LOGAR Windows Server Hub

Standalone compiled executable and installer distribution for Windows Server environments (Server.exe).

Overview

Server.exe is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, dynamic PKI certificate authority, and reporting hub of the LOGAR infrastructure.

Key Architecture & Capabilities

Pre-compiled & Dependency-Free: Ships as a standalone Windows executable (Server.exe) or full installer (LOGAR-Server-Setup.exe). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
Mutual TLS 1.3 (mTLS) Ingestion (Port 9443): Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Root CA and verifies active licensing in SQLite.
Dynamic PKI & License Accounting: Built-in Root CA generates server TLS certificates with SANs and dynamically signs client certificates via POST /api/client/enroll while enforcing seat limits (max_seats).
Warning Persistence & Immediate Error Routing: High-severity ERROR, CRITICAL, and FATAL events are promoted to VERIFIED immediately on their first occurrence. Operational WARNING and INFO events require persistence across at least 4 distinct transmission cycles within a rolling 12-hour evaluation window.
Embedded Hermes Reporting & Management API (Port 8443): Integrated REST API exposing /api/hermes/report, /api/clients, and /api/client/enroll.
State Database: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (logar_state.db).

1. Automated Installation via Inno Setup (Recommended)

Run the self-contained installer built from compilation/installer_server.iss:

.\LOGAR-Server-Setup.exe

This installer:

Installs Server.exe and bundled nssm.exe to C:\Program Files\LOGAR-Server\.
Registers and starts the LOGAR_Server Windows service automatically via NSSM.
Redirects stdout and stderr logs to C:\ProgramData\LOGAR-Server\server.log and server_err.log.

2. Initializing & Generating Server Configuration

Step 1: Automatic First-Run Generation

When launched without an existing server_config.json, Server.exe automatically initializes:

An internal Root CA (certs/ca.crt and certs/ca.key).
A server TLS certificate (certs/server.crt and certs/server.key) with SANs.
An OpenPGP RSA-2048 keypair (private_key and public_key).
Cryptographically random authentication tokens and enrollment secrets.
Default network socket coordinates (mTLS 9443, Hermes API 8443).

Open PowerShell and run:

.\Server.exe

Output:

[!] Config 'server_config.json' not found. Initializing first-run configuration...
[+] Successfully generated new server config and OpenPGP keypair.
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
[+] Saved to: server_config.json
============================================================
  LOGAR Server Hub: LOGAR-Cloud-Hub
  Transport Security: mTLS (TLS 1.3)
  License Quota: 10 Active Seats
  Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
  Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
============================================================
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll

Step 2: Configuration Fields Reference

The generated server_config.json contains:

{
  "server_name": "LOGAR-Windows-Hub",
  "tcp_host": "0.0.0.0",
  "tcp_port": 9443,
  "hermes_host": "0.0.0.0",
  "hermes_port": 8443,
  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
  "enrollment_secret": "e1f2a3b4c5d6...",
  "max_seats": 10,
  "cert_dir": "certs",
  "tls_enabled": true,
  "db_path": "logar_state.db",
  "evaluation_window_hours": 12,
  "min_persistence_runs": 4,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
}

3. Exporting Client Configurations

Generate a client configuration bundle to deploy onto Windows or Linux forwarders:

.\Server.exe --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json

The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.

4. Manual Windows Service Setup (via NSSM)

.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
.\nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
.\nssm.exe set LOGAR_Server AppStdout "C:\ProgramData\LOGAR-Server\server.log"
.\nssm.exe set LOGAR_Server AppStderr "C:\ProgramData\LOGAR-Server\server_err.log"
.\nssm.exe start LOGAR_Server

5. Uninstallation

If installed via the Inno Setup installer, use Windows Add/Remove Programs.

If installed manually via NSSM:

.\nssm.exe stop LOGAR_Server
.\nssm.exe remove LOGAR_Server confirm

5.2 KiB Raw Blame History