feat(ui,docs): add auto_update feature flag integration, UI card, and documentation
CI Test Suite / Run Component Tests & Pipeline Verification (push) Successful in 2m17s
Build and Push LOGAR Runner / Build & Push Runner Image (push) Successful in 7m27s
Release Binaries & Packages / Build & Release Standalone Binaries (Linux & Windows Cross-Compilation) (push) Failing after 5m16s
CI Test Suite / Run Component Tests & Pipeline Verification (push) Successful in 2m17s
Build and Push LOGAR Runner / Build & Push Runner Image (push) Successful in 7m27s
Release Binaries & Packages / Build & Release Standalone Binaries (Linux & Windows Cross-Compilation) (push) Failing after 5m16s
This commit is contained in:
@@ -5,14 +5,14 @@
|
||||
# LOGAR: Fleet Log Aggregation & Centralized Provisioning System
|
||||
### *Secure Log Aggregation, PKI Fleet Licensing & Centralized Delivery for Autonomous AI Analysis*
|
||||
|
||||
[](RELEASE_NOTES.md)
|
||||
[](tests/)
|
||||
[](RELEASE_NOTES.md)
|
||||
[](tests/)
|
||||
[](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)
|
||||
[](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)
|
||||
|
||||
**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.
|
||||
**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, fleet auto-update package distribution, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.
|
||||
|
||||
> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**.
|
||||
> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, fleet package distribution, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**.
|
||||
|
||||
---
|
||||
|
||||
@@ -20,7 +20,8 @@
|
||||
|
||||
- **Zero-State Edge Forwarders**: Windows (`Win_Client`) and Linux (`Linux_Client`) agents maintain zero local databases, zero cache files, and minimal memory footprint.
|
||||
- **Mutual TLS 1.3 (`:9443`)**: Enforces bidirectional cryptographic identity verification (`ssl.CERT_REQUIRED`) for all streaming log frames.
|
||||
- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (e.g. `enterprise_db`) are introspected dynamically.
|
||||
- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (`enterprise_db`, `auto_update`) are introspected dynamically.
|
||||
- **Fleet Auto-Update & Binary Distribution**: Centralized local binary distribution point with SHA-256 integrity verification, automated client version negotiation, and background pull orchestrator.
|
||||
- **Multi-Engine Storage Backend**: Switch seamlessly between lightweight local SQLite (WAL mode) and external enterprise databases (PostgreSQL, MySQL, MariaDB) with automated schema migration.
|
||||
- **High-Throughput Ring Buffer**: In-memory ingestion queue with configurable batch flushing to eliminate disk I/O bottlenecks during peak traffic bursts.
|
||||
- **Zero-Knowledge Data Encryption**: End-to-end payload encryption at rest using server X.509 RSA-2048 / OpenPGP keys for external SQL databases.
|
||||
@@ -152,12 +153,39 @@ LOGAR/
|
||||
|
||||
- **`POST /api/client/enroll`**: Forwarder auto-enrollment and proactive certificate renewal.
|
||||
- **`GET /api/clients`**: Returns active seat quota and registered edge forwarder telemetry *(Admin Auth)*.
|
||||
- **`GET /api/client/update/check`**: Evaluates client version and returns upgrade manifest with SHA-256 integrity digest.
|
||||
- **`GET /api/client/update/download`**: Delivers OS-specific standalone binary packages for forwarder upgrades.
|
||||
- **`GET /api/hermes/report`**: Structured JSON anomaly stream for Hermes AI reasoning.
|
||||
- **`POST /api/license/sync`**: Triggers immediate WebSocket sync with `logar.eibl.tech` *(Admin Auth)*.
|
||||
- **`GET /health`**: Server health, encryption fingerprint, and mTLS status.
|
||||
|
||||
---
|
||||
|
||||
## Enterprise Feature Capabilities
|
||||
|
||||
LOGAR uses cryptographic X.509 v3 custom extensions embedded inside activated `.lic` intermediate CA certificates issued by the Master Authority:
|
||||
|
||||
| Feature Flag | Capability Name | Description | Default Status |
|
||||
| :--- | :--- | :--- | :--- |
|
||||
| **`enterprise_db`** | **External DB & Ingestion Buffer** | Unlocks PostgreSQL/MySQL storage backends, high-throughput in-memory RAM buffering with batch flushing, and OpenPGP zero-knowledge at-rest data encryption. | Enabled by default |
|
||||
| **`auto_update`** | **Fleet Auto-Update Orchestration** | Enables central repository binary hosting, client version discovery, background update polling, and automated binary hot-upgrades. | Enabled by default |
|
||||
|
||||
---
|
||||
|
||||
## Fleet Auto-Update & Package Distribution
|
||||
|
||||
LOGAR operates a pull-based fleet package distribution architecture:
|
||||
|
||||
1. **Central Server Repository**: The Server Hub monitors upstream releases and hosts target client binaries (`LOGAR_Client_Setup.exe`, `Linux_Client.bin`) in the local repository (`/opt/logar-server/updates/` or `.\updates\`).
|
||||
2. **Version Negotiation**: Edge clients periodically contact `GET /api/client/update/check?os=<windows|linux>&version=<current>` to compare active versions against the Hub.
|
||||
3. **Integrity Verification**: Client packages are validated using streaming SHA-256 digests prior to installation or hot-swap.
|
||||
4. **Client CLI Flags**:
|
||||
- `--auto-update`: Enables automated background update polling and downloading.
|
||||
- `--update-check-interval <seconds>`: Configures update poll frequency (default: 3600s).
|
||||
- `--check-update-now`: Queries server for available updates and exits.
|
||||
|
||||
---
|
||||
|
||||
## Testing & Cross-Compilation
|
||||
|
||||
```bash
|
||||
|
||||
+20
-1
@@ -177,6 +177,7 @@ class WebUIRenderer:
|
||||
|
||||
summary = LicenseManager.get_license_summary(server_state=state, db_path=db_path)
|
||||
is_db_unlocked = LicenseManager.is_feature_licensed("enterprise_db", db_path=db_path, server_state=state)
|
||||
is_auto_update_unlocked = LicenseManager.is_feature_licensed("auto_update", db_path=db_path, server_state=state)
|
||||
queue_stats = ingest_queue.get_stats() if ingest_queue else {
|
||||
"queue_size": 0, "total_ingested": 0, "total_flushed": 0, "dropped_count": 0,
|
||||
"last_flush_time": "Never", "avg_flush_latency_ms": 0.0, "flush_count": 0,
|
||||
@@ -400,6 +401,21 @@ class WebUIRenderer:
|
||||
</div>
|
||||
</div>
|
||||
""")
|
||||
elif feat == "auto_update":
|
||||
feature_cards.append("""
|
||||
<div style="background: #0f172a; padding: 14px 18px; border-radius: 8px; border: 1px solid rgba(16, 185, 129, 0.35); display: flex; align-items: flex-start; gap: 14px;">
|
||||
<div style="font-size: 22px; line-height: 1;">🔄</div>
|
||||
<div>
|
||||
<div style="display: flex; align-items: center; gap: 8px; margin-bottom: 3px;">
|
||||
<strong style="color: #34d399; font-size: 14px;">auto_update</strong>
|
||||
<span class="badge badge-active" style="font-size: 10px;">AUTHORIZED</span>
|
||||
</div>
|
||||
<div style="font-size: 12px; color: var(--text-muted); line-height: 1.4;">
|
||||
<strong>Fleet Auto-Update & Package Distribution:</strong> Unlocks automated background client binary synchronization, version checks, and fleet-wide package orchestration.
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
""")
|
||||
else:
|
||||
esc_feat = html.escape(str(feat))
|
||||
feat_title = html.escape(str(feat).replace("_", " ").title())
|
||||
@@ -650,7 +666,10 @@ class WebUIRenderer:
|
||||
<div class="card-title" style="font-size: 15px;">📦 Client Package Distribution Repository</div>
|
||||
<div class="subtitle" style="margin-top: 4px;">Hosted binaries for edge forwarders to automatically download and hot-upgrade</div>
|
||||
</div>
|
||||
<span class="badge badge-active">Target: v{hosted_client_ver}</span>
|
||||
<div style="display: flex; align-items: center; gap: 8px;">
|
||||
{('<span class="badge badge-active" style="font-size: 11px;">🔄 FLEET AUTO-UPDATE LICENSED</span>' if is_auto_update_unlocked else '<span class="badge" style="background: rgba(148, 163, 184, 0.15); color: #94a3b8; border: 1px solid rgba(148, 163, 184, 0.3); font-size: 11px;">STANDARD DISTRIBUTION</span>')}
|
||||
<span class="badge badge-active">Target: v{hosted_client_ver}</span>
|
||||
</div>
|
||||
</div>
|
||||
<div style="overflow-x: auto; margin-bottom: 24px;">
|
||||
<table>
|
||||
|
||||
Reference in New Issue
Block a user