From ea2ff1c4a930b15d59c59aa77bcb00001b373358 Mon Sep 17 00:00:00 2001 From: max Date: Sat, 3 Oct 2026 23:11:17 +0200 Subject: [PATCH] feat(ui,docs): add auto_update feature flag integration, UI card, and documentation --- README.md | 38 +++++++++++++++++++++++++++++++++----- src/hub/web_ui.py | 21 ++++++++++++++++++++- 2 files changed, 53 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 7783aaf..989b743 100644 --- a/README.md +++ b/README.md @@ -5,14 +5,14 @@ # LOGAR: Fleet Log Aggregation & Centralized Provisioning System ### *Secure Log Aggregation, PKI Fleet Licensing & Centralized Delivery for Autonomous AI Analysis* -[![Version](https://img.shields.io/badge/version-0.3.5.1-blue.svg)](RELEASE_NOTES.md) -[![Tests](https://img.shields.io/badge/tests-51%20passed-success.svg)](tests/) +[![Version](https://img.shields.io/badge/version-0.3.5.2-blue.svg)](RELEASE_NOTES.md) +[![Tests](https://img.shields.io/badge/tests-94%20passed-success.svg)](tests/) [![Security](https://img.shields.io/badge/mTLS-TLS%201.3-green.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing) [![Admin Guide](https://img.shields.io/badge/wiki-Admin%20Guide-blueviolet.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) -**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making. +**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, fleet auto-update package distribution, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making. -> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**. +> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, fleet package distribution, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**. --- @@ -20,7 +20,8 @@ - **Zero-State Edge Forwarders**: Windows (`Win_Client`) and Linux (`Linux_Client`) agents maintain zero local databases, zero cache files, and minimal memory footprint. - **Mutual TLS 1.3 (`:9443`)**: Enforces bidirectional cryptographic identity verification (`ssl.CERT_REQUIRED`) for all streaming log frames. -- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (e.g. `enterprise_db`) are introspected dynamically. +- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (`enterprise_db`, `auto_update`) are introspected dynamically. +- **Fleet Auto-Update & Binary Distribution**: Centralized local binary distribution point with SHA-256 integrity verification, automated client version negotiation, and background pull orchestrator. - **Multi-Engine Storage Backend**: Switch seamlessly between lightweight local SQLite (WAL mode) and external enterprise databases (PostgreSQL, MySQL, MariaDB) with automated schema migration. - **High-Throughput Ring Buffer**: In-memory ingestion queue with configurable batch flushing to eliminate disk I/O bottlenecks during peak traffic bursts. - **Zero-Knowledge Data Encryption**: End-to-end payload encryption at rest using server X.509 RSA-2048 / OpenPGP keys for external SQL databases. @@ -152,12 +153,39 @@ LOGAR/ - **`POST /api/client/enroll`**: Forwarder auto-enrollment and proactive certificate renewal. - **`GET /api/clients`**: Returns active seat quota and registered edge forwarder telemetry *(Admin Auth)*. +- **`GET /api/client/update/check`**: Evaluates client version and returns upgrade manifest with SHA-256 integrity digest. +- **`GET /api/client/update/download`**: Delivers OS-specific standalone binary packages for forwarder upgrades. - **`GET /api/hermes/report`**: Structured JSON anomaly stream for Hermes AI reasoning. - **`POST /api/license/sync`**: Triggers immediate WebSocket sync with `logar.eibl.tech` *(Admin Auth)*. - **`GET /health`**: Server health, encryption fingerprint, and mTLS status. --- +## Enterprise Feature Capabilities + +LOGAR uses cryptographic X.509 v3 custom extensions embedded inside activated `.lic` intermediate CA certificates issued by the Master Authority: + +| Feature Flag | Capability Name | Description | Default Status | +| :--- | :--- | :--- | :--- | +| **`enterprise_db`** | **External DB & Ingestion Buffer** | Unlocks PostgreSQL/MySQL storage backends, high-throughput in-memory RAM buffering with batch flushing, and OpenPGP zero-knowledge at-rest data encryption. | Enabled by default | +| **`auto_update`** | **Fleet Auto-Update Orchestration** | Enables central repository binary hosting, client version discovery, background update polling, and automated binary hot-upgrades. | Enabled by default | + +--- + +## Fleet Auto-Update & Package Distribution + +LOGAR operates a pull-based fleet package distribution architecture: + +1. **Central Server Repository**: The Server Hub monitors upstream releases and hosts target client binaries (`LOGAR_Client_Setup.exe`, `Linux_Client.bin`) in the local repository (`/opt/logar-server/updates/` or `.\updates\`). +2. **Version Negotiation**: Edge clients periodically contact `GET /api/client/update/check?os=&version=` to compare active versions against the Hub. +3. **Integrity Verification**: Client packages are validated using streaming SHA-256 digests prior to installation or hot-swap. +4. **Client CLI Flags**: + - `--auto-update`: Enables automated background update polling and downloading. + - `--update-check-interval `: Configures update poll frequency (default: 3600s). + - `--check-update-now`: Queries server for available updates and exits. + +--- + ## Testing & Cross-Compilation ```bash diff --git a/src/hub/web_ui.py b/src/hub/web_ui.py index d8c6848..9dcc3d1 100644 --- a/src/hub/web_ui.py +++ b/src/hub/web_ui.py @@ -177,6 +177,7 @@ class WebUIRenderer: summary = LicenseManager.get_license_summary(server_state=state, db_path=db_path) is_db_unlocked = LicenseManager.is_feature_licensed("enterprise_db", db_path=db_path, server_state=state) + is_auto_update_unlocked = LicenseManager.is_feature_licensed("auto_update", db_path=db_path, server_state=state) queue_stats = ingest_queue.get_stats() if ingest_queue else { "queue_size": 0, "total_ingested": 0, "total_flushed": 0, "dropped_count": 0, "last_flush_time": "Never", "avg_flush_latency_ms": 0.0, "flush_count": 0, @@ -400,6 +401,21 @@ class WebUIRenderer: """) + elif feat == "auto_update": + feature_cards.append(""" +
+
🔄
+
+
+ auto_update + AUTHORIZED +
+
+ Fleet Auto-Update & Package Distribution: Unlocks automated background client binary synchronization, version checks, and fleet-wide package orchestration. +
+
+
+ """) else: esc_feat = html.escape(str(feat)) feat_title = html.escape(str(feat).replace("_", " ").title()) @@ -650,7 +666,10 @@ class WebUIRenderer:
📦 Client Package Distribution Repository
Hosted binaries for edge forwarders to automatically download and hot-upgrade
- Target: v{hosted_client_ver} +
+ {('🔄 FLEET AUTO-UPDATE LICENSED' if is_auto_update_unlocked else 'STANDARD DISTRIBUTION')} + Target: v{hosted_client_ver} +