Outbound connections & licensing

Hortval is designed to run inside hardened, segmented networks — often right next to your CA. Security teams rightly audit everything that leaves such a host. This page explains the only network connection Hortval makes, why it exists, and how to turn it off entirely.

Short version:

• In online mode (default), the binary's only outbound destination is Hortval's licensing backend (HTTPS, on hortval.com). Nothing else.
• In offline mode (license: offline: true), the binary makes zero outbound connections. It is fully air-gappable.
• It never sends your certificates, private keys, the domain names you issue for, your ACME accounts, your DNS configuration, or your audit log.

Why the connection exists

The connection serves one purpose: the license lifecycle. A Hortval license is a signed file (.lic) that describes what the instance is allowed to do (allowed databases, max CAs, max managed servers, expiry). The backend is the authority that issues and updates that file. The binary contacts it to:

1. Receive its license after registration.
2. Pick up changes you make in the portal — with no action on the box. This is why the check is periodic: a plan upgrade (more CAs, more managed servers, …), a renewal, or a revocation/retirement done in the portal lands on the running instance automatically, instead of forcing you to copy a new license file by hand.

How an instance becomes licensed

• From the box (CLI): an operator runs hortval license register. The instance is bound to the license and receives its .lic.
• From the portal (web): an admin links the instance's installation key to a license in the portal UI. The box only polls; once the key is linked, the next poll delivers the .lic — no register command needed on the box.

The recurring polls afterwards are what deliver upgrades, renewals and revocations without operator action.

What is exchanged

The binary sends two categories, and nothing else. In return it may receive an updated license file.

What describes your installation — the figures used to check your running configuration against your plan:

• the Hortval server's hostname, as reported by the operating system;
• the number of managed servers;
• the number of managed CAs;
• the database driver in use;
• the environment you declared, at registration only.

What identifies the licence — none of it describes your network:

• the licence key and the installation key;
• the plan the instance is running under;
• the running binary version.

It does not send any operational data — specifically never:

• certificates, certificate chains, or CSRs;
• private keys (CA keys, the server's own key — none);
• the domain names / SANs you issue certificates for;
• ACME accounts or any ACME protocol data;
• your DNS-validation configuration or network topology;
• the audit log or database contents.

There is no separate telemetry, analytics, or crash-reporting channel: the licensing call above is the entire outbound surface.

Turning it off — offline mode

In config.yml:

license:
  offline: true

With offline: true the binary builds no licensing client at all: no polling, registration, renewal, or revocation check, in any boot mode. Zero outbound connections — the mode for air-gapped or strictly segmented deployments.

Trade-offs you accept offline:

• You install the license yourself: hortval license install <file.lic> (delivered out-of-band).
• No automatic renewal or plan-upgrade pickup — apply a new .lic manually.
• No portal-driven revocation/retirement of the instance.

Verifying it yourself

The surface is small and deterministic, so you can confirm it: point a network monitor at the host — in online mode you see only HTTPS to hortval.com; in offline mode, nothing at all. The binary is reproducible and its dependencies are published — see Dependencies & SBOM and Verifying release binaries.