# LOGAR Release v2.0.1

Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.

### Key Highlights & Changes in v2.0.1:

- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**:
  - Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`).
  - Standardized tag matching for Gitea Actions on `push: tags: ['v*']`.
  - Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`).
  - Retired deprecated `release-linux.yml` and `release-windows.yml` files.

- **Installer & Engine Version Bump**:
  - Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`.
  - Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`.
  - Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`.

- **Distribution & Release Documentation**:
  - Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.

---

# LOGAR Release v2.0.0

Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.

### Key Highlights & Changes in v2.0.0:

- **mTLS 1.3 Transport Security & Runtime Licensing**:
  - Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (`ssl.CERT_REQUIRED`, TLS 1.3 minimum version).
  - Hub dynamically validates incoming client Common Name (`client_id`) against active license seats in SQLite during the TLS handshake.
  - Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.

- **Dynamic Hub PKI Engine (`src/server_enrollment.py`)**:
  - Automatically initializes an internal RSA-4096 Root CA (`ca.crt` / `ca.key`).
  - Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
  - Full OpenSSL 3.x and Python 3.12–3.14 compatibility via `SubjectKeyIdentifier` and `AuthorityKeyIdentifier` certificate extensions.
  - Generates and signs client certificates on demand via `POST /api/client/enroll`.

- **In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading**:
  - Server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, evaluated every 12 hours) alongside startup checks.
  - Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
  - Generates renewed certificates on disk with timestamped backups (`.bak`), and reloads active `ssl.SSLContext` in memory dynamically without dropping socket listeners or restarting the background service.

- **Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal**:
  - **Proactive**: Forwarders (`Win_Client.py` and `Linux_Client.py`) evaluate `client.crt` validity before each run, auto-renewing via `/api/client/enroll` if expiring within 30 days.
  - **Reactive**: If the hub rotates its Root CA or a TLS verification error (`ssl.SSLError` / `SSLCertVerificationError`) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.

- **Database Schema & License Quota Accounting**:
  - SQLite tables `license_config` (`max_seats`, `enrollment_secret`) and `clients` (`client_id`, `hostname`, `os_type`, `cert_fingerprint`, `status`, timestamps).
  - Enforces seat limits on enrollment (`HTTP 403 License seat limit reached`) while allowing active registered nodes to re-enroll/renew indefinitely.
  - Added `GET /api/clients` endpoint for license auditing and telemetry tracking.

- **Automated Service Installers**:
  - **Windows**: Self-contained Inno Setup installers (`LOGAR-Client-Setup.exe` and `LOGAR-Server-Setup.exe`) bundling `nssm.exe` to register, configure, and start Windows services automatically.
  - **Linux**: Automated installer scripts (`compilation/install_linux_client.sh` and `install_linux_server.sh`) deploying systemd service units with auto-restart policies.

- **CI/CD Release Workflows**:
  - Windows workflow (`.gitea/workflows/release-windows.yml`) and Linux workflow (`.gitea/workflows/release-linux.yml`) automated to build native executables, installers, and upload release assets on tag push.