61 lines
4.6 KiB
Markdown
61 lines
4.6 KiB
Markdown
# LOGAR Release v2.0.1
|
||
|
||
Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.
|
||
|
||
### Key Highlights & Changes in v2.0.1:
|
||
|
||
- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**:
|
||
- Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`).
|
||
- Standardized tag matching for Gitea Actions on `push: tags: ['v*']`.
|
||
- Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`).
|
||
- Retired deprecated `release-linux.yml` and `release-windows.yml` files.
|
||
|
||
- **Installer & Engine Version Bump**:
|
||
- Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`.
|
||
- Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`.
|
||
- Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`.
|
||
|
||
- **Distribution & Release Documentation**:
|
||
- Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.
|
||
|
||
---
|
||
|
||
# LOGAR Release v2.0.0
|
||
|
||
Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.
|
||
|
||
### Key Highlights & Changes in v2.0.0:
|
||
|
||
- **mTLS 1.3 Transport Security & Runtime Licensing**:
|
||
- Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (`ssl.CERT_REQUIRED`, TLS 1.3 minimum version).
|
||
- Hub dynamically validates incoming client Common Name (`client_id`) against active license seats in SQLite during the TLS handshake.
|
||
- Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.
|
||
|
||
- **Dynamic Hub PKI Engine (`src/server_enrollment.py`)**:
|
||
- Automatically initializes an internal RSA-4096 Root CA (`ca.crt` / `ca.key`).
|
||
- Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
|
||
- Full OpenSSL 3.x and Python 3.12–3.14 compatibility via `SubjectKeyIdentifier` and `AuthorityKeyIdentifier` certificate extensions.
|
||
- Generates and signs client certificates on demand via `POST /api/client/enroll`.
|
||
|
||
- **In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading**:
|
||
- Server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, evaluated every 12 hours) alongside startup checks.
|
||
- Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
|
||
- Generates renewed certificates on disk with timestamped backups (`.bak`), and reloads active `ssl.SSLContext` in memory dynamically without dropping socket listeners or restarting the background service.
|
||
|
||
- **Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal**:
|
||
- **Proactive**: Forwarders (`Win_Client.py` and `Linux_Client.py`) evaluate `client.crt` validity before each run, auto-renewing via `/api/client/enroll` if expiring within 30 days.
|
||
- **Reactive**: If the hub rotates its Root CA or a TLS verification error (`ssl.SSLError` / `SSLCertVerificationError`) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.
|
||
|
||
- **Database Schema & License Quota Accounting**:
|
||
- SQLite tables `license_config` (`max_seats`, `enrollment_secret`) and `clients` (`client_id`, `hostname`, `os_type`, `cert_fingerprint`, `status`, timestamps).
|
||
- Enforces seat limits on enrollment (`HTTP 403 License seat limit reached`) while allowing active registered nodes to re-enroll/renew indefinitely.
|
||
- Added `GET /api/clients` endpoint for license auditing and telemetry tracking.
|
||
|
||
- **Automated Service Installers**:
|
||
- **Windows**: Self-contained Inno Setup installers (`LOGAR-Client-Setup.exe` and `LOGAR-Server-Setup.exe`) bundling `nssm.exe` to register, configure, and start Windows services automatically.
|
||
- **Linux**: Automated installer scripts (`compilation/install_linux_client.sh` and `install_linux_server.sh`) deploying systemd service units with auto-restart policies.
|
||
|
||
- **CI/CD Release Workflows**:
|
||
- Windows workflow (`.gitea/workflows/release-windows.yml`) and Linux workflow (`.gitea/workflows/release-linux.yml`) automated to build native executables, installers, and upload release assets on tag push.
|
||
|