LOGAR/out/win_server

LOGAR Windows Server Hub

Standalone compiled executable and installer distribution for Windows Server environments (Server.exe).

---

Overview

Server.exe is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, dynamic PKI certificate authority, and reporting hub of the LOGAR infrastructure.

Key Architecture & Capabilities

• Pre-compiled & Dependency-Free: Ships as a standalone Windows executable (Server.exe) or full installer (LOGAR-Server-Setup.exe). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
• Mutual TLS 1.3 (mTLS) Ingestion (Port 9443): Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
• Master License Authority (logar.eibl.tech) & Seat-Bearing CA: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID 1.3.6.1.4.1.59999.1.1.
• Zero-Touch mTLS Renewals: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with https://logar.eibl.tech/api/license/renew when nearing expiration (< 30 days).
• Fleet Management & WebUI Dashboard (Port 8443): Modern browser WebUI accessible at http://localhost:8443/webui to monitor seat quotas, export .lic request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
• Warning Persistence & Immediate Error Routing: High-severity ERROR, CRITICAL, and FATAL events are promoted to VERIFIED immediately on their first occurrence. Operational WARNING and INFO events require persistence across at least 4 distinct transmission cycles within a rolling 12-hour evaluation window.
• Embedded Hermes Reporting API (Port 8443): Integrated REST API exposing /api/hermes/report, /api/clients, and /api/client/enroll.
• State Database: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (logar_state.db).

---

1. Automated Installation via Inno Setup (Recommended)

Run the self-contained installer built from compilation/installer_server.iss:

.\LOGAR-Server-Setup.exe

This installer:

1. Installs Server.exe and bundled nssm.exe to C:\Program Files\LOGAR-Server\.
2. Registers and starts the LOGAR_Server Windows service automatically via NSSM.
3. Redirects stdout and stderr logs to C:\ProgramData\LOGAR-Server\server.log and server_err.log.

---

2. Initializing & Generating Server Configuration

Step 1: Automatic First-Run Generation

When launched without an existing server_config.json, Server.exe automatically initializes:

1. An internal Root CA (certs/ca.crt and certs/ca.key).
2. A server TLS certificate (certs/server.crt and certs/server.key) with SANs.
3. An OpenPGP RSA-2048 keypair (private_key and public_key).
4. Cryptographically random authentication tokens and enrollment secrets.
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).

Open PowerShell and run:

.\Server.exe

Output:

[!] Config 'server_config.json' not found. Initializing first-run configuration...
[+] Successfully generated new server config and OpenPGP keypair.
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
[+] Saved to: server_config.json
============================================================
  LOGAR Server Hub: LOGAR-Cloud-Hub
  Transport Security: mTLS (TLS 1.3)
  License Quota: 10 Active Seats
  Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
  Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
============================================================
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll

Step 2: Configuration Fields Reference

The generated server_config.json contains:

{
  "server_name": "LOGAR-Windows-Hub",
  "tcp_host": "0.0.0.0",
  "tcp_port": 9443,
  "hermes_host": "0.0.0.0",
  "hermes_port": 8443,
  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
  "enrollment_secret": "e1f2a3b4c5d6...",
  "max_seats": 10,
  "cert_dir": "certs",
  "tls_enabled": true,
  "db_path": "logar_state.db",
  "evaluation_window_hours": 12,
  "min_persistence_runs": 4,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
}

---

3. Exporting Client Configurations

Generate a client configuration bundle to deploy onto Windows or Linux forwarders:

.\Server.exe --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json

The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.

---

4. Fleet Licensing, .lic Files & WebUI Dashboard

Accessing the WebUI

Open your browser and navigate to:

http://localhost:8443/webui

The WebUI provides:

1. Real-time Seat Quota Meter: Visual meter displaying active clients against approved seat quota.
2. Export .lic Request: 1-click download of logar_server.lic containing your Subordinate CA CSR and machine fingerprint for logar.eibl.tech.
3. Import License (.lic / ca.crt): Modal to paste or upload the activated .lic package or ca.crt issued by logar.eibl.tech. Activating updates your seat limit immediately and reloads mTLS context in-flight.
4. Sync & Renew via mTLS: Button to test or trigger immediate mTLS renewal against logar.eibl.tech and pull seat quota increases without restart.
5. Client Seat Management: View all enrolled nodes; click Revoke Seat to immediately drop and block an edge node at the socket layer, or Reactivate to restore access.

CLI Licensing Utilities

Export a .lic request file via CLI:

.\Server.exe --export-lic C:\LOGAR-Server\server.lic

Import an activated .lic license package or signed CA certificate via CLI:

.\Server.exe --import-lic C:\LOGAR-Server\activated.lic
# Or alternatively with --import-ca:
.\Server.exe --import-ca C:\LOGAR-Server\ca.crt

Synchronize license and check for seat quota increases against the master authority:

.\Server.exe --sync-license

Upstream Authority Deployment (Portainer GitOps & Reverse Proxy)

The upstream Master License Authority service (logar.eibl.tech) is compiled and deployed via Portainer GitOps from the LOGAR-LICENSING repository, running from gitea.eibl.tech/me0nline/logar-licensing:latest with automated pipeline compilation and persistent volume storage. Public traffic passes through a reverse proxy (e.g., Nginx Proxy Manager, Caddy) which validates mTLS client certificates against the Master Root CA and forwards client credentials.

---

5. Manual Windows Service Setup (via NSSM)

.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
.\nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
.\nssm.exe set LOGAR_Server AppStdout "C:\ProgramData\LOGAR-Server\server.log"
.\nssm.exe set LOGAR_Server AppStderr "C:\ProgramData\LOGAR-Server\server_err.log"
.\nssm.exe start LOGAR_Server

---

6. Uninstallation

If installed via the Inno Setup installer, use Windows Add/Remove Programs.

If installed manually via NSSM:

.\nssm.exe stop LOGAR_Server
.\nssm.exe remove LOGAR_Server confirm