remove legacy out, docs, and wiki folders from repo
This commit is contained in:
@@ -9,6 +9,7 @@ __pycache__/
|
||||
*$py.class
|
||||
build/
|
||||
dist/
|
||||
out/
|
||||
*.spec
|
||||
*.exe
|
||||
!compilation/nssm.exe
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
[](RELEASE_NOTES.md)
|
||||
[](tests/)
|
||||
[](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)
|
||||
[](wiki/Branding-Guide.md)
|
||||
[](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Branding-Guide)
|
||||
|
||||
**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.
|
||||
|
||||
@@ -118,8 +118,6 @@ LOGAR/
|
||||
│ ├── logo_banner.svg # Full brand banner
|
||||
│ ├── logo.ico / favicon.ico # Application & web icons
|
||||
│ └── wizard_*.bmp # Installer dialog bitmaps
|
||||
├── wiki/ # Comprehensive documentation & guides
|
||||
│ └── Branding-Guide.md # Official visual identity and design system
|
||||
├── .gitea/workflows/ # CI/CD pipelines (ci.yml, release.yml)
|
||||
├── compilation/ # Build scripts, Linux installers & Inno Setup scripts
|
||||
│ ├── generate_branding_assets.py # Asset & bitmap generator
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
|
||||
### 🎨 Brand Identity, Centralized Asset Library & Design System
|
||||
- **Centralized `/assets` Repository**: Added official vector graphics (`logo.svg`, `logo_transparent.svg`, `logo_dark.svg`, `logo_banner.svg`), high-resolution master PNGs (16px to 512px), multi-resolution Windows ICOs (`logo.ico`, `favicon.ico`), and installer dialog bitmaps (`wizard_header.bmp`, `wizard_small.bmp`, `wizard_sidebar.bmp`).
|
||||
- **Official Wiki Branding Guide**: Published comprehensive visual identity standards at `wiki/Branding-Guide.md` detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning.
|
||||
- **Official Wiki Branding Guide**: Published comprehensive visual identity standards on the Gitea Wiki at `https://gitea.eibl.tech/me0nline/LOGAR/wiki/Branding-Guide` detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning.
|
||||
- **Unified Interface & Tab Branding**: Implemented transparent vector logos on all web navigation bars and browser tabs across both the LOGAR Server Hub (`:8443`) and Master Licensing Authority (`logar.eibl.tech`).
|
||||
- **Clean Installer Bitmaps**: Regenerated 24-bit RGB header bitmaps with seamless white backgrounds (`#FFFFFF`) matching native Windows Inno Setup wizard dialogs.
|
||||
- **Automated Asset Pipeline**: Enhanced `compilation/generate_branding_assets.py` to deterministically compile and distribute assets across main repo, compilation subdirectories, and the licensing submodule without third-party graphics dependencies.
|
||||
|
||||
@@ -1,163 +0,0 @@
|
||||
# LOGAR Brand Identity & Design Guide
|
||||
|
||||
> **Official Design System & Visual Identity Standards for LOGAR**
|
||||
> *Fleet Log Aggregation, PKI Fleet Licensing & Centralized Telemetry Provisioning Hub*
|
||||
|
||||
---
|
||||
|
||||
## 1. Brand Identity & Positioning
|
||||
|
||||
**LOGAR** is an enterprise log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It connects lightweight, zero-state edge forwarders to a centralized hub that enforces mutual TLS 1.3 (**mTLS**), cryptographic seat leasing, rolling 12-hour temporal persistence tracking, and direct anomaly streaming to **Hermes AI**.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["Edge Forwarders<br/>(Win & Linux)"] -->|mTLS 1.3 Stream| B["LOGAR Server Hub<br/>(Central Aggregator)"]
|
||||
B -->|Verified Telemetry| C["Hermes AI<br/>(Deep Reasoning Engine)"]
|
||||
D["License Authority<br/>(Master PKI)"] <==>|WebSocket Quota| B
|
||||
```
|
||||
|
||||
### Brand Positioning Rules:
|
||||
* **Log Aggregator & Telemetry Hub**: LOGAR is a high-throughput, zero-state log aggregation, filtering, and telemetry provisioning hub.
|
||||
* **Strict Naming Constraint**: **LOGAR is NOT a SIEM** (Security Information and Event Management) system. It does not provide intrusion detection, security rule engines, or threat intelligence feeds. Never describe LOGAR as a SIEM in documentation, user interfaces, installer scripts, or promotional material.
|
||||
|
||||
---
|
||||
|
||||
## 2. Logo Anatomy & Symbolism
|
||||
|
||||
The LOGAR emblem combines cybersecurity aesthetics with real-time log streaming geometry:
|
||||
|
||||
<p align="center">
|
||||
<img src="../assets/logo_banner.svg" alt="LOGAR Banner" width="600"/>
|
||||
</p>
|
||||
|
||||
```
|
||||
/\ [ Hexagon Shield: PKI Cryptographic Integrity ]
|
||||
/ \
|
||||
/ \ [ Left 'L' Pillar: Zero-State Forwarder Pipeline ]
|
||||
| || |
|
||||
| ||. | [ Stepped Telemetry Bars: Structured Log Stream ]
|
||||
| |___|
|
||||
\ / [ Spark Points: Dynamic Seat Sync & Handshake ]
|
||||
\ /
|
||||
\/
|
||||
```
|
||||
|
||||
### Key Components:
|
||||
1. **Hexagonal Shield**: Represents mutual TLS 1.3 cryptographic verification and authoritative PKI trust boundaries.
|
||||
2. **The Stylized 'L' Glyph**: Represents the high-performance forwarder pipeline and log ingestion stream.
|
||||
3. **Stepped Telemetry Bars**: Depicts normalized structured log records propagating from edge forwarders to the central temporal engine.
|
||||
4. **Spark & Sync Points**: Visualizes live WebSocket connection nodes and mTLS handshake synchronization.
|
||||
|
||||
---
|
||||
|
||||
## 3. Official Color Palette
|
||||
|
||||
LOGAR uses a cyber-slate and neon telemetry palette designed for high contrast in dark mode environments, with seamless light-mode compatibility for native operating system dialogs and installer wizards.
|
||||
|
||||
### Primary Colors
|
||||
|
||||
| Swatch | Color Name | Hex Code | RGB | HSL | Usage |
|
||||
| :--- | :--- | :--- | :--- | :--- | :--- |
|
||||
|  | **Cyber Cyan** | `#00E5FF` | `0, 229, 255` | `186°, 100%, 50%` | Primary brand accent, glowing telemetry lines, active links, primary CTA buttons |
|
||||
|  | **Emerald Pulse** | `#00FFA3` | `0, 255, 163` | `158°, 100%, 50%` | Healthy node indicators, approved client seats, online PKI status, success badges |
|
||||
|  | **Electric Blue** | `#0072FF` | `0, 114, 255` | `213°, 100%, 50%` | Gradient stop with Cyber Cyan, secondary action highlights |
|
||||
|  | **Dark Navy** | `#0E1A2E` | `14, 26, 46` | `218°, 53%, 12%` | Emblem background, card surfaces, modal dialogs |
|
||||
|  | **Midnight Slate**| `#070C18` | `7, 12, 24` | `222°, 55%, 6%` | Application canvas background, dark-mode body |
|
||||
|
||||
### Semantic & Status Colors
|
||||
|
||||
| Swatch | Color Name | Hex Code | RGB | Usage |
|
||||
| :--- | :--- | :--- | :--- | :--- |
|
||||
|  | **Crimson Alert** | `#EF4444` | `239, 68, 68` | Critical anomalies, revoked seats, connection errors |
|
||||
|  | **Amber Warning** | `#F59E0B` | `245, 158, 11` | Pending enrollment approvals, seat quota thresholds (>85%) |
|
||||
|  | **Text Muted** | `#94A3B8` | `148, 163, 184` | Table headers, secondary descriptions, timestamps |
|
||||
|  | **Pure White** | `#FFFFFF` | `255, 255, 255` | Installer header background, text on dark cards |
|
||||
|
||||
---
|
||||
|
||||
## 4. Typography System
|
||||
|
||||
LOGAR uses clean, modern sans-serif typography for user interfaces and clear monospace fonts for log telemetry and cryptographic fingerprints.
|
||||
|
||||
### Monospace (Telemetry, Fingerprints & Code)
|
||||
* **Primary**: `'JetBrains Mono', 'Fira Code', 'Cascadia Code', Consolas, monospace`
|
||||
* **Usage**: Raw log frames, JSON schemas, X.509 serials, SHA-256 fingerprints, port mappings, command-line snippets.
|
||||
|
||||
### Interface Sans-Serif (WebUI & Marketing)
|
||||
* **Primary**: `-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif`
|
||||
* **Usage**: Headings, navigation bars, modal forms, buttons, dashboard metrics.
|
||||
|
||||
### Type Scale
|
||||
* **Hero Title**: `48px` - `56px` / Bold (900) / Tracking: `-0.02em`
|
||||
* **Page Header (H1)**: `24px` - `32px` / Extra Bold (800)
|
||||
* **Section Title (H2)**: `20px` - `24px` / Bold (700)
|
||||
* **Card Header (H3)**: `16px` - `18px` / Semi-Bold (600)
|
||||
* **Body Text**: `14px` - `15px` / Regular (400) / Line Height: `1.6`
|
||||
* **Code / Badges / Monospace**: `12px` - `13px` / Medium (500)
|
||||
|
||||
---
|
||||
|
||||
## 5. Asset Library Inventory
|
||||
|
||||
All brand visual assets are maintained in the central [`assets/`](../assets/) directory:
|
||||
|
||||
| Filename | Format | Dimensions | Purpose |
|
||||
| :--- | :--- | :--- | :--- |
|
||||
| [`logo.svg`](../assets/logo.svg) | SVG | Vector | Full emblem with dark shield background |
|
||||
| [`logo_transparent.svg`](../assets/logo_transparent.svg) | SVG | Vector | **Primary WebUI Emblem**: Transparent background for headers, tabs, and light/dark themes |
|
||||
| [`logo_dark.svg`](../assets/logo_dark.svg) | SVG | Vector | Shield emblem optimized for dark mode backgrounds |
|
||||
| [`logo_banner.svg`](../assets/logo_banner.svg) | SVG | 960x240 | Wide brand banner with emblem, typography, and tagline |
|
||||
| [`logo.png`](../assets/logo.png) | PNG (RGBA) | 512x512 | High-resolution master raster asset |
|
||||
| [`logo_256x256.png`](../assets/logo_256x256.png) | PNG (RGBA) | 256x256 | App icon and README graphics |
|
||||
| [`logo_128x128.png`](../assets/logo_128x128.png) | PNG (RGBA) | 128x128 | Medium display icon |
|
||||
| [`logo_64x64.png`](../assets/logo_64x64.png) | PNG (RGBA) | 64x64 | Small UI asset |
|
||||
| [`logo_32x32.png`](../assets/logo_32x32.png) | PNG (RGBA) | 32x32 | Standard favicon raster |
|
||||
| [`logo_16x16.png`](../assets/logo_16x16.png) | PNG (RGBA) | 16x16 | Small favicon raster |
|
||||
| [`logo.ico`](../assets/logo.ico) | ICO | Multi (16-256) | Windows executable icon & installer icon |
|
||||
| [`favicon.ico`](../assets/favicon.ico) | ICO | Multi (16-256) | WebUI dashboard favicon |
|
||||
| [`wizard_header.bmp`](../assets/wizard_header.bmp) | BMP (24-bit) | 150x57 | Inno Setup & NSIS top header bitmap (white background) |
|
||||
| [`wizard_small.bmp`](../assets/wizard_small.bmp) | BMP (24-bit) | 55x55 | Inno Setup small wizard bitmap |
|
||||
| [`wizard_sidebar.bmp`](../assets/wizard_sidebar.bmp) | BMP (24-bit) | 164x314 | Inno Setup & NSIS welcome wizard sidebar graphic |
|
||||
|
||||
---
|
||||
|
||||
## 6. Logo Usage Guidelines
|
||||
|
||||
### 1. WebUI Navigation & Tabs
|
||||
* **Rule**: Always use the **transparent background vector emblem** (`logo_transparent.svg`) aligned to the **far left** of headers and tab bars.
|
||||
* **Style**: `.logo-icon { background: transparent; box-shadow: none; display: flex; align-items: center; justify-content: center; }`
|
||||
* **Clear Space**: Maintain a minimum margin of `12px` between the logo and adjacent title text.
|
||||
|
||||
### 2. Windows Installers & Native Wizards
|
||||
* **Rule**: The top header banner (`wizard_header.bmp`) uses a pure white background (`#FFFFFF`) with the emblem positioned on the left, blending seamlessly with native Windows wizard backgrounds.
|
||||
* **Sidebar**: The welcome screen uses `wizard_sidebar.bmp` with cyber-navy gradients and pulse log lines.
|
||||
|
||||
### 3. CLI & Linux Setup Scripts
|
||||
* **Rule**: CLI installers output branded cyan/emerald ANSI banners and formatted step indicators:
|
||||
```
|
||||
============================================================
|
||||
LOGAR Fleet Log Aggregation & Centralized Provisioning
|
||||
============================================================
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Dos and Don'ts
|
||||
|
||||
| Do | Don't |
|
||||
| :--- | :--- |
|
||||
| ✅ **DO** use `assets/logo_transparent.svg` for web tabs and navigation bars. | ❌ **DON'T** put a solid dark box behind the logo in web tabs or navbar headers. |
|
||||
| ✅ **DO** refer to LOGAR as a **Log Aggregator** or **Telemetry Hub**. | ❌ **DON'T** refer to LOGAR as a **SIEM** or security monitor. |
|
||||
| ✅ **DO** maintain the SVG aspect ratio (`1:1` for emblem, `4:1` for banner). | ❌ **DON'T** stretch or skew the logo geometry. |
|
||||
| ✅ **DO** use the official Cyber Cyan (`#00E5FF`) and Emerald (`#00FFA3`) accent colors. | ❌ **DON'T** substitute arbitrary neon colors (such as hot pink or bright orange). |
|
||||
| ✅ **DO** link to documentation using standard Gitea Wiki URLs. | ❌ **DON'T** hardcode stale wiki links in installer dialogs. |
|
||||
|
||||
---
|
||||
|
||||
## 8. Regenerating Branding Assets
|
||||
|
||||
To programmatically regenerate all vector, raster, icon, and installer bitmap assets across the codebase:
|
||||
|
||||
```bash
|
||||
python compilation/generate_branding_assets.py
|
||||
```
|
||||
@@ -1,35 +0,0 @@
|
||||
# Impressum / Legal Notice
|
||||
|
||||
Information pursuant to § 5 TMG (German Telemedia Act) and § 18 MStV (German Media State Treaty).
|
||||
|
||||
---
|
||||
|
||||
## Angaben gemäß § 5 TMG / § 18 MStV
|
||||
|
||||
### Diensteanbieter & Betreiber / Service Provider
|
||||
**Maximilian Eibl**
|
||||
Eibl Tech IT-Services
|
||||
Internet: [https://eibl.tech](https://eibl.tech)
|
||||
Repository: [https://gitea.eibl.tech/me0nline/LOGAR](https://gitea.eibl.tech/me0nline/LOGAR)
|
||||
|
||||
### Kontakt / Contact
|
||||
**E-Mail**: `contact@eibl.tech` / `max@eibl.tech`
|
||||
|
||||
### Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV
|
||||
**Maximilian Eibl**
|
||||
eibl.tech
|
||||
|
||||
---
|
||||
|
||||
## Haftungsausschluss / Disclaimer
|
||||
|
||||
### Haftung für Inhalte (Liability for Content)
|
||||
Als Diensteanbieter sind wir gemäß § 7 Abs.1 TMG für eigene Inhalte auf diesen Seiten nach den allgemeinen Gesetzen verantwortlich. Nach §§ 8 bis 10 TMG sind wir als Diensteanbieter jedoch nicht verpflichtet, übermittelte oder gespeicherte fremde Informationen zu überwachen oder nach Umständen zu forschen, die auf eine rechtswidrige Tätigkeit hinweisen.
|
||||
|
||||
### Haftung für Links (Liability for External Links)
|
||||
Unser Angebot enthält Links zu externen Websites Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen. Für die Inhalte der verlinkten Seiten ist stets der jeweilige Anbieter oder Betreiber der Seiten verantwortlich.
|
||||
|
||||
---
|
||||
|
||||
## Urheberrecht & Open-Source-Lizenz (Copyright & Licensing)
|
||||
Die durch die Seitenbetreiber erstellten Inhalte, Quellcodes, Dokumentationen und Marken auf diesen Seiten unterliegen dem Urheberrecht. LOGAR ist ein Open-Source-Projekt und wird unter den Bedingungen der jeweiligen Projektlizenz bereitgestellt.
|
||||
@@ -1,139 +0,0 @@
|
||||
# LOGAR Linux Edge Forwarder
|
||||
|
||||
Standalone compiled binary and automated systemd service distribution for Linux edge servers.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
`Linux_Client.bin` is a self-contained, pre-compiled executable that queries `systemd-journald` via `journalctl`, filters logs directly at the source, auto-enrolls with the central LOGAR hub, and streams candidate events over mutual TLS 1.3 (**mTLS**) to the central hub.
|
||||
|
||||
### Key Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native binary (`Linux_Client.bin`). No Python environment, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion**: Streams directly over hardware-authenticated TLS 1.3 sockets with machine-bound client certificates.
|
||||
- **Automated Client Enrollment**: On first run with an `enrollment_secret`, the client automatically calls `POST /api/client/enroll` on the hub, saves its certificates into `/etc/logar/certs/`, and establishes secure mTLS streaming.
|
||||
- **Proactive Expiry Check & Reactive Self-Healing**: Before each run, the client evaluates `client.crt` validity. If within 30 days of expiry, it automatically contacts the hub to renew certificates. If the server Root CA rotates or a TLS handshake error occurs, the client catch-heals by re-enrolling immediately and re-establishing connection without human intervention.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR` (`journalctl -p warning`). Drops debug noise and skips events older than 24 hours.
|
||||
- **State Tracking & Deduplication**: Maintains persistent client state in `client_state.json` (tracking systemd journalctl cursors and microsecond timestamps) so every log record is forwarded exactly once without duplicates.
|
||||
- **Fleet Seat Accounting & License Revocation**: Each enrolled client consumes 1 seat from the hub's master license. If revoked by an administrator via the hub WebUI, socket connections are immediately dropped and blocked until reactivated.
|
||||
- **Dynamic Seat Expansion & Automatic Hub Synchronization**: The forwarder benefits from the hub's dynamic seat quota expansion; as the hub's license seats are increased and synced with the master authority (`logar.eibl.tech`), edge capacity expands automatically without requiring forwarder configuration changes.
|
||||
- **Master Authority High Availability (Portainer GitOps)**: The authoritative license server at `logar.eibl.tech` runs containerized via Portainer GitOps with automated pipeline builds, ensuring high availability for client seat verification and renewals.
|
||||
|
||||
---
|
||||
|
||||
## 1. Automated Installation via Script (Recommended)
|
||||
|
||||
Run the automated installer script:
|
||||
```bash
|
||||
sudo ./compilation/install_linux_client.sh "http://<HUB_HOST>:8443" "<ENROLLMENT_SECRET>"
|
||||
```
|
||||
This script:
|
||||
1. Installs the binary to `/opt/logar-client/Linux_Client`.
|
||||
2. Creates `/etc/logar/certs` with strict permissions.
|
||||
3. Automatically queries `/etc/machine-id` and enrolls with the hub via `curl`.
|
||||
4. Deploys, enables, and starts the systemd service unit `/etc/systemd/system/logar-client.service`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating & Deploying the Configuration File
|
||||
|
||||
### Step 1: Generate `client_config.json` on the Server
|
||||
Run the following command on your central LOGAR server:
|
||||
```bash
|
||||
python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
- Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.
|
||||
- Default mTLS socket port is `9443`; Hermes REST API port is `8443`.
|
||||
|
||||
### Step 2: Configuration Structure
|
||||
The generated `client_config.json` contains:
|
||||
```json
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"hermes_host": "192.168.1.100",
|
||||
"hermes_port": 8443,
|
||||
"enrollment_secret": "a1b2c3d4e5f6...",
|
||||
"cert_dir": "certs",
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"auth_token": "a1b2c3d4e5f6..."
|
||||
}
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The configuration contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
|
||||
### Step 3: Copy to Edge Node
|
||||
Place `Linux_Client.bin` and `client_config.json` into the target directory (e.g. `/opt/logar/`):
|
||||
```bash
|
||||
sudo mkdir -p /opt/logar
|
||||
sudo cp Linux_Client.bin client_config.json /opt/logar/
|
||||
sudo chmod +x /opt/logar/Linux_Client.bin
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Running Manually
|
||||
|
||||
Test the forwarder interactively:
|
||||
```bash
|
||||
cd /opt/logar
|
||||
./Linux_Client.bin --hours 24
|
||||
```
|
||||
On first run, the client contacts `http://<hermes_host>:<hermes_port>/api/client/enroll`, downloads `ca.crt`, `client.crt`, and `client.key` into `certs/`, and streams logs over mTLS.
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Default | Description |
|
||||
| :--- | :--- | :--- |
|
||||
| `--config` | `client_config.json` | Path to client configuration file |
|
||||
| `--hours` | `24` | Lookback window in hours for journal logs |
|
||||
| `--state-file` | `client_state.json` | Path to persistent state file |
|
||||
| `--no-state` | `False` | Disable state tracking and send all events matching lookback window |
|
||||
|
||||
---
|
||||
|
||||
## 4. Manual Systemd Service & Timer Setup
|
||||
|
||||
### Step 1: Create the Systemd Service Unit
|
||||
Create `/etc/systemd/system/logar-client.service`:
|
||||
```ini
|
||||
[Unit]
|
||||
Description=LOGAR Edge Log Forwarder
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/logar
|
||||
ExecStart=/opt/logar/Linux_Client.bin --hours 24
|
||||
Restart=always
|
||||
RestartSec=5s
|
||||
User=root
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
### Step 2: Enable and Start the Service
|
||||
```bash
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now logar-client.service
|
||||
```
|
||||
|
||||
### Step 3: Check Logs
|
||||
```bash
|
||||
sudo journalctl -u logar-client.service -n 50 -f
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Uninstallation & Removal
|
||||
|
||||
```bash
|
||||
sudo systemctl disable --now logar-client.service
|
||||
sudo rm -f /etc/systemd/system/logar-client.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo rm -rf /opt/logar-client /opt/logar /etc/logar
|
||||
```
|
||||
@@ -1,7 +0,0 @@
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"server_fingerprint": "PASTE_SERVER_FINGERPRINT_HERE",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...\n-----END PGP PUBLIC KEY BLOCK-----\n",
|
||||
"auth_token": "PASTE_AUTH_TOKEN_HERE"
|
||||
}
|
||||
@@ -1,160 +0,0 @@
|
||||
# LOGAR Linux Server Hub
|
||||
|
||||
Standalone compiled binary and automated systemd service distribution for Linux server environments (`Server.bin`).
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
`Server.bin` is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination, log analysis, dynamic PKI, and reporting hub of the LOGAR telemetry architecture.
|
||||
|
||||
### Key Architecture & Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
|
||||
- **Master License Authority (`logar.eibl.tech`) & Seat-Bearing CA**: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID `1.3.6.1.4.1.59999.1.1`.
|
||||
- **Zero-Touch mTLS Renewals**: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with `https://logar.eibl.tech/api/license/renew` when nearing expiration (< 30 days).
|
||||
- **Fleet Management & WebUI Dashboard (Port 8443)**: Modern browser WebUI accessible at `http://localhost:8443/webui` to monitor seat quotas, export `.lic` request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
|
||||
- **Direct Hermes Intelligence & Temporal Telemetry**: All ingested actionable anomalies (`WARNING`, `ERROR`, `INFO`) are immediately promoted to `VERIFIED` and surfaced directly to Hermes with rich temporal metadata (run counts, timestamps) across a rolling 12-hour evaluation window, allowing Hermes AI to perform all contextual reasoning and decisions.
|
||||
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
||||
|
||||
---
|
||||
|
||||
## 1. Automated Installation via Script (Recommended)
|
||||
|
||||
Deploy using the automated installer:
|
||||
```bash
|
||||
sudo ./compilation/install_linux_server.sh
|
||||
```
|
||||
This script:
|
||||
1. Installs the server binary to `/opt/logar-server/Server`.
|
||||
2. Creates `/etc/logar` and `/var/log/logar`.
|
||||
3. Deploys, enables, and starts the systemd service unit `/etc/systemd/system/logar-server.service` with `LimitNOFILE=65536`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Initializing & Generating Server Configuration
|
||||
|
||||
### Step 1: Automatic First-Run Generation
|
||||
When launched without an existing `server_config.json`, `Server.bin` automatically generates:
|
||||
1. An internal Root CA (`certs/ca.crt` and `certs/ca.key`).
|
||||
2. A server TLS certificate (`certs/server.crt` and `certs/server.key`) with SANs.
|
||||
3. An OpenPGP RSA-2048 keypair (`private_key` and `public_key`).
|
||||
4. Cryptographically random authentication tokens and enrollment secrets.
|
||||
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).
|
||||
|
||||
Run `Server.bin` once to initialize:
|
||||
```bash
|
||||
./Server.bin
|
||||
```
|
||||
Output:
|
||||
```
|
||||
[!] Config 'server_config.json' not found. Initializing first-run configuration...
|
||||
[+] Successfully generated new server config and OpenPGP keypair.
|
||||
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
[+] Saved to: server_config.json
|
||||
============================================================
|
||||
LOGAR Server Hub: LOGAR-Cloud-Hub
|
||||
Transport Security: mTLS (TLS 1.3)
|
||||
License Quota: 10 Active Seats
|
||||
Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
Evaluation Window: 12 hours | Direct Hermes Reasoning Enabled
|
||||
============================================================
|
||||
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
|
||||
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
|
||||
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll
|
||||
```
|
||||
|
||||
### Step 2: Configuration Fields Reference
|
||||
The generated `server_config.json` contains:
|
||||
```json
|
||||
{
|
||||
"server_name": "LOGAR-Linux-Hub",
|
||||
"tcp_host": "0.0.0.0",
|
||||
"tcp_port": 9443,
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
|
||||
"enrollment_secret": "e1f2a3b4c5d6...",
|
||||
"max_seats": 10,
|
||||
"cert_dir": "certs",
|
||||
"tls_enabled": true,
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 1,
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Exporting Client Configurations
|
||||
|
||||
Generate a client configuration bundle to deploy onto Windows or Linux forwarders:
|
||||
```bash
|
||||
./Server.bin --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.
|
||||
|
||||
---
|
||||
|
||||
## 4. Fleet Licensing, .lic Files & WebUI Dashboard
|
||||
|
||||
### Accessing the WebUI
|
||||
Open your browser and navigate to:
|
||||
```
|
||||
http://<SERVER_IP>:8443/webui
|
||||
```
|
||||
The WebUI provides:
|
||||
1. **Real-time Seat Quota Meter**: Visual meter displaying active clients against approved seat quota.
|
||||
2. **Export .lic Request**: 1-click download of `logar_server.lic` containing your Subordinate CA CSR and machine fingerprint for `logar.eibl.tech`.
|
||||
3. **Import License (.lic / ca.crt)**: Modal to paste or upload the activated `.lic` package or `ca.crt` issued by `logar.eibl.tech`. Activating updates your seat limit immediately and reloads mTLS context in-flight.
|
||||
4. **Sync & Renew via mTLS**: Button to test or trigger immediate mTLS renewal against `logar.eibl.tech` and pull seat quota increases without restart.
|
||||
5. **Client Seat Management**: View all enrolled nodes; click **Revoke Seat** to immediately drop and block an edge node at the socket layer, or **Reactivate** to restore access.
|
||||
|
||||
### CLI Licensing Utilities
|
||||
Export a `.lic` request file via CLI:
|
||||
```bash
|
||||
./Server.bin --export-lic server.lic
|
||||
```
|
||||
Import an activated `.lic` license package or signed CA certificate via CLI:
|
||||
```bash
|
||||
./Server.bin --import-lic activated.lic
|
||||
# Or alternatively with --import-ca:
|
||||
./Server.bin --import-ca ca.crt
|
||||
```
|
||||
Synchronize license and check for seat quota increases against the master authority:
|
||||
```bash
|
||||
./Server.bin --sync-license
|
||||
```
|
||||
|
||||
### Upstream Authority Deployment (Portainer GitOps & Reverse Proxy)
|
||||
The upstream Master License Authority service (`logar.eibl.tech`) is compiled and deployed via Portainer GitOps from the [`LOGAR-LICENSING`](https://gitea.eibl.tech/me0nline/LOGAR-LICENSING.git) repository, running from `gitea.eibl.tech/me0nline/logar-licensing:latest` with automated pipeline compilation and persistent volume storage. Public traffic passes through a reverse proxy (e.g., Nginx Proxy Manager with **Websockets Support** enabled), handling WebSocket licensing handshakes (`wss://logar.eibl.tech/ws/license`), multi-tenant fleet isolation, user management, and authenticated WebUI dashboard access.
|
||||
|
||||
---
|
||||
|
||||
## 5. Manual Systemd Service Management
|
||||
|
||||
Check service status:
|
||||
```bash
|
||||
sudo systemctl status logar-server.service
|
||||
```
|
||||
|
||||
Inspect live service logs:
|
||||
```bash
|
||||
sudo journalctl -u logar-server.service -f -n 50
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Uninstallation & Removal
|
||||
|
||||
```bash
|
||||
sudo systemctl disable --now logar-server.service
|
||||
sudo rm -f /etc/systemd/system/logar-server.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo rm -rf /opt/logar-server /etc/logar /var/log/logar
|
||||
```
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
{
|
||||
"server_name": "LOGAR-Linux-Hub",
|
||||
"tcp_host": "0.0.0.0",
|
||||
"tcp_port": 9443,
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "replace_with_secure_random_hex_token",
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 4,
|
||||
"server_fingerprint": "AUTO_GENERATED_ON_FIRST_RUN",
|
||||
"public_key": "AUTO_GENERATED_ON_FIRST_RUN",
|
||||
"private_key": "AUTO_GENERATED_ON_FIRST_RUN"
|
||||
}
|
||||
@@ -1,134 +0,0 @@
|
||||
# LOGAR Windows Edge Forwarder
|
||||
|
||||
Standalone compiled executable and installer distribution for Windows Server and workstation environments.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
`Win_Client.exe` is a self-contained executable that queries the Windows Application Event Log, filters candidate events at the source, auto-enrolls with the central LOGAR hub to receive signed mTLS certificates, and streams records over mutual TLS 1.3 (**mTLS**) socket connection.
|
||||
|
||||
### Key Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone native Windows executable (`Win_Client.exe`) or full installer (`LOGAR-Client-Setup.exe`). No Python installation, pip packages, or GnuPG binaries are required on the host.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion**: Streams directly over hardware-authenticated TLS 1.3 sockets with hardware/machine-bound client certificates.
|
||||
- **Automated Client Enrollment**: On first run with an `enrollment_secret`, the client automatically calls `POST /api/client/enroll` on the hub, saves its certificates into `certs/`, and establishes secure mTLS streaming.
|
||||
- **Proactive Expiry Check & Reactive Self-Healing**: Before each run, the client evaluates `client.crt` validity. If within 30 days of expiry, it automatically contacts the hub to renew certificates. If the server Root CA rotates or a TLS handshake error occurs, the client catch-heals by re-enrolling immediately and re-establishing connection without human intervention.
|
||||
- **Source-Level Filtering**: Retains events spanning `INFO`, `WARNING`, and `ERROR`. Strips audit events and debug noise, skipping events older than 24 hours.
|
||||
- **State Tracking & Deduplication**: Maintains persistent client state in `client_state.json` (tracking event record numbers and timestamp signatures) so every log record is forwarded exactly once without duplicates.
|
||||
- **Fleet Seat Accounting & License Revocation**: Each enrolled client consumes 1 seat from the hub's master license. If revoked by an administrator via the hub WebUI, socket connections are immediately dropped and blocked until reactivated.
|
||||
- **Dynamic Seat Expansion & Automatic Hub Synchronization**: The forwarder benefits from the hub's dynamic seat quota expansion; as the hub's license seats are increased and synced with the master authority (`logar.eibl.tech`), edge capacity expands automatically without requiring forwarder configuration changes.
|
||||
- **Master Authority High Availability (Portainer GitOps)**: The authoritative license server at `logar.eibl.tech` runs containerized via Portainer GitOps with automated pipeline builds, ensuring high availability for client seat verification and renewals.
|
||||
|
||||
---
|
||||
|
||||
## 1. Automated Installation via Inno Setup (Recommended)
|
||||
|
||||
Run the self-contained installer built from `compilation/installer_client.iss`:
|
||||
```powershell
|
||||
.\LOGAR-Client-Setup.exe
|
||||
```
|
||||
This installer:
|
||||
1. Installs `Win_Client.exe` and bundled `nssm.exe` to `C:\Program Files\LOGAR\`.
|
||||
2. Sets up directory permissions in `C:\ProgramData\LOGAR\`.
|
||||
3. Registers and starts the `LOGAR_Client` Windows service automatically via NSSM.
|
||||
4. Redirects stdout and stderr logs to `C:\ProgramData\LOGAR\client.log` and `client_err.log`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Generating & Deploying the Configuration File
|
||||
|
||||
### Step 1: Generate `client_config.json` on the Server
|
||||
Run the following command on your central LOGAR server:
|
||||
```bash
|
||||
python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
- Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.
|
||||
- Default mTLS socket port is `9443`; Hermes REST API port is `8443`.
|
||||
|
||||
### Step 2: Configuration Structure
|
||||
The generated `client_config.json` contains:
|
||||
```json
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"hermes_host": "192.168.1.100",
|
||||
"hermes_port": 8443,
|
||||
"enrollment_secret": "a1b2c3d4e5f6...",
|
||||
"cert_dir": "certs",
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"auth_token": "a1b2c3d4e5f6..."
|
||||
}
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The configuration contains **no host-specific names or site names** to ensure client anonymity and easy redistribution.
|
||||
|
||||
### Step 3: Copy to Edge Node
|
||||
Place `client_config.json` next to `Win_Client.exe` (e.g. `C:\Program Files\LOGAR\` or `C:\LOGAR\`):
|
||||
```powershell
|
||||
New-Item -ItemType Directory -Path "C:\LOGAR" -Force
|
||||
Copy-Item "Win_Client.exe", "client_config.json" -Destination "C:\LOGAR\"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Running Manually
|
||||
|
||||
Test the forwarder interactively from PowerShell or Command Prompt:
|
||||
```powershell
|
||||
cd C:\LOGAR
|
||||
.\Win_Client.exe --hours 24
|
||||
```
|
||||
On first run, the client contacts `http://<hermes_host>:<hermes_port>/api/client/enroll`, downloads `ca.crt`, `client.crt`, and `client.key` into `certs/`, and streams logs over mTLS.
|
||||
|
||||
### Command-Line Arguments
|
||||
| Argument | Default | Description |
|
||||
| :--- | :--- | :--- |
|
||||
| `--config` | `client_config.json` | Path to client configuration file |
|
||||
| `--hours` | `24` | Lookback window in hours for event logs |
|
||||
| `--state-file` | `client_state.json` | Path to persistent state tracking file |
|
||||
| `--no-state` | `False` | Disable state tracking and send all events matching lookback window |
|
||||
|
||||
---
|
||||
|
||||
## 4. Manual Service Installation (NSSM or Scheduled Task)
|
||||
|
||||
### Method A: Windows Service via Bundled NSSM
|
||||
```powershell
|
||||
# From the compilation directory or with bundled nssm.exe:
|
||||
.\nssm.exe install LOGAR_Client "C:\LOGAR\Win_Client.exe" "--hours 24"
|
||||
.\nssm.exe set LOGAR_Client AppDirectory "C:\LOGAR"
|
||||
.\nssm.exe set LOGAR_Client AppStdout "C:\ProgramData\LOGAR\client.log"
|
||||
.\nssm.exe set LOGAR_Client AppStderr "C:\ProgramData\LOGAR\client_err.log"
|
||||
.\nssm.exe start LOGAR_Client
|
||||
```
|
||||
|
||||
### Method B: Windows Scheduled Task via PowerShell
|
||||
```powershell
|
||||
$Action = New-ScheduledTaskAction -Execute "C:\LOGAR\Win_Client.exe" -Argument "--hours 24" -WorkingDirectory "C:\LOGAR"
|
||||
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 3)
|
||||
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 15)
|
||||
|
||||
Register-ScheduledTask -TaskName "LOGAR_Forwarder" `
|
||||
-Action $Action `
|
||||
-Trigger $Trigger `
|
||||
-Settings $Settings `
|
||||
-User "NT AUTHORITY\SYSTEM" `
|
||||
-RunLevel Highest `
|
||||
-Description "LOGAR Windows Edge Log Forwarder Service"
|
||||
|
||||
Start-ScheduledTask -TaskName "LOGAR_Forwarder"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Uninstallation
|
||||
|
||||
If installed via the Inno Setup installer, use **Windows Add/Remove Programs** or run `unins000.exe` in `C:\Program Files\LOGAR\`.
|
||||
|
||||
If installed manually via NSSM:
|
||||
```powershell
|
||||
.\nssm.exe stop LOGAR_Client
|
||||
.\nssm.exe remove LOGAR_Client confirm
|
||||
Remove-Item -Recurse -Force "C:\LOGAR"
|
||||
```
|
||||
@@ -1,7 +0,0 @@
|
||||
{
|
||||
"server_host": "192.168.1.100",
|
||||
"server_port": 9443,
|
||||
"server_fingerprint": "PASTE_SERVER_FINGERPRINT_HERE",
|
||||
"server_public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...\n-----END PGP PUBLIC KEY BLOCK-----\n",
|
||||
"auth_token": "PASTE_AUTH_TOKEN_HERE"
|
||||
}
|
||||
@@ -1,159 +0,0 @@
|
||||
# LOGAR Windows Server Hub
|
||||
|
||||
Standalone compiled executable and installer distribution for Windows Server environments (`Server.exe`).
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
`Server.exe` is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, dynamic PKI certificate authority, and reporting hub of the LOGAR infrastructure.
|
||||
|
||||
### Key Architecture & Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone Windows executable (`Server.exe`) or full installer (`LOGAR-Server-Setup.exe`). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
|
||||
- **Master License Authority (`logar.eibl.tech`) & Seat-Bearing CA**: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID `1.3.6.1.4.1.59999.1.1`.
|
||||
- **Zero-Touch mTLS Renewals**: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with `https://logar.eibl.tech/api/license/renew` when nearing expiration (< 30 days).
|
||||
- **Fleet Management & WebUI Dashboard (Port 8443)**: Modern browser WebUI accessible at `http://localhost:8443/webui` to monitor seat quotas, export `.lic` request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
|
||||
- **Direct Hermes Intelligence & Temporal Telemetry**: All ingested actionable anomalies (`WARNING`, `ERROR`, `INFO`) are immediately promoted to `VERIFIED` and surfaced directly to Hermes with rich temporal metadata (run counts, timestamps) across a rolling 12-hour evaluation window, allowing Hermes AI to perform all contextual reasoning and decisions.
|
||||
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
||||
|
||||
---
|
||||
|
||||
## 1. Automated Installation via Inno Setup (Recommended)
|
||||
|
||||
Run the self-contained installer built from `compilation/installer_server.iss`:
|
||||
```powershell
|
||||
.\LOGAR-Server-Setup.exe
|
||||
```
|
||||
This installer:
|
||||
1. Installs `Server.exe` and bundled `nssm.exe` to `C:\Program Files\LOGAR-Server\`.
|
||||
2. Registers and starts the `LOGAR_Server` Windows service automatically via NSSM.
|
||||
3. Redirects stdout and stderr logs to `C:\ProgramData\LOGAR-Server\server.log` and `server_err.log`.
|
||||
|
||||
---
|
||||
|
||||
## 2. Initializing & Generating Server Configuration
|
||||
|
||||
### Step 1: Automatic First-Run Generation
|
||||
When launched without an existing `server_config.json`, `Server.exe` automatically initializes:
|
||||
1. An internal Root CA (`certs/ca.crt` and `certs/ca.key`).
|
||||
2. A server TLS certificate (`certs/server.crt` and `certs/server.key`) with SANs.
|
||||
3. An OpenPGP RSA-2048 keypair (`private_key` and `public_key`).
|
||||
4. Cryptographically random authentication tokens and enrollment secrets.
|
||||
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).
|
||||
|
||||
Open PowerShell and run:
|
||||
```powershell
|
||||
.\Server.exe
|
||||
```
|
||||
Output:
|
||||
```
|
||||
[!] Config 'server_config.json' not found. Initializing first-run configuration...
|
||||
[+] Successfully generated new server config and OpenPGP keypair.
|
||||
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
[+] Saved to: server_config.json
|
||||
============================================================
|
||||
LOGAR Server Hub: LOGAR-Cloud-Hub
|
||||
Transport Security: mTLS (TLS 1.3)
|
||||
License Quota: 10 Active Seats
|
||||
Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
|
||||
Evaluation Window: 12 hours | Direct Hermes Reasoning Enabled
|
||||
============================================================
|
||||
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
|
||||
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
|
||||
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll
|
||||
```
|
||||
|
||||
### Step 2: Configuration Fields Reference
|
||||
The generated `server_config.json` contains:
|
||||
```json
|
||||
{
|
||||
"server_name": "LOGAR-Windows-Hub",
|
||||
"tcp_host": "0.0.0.0",
|
||||
"tcp_port": 9443,
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
|
||||
"enrollment_secret": "e1f2a3b4c5d6...",
|
||||
"max_seats": 10,
|
||||
"cert_dir": "certs",
|
||||
"tls_enabled": true,
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 1,
|
||||
"server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
|
||||
"public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
|
||||
"private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Exporting Client Configurations
|
||||
|
||||
Generate a client configuration bundle to deploy onto Windows or Linux forwarders:
|
||||
```powershell
|
||||
.\Server.exe --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json
|
||||
```
|
||||
The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.
|
||||
|
||||
---
|
||||
|
||||
## 4. Fleet Licensing, .lic Files & WebUI Dashboard
|
||||
|
||||
### Accessing the WebUI
|
||||
Open your browser and navigate to:
|
||||
```
|
||||
http://localhost:8443/webui
|
||||
```
|
||||
The WebUI provides:
|
||||
1. **Real-time Seat Quota Meter**: Visual meter displaying active clients against approved seat quota.
|
||||
2. **Export .lic Request**: 1-click download of `logar_server.lic` containing your Subordinate CA CSR and machine fingerprint for `logar.eibl.tech`.
|
||||
3. **Import License (.lic / ca.crt)**: Modal to paste or upload the activated `.lic` package or `ca.crt` issued by `logar.eibl.tech`. Activating updates your seat limit immediately and reloads mTLS context in-flight.
|
||||
4. **Sync & Renew via mTLS**: Button to test or trigger immediate mTLS renewal against `logar.eibl.tech` and pull seat quota increases without restart.
|
||||
5. **Client Seat Management**: View all enrolled nodes; click **Revoke Seat** to immediately drop and block an edge node at the socket layer, or **Reactivate** to restore access.
|
||||
|
||||
### CLI Licensing Utilities
|
||||
Export a `.lic` request file via CLI:
|
||||
```powershell
|
||||
.\Server.exe --export-lic C:\LOGAR-Server\server.lic
|
||||
```
|
||||
Import an activated `.lic` license package or signed CA certificate via CLI:
|
||||
```powershell
|
||||
.\Server.exe --import-lic C:\LOGAR-Server\activated.lic
|
||||
# Or alternatively with --import-ca:
|
||||
.\Server.exe --import-ca C:\LOGAR-Server\ca.crt
|
||||
```
|
||||
Synchronize license and check for seat quota increases against the master authority:
|
||||
```powershell
|
||||
.\Server.exe --sync-license
|
||||
```
|
||||
|
||||
### Upstream Authority Deployment (Portainer GitOps & Reverse Proxy)
|
||||
The upstream Master License Authority service (`logar.eibl.tech`) is compiled and deployed via Portainer GitOps from the [`LOGAR-LICENSING`](https://gitea.eibl.tech/me0nline/LOGAR-LICENSING.git) repository, running from `gitea.eibl.tech/me0nline/logar-licensing:latest` with automated pipeline compilation and persistent volume storage. Public traffic passes through a reverse proxy (e.g., Nginx Proxy Manager with **Websockets Support** enabled), handling WebSocket licensing handshakes (`wss://logar.eibl.tech/ws/license`), multi-tenant fleet isolation, user management, and authenticated WebUI dashboard access.
|
||||
|
||||
---
|
||||
|
||||
## 5. Manual Windows Service Setup (via NSSM)
|
||||
|
||||
```powershell
|
||||
.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
|
||||
.\nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
|
||||
.\nssm.exe set LOGAR_Server AppStdout "C:\ProgramData\LOGAR-Server\server.log"
|
||||
.\nssm.exe set LOGAR_Server AppStderr "C:\ProgramData\LOGAR-Server\server_err.log"
|
||||
.\nssm.exe start LOGAR_Server
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Uninstallation
|
||||
|
||||
If installed via the Inno Setup installer, use **Windows Add/Remove Programs**.
|
||||
|
||||
If installed manually via NSSM:
|
||||
```powershell
|
||||
.\nssm.exe stop LOGAR_Server
|
||||
.\nssm.exe remove LOGAR_Server confirm
|
||||
```
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
{
|
||||
"server_name": "LOGAR-Windows-Hub",
|
||||
"tcp_host": "0.0.0.0",
|
||||
"tcp_port": 9443,
|
||||
"hermes_host": "0.0.0.0",
|
||||
"hermes_port": 8443,
|
||||
"auth_token": "replace_with_secure_random_hex_token",
|
||||
"db_path": "logar_state.db",
|
||||
"evaluation_window_hours": 12,
|
||||
"min_persistence_runs": 4,
|
||||
"server_fingerprint": "AUTO_GENERATED_ON_FIRST_RUN",
|
||||
"public_key": "AUTO_GENERATED_ON_FIRST_RUN",
|
||||
"private_key": "AUTO_GENERATED_ON_FIRST_RUN"
|
||||
}
|
||||
@@ -1,163 +0,0 @@
|
||||
# LOGAR Brand Identity & Design Guide
|
||||
|
||||
> **Official Design System & Visual Identity Standards for LOGAR**
|
||||
> *Fleet Log Aggregation, PKI Fleet Licensing & Centralized Telemetry Provisioning Hub*
|
||||
|
||||
---
|
||||
|
||||
## 1. Brand Identity & Positioning
|
||||
|
||||
**LOGAR** is an enterprise log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It connects lightweight, zero-state edge forwarders to a centralized hub that enforces mutual TLS 1.3 (**mTLS**), cryptographic seat leasing, rolling 12-hour temporal persistence tracking, and direct anomaly streaming to **Hermes AI**.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["Edge Forwarders<br/>(Win & Linux)"] -->|mTLS 1.3 Stream| B["LOGAR Server Hub<br/>(Central Aggregator)"]
|
||||
B -->|Verified Telemetry| C["Hermes AI<br/>(Deep Reasoning Engine)"]
|
||||
D["License Authority<br/>(Master PKI)"] <==>|WebSocket Quota| B
|
||||
```
|
||||
|
||||
### Brand Positioning Rules:
|
||||
* **Log Aggregator & Telemetry Hub**: LOGAR is a high-throughput, zero-state log aggregation, filtering, and telemetry provisioning hub.
|
||||
* **Strict Naming Constraint**: **LOGAR is NOT a SIEM** (Security Information and Event Management) system. It does not provide intrusion detection, security rule engines, or threat intelligence feeds. Never describe LOGAR as a SIEM in documentation, user interfaces, installer scripts, or promotional material.
|
||||
|
||||
---
|
||||
|
||||
## 2. Logo Anatomy & Symbolism
|
||||
|
||||
The LOGAR emblem combines cybersecurity aesthetics with real-time log streaming geometry:
|
||||
|
||||
<p align="center">
|
||||
<img src="../assets/logo_banner.svg" alt="LOGAR Banner" width="600"/>
|
||||
</p>
|
||||
|
||||
```
|
||||
/\ [ Hexagon Shield: PKI Cryptographic Integrity ]
|
||||
/ \
|
||||
/ \ [ Left 'L' Pillar: Zero-State Forwarder Pipeline ]
|
||||
| || |
|
||||
| ||. | [ Stepped Telemetry Bars: Structured Log Stream ]
|
||||
| |___|
|
||||
\ / [ Spark Points: Dynamic Seat Sync & Handshake ]
|
||||
\ /
|
||||
\/
|
||||
```
|
||||
|
||||
### Key Components:
|
||||
1. **Hexagonal Shield**: Represents mutual TLS 1.3 cryptographic verification and authoritative PKI trust boundaries.
|
||||
2. **The Stylized 'L' Glyph**: Represents the high-performance forwarder pipeline and log ingestion stream.
|
||||
3. **Stepped Telemetry Bars**: Depicts normalized structured log records propagating from edge forwarders to the central temporal engine.
|
||||
4. **Spark & Sync Points**: Visualizes live WebSocket connection nodes and mTLS handshake synchronization.
|
||||
|
||||
---
|
||||
|
||||
## 3. Official Color Palette
|
||||
|
||||
LOGAR uses a cyber-slate and neon telemetry palette designed for high contrast in dark mode environments, with seamless light-mode compatibility for native operating system dialogs and installer wizards.
|
||||
|
||||
### Primary Colors
|
||||
|
||||
| Swatch | Color Name | Hex Code | RGB | HSL | Usage |
|
||||
| :--- | :--- | :--- | :--- | :--- | :--- |
|
||||
|  | **Cyber Cyan** | `#00E5FF` | `0, 229, 255` | `186°, 100%, 50%` | Primary brand accent, glowing telemetry lines, active links, primary CTA buttons |
|
||||
|  | **Emerald Pulse** | `#00FFA3` | `0, 255, 163` | `158°, 100%, 50%` | Healthy node indicators, approved client seats, online PKI status, success badges |
|
||||
|  | **Electric Blue** | `#0072FF` | `0, 114, 255` | `213°, 100%, 50%` | Gradient stop with Cyber Cyan, secondary action highlights |
|
||||
|  | **Dark Navy** | `#0E1A2E` | `14, 26, 46` | `218°, 53%, 12%` | Emblem background, card surfaces, modal dialogs |
|
||||
|  | **Midnight Slate**| `#070C18` | `7, 12, 24` | `222°, 55%, 6%` | Application canvas background, dark-mode body |
|
||||
|
||||
### Semantic & Status Colors
|
||||
|
||||
| Swatch | Color Name | Hex Code | RGB | Usage |
|
||||
| :--- | :--- | :--- | :--- | :--- |
|
||||
|  | **Crimson Alert** | `#EF4444` | `239, 68, 68` | Critical anomalies, revoked seats, connection errors |
|
||||
|  | **Amber Warning** | `#F59E0B` | `245, 158, 11` | Pending enrollment approvals, seat quota thresholds (>85%) |
|
||||
|  | **Text Muted** | `#94A3B8` | `148, 163, 184` | Table headers, secondary descriptions, timestamps |
|
||||
|  | **Pure White** | `#FFFFFF` | `255, 255, 255` | Installer header background, text on dark cards |
|
||||
|
||||
---
|
||||
|
||||
## 4. Typography System
|
||||
|
||||
LOGAR uses clean, modern sans-serif typography for user interfaces and clear monospace fonts for log telemetry and cryptographic fingerprints.
|
||||
|
||||
### Monospace (Telemetry, Fingerprints & Code)
|
||||
* **Primary**: `'JetBrains Mono', 'Fira Code', 'Cascadia Code', Consolas, monospace`
|
||||
* **Usage**: Raw log frames, JSON schemas, X.509 serials, SHA-256 fingerprints, port mappings, command-line snippets.
|
||||
|
||||
### Interface Sans-Serif (WebUI & Marketing)
|
||||
* **Primary**: `-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif`
|
||||
* **Usage**: Headings, navigation bars, modal forms, buttons, dashboard metrics.
|
||||
|
||||
### Type Scale
|
||||
* **Hero Title**: `48px` - `56px` / Bold (900) / Tracking: `-0.02em`
|
||||
* **Page Header (H1)**: `24px` - `32px` / Extra Bold (800)
|
||||
* **Section Title (H2)**: `20px` - `24px` / Bold (700)
|
||||
* **Card Header (H3)**: `16px` - `18px` / Semi-Bold (600)
|
||||
* **Body Text**: `14px` - `15px` / Regular (400) / Line Height: `1.6`
|
||||
* **Code / Badges / Monospace**: `12px` - `13px` / Medium (500)
|
||||
|
||||
---
|
||||
|
||||
## 5. Asset Library Inventory
|
||||
|
||||
All brand visual assets are maintained in the central [`assets/`](../assets/) directory:
|
||||
|
||||
| Filename | Format | Dimensions | Purpose |
|
||||
| :--- | :--- | :--- | :--- |
|
||||
| [`logo.svg`](../assets/logo.svg) | SVG | Vector | Full emblem with dark shield background |
|
||||
| [`logo_transparent.svg`](../assets/logo_transparent.svg) | SVG | Vector | **Primary WebUI Emblem**: Transparent background for headers, tabs, and light/dark themes |
|
||||
| [`logo_dark.svg`](../assets/logo_dark.svg) | SVG | Vector | Shield emblem optimized for dark mode backgrounds |
|
||||
| [`logo_banner.svg`](../assets/logo_banner.svg) | SVG | 960x240 | Wide brand banner with emblem, typography, and tagline |
|
||||
| [`logo.png`](../assets/logo.png) | PNG (RGBA) | 512x512 | High-resolution master raster asset |
|
||||
| [`logo_256x256.png`](../assets/logo_256x256.png) | PNG (RGBA) | 256x256 | App icon and README graphics |
|
||||
| [`logo_128x128.png`](../assets/logo_128x128.png) | PNG (RGBA) | 128x128 | Medium display icon |
|
||||
| [`logo_64x64.png`](../assets/logo_64x64.png) | PNG (RGBA) | 64x64 | Small UI asset |
|
||||
| [`logo_32x32.png`](../assets/logo_32x32.png) | PNG (RGBA) | 32x32 | Standard favicon raster |
|
||||
| [`logo_16x16.png`](../assets/logo_16x16.png) | PNG (RGBA) | 16x16 | Small favicon raster |
|
||||
| [`logo.ico`](../assets/logo.ico) | ICO | Multi (16-256) | Windows executable icon & installer icon |
|
||||
| [`favicon.ico`](../assets/favicon.ico) | ICO | Multi (16-256) | WebUI dashboard favicon |
|
||||
| [`wizard_header.bmp`](../assets/wizard_header.bmp) | BMP (24-bit) | 150x57 | Inno Setup & NSIS top header bitmap (white background) |
|
||||
| [`wizard_small.bmp`](../assets/wizard_small.bmp) | BMP (24-bit) | 55x55 | Inno Setup small wizard bitmap |
|
||||
| [`wizard_sidebar.bmp`](../assets/wizard_sidebar.bmp) | BMP (24-bit) | 164x314 | Inno Setup & NSIS welcome wizard sidebar graphic |
|
||||
|
||||
---
|
||||
|
||||
## 6. Logo Usage Guidelines
|
||||
|
||||
### 1. WebUI Navigation & Tabs
|
||||
* **Rule**: Always use the **transparent background vector emblem** (`logo_transparent.svg`) aligned to the **far left** of headers and tab bars.
|
||||
* **Style**: `.logo-icon { background: transparent; box-shadow: none; display: flex; align-items: center; justify-content: center; }`
|
||||
* **Clear Space**: Maintain a minimum margin of `12px` between the logo and adjacent title text.
|
||||
|
||||
### 2. Windows Installers & Native Wizards
|
||||
* **Rule**: The top header banner (`wizard_header.bmp`) uses a pure white background (`#FFFFFF`) with the emblem positioned on the left, blending seamlessly with native Windows wizard backgrounds.
|
||||
* **Sidebar**: The welcome screen uses `wizard_sidebar.bmp` with cyber-navy gradients and pulse log lines.
|
||||
|
||||
### 3. CLI & Linux Setup Scripts
|
||||
* **Rule**: CLI installers output branded cyan/emerald ANSI banners and formatted step indicators:
|
||||
```
|
||||
============================================================
|
||||
LOGAR Fleet Log Aggregation & Centralized Provisioning
|
||||
============================================================
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Dos and Don'ts
|
||||
|
||||
| Do | Don't |
|
||||
| :--- | :--- |
|
||||
| ✅ **DO** use `assets/logo_transparent.svg` for web tabs and navigation bars. | ❌ **DON'T** put a solid dark box behind the logo in web tabs or navbar headers. |
|
||||
| ✅ **DO** refer to LOGAR as a **Log Aggregator** or **Telemetry Hub**. | ❌ **DON'T** refer to LOGAR as a **SIEM** or security monitor. |
|
||||
| ✅ **DO** maintain the SVG aspect ratio (`1:1` for emblem, `4:1` for banner). | ❌ **DON'T** stretch or skew the logo geometry. |
|
||||
| ✅ **DO** use the official Cyber Cyan (`#00E5FF`) and Emerald (`#00FFA3`) accent colors. | ❌ **DON'T** substitute arbitrary neon colors (such as hot pink or bright orange). |
|
||||
| ✅ **DO** link to documentation using standard Gitea Wiki URLs. | ❌ **DON'T** hardcode stale wiki links in installer dialogs. |
|
||||
|
||||
---
|
||||
|
||||
## 8. Regenerating Branding Assets
|
||||
|
||||
To programmatically regenerate all vector, raster, icon, and installer bitmap assets across the codebase:
|
||||
|
||||
```bash
|
||||
python compilation/generate_branding_assets.py
|
||||
```
|
||||
@@ -1,35 +0,0 @@
|
||||
# Impressum / Legal Notice
|
||||
|
||||
Information pursuant to § 5 TMG (German Telemedia Act) and § 18 MStV (German Media State Treaty).
|
||||
|
||||
---
|
||||
|
||||
## Angaben gemäß § 5 TMG / § 18 MStV
|
||||
|
||||
### Diensteanbieter & Betreiber / Service Provider
|
||||
**Maximilian Eibl**
|
||||
Eibl Tech IT-Services
|
||||
Internet: [https://eibl.tech](https://eibl.tech)
|
||||
Repository: [https://gitea.eibl.tech/me0nline/LOGAR](https://gitea.eibl.tech/me0nline/LOGAR)
|
||||
|
||||
### Kontakt / Contact
|
||||
**E-Mail**: `contact@eibl.tech` / `max@eibl.tech`
|
||||
|
||||
### Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV
|
||||
**Maximilian Eibl**
|
||||
eibl.tech
|
||||
|
||||
---
|
||||
|
||||
## Haftungsausschluss / Disclaimer
|
||||
|
||||
### Haftung für Inhalte (Liability for Content)
|
||||
Als Diensteanbieter sind wir gemäß § 7 Abs.1 TMG für eigene Inhalte auf diesen Seiten nach den allgemeinen Gesetzen verantwortlich. Nach §§ 8 bis 10 TMG sind wir als Diensteanbieter jedoch nicht verpflichtet, übermittelte oder gespeicherte fremde Informationen zu überwachen oder nach Umständen zu forschen, die auf eine rechtswidrige Tätigkeit hinweisen.
|
||||
|
||||
### Haftung für Links (Liability for External Links)
|
||||
Unser Angebot enthält Links zu externen Websites Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen. Für die Inhalte der verlinkten Seiten ist stets der jeweilige Anbieter oder Betreiber der Seiten verantwortlich.
|
||||
|
||||
---
|
||||
|
||||
## Urheberrecht & Open-Source-Lizenz (Copyright & Licensing)
|
||||
Die durch die Seitenbetreiber erstellten Inhalte, Quellcodes, Dokumentationen und Marken auf diesen Seiten unterliegen dem Urheberrecht. LOGAR ist ein Open-Source-Projekt und wird unter den Bedingungen der jeweiligen Projektlizenz bereitgestellt.
|
||||
Reference in New Issue
Block a user