Docs / dflux EdgeGuard
ContactGet started

Licensing

Community builds run without a license file. A signed file from dflux is optional and unlocks commercial editions. This page covers where the proxy looks for a file when you have one — all fully offline.

Community — no file required

Unsigned community builds are fail-open. d3x-edge starts without a license file. A missing file does not block listeners from opening.

Optional signed license

Commercial editions get a signed license file from dflux for the edgeguard product (commonly named edgeguard.lic, or a compound d3x.lic that grants several products). The file names your organization, edition, and expiry. Copy it onto each host that runs the proxy when you have one.

The download link for the binary archive is separate and time-limited; the license file, if you have one, is yours to keep.

Default path

When a signed file is present, resolution is:

  1. D3X_LICENSE_FILE when set (explicit override).
  2. $HOME/.dflux/d3x.lic when that compound file exists.
  3. $HOME/.dflux/edgeguard.lic — per-product file in the same directory.
  4. /etc/dflux/d3x.lic when that compound file exists.
  5. /etc/dflux/edgeguard.lic — per-product fallback.
Bash

Overriding the path

Point the proxy at a custom path with the environment variable:

Bash

There is no -license-path flag and no license_path config key — path selection is solely via D3X_LICENSE_FILE or the default files under /etc/dflux/.

Startup output

With no file, the daemon starts with no licensed-to line. With a signed file, the proxy logs a single line naming the organization, edition, and expiry:

Code

Grace and expiry

When a signed file is present, the gate enforces product scope and expiry (with a grace window). Once running, the proxy re-checks daily and escalates warnings as expiry approaches or passes — it does not self-terminate the data plane.

Offline and air-gapped operation

License verification is entirely offline. The proxy validates a signed token locally and never contacts dflux or any other network endpoint to check it — there is no phone-home, no activation server, and no telemetry tied to the license. The proxy runs identically on an air-gapped network as it does on one with internet access.

Renewal

When you renew or change editions, dflux issues a fresh license file. Replace the file at whichever path the proxy resolves and restart the daemon so it re-reads the license:

Bash

Confirm the new grant from the licensed-to line in the startup logs.