me0nline
668f6e66cd
CI Test Suite / Run Component Tests & Pipeline Verification (push) Failing after 1m50s
Release Binaries & Installers / Build & Release Linux Binaries (push) Failing after 1m5s
Release Binaries & Installers / Build & Release Windows Binaries & Installers (push) Canceled after 0s
91 lines
6.7 KiB
Markdown
91 lines
6.7 KiB
Markdown
# LOGAR Release v3.0.0
|
||
|
||
Major architectural release introducing the centralized **Master Licensing Authority** (logar.eibl.tech), Subordinate CA hierarchy, live seat synchronization over mTLS, authenticated Hermes AI Bearer token integrations, and streamlined WebUI dashboard controls.
|
||
|
||
### Key Highlights & Changes in v3.0.0:
|
||
|
||
- **Enterprise Master Licensing Authority (`LOGAR-LICENSING`)**:
|
||
- Implemented standalone hierarchical PKI Authority issuing and signing subordinate CA certificates with custom X.509 OID seat quotas (`1.3.6.1.4.1.59999.1.1`).
|
||
- Automated mTLS renewal and synchronization (`renew_ca_cert_mtls`) connecting Hub servers to upstream authority.
|
||
- Dedicated multi-tenant licensing dashboard with 2FA TOTP authentication, user RBAC, and WebSocket real-time seat synchronization.
|
||
- Dedicated Docker container publishing workflow on release tags and portainer GitOps redeployment webhooks.
|
||
|
||
- **Real-Time Active Seat Quota Synchronization**:
|
||
- Hub automatically tracks and reports active node seat quotas (`seats_taken`, `active_seats`, `hostname`, `server_fingerprint`) to the upstream authority upon client enrollment, approval, revocation, and removal.
|
||
- Non-blocking asynchronous thread dispatch ensures instantaneous client responses while keeping central licensing metrics synchronized.
|
||
|
||
- **Hermes AI Integration & Token Authentication**:
|
||
- Dedicated `/api/hermes/report` ingestion endpoint delivering verified anomalies within a 12-hour evaluation window.
|
||
- Bearer token administration (`/api/hermes/tokens`) with dedicated generation, copying, revocation, and deletion in the Hub WebUI.
|
||
|
||
- **Streamlined WebUI Dashboard**:
|
||
- Cleaned up top summary KPI cards to focus strictly on operational status and fleet health.
|
||
- Centralized full cryptographic inspection (Master Authority URL, Server Hub Fingerprint, CA Fingerprint) into the dedicated *Sub-CA & Licensing* tab.
|
||
|
||
- **Standalone CI & Modular Testing**:
|
||
- Decoupled LOGAR and LOGAR-LICENSING CI pipelines so each repository tests independently without submodule dependencies.
|
||
- 100% test coverage across 35 LOGAR unit tests and 14 Licensing Authority unit tests.
|
||
|
||
---
|
||
|
||
# LOGAR Release v2.0.1
|
||
|
||
Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.
|
||
|
||
### Key Highlights & Changes in v2.0.1:
|
||
|
||
- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**:
|
||
- Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`).
|
||
- Standardized tag matching for Gitea Actions on `push: tags: ['v*']`.
|
||
- Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`).
|
||
- Retired deprecated `release-linux.yml` and `release-windows.yml` files.
|
||
|
||
- **Installer & Engine Version Bump**:
|
||
- Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`.
|
||
- Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`.
|
||
- Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`.
|
||
|
||
- **Distribution & Release Documentation**:
|
||
- Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.
|
||
|
||
---
|
||
|
||
# LOGAR Release v2.0.0
|
||
|
||
Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.
|
||
|
||
### Key Highlights & Changes in v2.0.0:
|
||
|
||
- **mTLS 1.3 Transport Security & Runtime Licensing**:
|
||
- Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (`ssl.CERT_REQUIRED`, TLS 1.3 minimum version).
|
||
- Hub dynamically validates incoming client Common Name (`client_id`) against active license seats in SQLite during the TLS handshake.
|
||
- Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.
|
||
|
||
- **Dynamic Hub PKI Engine (`src/server_enrollment.py`)**:
|
||
- Automatically initializes an internal RSA-4096 Root CA (`ca.crt` / `ca.key`).
|
||
- Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
|
||
- Full OpenSSL 3.x and Python 3.12–3.14 compatibility via `SubjectKeyIdentifier` and `AuthorityKeyIdentifier` certificate extensions.
|
||
- Generates and signs client certificates on demand via `POST /api/client/enroll`.
|
||
|
||
- **In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading**:
|
||
- Server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, evaluated every 12 hours) alongside startup checks.
|
||
- Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
|
||
- Generates renewed certificates on disk with timestamped backups (`.bak`), and reloads active `ssl.SSLContext` in memory dynamically without dropping socket listeners or restarting the background service.
|
||
|
||
- **Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal**:
|
||
- **Proactive**: Forwarders (`Win_Client.py` and `Linux_Client.py`) evaluate `client.crt` validity before each run, auto-renewing via `/api/client/enroll` if expiring within 30 days.
|
||
- **Reactive**: If the hub rotates its Root CA or a TLS verification error (`ssl.SSLError` / `SSLCertVerificationError`) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.
|
||
|
||
- **Database Schema & License Quota Accounting**:
|
||
- SQLite tables `license_config` (`max_seats`, `enrollment_secret`) and `clients` (`client_id`, `hostname`, `os_type`, `cert_fingerprint`, `status`, timestamps).
|
||
- Enforces seat limits on enrollment (`HTTP 403 License seat limit reached`) while allowing active registered nodes to re-enroll/renew indefinitely.
|
||
- Added `GET /api/clients` endpoint for license auditing and telemetry tracking.
|
||
|
||
- **Automated Service Installers**:
|
||
- **Windows**: Self-contained Inno Setup installers (`LOGAR-Client-Setup.exe` and `LOGAR-Server-Setup.exe`) bundling `nssm.exe` to register, configure, and start Windows services automatically.
|
||
- **Linux**: Automated installer scripts (`compilation/install_linux_client.sh` and `install_linux_server.sh`) deploying systemd service units with auto-restart policies.
|
||
|
||
- **CI/CD Release Workflows**:
|
||
- Windows workflow (`.gitea/workflows/release-windows.yml`) and Linux workflow (`.gitea/workflows/release-linux.yml`) automated to build native executables, installers, and upload release assets on tag push.
|
||
|