LOGAR/RELEASE_NOTES.md

LOGAR Release v2.0.0

Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.

Key Highlights & Changes in v2.0.0:

• mTLS 1.3 Transport Security & Runtime Licensing:

  • Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (ssl.CERT_REQUIRED, TLS 1.3 minimum version).
  • Hub dynamically validates incoming client Common Name (client_id) against active license seats in SQLite during the TLS handshake.
  • Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.

• Dynamic Hub PKI Engine (src/server_enrollment.py):

  • Automatically initializes an internal RSA-4096 Root CA (ca.crt / ca.key).
  • Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
  • Full OpenSSL 3.x and Python 3.12–3.14 compatibility via SubjectKeyIdentifier and AuthorityKeyIdentifier certificate extensions.
  • Generates and signs client certificates on demand via POST /api/client/enroll.

• In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading:

  • Server hub runs a continuous background watchdog coroutine (cert_validity_watchdog, evaluated every 12 hours) alongside startup checks.
  • Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
  • Generates renewed certificates on disk with timestamped backups (.bak), and reloads active ssl.SSLContext in memory dynamically without dropping socket listeners or restarting the background service.

• Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal:

  • Proactive: Forwarders (Win_Client.py and Linux_Client.py) evaluate client.crt validity before each run, auto-renewing via /api/client/enroll if expiring within 30 days.
  • Reactive: If the hub rotates its Root CA or a TLS verification error (ssl.SSLError / SSLCertVerificationError) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.

• Database Schema & License Quota Accounting:

  • SQLite tables license_config (max_seats, enrollment_secret) and clients (client_id, hostname, os_type, cert_fingerprint, status, timestamps).
  • Enforces seat limits on enrollment (HTTP 403 License seat limit reached) while allowing active registered nodes to re-enroll/renew indefinitely.
  • Added GET /api/clients endpoint for license auditing and telemetry tracking.

• Automated Service Installers:

  • Windows: Self-contained Inno Setup installers (LOGAR-Client-Setup.exe and LOGAR-Server-Setup.exe) bundling nssm.exe to register, configure, and start Windows services automatically.
  • Linux: Automated installer scripts (compilation/install_linux_client.sh and install_linux_server.sh) deploying systemd service units with auto-restart policies.

• CI/CD Release Workflows:

  • Windows workflow (.gitea/workflows/release-windows.yml) and Linux workflow (.gitea/workflows/release-linux.yml) automated to build native executables, installers, and upload release assets on tag push.