From 4970ef7c255cd90c1d7f75a57bc3e1c49b2fcd61 Mon Sep 17 00:00:00 2001 From: max Date: Thu, 24 Sep 2026 16:50:08 +0200 Subject: [PATCH] docs(linux_server): document Master License Authority, WebUI dashboard, and .lic export --- out/linux_server/README.md | 40 ++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/out/linux_server/README.md b/out/linux_server/README.md index 386d440..7f6103f 100644 --- a/out/linux_server/README.md +++ b/out/linux_server/README.md @@ -10,11 +10,12 @@ Standalone compiled binary and automated systemd service distribution for Linux ### Key Architecture & Capabilities - **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system. -- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite. -- **Dynamic PKI & License Accounting**: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via `POST /api/client/enroll` while enforcing seat limits (`max_seats`). -- **In-Flight Certificate Watchdog & Dynamic Reloading**: Continuously monitors Root CA (`ca.crt`) and Server TLS certificate (`server.crt`) validity in the background (every 12 hours). When nearing expiration (< 30 days), certificates are automatically regenerated with timestamped backups, and active `ssl.SSLContext` structures are reloaded dynamically without dropping socket connections or restarting the systemd service. +- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite. +- **Master License Authority (`logar.eibl.tech`) & Seat-Bearing CA**: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID `1.3.6.1.4.1.59999.1.1`. +- **Zero-Touch mTLS Renewals**: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with `https://logar.eibl.tech/api/license/renew` when nearing expiration (< 30 days). +- **Fleet Management & WebUI Dashboard (Port 8443)**: Modern browser WebUI accessible at `http://localhost:8443/webui` to monitor seat quotas, export `.lic` request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement. - **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events require persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window. -- **Embedded Hermes Reporting & Management API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`. +- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`. - **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`). --- @@ -99,7 +100,33 @@ The output file contains the server coordinates, enrollment secret, and fingerpr --- -## 4. Manual Systemd Service Management +## 4. Fleet Licensing, .lic Files & WebUI Dashboard + +### Accessing the WebUI +Open your browser and navigate to: +``` +http://:8443/webui +``` +The WebUI provides: +1. **Real-time Seat Quota Meter**: Visual meter displaying active clients against approved seat quota. +2. **Export .lic Request**: 1-click download of `logar_server.lic` containing your Subordinate CA CSR and machine fingerprint for `logar.eibl.tech`. +3. **Import Signed CA Certificate**: Modal to paste or upload the signed `ca.crt` issued by `logar.eibl.tech`. Activating updates your seat limit immediately and reloads mTLS context in-flight. +4. **Trigger mTLS Renewal Now**: Button to test or trigger immediate mTLS renewal against `logar.eibl.tech`. +5. **Client Seat Management**: View all enrolled nodes; click **Revoke Seat** to immediately drop and block an edge node at the socket layer, or **Reactivate** to restore access. + +### CLI Licensing Utilities +Export a `.lic` request file via CLI: +```bash +./Server.bin --export-lic server.lic +``` +Import a signed CA certificate via CLI: +```bash +./Server.bin --import-ca ca.crt +``` + +--- + +## 5. Manual Systemd Service Management Check service status: ```bash @@ -113,7 +140,7 @@ sudo journalctl -u logar-server.service -f -n 50 --- -## 5. Uninstallation & Removal +## 6. Uninstallation & Removal ```bash sudo systemctl disable --now logar-server.service @@ -121,3 +148,4 @@ sudo rm -f /etc/systemd/system/logar-server.service sudo systemctl daemon-reload sudo rm -rf /opt/logar-server /etc/logar /var/log/logar ``` +