LOGAR/out/linux_server

LOGAR Linux Server Hub

Standalone compiled binary and automated systemd service distribution for Linux server environments (Server.bin).

---

Overview

Server.bin is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination, log analysis, dynamic PKI, and reporting hub of the LOGAR telemetry architecture.

Key Architecture & Capabilities

• Pre-compiled & Dependency-Free: Ships as a standalone native Linux ELF binary (Server.bin). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
• Mutual TLS 1.3 (mTLS) Ingestion (Port 9443): Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
• Master License Authority (logar.eibl.tech) & Seat-Bearing CA: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID 1.3.6.1.4.1.59999.1.1.
• Zero-Touch mTLS Renewals: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with https://logar.eibl.tech/api/license/renew when nearing expiration (< 30 days).
• Fleet Management & WebUI Dashboard (Port 8443): Modern browser WebUI accessible at http://localhost:8443/webui to monitor seat quotas, export .lic request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
• Warning Persistence & Immediate Error Routing: High-severity ERROR, CRITICAL, and FATAL events are promoted to VERIFIED immediately on their first occurrence. Operational WARNING and INFO events require persistence across at least 4 distinct client transmission cycles within a rolling 12-hour evaluation window.
• Embedded Hermes Reporting API (Port 8443): Integrated REST API exposing /api/hermes/report, /api/clients, and /api/client/enroll.
• State Database: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (logar_state.db).

---

1. Automated Installation via Script (Recommended)

Deploy using the automated installer:

sudo ./compilation/install_linux_server.sh

This script:

1. Installs the server binary to /opt/logar-server/Server.
2. Creates /etc/logar and /var/log/logar.
3. Deploys, enables, and starts the systemd service unit /etc/systemd/system/logar-server.service with LimitNOFILE=65536.

---

2. Initializing & Generating Server Configuration

Step 1: Automatic First-Run Generation

When launched without an existing server_config.json, Server.bin automatically generates:

1. An internal Root CA (certs/ca.crt and certs/ca.key).
2. A server TLS certificate (certs/server.crt and certs/server.key) with SANs.
3. An OpenPGP RSA-2048 keypair (private_key and public_key).
4. Cryptographically random authentication tokens and enrollment secrets.
5. Default network socket coordinates (mTLS 9443, Hermes API 8443).

Run Server.bin once to initialize:

./Server.bin

Output:

[!] Config 'server_config.json' not found. Initializing first-run configuration...
[+] Successfully generated new server config and OpenPGP keypair.
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
[+] Saved to: server_config.json
============================================================
  LOGAR Server Hub: LOGAR-Cloud-Hub
  Transport Security: mTLS (TLS 1.3)
  License Quota: 10 Active Seats
  Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
  Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
============================================================
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll

Step 2: Configuration Fields Reference

The generated server_config.json contains:

{
  "server_name": "LOGAR-Linux-Hub",
  "tcp_host": "0.0.0.0",
  "tcp_port": 9443,
  "hermes_host": "0.0.0.0",
  "hermes_port": 8443,
  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
  "enrollment_secret": "e1f2a3b4c5d6...",
  "max_seats": 10,
  "cert_dir": "certs",
  "tls_enabled": true,
  "db_path": "logar_state.db",
  "evaluation_window_hours": 12,
  "min_persistence_runs": 4,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
}

---

3. Exporting Client Configurations

Generate a client configuration bundle to deploy onto Windows or Linux forwarders:

./Server.bin --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json

The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.

---

4. Fleet Licensing, .lic Files & WebUI Dashboard

Accessing the WebUI

Open your browser and navigate to:

http://<SERVER_IP>:8443/webui

The WebUI provides:

1. Real-time Seat Quota Meter: Visual meter displaying active clients against approved seat quota.
2. Export .lic Request: 1-click download of logar_server.lic containing your Subordinate CA CSR and machine fingerprint for logar.eibl.tech.
3. Import License (.lic / ca.crt): Modal to paste or upload the activated .lic package or ca.crt issued by logar.eibl.tech. Activating updates your seat limit immediately and reloads mTLS context in-flight.
4. Sync & Renew via mTLS: Button to test or trigger immediate mTLS renewal against logar.eibl.tech and pull seat quota increases without restart.
5. Client Seat Management: View all enrolled nodes; click Revoke Seat to immediately drop and block an edge node at the socket layer, or Reactivate to restore access.

CLI Licensing Utilities

Export a .lic request file via CLI:

./Server.bin --export-lic server.lic

Import an activated .lic license package or signed CA certificate via CLI:

./Server.bin --import-lic activated.lic
# Or alternatively with --import-ca:
./Server.bin --import-ca ca.crt

Synchronize license and check for seat quota increases against the master authority:

./Server.bin --sync-license

Upstream Authority Deployment (Portainer GitOps)

The upstream Master License Authority service (logar.eibl.tech) is compiled and deployed via Portainer GitOps from the LOGAR-LICENSING repository, running from gitea.eibl.tech/me0nline/logar-licensing:latest with automated pipeline compilation and persistent volume storage.

---

5. Manual Systemd Service Management

Check service status:

sudo systemctl status logar-server.service

Inspect live service logs:

sudo journalctl -u logar-server.service -f -n 50

---

6. Uninstallation & Removal

sudo systemctl disable --now logar-server.service
sudo rm -f /etc/systemd/system/logar-server.service
sudo systemctl daemon-reload
sudo rm -rf /opt/logar-server /etc/logar /var/log/logar