Caronte

Caronte is the license server that governs activation across the product ecosystem. It generates and validates keys, controls how many devices each license may activate and which features it unlocks, and solves the awkward case every licensing system runs into: validating without a connection. It does so by issuing Ed25519-signed tokens with a configurable lifetime, so an offline client keeps working for a bounded window without that becoming a way to run indefinitely.

What it does

It is the piece that decides whether a product may start, and it has to give that answer both online and offline.

• Generates license keys in a dedicated format and manages their lifecycle.
• Supports perpetual, subscription and trial licenses.
• Caps by seat how many devices may activate the same license.
• Enables or disables specific features per license through entitlements.
• Validates online or offline with Ed25519-signed tokens and a configurable lifetime.
• Exposes validation over REST and gRPC, so each product picks the protocol that suits it.
• Audits every license operation and sends email warnings for expirations and activations.

Architecture

It breaks down into small services behind a gateway, with cryptography chosen so that offline validation never depends on sharing a secret.

• An API gateway in Rust on Axum as the single entry point.
• Separate license, validation and notification services, each with a bounded responsibility.
• Dual protocol in the validation service: REST for simple integrations and gRPC for those that need low latency.
• Asymmetric Ed25519 signing for offline tokens: the client verifies with the public key and never holds a secret capable of issuing licenses.
• Passwords with Argon2id and API keys stored as SHA-256.
• PostgreSQL 16 as the store, accessed through SQLx with compile-time checked queries.
• An administration dashboard in Next.js and a full deployment with Docker Compose in a single command.

Stack

Services in Rust on Axum for REST and tonic for gRPC, with SQLx against PostgreSQL 16. Cryptography combines Ed25519 for offline tokens, Argon2id for passwords and SHA-256 for API keys. The admin dashboard is Next.js 16 with TypeScript and Tailwind, and the whole set comes up with Docker Compose, with continuous integration on GitHub Actions and Jenkins.