me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Document WebSocket protocol licensing and bootstrap .lic package flow in README

Browse Source
This commit is contained in:
me0nline
2026-09-25 16:02:17 +02:00
parent 63e8ff5492
commit ff5caaf8c7
1 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -12
View File
@@ -104,18 +104,17 @@ graph TB
- `OID_LOGAR_SEATS (1.3.6.1.4.1.59999.1.1)`: Embeds the exact licensed seat quota directly inside the signed Subordinate CA certificate. - `OID_LOGAR_SEATS (1.3.6.1.4.1.59999.1.1)`: Embeds the exact licensed seat quota directly inside the signed Subordinate CA certificate.
- `OID_LOGAR_LICENSE_ID (1.3.6.1.4.1.59999.1.2)`: Uniquely tracks enterprise license entitlement. - `OID_LOGAR_LICENSE_ID (1.3.6.1.4.1.59999.1.2)`: Uniquely tracks enterprise license entitlement.
- `OID_LOGAR_ISSUER_URL (1.3.6.1.4.1.59999.1.3)`: Embedded endpoint coordinate (`https://logar.eibl.tech`). - `OID_LOGAR_ISSUER_URL (1.3.6.1.4.1.59999.1.3)`: Embedded endpoint coordinate (`https://logar.eibl.tech`).
- **Exportable `.lic` Request & Activated `.lic` Packages**: - **Bootstrap `.lic` Packages & Instant WebSocket Auto-Enrollment**:
- **Request**: The LOGAR server generates its Subordinate CA private key (`certs/ca.key`), Certificate Signing Request (`certs/ca.csr`), and packages them into an exportable `logar_server.lic` file. - The License Authority (`logar.eibl.tech`) generates initial **Bootstrap `.lic` Packages** containing Master Root CA, dedicated communication credentials (`communication_cert` + `communication_key`), CSR templates, and WebSocket coordinates (`wss://logar.eibl.tech/ws/license`).
- **Activation Package**: The master license authority issues an activated `.lic` package containing the signed Subordinate CA, granted seat quota, server metadata, and the Master Root CA (`upstream_ca.crt`). - **1-Click Import & Live Signing**: Importing the `.lic` file on the client server (`python src/Server.py --import-lic <file.lic>` or via WebUI) connects directly via **WebSocket**, submits the server Sub-CA CSR, and immediately installs the officially signed Sub-CA license certificate.
- Importable via WebUI or CLI (`python src/Server.py --import-lic activated.lic` or `--import-ca`). - **Self-Updating Client Servers & Live WebSocket Sync**:
- **Self-Updating Client Servers & Dynamic Seat Expansion**: - Client servers update themselves against the master authority (`wss://logar.eibl.tech/ws/license`) over WebSocket (`python src/Server.py --sync-license` or via WebUI / automated watchdog).
- Client servers update themselves against the master authority (`logar.eibl.tech`) over mTLS (`python src/Server.py --sync-license` or via WebUI / automated watchdog). - Seat quotas can be increased with each renewal or updated on-demand in the License Authority WebUI.
- Seat quotas can be increased with each renewal or updated on-demand on the master authority. - The client server automatically receives the updated seat quota in its signed certificate, updates its SQLite database and runtime configuration, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services.
- The client server automatically detects the higher seat count in the signed certificate's OID, updates its database and runtime configuration, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services. - **Automated Container Pipeline & Ephemeral NPM Pass-Through**:
- **Automated Container Pipeline & Portainer GitOps Deployment**: - The license authority repository includes a dedicated CI/CD workflow ([`.gitea/workflows/build-container.yml`](file:///u:/max/Desktop/LOGAR/LOGAR-LICENSING/.gitea/workflows/build-container.yml)) publishing to `gitea.eibl.tech/me0nline/logar-licensing:latest` and `10.30.0.3:5000/logar-licensing:latest`.
- The license authority repository includes a dedicated CI/CD workflow ([`.gitea/workflows/build-container.yml`](file:///u:/max/Desktop/LOGAR/LOGAR-LICENSING/.gitea/workflows/build-container.yml)) compiling and publishing the container image to `gitea.eibl.tech/me0nline/logar-licensing:latest` (authenticated via `giteatoken` secret) and `10.30.0.3:5000/logar-licensing:latest`. - Works seamlessly with ephemeral Nginx Proxy Manager (NPM) by enabling the standard **Websockets Support** toggle for `logar.eibl.tech`.
- It deploys seamlessly in Portainer using a GitOps Stack connected directly to [`LOGAR-LICENSING`](https://gitea.eibl.tech/me0nline/LOGAR-LICENSING.git) via [`docker-compose.yml`](file:///u:/max/Desktop/LOGAR/LOGAR-LICENSING/docker-compose.yml) with automatic polling or webhook redeployment and persistent volume storage (`logar_licensing_data`) preserving Root CA keys and database. - Admin WebUI is protected by session login (`/login`, default: `admin` / `admin_license_2026!`).
- Reverse proxy integration (e.g., Nginx Proxy Manager, Caddy) terminates HTTPS on port 443, verifies client mTLS against the downloadable Master Root CA (`/api/ca.crt`), and forwards client certificate headers (`X-SSL-Client-Cert`) to port 8090.
### 3. Integrated Fleet Licensing & WebUI Dashboard ### 3. Integrated Fleet Licensing & WebUI Dashboard
- **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`). - **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`).