docs(win_server): document Master License Authority, WebUI dashboard, and .lic export
This commit is contained in:
@@ -10,11 +10,12 @@ Standalone compiled executable and installer distribution for Windows Server env
|
||||
|
||||
### Key Architecture & Capabilities
|
||||
- **Pre-compiled & Dependency-Free**: Ships as a standalone Windows executable (`Server.exe`) or full installer (`LOGAR-Server-Setup.exe`). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite.
|
||||
- **Dynamic PKI & License Accounting**: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via `POST /api/client/enroll` while enforcing seat limits (`max_seats`).
|
||||
- **In-Flight Certificate Watchdog & Dynamic Reloading**: Continuously monitors Root CA (`ca.crt`) and Server TLS certificate (`server.crt`) validity in the background (every 12 hours). When nearing expiration (< 30 days), certificates are automatically regenerated with timestamped backups, and active `ssl.SSLContext` structures are reloaded dynamically without dropping socket connections or restarting the Windows service.
|
||||
- **Mutual TLS 1.3 (mTLS) Ingestion (Port 9443)**: Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
|
||||
- **Master License Authority (`logar.eibl.tech`) & Seat-Bearing CA**: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID `1.3.6.1.4.1.59999.1.1`.
|
||||
- **Zero-Touch mTLS Renewals**: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with `https://logar.eibl.tech/api/license/renew` when nearing expiration (< 30 days).
|
||||
- **Fleet Management & WebUI Dashboard (Port 8443)**: Modern browser WebUI accessible at `http://localhost:8443/webui` to monitor seat quotas, export `.lic` request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
|
||||
- **Warning Persistence & Immediate Error Routing**: High-severity `ERROR`, `CRITICAL`, and `FATAL` events are promoted to `VERIFIED` immediately on their first occurrence. Operational `WARNING` and `INFO` events require persistence across at least 4 distinct transmission cycles within a rolling 12-hour evaluation window.
|
||||
- **Embedded Hermes Reporting & Management API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report`, `/api/clients`, and `/api/client/enroll`.
|
||||
- **State Database**: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (`logar_state.db`).
|
||||
|
||||
---
|
||||
@@ -99,7 +100,33 @@ The output file contains the server coordinates, enrollment secret, and fingerpr
|
||||
|
||||
---
|
||||
|
||||
## 4. Manual Windows Service Setup (via NSSM)
|
||||
## 4. Fleet Licensing, .lic Files & WebUI Dashboard
|
||||
|
||||
### Accessing the WebUI
|
||||
Open your browser and navigate to:
|
||||
```
|
||||
http://localhost:8443/webui
|
||||
```
|
||||
The WebUI provides:
|
||||
1. **Real-time Seat Quota Meter**: Visual meter displaying active clients against approved seat quota.
|
||||
2. **Export .lic Request**: 1-click download of `logar_server.lic` containing your Subordinate CA CSR and machine fingerprint for `logar.eibl.tech`.
|
||||
3. **Import Signed CA Certificate**: Modal to paste or upload the signed `ca.crt` issued by `logar.eibl.tech`. Activating updates your seat limit immediately and reloads mTLS context in-flight.
|
||||
4. **Trigger mTLS Renewal Now**: Button to test or trigger immediate mTLS renewal against `logar.eibl.tech`.
|
||||
5. **Client Seat Management**: View all enrolled nodes; click **Revoke Seat** to immediately drop and block an edge node at the socket layer, or **Reactivate** to restore access.
|
||||
|
||||
### CLI Licensing Utilities
|
||||
Export a `.lic` request file via CLI:
|
||||
```powershell
|
||||
.\Server.exe --export-lic C:\LOGAR-Server\server.lic
|
||||
```
|
||||
Import a signed CA certificate via CLI:
|
||||
```powershell
|
||||
.\Server.exe --import-ca C:\LOGAR-Server\ca.crt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Manual Windows Service Setup (via NSSM)
|
||||
|
||||
```powershell
|
||||
.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
|
||||
@@ -111,7 +138,7 @@ The output file contains the server coordinates, enrollment secret, and fingerpr
|
||||
|
||||
---
|
||||
|
||||
## 5. Uninstallation
|
||||
## 6. Uninstallation
|
||||
|
||||
If installed via the Inno Setup installer, use **Windows Add/Remove Programs**.
|
||||
|
||||
@@ -120,3 +147,4 @@ If installed manually via NSSM:
|
||||
.\nssm.exe stop LOGAR_Server
|
||||
.\nssm.exe remove LOGAR_Server confirm
|
||||
```
|
||||
|
||||
|
||||
Reference in New Issue
Block a user