me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

10 Releases 10 Tags

RSS Feed
  • v0.3.6.0-rc1 d261802f8d
    Compare

    LOGAR Release v0.3.6.0-rc1
    CI Test Suite / Run Component Tests & Pipeline Verification (push) Failing after 4m56s
    Details
    Release Binaries & Packages / Build & Release Standalone Binaries (Linux & Windows Cross-Compilation) (push) Successful in 5m40s
    Details
    Build and Push LOGAR Runner / Build & Push Runner Image (push) Successful in 11m54s
    Details
    Pre-Release

    me0nline released this 2026-10-11 14:37:33 +00:00 | 1 commits to main since this release

    LOGAR Release Notes

    [v0.3.5.2] - 2026-10-03

    🚀 Fleet Hub Client Update Caching & Distribution

    • Local Package Caching: The Fleet Hub automatically caches edge client binaries and packages locally on startup and upon scheduled refresh, minimizing external upstream traffic.
    • Edge Pull Mechanism: Forwarder nodes retrieve validated update payloads directly from the local Fleet Hub.

    🛡️ Windows Defender Firewall Automation (Fixes Issue #1)

    • Automated Port Exemptions: Inno Setup (installer_server.iss) and NSIS (installer_server.nsi) server installers automatically configure inbound Windows Defender Firewall rules for WebUI (TCP 8443) and mTLS log ingestion (TCP 9443).
    • Clean Uninstallation: Uninstallers automatically remove the created firewall rules cleanly upon server decommissioning.

    📊 Forwarder Liveness, Silent Server Detection & System Telemetry (Fixes Issue #2)

    • Silent Node & Crash Detection: Resolved the "Silent Server Down Bug" by tracking forwarder heartbeats (last_seen). Hermes reporting (GET /api/hermes/report) automatically flags edge nodes that have gone silent for >15 minutes as CRITICAL NODE_OFFLINE alerts.
    • Troubleshooting System Telemetry: Cross-platform system telemetry metrics (CPU utilization %, Memory load %, and Free Disk space %) are collected and attached to client heartbeats and Hermes anomaly records without external dependencies.
    • Benign Service Noise Suppression: Filtered routine repetitive Windows and Linux background service lifecycle events (e.g., sppsvc, edgeupdate, trustedinstaller, wuauserv, backgroundTaskHost) from false-positive anomaly alert fatigue.

    🔑 Dynamic Enrollment Key Rotation & WebUI Key Management

    • Automatic Key Invalidation: Clicking "Download Client Config" (GET /api/client/export-profile) automatically generates a fresh enrollment secret and invalidates previous secrets, preventing reuse of leaked keys.
    • WebUI Reset Shared Key: Added "🔄 Reset Shared Key" controls in the WebUI header, Fleet tab, and Export Modal, backed by POST /api/server/reset-enrollment-secret to rotate keys and update quick-deploy command snippets on demand.

    🔒 Security Hardening & Modular Architecture

    • Decoupled CI & Test Execution: Clean modularization across server, client, and authority services with fully autonomous unit and integration test suites.
    • API Robustness & Validation: Added cryptographic CSR validation endpoints and request sanitization.

    [v0.3.5.1] - 2026-09-30

    🗄️ Multi-Engine Storage Architecture

    • Dynamic Backend Switching: LOGAR Server Hub supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
    • Automated Schema Provisioning: Database switching automatically verifies connectivity, provisions normalized tables (telemetry_events, client_seats, license_config, admin_users), and generates optimized query indices.
    • Config Isolation: Runtime backend parameters are stored persistently in server_config.json under db_engine and safely isolated from ephemeral test runs.

    ⚡ Ingestion Ring Buffer & Burst Protection

    • In-Memory Queue Buffering: Built-in ring buffer with an asynchronous background flusher decoupled from mTLS socket I/O.
    • Cache Mode: High-velocity log spikes are absorbed in memory without blocking incoming mTLS 1.3 frame streams.
    • Configurable Batching: Configurable flush interval (buffer_flush_interval_sec, default 2.0s) and batch size (buffer_batch_size, default 100).
    • Graceful Shutdown: Unflushed queue items are flushed and committed cleanly during server shutdown.
    • Opt-In Security Policy: Buffering remains an explicit administrative choice and is not auto-enabled upon license activation.

    🔐 Zero-Knowledge OpenPGP Data Encryption at Rest

    • Public-Key Envelope Encryption: External SQL payloads (event_data) can be encrypted at rest using the server's X.509 RSA-2048 / OpenPGP public key with AES-256-GCM symmetric session keys.
    • Zero-Knowledge on Database Host: External DBAs or compromised database hosts cannot read plaintext telemetry without the server's private key.
    • Opt-In Security Policy: Payload encryption is strictly opt-in and configurable per compliance requirements.

    📜 Dynamic Licensing Introspection & Clean Dashboard WebUI

    • Modular Capability Introspection: PKI X.509 extension OID 1.3.6.1.4.1.58888.1.3 and persistent license records are dynamically parsed to display active modules (enterprise_db, etc.) in a dedicated card on the 📜 Sub-CA & Licensing tab.
    • Distraction-Free Tab Navigation: Cleaned all dashboard tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
    • Graceful Feature Locking: Unlicensed enterprise controls remain visible but gracefully disabled in the WebUI and rejected by backend API validation.

    🛠️ Dynamic Installer Context Versioning & Streamlined CI/CD

    • Context-Aware Installer Builds: NSIS and Inno Setup compiler scripts dynamically derive version information directly from build context/tags (v0.3.5.1) without hardcoded version strings.
    • Pre-Integrated Builder Runner: Streamlined CI/CD workflows to rely directly on pre-installed container tools and libraries without runtime apt/pip overhead.

    📖 WebUI Administrator Guide & 51 Automated Tests

    • WebUI Administrator Guide: Published comprehensive WebUI management guide on the Gitea Wiki covering console access, telemetry filtering, seat management, licensing, database switching, queue tuning, zero-knowledge crypto, Hermes AI, and 2FA.
    • Expanded Test Suite: 51 automated unit and integration tests passing with 100% test coverage.
    Downloads