me0nline/LOGAR

Fork 0

Files

T

me0nline f72bb06115 Update win_server README with reverse proxy mTLS forwarding info

2026-09-24 18:00:41 +02:00

7.7 KiB

Raw Blame History

LOGAR Windows Server Hub

Standalone compiled executable and installer distribution for Windows Server environments (Server.exe).

Overview

Server.exe is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, dynamic PKI certificate authority, and reporting hub of the LOGAR infrastructure.

Key Architecture & Capabilities

Pre-compiled & Dependency-Free: Ships as a standalone Windows executable (Server.exe) or full installer (LOGAR-Server-Setup.exe). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
Mutual TLS 1.3 (mTLS) Ingestion (Port 9443): Enforces mutual TLS 1.3 authentication for all incoming edge connections. Validates client certificates against an internal Subordinate CA and verifies active licensing in SQLite.
Master License Authority (logar.eibl.tech) & Seat-Bearing CA: Integrates with the upstream authority. Subordinate CA certificates embed exact seat quotas via custom enterprise X.509 OID 1.3.6.1.4.1.59999.1.1.
Zero-Touch mTLS Renewals: Once initial signed CA cert is imported, the server hub automatically executes in-flight mTLS renewals with https://logar.eibl.tech/api/license/renew when nearing expiration (< 30 days).
Fleet Management & WebUI Dashboard (Port 8443): Modern browser WebUI accessible at http://localhost:8443/webui to monitor seat quotas, export .lic request files, copy CA CSRs, activate signed CA certs, and revoke/reactivate forwarder seats with immediate socket enforcement.
Warning Persistence & Immediate Error Routing: High-severity ERROR, CRITICAL, and FATAL events are promoted to VERIFIED immediately on their first occurrence. Operational WARNING and INFO events require persistence across at least 4 distinct transmission cycles within a rolling 12-hour evaluation window.
Embedded Hermes Reporting API (Port 8443): Integrated REST API exposing /api/hermes/report, /api/clients, and /api/client/enroll.
State Database: Stores issue lifecycle records, client telemetry, and licensing quotas in a local SQLite database (logar_state.db).

1. Automated Installation via Inno Setup (Recommended)

Run the self-contained installer built from compilation/installer_server.iss:

.\LOGAR-Server-Setup.exe

This installer:

Installs Server.exe and bundled nssm.exe to C:\Program Files\LOGAR-Server\.
Registers and starts the LOGAR_Server Windows service automatically via NSSM.
Redirects stdout and stderr logs to C:\ProgramData\LOGAR-Server\server.log and server_err.log.

2. Initializing & Generating Server Configuration

Step 1: Automatic First-Run Generation

When launched without an existing server_config.json, Server.exe automatically initializes:

An internal Root CA (certs/ca.crt and certs/ca.key).
A server TLS certificate (certs/server.crt and certs/server.key) with SANs.
An OpenPGP RSA-2048 keypair (private_key and public_key).
Cryptographically random authentication tokens and enrollment secrets.
Default network socket coordinates (mTLS 9443, Hermes API 8443).

Open PowerShell and run:

.\Server.exe

Output:

[!] Config 'server_config.json' not found. Initializing first-run configuration...
[+] Successfully generated new server config and OpenPGP keypair.
[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
[+] Saved to: server_config.json
============================================================
  LOGAR Server Hub: LOGAR-Cloud-Hub
  Transport Security: mTLS (TLS 1.3)
  License Quota: 10 Active Seats
  Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
  Evaluation Window: 12 hours | 4-Run Rule: Warnings | Immediate Pass: Errors
============================================================
[*] LOGAR mTLS TLSv1.3 Socket Server listening on 0.0.0.0:9443
[*] Hermes Reporting API available at http://0.0.0.0:8443/api/hermes/report
[*] Client Enrollment API available at http://0.0.0.0:8443/api/client/enroll

Step 2: Configuration Fields Reference

The generated server_config.json contains:

{
  "server_name": "LOGAR-Windows-Hub",
  "tcp_host": "0.0.0.0",
  "tcp_port": 9443,
  "hermes_host": "0.0.0.0",
  "hermes_port": 8443,
  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
  "enrollment_secret": "e1f2a3b4c5d6...",
  "max_seats": 10,
  "cert_dir": "certs",
  "tls_enabled": true,
  "db_path": "logar_state.db",
  "evaluation_window_hours": 12,
  "min_persistence_runs": 4,
  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
}

3. Exporting Client Configurations

Generate a client configuration bundle to deploy onto Windows or Linux forwarders:

.\Server.exe --create-client-config --server-host 192.168.1.100 --server-port 9443 --client-out client_config.json

The output file contains the server coordinates, enrollment secret, and fingerprint, ready for client deployment.

4. Fleet Licensing, .lic Files & WebUI Dashboard

Accessing the WebUI

Open your browser and navigate to:

http://localhost:8443/webui

The WebUI provides:

Real-time Seat Quota Meter: Visual meter displaying active clients against approved seat quota.
Export .lic Request: 1-click download of logar_server.lic containing your Subordinate CA CSR and machine fingerprint for logar.eibl.tech.
Import License (.lic / ca.crt): Modal to paste or upload the activated .lic package or ca.crt issued by logar.eibl.tech. Activating updates your seat limit immediately and reloads mTLS context in-flight.
Sync & Renew via mTLS: Button to test or trigger immediate mTLS renewal against logar.eibl.tech and pull seat quota increases without restart.
Client Seat Management: View all enrolled nodes; click Revoke Seat to immediately drop and block an edge node at the socket layer, or Reactivate to restore access.

CLI Licensing Utilities

Export a .lic request file via CLI:

.\Server.exe --export-lic C:\LOGAR-Server\server.lic

Import an activated .lic license package or signed CA certificate via CLI:

.\Server.exe --import-lic C:\LOGAR-Server\activated.lic
# Or alternatively with --import-ca:
.\Server.exe --import-ca C:\LOGAR-Server\ca.crt

Synchronize license and check for seat quota increases against the master authority:

.\Server.exe --sync-license

Upstream Authority Deployment (Portainer GitOps & Reverse Proxy)

The upstream Master License Authority service (logar.eibl.tech) is compiled and deployed via Portainer GitOps from the LOGAR-LICENSING repository, running from gitea.eibl.tech/me0nline/logar-licensing:latest with automated pipeline compilation and persistent volume storage. Public traffic passes through a reverse proxy (e.g., Nginx Proxy Manager, Caddy) which validates mTLS client certificates against the Master Root CA and forwards client credentials.

5. Manual Windows Service Setup (via NSSM)

.\nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe"
.\nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
.\nssm.exe set LOGAR_Server AppStdout "C:\ProgramData\LOGAR-Server\server.log"
.\nssm.exe set LOGAR_Server AppStderr "C:\ProgramData\LOGAR-Server\server_err.log"
.\nssm.exe start LOGAR_Server

6. Uninstallation

If installed via the Inno Setup installer, use Windows Add/Remove Programs.

If installed manually via NSSM:

.\nssm.exe stop LOGAR_Server
.\nssm.exe remove LOGAR_Server confirm

7.7 KiB Raw Blame History