Licensing

PteroCloud is a commercial Pterodactyl extension. Its control layer is gated by a signed runtime lease issued by the Krapple licensing server.

• License states — the full state vocabulary.
• Runtime — lease refresh and enforcement points.
• Offline behaviour — there is no unlimited offline mode.
• Recovery — unlocking after a problem.
• Troubleshooting — diagnosis.
• Security — tamper resistance and honest limits.

Principles

1. Fail closed. No valid license means no install; no valid signed runtime lease means the control layer is locked. A missing class, an HTTP/JSON/ signature failure, a missing cache or an exception never results in "allowed".
2. Infrastructure is never collateral. Licensing never deletes or destroys customer VMs, disks, backups or IPs. Only the control layer locks. Existing QEMU/Proxmox workloads keep running and can always be powered, deleted, backed up, restored in place or recovered.
3. Only a signature is authority. A local database flag, a local expires_at, a local feature array or a client-supplied flag is never trusted. The Ed25519 signature over the exact signed lease bytes is the root of trust.
4. No bypass switches. There is no --skip-license, no licensing.enabled=false, and no universal dev/test license that can load in production.

Architecture

Krapple server (private signing key)
            │  signed lease (Ed25519)
            ▼
KrappleLicenseClient ──► LeaseVerifier ──► LeaseStore ──► LicenseGate
   (transport)             (crypto)         (persist)     (enforcement)

• KrappleLicenseClient — HTTP transport (activate/validate/heartbeat). Holds only the pinned public key.
• LeaseVerifier — verifies signature, kid, product, installation binding, schema version and time windows.
• LeaseStore — persists the signed lease (encrypted at rest) and re-verifies it on every read.
• LicenseGate — the single enforcement point.
• LicenseIntegrityService — verifies a signed release manifest over security-critical files.

What the customer sees

When locked, customers see only a generic "temporarily unavailable". No license details, plan, key or billing information is exposed to customers. Operators see the full diagnostics on the admin license page.

Commands

Command	Purpose
pterocloud:license:status	Secret-free status (--json).
pterocloud:license:verify	Verify lease + integrity.
pterocloud:license:activate	One activation attempt.
pterocloud:license:refresh	Fetch a fresh lease.
pterocloud:license:deactivate	Release the installation slot (confirmation).
pterocloud:license:diagnostics	Secret-free support diagnostics (--json).

Honest scope

This is strong commercial tamper resistance, not magic. A determined root user on the host can patch both the code and the verifier. What it does reliably is prevent casual copying, detect edited/copied leases, enforce server-authoritative suspension/revocation, and make naive tampering fail closed rather than open. See Security.