Docs / dflux EdgeGuard
ContactGet started

Licensing

dflux EdgeGuard is licensed software. d3x issues you a signed license file that names your organization, edition, and expiry. This page covers where the proxy looks for it, how to override the path, what it logs at startup, and how grace and renewal work — all fully offline.

The license file

Along with your download link, d3x gives you a signed license file for the edgeguard product (commonly named edgeguard.lic, or a compound d3x.lic that grants several products). The daemon verifies it at startup and refuses to run without a valid in-scope grant. The file is yours to keep and to copy onto each host that runs the proxy.

Startup is fail-closed
A missing, invalid, or out-of-scope license is fatal at process start — d3x-edge will not open listeners. After a successful start, daily expiry re-checks only log warnings; they never tear down a running data plane.

Default path

License resolution (same for every d3x product binary):

  1. D3X_LICENSE_FILE when set (explicit override).
  2. $HOME/.dflux/d3x.lic when that compound file exists.
  3. $HOME/.dflux/edgeguard.lic — per-product file in the same directory.
  4. /etc/dflux/d3x.lic when that compound file exists.
  5. /etc/dflux/edgeguard.lic — per-product fallback (this path is returned even when the file is missing, so a startup error names a stable location).
Bash

Overriding the path

Point the proxy at a custom path with the environment variable:

Bash

There is no -license-path flag and no license_path config key — path selection is solely via D3X_LICENSE_FILE or the default files under /etc/dflux/.

Startup output

On a clean start the proxy resolves the license and logs a single line naming the organization, edition, and expiry:

Code

Grace and expiry

At startup the gate enforces product scope and expiry (with a grace window defined by the license library). An unlicensed start fails closed. Once running, the proxy re-checks daily and escalates warnings as expiry approaches or passes — it does not self-terminate the data plane.

Offline and air-gapped operation

License verification is entirely offline. The proxy validates the signed token locally and never contacts dflux or any other network endpoint to check it — there is no phone-home, no activation server, and no telemetry tied to the license. The proxy runs identically on an air-gapped network as it does on one with internet access. The only thing you ever transfer over the network is the license file itself, once, when d3x sends it to you.

Renewal

When you renew or change editions, d3x issues a fresh license file. Replace the file at whichever path the proxy resolves and restart the daemon so it re-reads the license:

Bash

Confirm the new grant from the licensed-to line in the startup logs.