diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 0ac6e84..0000000 Binary files a/.DS_Store and /dev/null differ diff --git a/.env b/.env index 2eecd48..6fa6f86 100644 --- a/.env +++ b/.env @@ -9,9 +9,9 @@ POSTGRES_DB=cryptlex EMAIL=joe.doe@mycompany.com WEB_API_DOMAIN=cryptlex-api.mycompany.com RELEASE_SERVER_DOMAIN=cryptlex-releases.mycompany.com -ADMIN_PORTAL_DOMAIN=admin-portal.mycompany.com -CUSTOMER_PORTAL_DOMAIN=customer-portal.mycompany.com -RESELLER_PORTAL_DOMAIN=reseller-portal.mycompany.com +ADMIN_PORTAL_DOMAIN=cryptlex-admin-portal.mycompany.com +CUSTOMER_PORTAL_DOMAIN=cryptlex-customer-portal.mycompany.com +RESELLER_PORTAL_DOMAIN=cryptlex-reseller-portal.mycompany.com # filestore - Minio or AWS S3 diff --git a/.github/workflows/codium_pr_agent.yml b/.github/workflows/codium_pr_agent.yml deleted file mode 100644 index a078b3a..0000000 --- a/.github/workflows/codium_pr_agent.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Codium PR Agent Workflow - -on: - pull_request: - types: [opened, reopened, ready_for_review] - issue_comment: - -jobs: - call-workflow: - uses: cryptlex/github-actions/.github/workflows/codium_pr_agent.yml@main - secrets: inherit - - diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e43b0f9 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.DS_Store diff --git a/README.md b/README.md index 3d3a476..ec15a04 100644 --- a/README.md +++ b/README.md @@ -1,182 +1,178 @@ # Cryptlex On-premise -Cryptlex On-premise provides a fully self-hosted deployment of Cryptlex for organizations that require complete control over infrastructure, data residency, security, and network environments. +Self-host the complete Cryptlex platform (Web API, Web Portals, Release Server, database, cache, and file store) on a single server using Docker Compose. It has all the features of SaaS Cryptlex, and regular releases keep you up to date. -It includes all major Cryptlex platform capabilities, including license management, activations, floating licenses, trials, entitlements, release management, and APIs, while allowing deployment within your own infrastructure. +This repository is for single-server deployments. For high-availability deployments on Kubernetes, use the [Cryptlex Helm charts](https://github.com/cryptlex/helm-charts). -Cryptlex On-premise can be deployed in: +## Architecture -* private cloud environments -* enterprise data centers -* staging and production clusters -* regulated or compliance sensitive environments +```mermaid +flowchart TB + clients([Browsers / SDKs]) -- "HTTPS (443), HTTP (80) redirects to HTTPS" --> proxy["reverse-proxy
(Traefik)"] ---- + proxy --> api[web-api] + proxy --> admin[admin-portal] + proxy --> customer[customer-portal] + proxy --> reseller[reseller-portal] + proxy --> release[release-server] -## Documentation - -| Topic | Description | -| ---------------------------------------------------------------------------- | ------------------------------------ | - | [docs/000-overview.md](docs/000-overview.md) | Overview of Cryptlex On-premise | - | [docs/010-system-requirements.md](docs/010-system-requirements.md) | Hardware and software requirements | - | [docs/000-overview.md#server-layout](docs/000-overview.md#server-layout) | Recommended deployment architectures | - | [docs/025-configuring-client-libraries.md](docs/025-configuring-client-libraries.md) | Configure SDKs for On-premise | - | [docs/030-monitoring-your-instance.md](docs/030-monitoring-your-instance.md) | Monitoring and observability setup | - ---- - -## Architecture Overview - -Cryptlex On-premise consists of multiple independently scalable services: - -* Cryptlex Web API -* Cryptlex Release Server -* PostgreSQL -* Redis -* Reverse proxy (Traefik) -* MinIO or S3 compatible storage - -The services can be deployed either: - -* on a single server for development/testing -* across multiple servers for staging and production environments - ---- - -## Deployment Models + api --> db[("database
(PostgreSQL)")] + api --> cache[("cache
(Valkey)")] + release --> api + release --> store[("filestore
(MinIO)")] +``` -### Single Server Deployment +`docker-compose.yml` defines the following services: -Recommended for: +| Service | Purpose | +| ----------------- | ------------------------------------------------------ | +| `web-api` | Cryptlex Web API | +| `admin-portal` | Admin Portal | +| `customer-portal` | Customer Portal | +| `reseller-portal` | Reseller Portal | +| `release-server` | Handles upload and download of releases | +| `database` | PostgreSQL database storing all Cryptlex data | +| `cache` | Valkey (Redis-compatible) cache | +| `filestore` | MinIO, S3-compatible object storage for release files | +| `reverse-proxy` | Traefik, routes traffic and manages SSL certificates | -* development environments -* testing -* low volume deployments +If you don't use [release management](https://cryptlex.com/docs/release-management/overview), you can comment out the `release-server` and `filestore` services in `docker-compose.yml`. -Features: +## Requirements -* simple deployment -* minimal infrastructure requirements -* all services hosted together +- A Cryptlex license key and access to the private Docker images. If you are installing for the first time, [contact us](https://cryptlex.com/contact) to schedule a guided installation. +- A Linux server with: + - Docker 20.10.22 or higher + - dual-core CPU (quad-core recommended for higher volumes) + - 6 GB memory + - 20 GB+ storage (grows with the number of licenses and activations) +- Ports 80 and 443 reachable from the internet, required by Let's Encrypt to issue SSL certificates. To use your own certificates instead, see [Custom SSL certificates](#custom-ssl-certificates). ---- +## Installation -### Distributed Deployment +### 1. Create DNS records -Recommended for: +Create five A or CNAME records at your DNS provider, all pointing to the IP address or hostname of your server: -* production environments -* high availability deployments -* scalable enterprise workloads +| Sub-domain (example) | Service | +| ---------------------------------------- | --------------- | +| `cryptlex-api.mycompany.com` | Web API | +| `cryptlex-admin-portal.mycompany.com` | Admin Portal | +| `cryptlex-customer-portal.mycompany.com` | Customer Portal | +| `cryptlex-reseller-portal.mycompany.com` | Reseller Portal | +| `cryptlex-releases.mycompany.com` | Release Server | -Features: +### 2. Clone the repository -* external PostgreSQL -* external Redis -* load balancer support -* horizontal scaling -* storage redundancy support +```bash +git clone https://github.com/cryptlex/cryptlex-on-premise +cd cryptlex-on-premise +chmod 600 acme.json +``` ---- +`acme.json` stores the Let's Encrypt SSL certificates; Traefik requires it to have `600` permissions. -## System Requirements +### 3. Configure environment variables -### Minimum Requirements +**`.env`** -| Resource | Requirement | -| ---------- | ------------------ | -| CPU | Dual core | -| Memory | 1 GB minimum | -| Storage | 5 GB minimum | -| Docker | 20.10.22 or higher | -| PostgreSQL | 13.x or higher | +| Variable | Description | +| --------------------------------------------------- | ----------------------------------------------------------- | +| `POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD` | Database name and credentials. | +| `EMAIL` | Email address for SSL certificate notifications. | +| `WEB_API_DOMAIN`, `ADMIN_PORTAL_DOMAIN`, `CUSTOMER_PORTAL_DOMAIN`, `RESELLER_PORTAL_DOMAIN`, `RELEASE_SERVER_DOMAIN` | The five domains created in step 1. | +| `FILE_STORE_ACCESS_KEY`, `FILE_STORE_SECRET_KEY` | Credentials for the file store. | +| `GOOGLE_CLIENT_ID` | Optional, only needed to enable Google SSO. | +| `MAXMIND_ACCOUNT_ID`, `MAXMIND_LICENSE_KEY` | Optional, MaxMind credentials for GeoIP. | -### Recommended Production Requirements +**`web-api.env`** -| Resource | Recommendation | -| -------- | ----------------------------- | -| CPU | Quad core or higher | -| Memory | 4 GB or higher | -| Storage | SSD backed persistent storage | -| Database | Managed PostgreSQL cluster | -| Cache | Dedicated Redis instance | +| Variable | Description | +| ------------------------- | ------------------------------------------------------------------------------------------------ | +| `ENCRYPTION_KEY` | Any random string, used to encrypt the private keys and other secrets stored in the database. | +| `RSA_PASSPHRASE` | Same value as `ENCRYPTION_KEY`. Deprecated; will be removed in a future release. | +| `APPLICATION_LICENSE_KEY` | The license key for your on-premise Cryptlex server. | ---- +Additionally, configure the `SMTP_*` and `EMAIL_*` sender settings so the server can send emails. -## Configuring Client Libraries +**`release-server.env`** -By default, Cryptlex SDKs communicate with `api.cryptlex.com`. +| Variable | Description | +| ---------------------------------------- | ----------------------------------------------------------------- | +| `FILE_STORE_BUCKET` | Name of the bucket where release files are stored. | +| `FILE_STORE_REGION`, `FILE_STORE_USE_SSL` | Only change these if you use AWS S3 instead of the bundled MinIO. | -For On-premise deployments, configure your applications to use your self-hosted Cryptlex endpoint. +### 4. Start the services -Example using LexActivator: +Log in to Docker Hub with the account that has access to the Cryptlex images, then start the stack: -```c -status = SetCryptlexHost("https://cryptlex-api.mycompany.com"); +```bash +docker login -u $DOCKER_USERNAME +docker compose up -d ``` -See: - -* [Configuring client libraries](docs/025-configuring-client-libraries.md) +Check the logs for any errors: ---- +```bash +docker compose logs -t -f +``` -## Monitoring +Traefik automatically obtains SSL certificates for the five domains, stores them in `acme.json`, and routes traffic to the respective containers. -Cryptlex supports integrations with: +> **Note:** `docker-compose.yml` pins the PostgreSQL version. Once the database has data, moving to a newer major version requires a database migration. -* New Relic -* Bugsnag +### 5. Create your account -This allows monitoring of: +Open `https:///auth/signup` in the browser and sign up. Only one account can be created on an on-premise instance. -* service health -* application errors -* infrastructure stability -* alerting workflows +## Custom SSL certificates -See: -* [Monitoring your instance](docs/030-monitoring-your-instance.md) +To use your own SSL certificates instead of Let's Encrypt, follow the steps in [ssl/README](ssl/README). ---- +## Configuring client libraries -## Storage Components +By default, Cryptlex SDKs send requests to `api.cryptlex.com`. Point them to your on-premise Web API endpoint instead. This is the only integration change; everything else works as described in [Using LexActivator](https://cryptlex.com/docs/node-locked-licenses/using-lexactivator). -### PostgreSQL +**LexActivator**: call `SetCryptlexHost()` (available in all language bindings): -Primary database service used by Cryptlex Enterprise. +```c +status = SetCryptlexHost("https://cryptlex-api.mycompany.com"); +``` -### Redis +**LexFloatServer**: set `cryptlexHost` in its `config.yml`: -Caching service used for performance optimization. +```yaml +server: + cryptlexHost: https://cryptlex-api.mycompany.com +``` -### MinIO / S3 Compatible Storage +## Updating -Object storage service used for application file storage. +From the directory where you cloned this repository: ---- +```bash +./update.sh +``` -## Supported Platforms +The script pulls the latest images and restarts the updated services; average downtime is under a minute. Check the logs afterwards with `docker compose logs -t -f`. -Cryptlex On-premise can run on: +## Monitoring -* Linux -* Windows -* macOS +Cryptlex integrates with [OpenTelemetry](https://opentelemetry.io/) to collect logs, metrics, and traces from your instance, which you can export to any OTel-compatible backend (Grafana, Datadog, New Relic, Elastic, Splunk, etc.) to monitor health, set up alerts, and troubleshoot issues. -Provided Docker requirements are met. +To enable it, uncomment and set the following variables in `web-api.env`: ---- +| Variable | Description | +| ------------------------------ | ---------------------------------------------------------------------- | +| `OTEL_EXPORTER_OTLP_ENDPOINT` | OTLP endpoint of your monitoring backend. Logs are always exported once this is set. | +| `OTEL_ENABLEMETRICS` | Set to `true` to export metrics. | +| `OTEL_ENABLETRACES` | Set to `true` to export traces. | +| `OTEL_EXPORTER_OTLP_HEADERS` | Headers for backend authentication, as comma-separated `key=value` pairs. | ## Support -For assistance, enterprise inquiries, or deployment guidance: - -* [support@cryptlex.com](mailto:support@cryptlex.com) - ---- +For assistance, enterprise inquiries, or deployment guidance, [contact us](https://cryptlex.com/contact). ## License -Commercial software. -Contact Cryptlex for licensing details. \ No newline at end of file +Commercial software. Contact Cryptlex for licensing details. \ No newline at end of file diff --git a/assets/.DS_Store b/assets/.DS_Store deleted file mode 100644 index d2f5d77..0000000 Binary files a/assets/.DS_Store and /dev/null differ diff --git a/assets/cryptlex-on-premise.png b/assets/cryptlex-on-premise.png deleted file mode 100644 index 60578b4..0000000 Binary files a/assets/cryptlex-on-premise.png and /dev/null differ diff --git a/docs/.DS_Store b/docs/.DS_Store deleted file mode 100644 index c895f03..0000000 Binary files a/docs/.DS_Store and /dev/null differ diff --git a/docs/000-overview.md b/docs/000-overview.md deleted file mode 100644 index fb58041..0000000 --- a/docs/000-overview.md +++ /dev/null @@ -1,16 +0,0 @@ -# Cryptlex On-premise - -Cryptlex On-premise offers a self-hosted version of Cryptlex for organizations that need or want to manage their own data. It can be run in your existing environments. - -Cryptlex On-premise has all the features of SaaS Cryptlex and regular releases ensure you are kept up to date. All client libraries can easily be configured to send license activation requests to your Cryptlex On-premise instance. - -## Server Layout - -![Single Server Layout](../assets/cryptlex-on-premise.png) - -This configuration uses a single server to host all of the components for Cryptlex including the web portals. In this deployment model, there is no service redundancy. For this reason, this model should be limited to the following purposes: - -* Development servers or workstations -* Small production deployments - -To find out more or discuss your requirements please contact [support@cryptlex.com](mailto:support@cryptlex.com). \ No newline at end of file diff --git a/docs/010-system-requirements.md b/docs/010-system-requirements.md deleted file mode 100644 index 73135f1..0000000 --- a/docs/010-system-requirements.md +++ /dev/null @@ -1,33 +0,0 @@ -# System Requirements - -## Operating System - -Cryptlex On-premise is deployed using Docker. Hence it can be deployed on any Linux, Mac, and Windows-based servers that can run current versions of Docker (at least version 20.10.22 or higher). - -## Storage and Memory - -Cryptlex requires a minimum of 5GB to function for its database and docker images. Your exact storage size requirements will vary depending on the volume of licenses and the number of activations. - -Cryptlex requires at least 3GB of memory to function. If the database is also installed on the same server then at least 6GB of memory is required. - -## CPU - -Cryptlex requires at least a dual-core CPU, and that will work for low volume installations. For anything more than that we recommend going with a quad-core CPU. - -## Software - -### Docker - -Cryptlex requires at least version 20.10.22 (or higher) of Docker. - -### Database - -Cryptlex requires PostgreSQL 13.x (or higher) for storing all the data. - -### Cache - -Cryptlex uses Valkey (Redis) for storing the cache data. - -### Filestore - -It uses [Minio](https://www.minio.io/), which is an Amazon S3 compatible object storage server, for storing release files. In case you do not want to use the Cryptlex [release management](https://cryptlex.com/docs/release-management/overview) API, this is not required. \ No newline at end of file diff --git a/docs/020-Installation-Guide/.DS_Store b/docs/020-Installation-Guide/.DS_Store deleted file mode 100644 index 0aea92b..0000000 Binary files a/docs/020-Installation-Guide/.DS_Store and /dev/null differ diff --git a/docs/020-Installation-Guide/0200-docker.md b/docs/020-Installation-Guide/0200-docker.md deleted file mode 100644 index 2e981c7..0000000 --- a/docs/020-Installation-Guide/0200-docker.md +++ /dev/null @@ -1,199 +0,0 @@ -# Docker Compose Installation Guide - -## Before installation - -To get started with your Cryptlex On-premise installation, you will need the following things prepared in advance: - -- If this is your first time installing Cryptlex On-premise, you will need to [contact us](mailto:support@cryptlex.com) to schedule a guided installation. We’ll get you set up with a license key, and walk you through the installation process. -- A server meeting the [minimum system requirements](../010-system-requirements.md). - -## Installation - -Cryptlex On-premise uses [Docker Compose](https://docs.docker.com/compose/) to perform and manage installations. To install Cryptlex On-premise we first need to install and configure Docker Compose. - -### Install Docker Compose - -Please refer to following installation guide: [https://docs.docker.com/compose/install/](https://docs.docker.com/compose/install/) - -### Using Docker Compose - -All of the Cryptlex Docker images are available on [Docker Hub](https://hub.docker.com/u/cryptlex). If you’re looking for a complete configuration to get up and running quickly, follow the steps below. - -#### Step 1: Create custom A or CNAME records - -You will need to create five A or CNAME records for the server machine where you will be deploying Cryptlex. For this tutorial we will choose the following five sub-domains: - -`cryptlex-api.mycompany.com` for the Web API Server - -`cryptlex-admin-portal.mycompany.com` for the Admin Portal - -`cryptlex-customer-portal.mycompany.com` for the Customer Portal - -`cryptlex-reseller-portal.mycompany.com` for the Reseller Portal - -`cryptlex-releases.mycompany.com` for the Release Server - -Now to create the records: - -- Go to your DNS provider’s website (e.g. [GoDaddy](https://ie.godaddy.com/help/add-a-cname-record-19236) or [Cloudflare](https://www.cloudflare.com/dns/)). -- Create A or CNAME records for the above custom domains. -- Point all of them to the same IP address or hostname of your server. - -#### Step 2: Clone the cryptlex-on-premise repository - -Next, you need to login into your Linux server machine and clone the [cryptlex-on-premise](https://github.com/cryptlex/cryptlex-on-premise) repository inside any folder and execute the following commands: - -```bash -git clone https://github.com/cryptlex/cryptlex-on-premise -cd cryptlex-on-premise -chmod 0600 acme.json -``` - -The `acme.json` will store the SSL certificates, which will be generated for the above five sub-domains. - -#### Step 3: Update the Postgres version - -In the `docker-compose.yml` file change the value of `services.database.image` property to the current stable version of [Postgres](https://hub.docker.com/_/postgres). For example, if the latest version is 14.5 then set the value to `postgres:14.5-alpine`. Once the version is set, it cannot be updated later without migrating the database to a newer major version. - -#### Step 4: Update the environment variables - -The `cryptlex-on-premise` folder contains the following four files with environment variables that need to be updated with the correct values. - -**Update `.env` file** - -The `.env` file contains the following environment variables which you may need to update: - -| Environment Variables | Description | -| ------------------------ | ---------------------------------------------------------------------------------------------------------------------- | -| `POSTGRES_DB` | Name of the database. | -| `POSTGRES_USER` | Username of the database user. | -| `POSTGRES_PASSWORD` | The password of the database user. | -| `EMAIL` | Email required for SSL certificate notifications. | -| `WEB_API_DOMAIN` | The domain of the web API server. In this case: `cryptlex-api.mycompany.com` | -| `ADMIN_PORTAL_DOMAIN` | The domain of the Admin Portal. In this case: `cryptlex-admin-portal.mycompany.com` | -| `RESELLER_PORTAL_DOMAIN` | The domain of the Reseller Portal. In this case: `cryptlex-reseller-portal.mycompany.com` | -| `CUSTOMER_PORTAL_DOMAIN` | The domain of the Customer Portal. In this case: `cryptlex-customer-portal.mycompany.com` | -| `RELEASE_SERVER_DOMAIN` | The domain of the release server. In this case: `cryptlex-releases.mycompany.com` | -| `FILE_STORE_ACCESS_KEY` | Access key for the file store. | -| `FILE_STORE_SECRET_KEY` | The secret key for the file store. | -| `GOOGLE_CLIENT_ID` | This is needed in case you want to enable Google SSO. | - -**Update `webapi.env` file** - -The `webapi.env` file contains the following environment variables which you **must** update: - -| Environment Variables | Description | -| ------------------------- | ------------------------------------------------------------------------------------------------------------ | -| `ENCRYPTION_KEY` | Use any random string, this is used to encrypt the private keys and other secrets stored in the database. | -| `RSA_PASSPHRASE` | Set the same value as `ENCRYPTION_KEY`. This property is deprecated and will be removed in a future release. | -| `APPLICATION_LICENSE_KEY` | The license key which you get after you purchase the license for the self-hosted Cryptlex server. | - -Other than the above three you need to set environment variables for the email provider, and additionally you can configure other monitoring and error reporting services. - -**Update `release-server.env` file** - -The `release-server.env` file contains the following environment variables which you may need to update: - -| Environment Variables | Description | -| --------------------- | --------------------------------------------------------------------------------------------------------- | -| `FILE_STORE_BUCKET` | Name of the bucket (folder) where you want to store all your files. | -| `FILE_STORE_REGION` | This is required in case you are using the AWS S3 file store, otherwise, leave the default value as such. | -| `FILE_STORE_USE_SSL` | This should only be set to true in case you are using AWS S3. | - -#### Step 5: Run Docker Compose - -Execute the following commands to start the server: - -Ensure you have access to Cryptlex Docker images - -```bash -docker login -u $DOCKER_USERNAME -``` - -### Start the Cryptlex services - -```bash -docker compose up -d -``` - -### Check the logs for any errors - -```bash -docker compose logs -t -f -``` - -The [Traefik](https://traefik.io/) reverse proxy server configured in the `docker-compose.yml` file will automatically generate SSL certificates for the above-mentioned domains and store them in `acme.json`. Additionally, it will automatically route the traffic to the respective containers. - -#### Step 6: Signup for the Cryptlex account - -Next, you need to open the dashboard in the browser and create your Cryptlex account, which can be done at the following URL: **https://cryptlex-admin-portal.mycompany.com/auth/signup.** - - Only one Cryptlex account can be created in the on-premise version. - -### Docker Compose file details - -In the [docker-compose.yml](https://github.com/cryptlex/cryptlex-on-premise/blob/master/docker-compose.yml) file you will find the `database`, `filestore`, `cache`, `web-api`, `admin-portal`, `reseller-portal`, `customer-portal`, `release-server`, and `reverseproxy` services. Read below to better understand how each service is configured. - -#### Database service - -It contains the Postgres database server, which is used to store all the Cryptlex data. - -#### Cache service - -It uses [Valkey](https://valkey.io/) to store the cache data. If no Valkey database is provided it defaults to memory. - -#### Filestore service - -It stores release files using Minio, an AWS S3 compatible object storage server. In case you do not want to use Cryptlex [release management](https://cryptlex.com/docs/release-management/creating-releases) API, this service can be commented out in the `docker-compose.yml` file. - -#### Web API service - -It is the core service that runs the Cryptlex web API server. - -#### Admin Portal service - -This service runs the Cryptlex admin portal. - -#### Reseller Portal service - -This service runs the Cryptlex reseller portal. - -#### Customer Portal service - -This service runs the Cryptlex customer portal. - -#### Release server service - - It handles the upload and download of releases you create in Cryptlex. In case you do not want to use Cryptlex [release management](https://cryptlex.com/docs/release-management/creating-releases) API, this service can be commented out in the `docker-compose.yml` file. - -#### Reverse proxy service - -It uses [Traefik](https://traefik.io/) reverse proxy server to route the traffic and automatically generates and renews the SSL certificates for the `WEB_API_DOMAIN` , `RELEASE_SERVER_DOMAIN`, `ADMIN_PORTAL_DOMAIN`, `RESELLER_PORTAL_DOMAIN` and `CUSTOMER_PORTAL_DOMAIN`. - -### Checking logs - -To prevent logs from taking up the whole disk space, `20MB` limit has been applied to all the containers in the `docker-compose.yml` file. You can change that as per your requirements. - -To view the logs in realtime you can execute the following command: - -```bash -docker compose logs -t -f -``` - -## Upgrading - -First login to your Linux server machine where Cryptlex is deployed and go to the directory where the `cryptlex-on-premise` repository was initially cloned. Then execute the following commands: - -### Execute the update script - -```bash -./update.sh -``` - -### Check container logs - -```bash -docker compose logs -t -f -``` - - **Note:** The average downtime during the update is less than 1 minute. \ No newline at end of file diff --git a/docs/025-configuring-client-libraries.md b/docs/025-configuring-client-libraries.md deleted file mode 100644 index 0a195c8..0000000 --- a/docs/025-configuring-client-libraries.md +++ /dev/null @@ -1,44 +0,0 @@ -# Configuring Client Libraries - -## LexActivator - -By default, LexActivator will send license and trial activation requests to **api.cryptlex.com** - -You’ll need to configure your applications to send license and trial activation requests to your On-premise installation, at the hostname:port you configured for the Cryptlex Web API server endpoint. - -For example, in C/C++ applications: - -```c -int status; -status = SetProductData("PASTE_CONTENT_OF_PRODUCT.DAT_FILE"); -if (LA_OK != status) -{ - // handle error -} -status = SetProductId("PASTE_PRODUCT_ID", LA_USER); -if (LA_OK != status) -{ - // handle error -} -status = SetCryptlexHost("https://cryptlex-api.mycompany.com"); -if (LA_OK != status) -{ - // handle error -} -``` - -Similarly you can use the `SetCryptlexHost()` LexActivator API function for other programming languages. - -**Note:** The only additional configuration required for On Premise deployments is setting the Cryptlex host using `SetCryptlexHost()` to point to your On-premise Web API endpoint. Apart from this change, the integration and usage of LexActivator remains the same as described in our ["Using LexActivator"](https://cryptlex.com/docs/node-locked-licenses/using-lexactivator) guide. - - -## LexFloatServer - -By default, LexFloatServer will send its own license activation request to **api.cryptlex.com** - -In order to configure LexFloatServer to send the license activation requests to your On-premise installation, you should update **cryptlexHost** property in the LexFloatServer `config.yml` file: - -```bash -server: - cryptlexHost: https://license-api.example.com -``` diff --git a/docs/030-monitoring-your-instance.md b/docs/030-monitoring-your-instance.md deleted file mode 100644 index 7bab134..0000000 --- a/docs/030-monitoring-your-instance.md +++ /dev/null @@ -1,9 +0,0 @@ -# Monitoring your Instance - -Cryptlex integrates with [OTel](https://opentelemetry.io/) which you can use to monitor the health of your Cryptlex instance, set up alerts and get notified on errors. - -## Setting up OTel - -Cryptlex integrates with OpenTelemetry (OTel), an open standard for observability, which can be used to collect metrics, traces, and logs from your Cryptlex instance. You can export this telemetry data to your preferred monitoring platform, such as Grafana, Datadog, New Relic, Elastic, Splunk, or any other OpenTelemetry compatible backend. - -Using OpenTelemetry, you can monitor the health and performance of your Cryptlex instance, create alerts, troubleshoot issues, and gain visibility into application behavior. \ No newline at end of file diff --git a/migrate.md b/migrate.md index 08f39e3..eb8dcb3 100644 --- a/migrate.md +++ b/migrate.md @@ -1,12 +1,10 @@ # Migrating to the Traefik v3 setup -> Temporary document — delete once all customers are on the new setup. - ## What changed - **Traefik 1.7 → v3.7.** Static config moved from `traefik.toml` (deleted) to the `command:` flags in `docker-compose.yml`; TLS/custom-cert config moved to `dynamic/tls.yml`. - **Valkey cache enabled** (`cache` service, Redis-compatible); `web-api` uses it via `REDIS_URL`. -- **`geoip` service removed** — web-api uses the MaxMind credentials directly. +- **`geoip` service removed**; `web-api` uses the MaxMind credentials directly. - **`dashboard` service removed** (replaced by the portals) along with `dashboard.env`, and the Traefik admin dashboard (`TRAEFIK_BASIC_AUTH`) is gone. - **Internal services no longer published on random host ports** (`ports:` → `expose:`); only Traefik's 80/443 are exposed. @@ -15,8 +13,8 @@ 1. Backup the old files: `cp docker-compose.yml docker-compose.yml.bak && cp .env .env.bak` 2. `docker compose down` (data in named volumes is preserved). 3. Replace `docker-compose.yml` and `update.sh`, add `dynamic/tls.yml`, delete `traefik.toml` and `dashboard.env`. -4. In `.env`: remove `DASHBOARD_DOMAIN` and `TRAEFIK_BASIC_AUTH`; keep everything else as the customer had it. -5. Reset `acme.json` — the v1 ACME format is incompatible with v3, and v3 requires strict permissions: +4. In `.env`: remove `DASHBOARD_DOMAIN` and `TRAEFIK_BASIC_AUTH`; keep your existing values for everything else. +5. Reset `acme.json`; the v1 ACME format is incompatible with v3, and v3 requires strict permissions: ```bash > acme.json && chmod 600 acme.json ``` @@ -26,14 +24,14 @@ ## Verify -- `docker compose ps` — all services up; `database` and `cache` healthy. -- `docker compose logs reverse-proxy` — no ACME/TLS errors. -- Portals and web API load over HTTPS with a valid certificate. +- `docker compose ps`: all services up; `database` and `cache` healthy. +- `docker compose logs reverse-proxy`: no ACME/TLS errors. +- Portals and Web API load over HTTPS with a valid certificate. ## Keep in mind -- Customers must be off the legacy dashboard URL before migrating; its DNS record can be dropped afterwards. +- Make sure nothing still uses the legacy dashboard URL before migrating; you can drop its DNS record afterwards. - Let's Encrypt re-issues certs for all domains on first start, so 80/443 must be reachable from the internet. -- Customer-specific customizations (external Postgres/S3, extra services) must be ported by hand — diff against `docker-compose.yml.bak`. +- If you customized your deployment (external Postgres/S3, extra services), port those changes by hand by diffing against `docker-compose.yml.bak`. - The network MTU override (1300) is now commented out, so the recreated network uses the default 1500. Re-enable it (see the comment in `docker-compose.yml`) only for hosts on VPN/overlay networks with MTU below 1500. -- The project name is now pinned (`name: cryptlex-on-premise`). Before migrating, run `docker volume ls` — if the customer's volumes are not named `cryptlex-on-premise_database_data` / `cryptlex-on-premise_filestore_data` (i.e. they deployed from a differently named directory), starting the new stack would create fresh empty volumes instead of using their data. In that case the existing volumes must first be copied to ones carrying the `cryptlex-on-premise_` prefix (renaming the deployment directory alone does not rename volumes). +- The project name is now pinned (`name: cryptlex-on-premise`). Before migrating, run `docker volume ls`. If your volumes are not named `cryptlex-on-premise_database_data` / `cryptlex-on-premise_filestore_data` (i.e. you deployed from a differently named directory), starting the new stack would create fresh empty volumes instead of using your data. In that case, first copy the existing volumes to ones carrying the `cryptlex-on-premise_` prefix (renaming the deployment directory alone does not rename volumes). diff --git a/web-api.env b/web-api.env index 279fe9a..b7d3f39 100644 --- a/web-api.env +++ b/web-api.env @@ -1,4 +1,4 @@ -# Wep API server settings +# Web API server settings PORT=5000 FORCEHTTPS=false RSA_PASSPHRASE=PASTE_RSA_SECRET @@ -19,17 +19,19 @@ EMAIL_SIGNATURE=

Thanks,
The Company Team

#SMTP_USERNAME= #SMTP_PASSWORD= -#MAILGUN_APIKEY= -#MAILGUN_DOMAIN= - -#SENDGRID_APIKEY= - # Error monitoring #BUGSNAG_APIKEY= -# App metrics -#NEW_RELIC_LICENSE_KEY= - -GOOGLE_ANALYTICS_KEY=UA-XXXXXXXX-X +# App metrics (OpenTelemetry) +# Optional: only for New Relic (sets the app/service name). +#NEW_RELIC_APP_NAME= +#OTEL_EXPORTER_OTLP_ENDPOINT= +#OTEL_ENABLEMETRICS=true +#OTEL_ENABLETRACES=true +# Comma-separated key=value pairs, e.g. api-key=YOUR_BACKEND_API_KEY +#OTEL_EXPORTER_OTLP_HEADERS= + +# Optional: Google Analytics +#GOOGLE_ANALYTICS_KEY=G-XXXXXXXXXX