License

dnseditor-ee only starts with a valid license file. Verification happens offline: the file is signed with Ed25519 and the binary carries the corresponding public key. There is no call to the outside, no license server and no telemetry.

Location

Variable	Default	Meaning
DNSE_LICENSE_FILE	./license.json	Path to the license file
DNSE_LICENSE_PUBKEY	—	Public key as hex — development only

In releases the production public key is compiled in (-ldflags "-X main.publicKeyHex=…"). DNSE_LICENSE_PUBKEY exists for development and testing and overrides the built-in key.

Behavior at startup

If the file is missing, expired, or the signature does not match, the service logs the reason and exits with exit code 1. There is no “degraded” start — the license check is a gate, not a hint.

Generating a license (internal)

The private key stays with the publisher. For development and test licenses, use cmd/licensegen:

# one-time: generate a key pair (hex output)
go run ./cmd/licensegen -generate-keys

# sign a license
go run ./cmd/licensegen \
  -key <private-key-hex> \
  -licensee "Beispiel GmbH" \
  -features ee \
  -valid-until 2027-12-31 \
  -out license.json

Flag	Meaning
-generate-keys	generate a new Ed25519 key pair
-key	private key (hex) for signing
-licensee	name of the licensee
-features	feature flags, comma-separated (default ee)
-valid-until	expiry date YYYY-MM-DD
-out	output file (default license.json)

Caution

The private key must never end up in a repo, an image or a customer environment. If it is compromised, every license issued with it is worthless.

License expiry

After the expiry date, the service refuses to run on the next start. A running instance is not shut down mid-operation — renewal should nevertheless be planned before the date so a restart holds no surprises.