How does the Shelltrap licence key work, and what do licensed, grace and unlicensed mean?

One licence covers one server, and inside that server there is no counting: every domain, child domain, account and reseller on the machine is covered. A host with four hundred sites costs the same as a host with four.

The key

A key looks like STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX — Crockford Base32, 25 payload characters including two check characters. It is generated when the licence is created and returned in clear text exactly once; the service stores only a hash of it plus the first nine characters as a display prefix. You find it, and the servers currently using it, in the client area.

Activation binds to a fingerprint

shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
shelltrap license status
shelltrap license renew
shelltrap license deactivate

The fingerprint is a SHA-256 over a fixed prefix and the contents of /etc/machine-id; the hostname is sent for information only. The service issues an Ed25519-signed token that the daemon verifies offline, using pinned public keys that configuration may add to but never replace.

Two dates matter: the token is valid for 30 days after issue, which is what forces renewal, and the licence itself is valid until paid-through plus 14 days of grace. Whichever is earlier wins. A shelltrap-license.timer renews daily with up to an hour of jitter.

The three states

• licensed — valid token, matching fingerprint: normal operation.
• grace — the token expires in under seven days and renewal is failing: normal operation continues, plus a warning in the log, health degraded with license_renewal_failed, and one administrator notification per day.
• unlicensed — no token, a bad signature, expiry passed, or a foreign fingerprint.

What unlicensed actually does

The daemon does not crash and does not restart-loop. The watcher keeps running and events are counted but not scanned; the scheduler plans nothing; the upload gate answers allow with the reason unlicensed; health reports unlicensed with a precise cause (license_missing, license_expired, license_invalid or license_fingerprint_mismatch); an audit entry is written; the licence metrics reflect it; and the feed service answers 401.

That design is deliberate: an expired licence must be loudly useless, never quietly dangerous. A gate that started denying uploads because an invoice was late would be a worse product than one that says so in health and lets traffic through.

Getting back to licensed

shelltrap license status
shelltrap license renew
shelltrap health

If renewal fails, check that the host can reach the licence service over HTTPS and that the subscription in the client area is active and paid. Re-activating a fingerprint that is already active simply issues a new token and does not consume a second slot, so a renewal never locks you out of your own server.

What a licence check cannot do

An attacker with root on your server can patch any binary on it, ours included, and no client-side check survives that. The commercial protection rests on signatures, updates and support being reachable only with an active licence.