DTL_LicenseServer

The system combines a lightweight PHP and MariaDB Web service, a Python administration utility, and a Python client for Windows applications. User computers communicate only with the HTTPS API and never connect directly to MariaDB.

What?

The server covers administrative license creation, machine activation and refresh, online validation, deactivation, and controlled reactivation. A successful activation produces an Ed25519-signed token. MariaDB stores only the SHA-256 hash of each license key.

Why?

The system checks license status and expiry, the submitted machine, and the number of non-revoked activations. It keeps critical secrets on the server and lets client software rely on a centralized, traceable decision.

Architecture

The PHP API owns authorization logic and token signing. MariaDB stores products, licenses, activations, and the event history. The administration utility creates licenses, while the Windows client computes the machine fingerprint and stores its local token.

Lifecycle

1. A license is created for a product, customer, optional expiry, and maximum number of machines.
2. A first activation binds the license to the machine's SHA-256 fingerprint and receives an Ed25519 token.
3. The same machine can refresh its activation without consuming another slot.
4. Online validation checks the token, machine, activation, and current license state.
5. Deactivation revokes the activation and invalidates its token.
6. A revoked machine can later reactivate when a slot is available: its row is reused after the quota check.

Service interface

• health.php — service and MariaDB status;
• activate.php — machine activation, refresh, or reactivation;
• validate.php — online validation of a signed token;
• deactivate.php — revocation of the current machine;
• admin_create_license.php — creation protected by X-Admin-Key.

Reference data

The MariaDB schema distributed with the project defines the products, licenses, activations, license_events, and admin_users tables, together with the license_status view. The generic sample product is named MyProduct and uses the code MYPRODUCT.

Current limitation

The client stores next_check_days and offline_grace_days, but does not yet make its own offline-grace decision. Activation-attempt limit settings also exist in configuration without being enforced by the current scripts.

Security and privacy