes in v3.0.0:
|
- **Brute-Force Mitigation & Rate Limiting**: Implemented thread-safe sliding-window IP rate limiting on `/login` (10 attempts/min) and `/api/client/enroll` (15 attempts/min) with progressive delays and `HTTP 429` throttling.
|
||||||
|
- **Cookie Security Flags**: Session cookies now enforce `HttpOnly=True`, `SameSite="Lax"`, and dynamic `Secure=True` for HTTPS connections and reverse-proxy deployments (`X-Forwarded-Proto`).
|
||||||
- **Enterprise Master Licensing Authority (`LOGAR-LICENSING`)**:
|
- **Cryptographic Random Secrets**: Server Hub and License Authority session secrets are now generated with 256-bit CSPRNG (`secrets.token_hex(32)`) on initialization.
|
||||||
- Implemented standalone hierarchical PKI Authority issuing and signing subordinate CA certificates with custom X.509 OID seat quotas (`1.3.6.1.4.1.59999.1.1`).
|
- **License Renewal Validation**: Hardened `/api/license/renew` with explicit PEM structure and database validation, preventing unhandled exceptions.
|
||||||
- Automated mTLS renewal and synchronization (`renew_ca_cert_mtls`) connecting Hub servers to upstream authority.
|
|
||||||
- Dedicated multi-tenant licensing dashboard with 2FA TOTP authentication, user RBAC, and WebSocket real-time seat synchronization.
|
|
||||||
- Dedicated Docker container publishing workflow on release tags and portainer GitOps redeployment webhooks.
|
|
||||||
|
|
||||||
- **Real-Time Active Seat Quota Synchronization**:
|
|
||||||
- Hub automatically tracks and reports active node seat quotas (`seats_taken`, `active_seats`, `hostname`, `server_fingerprint`) to the upstream authority upon client enrollment, approval, revocation, and removal.
|
|
||||||
- Non-blocking asynchronous thread dispatch ensures instantaneous client responses while keeping central licensing metrics synchronized.
|
|
||||||
|
|
||||||
- **Hermes AI Integration & Token Authentication**:
|
|
||||||
- Dedicated `/api/hermes/report` ingestion endpoint delivering verified anomalies within a 12-hour evaluation window.
|
|
||||||
- Bearer token administration (`/api/hermes/tokens`) with dedicated generation, copying, revocation, and deletion in the Hub WebUI.
|
|
||||||
|
|
||||||
- **Streamlined WebUI Dashboard**:
|
|
||||||
- Cleaned up top summary KPI cards to focus strictly on operational status and fleet health.
|
|
||||||
- Centralized full cryptographic inspection (Master Authority URL, Server Hub Fingerprint, CA Fingerprint) into the dedicated *Sub-CA & Licensing* tab.
|
|
||||||
|
|
||||||
- **Standalone CI & Modular Testing**:
|
|
||||||
- Decoupled LOGAR and LOGAR-LICENSING CI pipelines so each repository tests independently without submodule dependencies.
|
|
||||||
- 100% test coverage across 35 LOGAR unit tests and 14 Licensing Authority unit tests.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
# LOGAR Release v2.0.1
|
|
||||||
|
|
||||||
Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.
|
|
||||||
|
|
||||||
### Key Highlights & Changes in v2.0.1:
|
|
||||||
|
|
||||||
- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**:
|
|
||||||
- Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`).
|
|
||||||
- Standardized tag matching for Gitea Actions on `push: tags: ['v*']`.
|
|
||||||
- Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`).
|
|
||||||
- Retired deprecated `release-linux.yml` and `release-windows.yml` files.
|
|
||||||
|
|
||||||
- **Installer & Engine Version Bump**:
|
|
||||||
- Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`.
|
|
||||||
- Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`.
|
|
||||||
- Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`.
|
|
||||||
|
|
||||||
- **Distribution & Release Documentation**:
|
|
||||||
- Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
# LOGAR Release v2.0.0
|
|
||||||
|
|
||||||
Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.
|
|
||||||
|
|
||||||
### Key Highlights & Changes in v2.0.0:
|
|
||||||
|
|
||||||
- **mTLS 1.3 Transport Security & Runtime Licensing**:
|
|
||||||
- Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (`ssl.CERT_REQUIRED`, TLS 1.3 minimum version).
|
|
||||||
- Hub dynamically validates incoming client Common Name (`client_id`) against active license seats in SQLite during the TLS handshake.
|
|
||||||
- Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.
|
|
||||||
|
|
||||||
- **Dynamic Hub PKI Engine (`src/server_enrollment.py`)**:
|
|
||||||
- Automatically initializes an internal RSA-4096 Root CA (`ca.crt` / `ca.key`).
|
|
||||||
- Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
|
|
||||||
- Full OpenSSL 3.x and Python 3.12–3.14 compatibility via `SubjectKeyIdentifier` and `AuthorityKeyIdentifier` certificate extensions.
|
|
||||||
- Generates and signs client certificates on demand via `POST /api/client/enroll`.
|
|
||||||
|
|
||||||
- **In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading**:
|
|
||||||
- Server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, evaluated every 12 hours) alongside startup checks.
|
|
||||||
- Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
|
|
||||||
- Generates renewed certificates on disk with timestamped backups (`.bak`), and reloads active `ssl.SSLContext` in memory dynamically without dropping socket listeners or restarting the background service.
|
|
||||||
|
|
||||||
- **Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal**:
|
|
||||||
- **Proactive**: Forwarders (`Win_Client.py` and `Linux_Client.py`) evaluate `client.crt` validity before each run, auto-renewing via `/api/client/enroll` if expiring within 30 days.
|
|
||||||
- **Reactive**: If the hub rotates its Root CA or a TLS verification error (`ssl.SSLError` / `SSLCertVerificationError`) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.
|
|
||||||
|
|
||||||
- **Database Schema & License Quota Accounting**:
|
|
||||||
- SQLite tables `license_config` (`max_seats`, `enrollment_secret`) and `clients` (`client_id`, `hostname`, `os_type`, `cert_fingerprint`, `status`, timestamps).
|
|
||||||
- Enforces seat limits on enrollment (`HTTP 403 License seat limit reached`) while allowing active registered nodes to re-enroll/renew indefinitely.
|
|
||||||
- Added `GET /api/clients` endpoint for license auditing and telemetry tracking.
|
|
||||||
|
|
||||||
- **Automated Service Installers**:
|
|
||||||
- **Windows**: Self-contained Inno Setup installers (`LOGAR-Client-Setup.exe` and `LOGAR-Server-Setup.exe`) bundling `nssm.exe` to register, configure, and start Windows services automatically.
|
|
||||||
- **Linux**: Automated installer scripts (`compilation/install_linux_client.sh` and `install_linux_server.sh`) deploying systemd service units with auto-restart policies.
|
|
||||||
|
|
||||||
- **CI/CD Release Workflows**:
|
|
||||||
- Windows workflow (`.gitea/workflows/release-windows.yml`) and Linux workflow (`.gitea/workflows/release-linux.yml`) automated to build native executables, installers, and upload release assets on tag push.
|
|
||||||
|
|
||||||
|
### ⚡ Operational Improvements & Modernization
|
||||||
|
- **FastAPI Lifespan Handlers**: Migrated legacy startup events to modern ASGI lifespan context managers.
|
||||||
|
- **OpenPGP Compression Preferences**: Aligned Server public key compression algorithms (`ZIP`, `ZLIB`, `BZ2`, `Uncompressed`) with client preferences.
|
||||||
|
- **Cross-Platform Compilation**: Unified automated packaging for standalone Windows and Linux binaries.
|
||||||
|
|||||||
Reference in New Issue
Block a user