# Aker v0.1.0 - Table of Contents

> Licences for on-premises Elixir apps: an install key in a file or the
machine's TPM chip, signed activation requests, licence files signed by a
root key the app trusts, and a gate that checks the licence at boot and
every hour and renews it.

## Pages

- [Aker](readme.md)
- [Changelog](changelog.md)
- [LICENSE](license.md)

- Guides
  - [Getting started](getting_started.md)
  - [Licence format](licence_format.md)

## Modules

- [Aker](Aker.md): Licences for on-premises Elixir apps.
- [Aker.Client](Aker.Client.md): The app's calls to the licensing server, under `/api/v1`, JSON both ways.
- [Aker.Gate](Aker.Gate.md): Whether this install may run. The gate checks the stored licence at boot
and every hour, holds `:licensed` or `{:locked, reason}` where every
reader finds it without a call, and renews the licence in its term's
last week.
- [Aker.InstallKey](Aker.InstallKey.md): The keypair that ties a licence to one install. The licensing server
stores its public half and names it in the signed licence; the app proves
it holds the private half by signing a fresh random value.
- [Aker.InstallKey.Software](Aker.InstallKey.Software.md): The install key as a PEM file, `install_key.pem`, in the licence folder,
for a machine with no TPM chip.
- [Aker.InstallKey.Tpm](Aker.InstallKey.Tpm.md): The install key inside the machine's TPM 2.0 chip. The chip
makes the P-256 keypair and never lets the private half out, so a copied
disk cannot prove it is the licensed machine.
- [Aker.Issuer](Aker.Issuer.md): Signs a licence file from an activation request. A licensing server
calls it, and `mix aker.sign` calls it on a developer's machine.
- [Aker.LicenceFile](Aker.LicenceFile.md): Reads a signed licence file and checks every signature and field in it.
- [Aker.MachineId](Aker.MachineId.md): The host's identity a licence names: the SHA-256 of its machine id file,
lowercase hex.
- [Aker.PublicKeys](Aker.PublicKeys.md): Ed25519 public keys as a host's config lists them: raw 32-byte keys,
base64. A host decodes its root key list through `decode/1` at boot and
stops on an error, which names the entry's place in the list and never
its value.

- [Aker.Request](Aker.Request.md): The activation request an install sends the licensing server to get its
licence.
- [Aker.SignedCall](Aker.SignedCall.md): A call to the licensing server signed by the install key, and the check a
server runs on one.
- [Aker.SigningKey](Aker.SigningKey.md): A private Ed25519 key: a licence issuer's root key, or a working key
the root key certifies. Only a signing task reads one, from a file kept off the
repository and off every server. `inspect/1` shows no key bytes, so a
crash or a log line that holds the key prints none.
- [Aker.Store](Aker.Store.md): Where a host keeps its licence. The gate reads and writes it only through
this behaviour, so the library takes no database dependency.
- [Aker.Terms](Aker.Terms.md): What a verified licence says. Only `Aker.LicenceFile` builds one,
after every signature and field passed, so holding one means a trusted
root key's working key issued it for this install.

## Mix Tasks

- [mix aker.sign](Mix.Tasks.Aker.Sign.md): Sign a licence from an install's activation request, standing in for the
licensing server on your own machine.