> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/get-started/licensing.md). # Licensing Which licence each way of running Norbix needs, what a licence contains, where you get it, and how an installation checks it. When Norbix runs on our servers, there is nothing to license. When it runs on **your** servers, the installation must prove that it belongs to a Norbix account and to one domain. A **licence** does that. ## How Norbix models it | Deployment type | Licence | Where you get it | | ----------------------------------------------------------- | --------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | [Managed service](/codemash/get-started/managed-service.md) | **None.** You pay with your subscription in Cloud → **Account**. | — | | [Self-hosted](/codemash/get-started/self-hosted.md) | **Self-hosted licence** (edition `community`). Starts as a trial. | Cloud → **Account → Licensing** | | [Enterprise](/codemash/get-started/enterprise.md) | **Enterprise licence** (edition `enterprise`), made for your organisation by hand | Ask from Cloud → **Account → Licensing**, or write to | {% hint style="info" %} Cloud → **Account → Licensing** (`/account/licensing`) is the **only** place to get a licence. Sign in at [cloud.norbix.ai](https://cloud.norbix.ai) (sign up first if you have no account — accounts exist only on the managed service), open **Licensing** and start your trial. The steps are on [Licences](/codemash/cloud/account/licences.md). {% endhint %} ### What is inside a licence A licence is a short signed text. Your installation reads it from the `NORBIX_LICENSE` environment variable. | Field | Meaning | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Edition** | `community` (self-hosted) or `enterprise`. A licence starts only the build of the same edition. | | **Domain** | The domain your installation runs on, for example `example.com`. Norbix lives on its sub-domains (see [DNS records](#dns-records)). Changing the domain needs a new licence. | | **Account** | Your Norbix account id (`acc_…`). | | **Email** | The account owner's email. Your installation creates its first admin user from it. | | **Expires** | The end of the licence period. | | **Project cap** | How many projects the installation may hold. | | **Trial** | Whether it is a trial licence. | ### How an installation checks its licence 1. **At start** — the installation checks the licence signature with a public key built into it. A broken or wrong-edition licence stops the start. The Hub log shows each check: ``` [ OK ] License deserialization [ OK ] License public key from config [ OK ] License signature validation [ OK ] License registered ``` 2. **Every 6 hours** — the installation sends its licence to the Norbix licence service (`https://hub.norbix.ai/v3`). The service then fetches a proof file from `cloud.` to check that the installation really runs on the licensed domain. So the installation needs outgoing internet access, and `cloud.` must be reachable from the internet. What happens when the proof does not pass: | State | When | Effect | | -------------- | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | | **Grace** | After the first start: 3 days (trial) or 7 days (paid) | Everything works while you finish DNS | | **Production** | The proof passed | Everything works | | **Degraded** | The proof failed for 7 days | Warnings; the owner gets an email | | **Suspended** | 7 more days in Degraded | The installation stops serving project traffic. Sign-in, Account and licensing keep working so you can fix it. | * As soon as a proof passes again, the installation goes back to Production — no restart needed. * If the licence service cannot be reached at all (our outage), nothing is punished for up to 7 days (trial) or 14 days (paid). * A local installation (`localhost`, an IP address) follows the same rules — there is no free mode without a proof. ### DNS records For a licence domain `example.com`, create these **A records**, all pointing at your server's public IP address. You can create them before the server exists. ``` cloud.example.com A api.example.com A *.api.example.com A hub.example.com A *.hub.example.com A admin.example.com A (optional, for the Admin portal) ``` | Record | Serves | | ------------------ | ------------------------------------------------------------- | | `cloud.*` | Cloud, the web app — and the licence proof | | `api.*`, `*.api.*` | The Api your apps call; the wildcard is for per-project hosts | | `hub.*`, `*.hub.*` | The Hub behind Cloud; the wildcard is for per-project hosts | | `admin.*` | The Admin portal (optional) | DNS changes can take minutes, sometimes longer, to reach everyone. ### First sign-in on your installation Your installation has only a sign-in screen: accounts are created on the managed service, never on the installation. On the first start the installation creates the first admin (root) user from the **email in the licence**: 1. If `NORBIX_ROOT_BOOTSTRAP_PASSWORD` is set, that is the first password. 2. If not, the Hub prints a one-time password in its log, in a block that starts with `[ SETUP ]`. 3. Open `cloud.`, sign in with the licence email and that password. You must choose your own password right away. Lost the root password? Set a **new** `NORBIX_ROOT_BOOTSTRAP_PASSWORD` and `NORBIX_ROOT_BOOTSTRAP_PASSWORD_RESET=true`, then restart: the reset runs once per value. Passwords are never printed to the log again. ### Renewal and changes * **Renewal** — renew in Cloud → **Account → Licensing**, then put the new licence into `NORBIX_LICENSE` and restart. * **New domain** — the domain is signed into the licence: get a new licence. * **Wrong edition** — a `community` licence does not start an `enterprise` build, and the other way round. ### Managed-service features on your installation A few Hub endpoints talk to Norbix's own billing and hosting, so they exist only on the managed service. On a self-hosted or enterprise installation (Production or Staging) they answer `CM-ERRORS-GENERIC-017`: * Heartbeat — the managed-service health ping. * Domain verification — start and status of a custom-domain check. * Get Billing Portal Url — the billing portal of the managed subscription. * Stripe webhook — answers `503` (not configured). * Database: Get Allowed Flex Tiers and Reveal Managed Flex Connection String — managed MongoDB Flex is a managed-service feature; connect your own MongoDB with a connection string instead. ## Where you use it * Cloud: [Licences](/codemash/cloud/account/licences.md) · [Account](/codemash/cloud/account.md) * Get started: [Self-hosted](/codemash/get-started/self-hosted.md) · [Enterprise](/codemash/get-started/enterprise.md) · [Keys and environments](/codemash/get-started/keys-and-environments.md)