AI Ingestion
Hardware Locks
Professional and Enterprise licenses are cryptographically bound to a physical host. This "Hardware Lock" ensures that the appliance operates only on authorized hardware, preventing unauthorized cloning or distribution of the binary environment.
Trust Platform Module (TPM)
The licensing system relies on the hardware's TPM 2.0 module for a unique, immutable identifier for the machine. TPM-based identity was chosen because it's resilient to hardware virtualization and component swaps.
The Ledger binary requires access to the TPM resource to perform validation. You must add the user running the appliance to the tss (Trusted Software Stack) group to allow the retrieval of the public Endorsement Key.
LXC Container Passthrough (on the host)
# Find the major/minor numbers (ie: 253, 65536)
ls -l /dev/tpmrm0
# Add them to your LXC Container:
nano /etc/pve/lxc/ID.conf
# Add this to the book of your file
lxc.cgroup2.devices.allow: c 253:65536 rwm
lxc.mount.entry: /dev/tpmrm0 dev/tpmrm0 none bind,optional,create=file
chmod 666 /dev/tpmrm0
LXC Container
sudo apt install -y tpm2-tools libtss2-tcti-tabrmd0
sudo usermod -aG tss application_user
# Note: A logout/login or service restart is required
groups application_user
Provisioning Process
Before a license file can be issued, you must extract your Machine Hash and provide it to our provisioning team. This hash is a SHA-256 representation of your hardware's unique public Endorsement Key (EK).
Use the provided Gateway Shell to identify the machine_id for each server. To support high-availability infrastructures, we recommend submitting multiple IDs for backup ledgers and dedicated reader instances.
While hardware locks are utilized to align licensing tiers with infrastructure scale, they are designed with a built-in sunset:
- Professional & Enterprise: Hardware locks expire after five years. This ensures your ability to migrate to new hardware without vendor intervention.
- Sovereign: Designed for total autonomy, these licenses bypass hardware locking entirely from day one.
Additional IDs can be provisioned during initial setup or as your infrastructure expands.
Hardware Locks
Professional and Enterprise licenses are cryptographically bound to a physical host. This "Hardware Lock" ensures that the appliance operates only on authorized hardware, preventing unauthorized cloning or distribution of the binary environment.
Trust Platform Module (TPM)
The licensing system relies on the hardware's TPM 2.0 module for a unique, immutable identifier for the machine. TPM-based identity was chosen because it's resilient to hardware virtualization and component swaps.
The Ledger binary requires access to the TPM resource to perform validation. You must add the user running the appliance to the tss (Trusted Software Stack) group to allow the retrieval of the public Endorsement Key.
LXC Container Passthrough (on the host)
# Find the major/minor numbers (ie: 253, 65536)
ls -l /dev/tpmrm0
# Add them to your LXC Container:
nano /etc/pve/lxc/ID.conf
# Add this to the book of your file
lxc.cgroup2.devices.allow: c 253:65536 rwm
lxc.mount.entry: /dev/tpmrm0 dev/tpmrm0 none bind,optional,create=file
chmod 666 /dev/tpmrm0
LXC Container
sudo apt install -y tpm2-tools libtss2-tcti-tabrmd0
sudo usermod -aG tss application_user
# Note: A logout/login or service restart is required
groups application_user
Provisioning Process
Before a license file can be issued, you must extract your Machine Hash and provide it to our provisioning team. This hash is a SHA-256 representation of your hardware's unique public Endorsement Key (EK).
Use the provided Gateway Shell to identify the machine_id for each server. To support high-availability infrastructures, we recommend submitting multiple IDs for backup ledgers and dedicated reader instances.
While hardware locks are utilized to align licensing tiers with infrastructure scale, they are designed with a built-in sunset:
- Professional & Enterprise: Hardware locks expire after five years. This ensures your ability to migrate to new hardware without vendor intervention.
- Sovereign: Designed for total autonomy, these licenses bypass hardware locking entirely from day one.
Additional IDs can be provisioned during initial setup or as your infrastructure expands.