Skip to content

Licensing

Trimus uses an offline, Ed25519-signed license to gate an instance (#136). It is time-based: a license is valid until its expiry date. It needs no network access — verification is fully offline and works air-gapped.

What this is — and isn't. Licensing here targets honest customers: a clean, professional expiry/renewal flow and a clear technical + contractual line. It is deliberately not DRM. Someone determined to bypass a license on a binary they control can; that is out of scope. Nothing here should be read as a promise of unbreakable protection.

Installing a license

Provide the signed token via one of:

  • TRIMUS_LICENSE — the token inline.
  • TRIMUS_LICENSE_FILE — a path to a file containing the token.

The token is verified at boot against the public key embedded in the binary. A valid license lets the instance run normally until its expires date.

# inline
export TRIMUS_LICENSE="eyJhbGci..."
# or a file
export TRIMUS_LICENSE_FILE=/etc/trimus/license.jwt

Installing or renewing a license via the environment takes effect on restart.

In the app, without a restart (#270)

An instance admin can also install or replace a license from Admin → Operations → License: paste the token and submit. It is verified before it is saved, persisted in the database, and applied immediately — no restart. This page stays reachable even while the instance is read-only (degraded), so you can restore a locked-down instance without shell access.

An uploaded license takes precedence over TRIMUS_LICENSE and survives restarts, so the license you installed in the UI is the one that stays active. Use Remove uploaded license on the same card to clear it and revert to the TRIMUS_LICENSE environment token (or the built-in trial). Minting new licenses stays CLI-only — the private key never ships in the app.

No license → 30-day trial

A fresh instance with no license runs a built-in 30-day trial (measured from first boot), then enters read-only mode. This keeps evaluation and development frictionless — you don't need a license to try Trimus or to run tests and dev environments.

Expiry, grace, and read-only mode

  • Before expiry — an escalating banner appears on every page as the date approaches (30 / 14 / 7 days).
  • Grace window — for 7 days after expires, the instance keeps running normally with loud warnings, so a renewal in flight never causes an abrupt outage.
  • After the grace window (or trial), or if the license is invalid — the instance enters read-only mode:
  • Your data stays fully viewable — you are never locked out.
  • New writes and new agent runs are blocked (no new companies/agents/issues, no heartbeats, no scheduled routines, remote workers idle).
  • A red banner explains the state and how to recover.

To recover: paste a valid license at Admin → Operations → License — it applies immediately, no restart (#270). Or set a valid TRIMUS_LICENSE (or renew) and restart. Login and all read/export paths remain available while degraded, so you can always reach your data and apply a new license.

Trustworthy time (offline expiry)

Because expiry is time-based and the system is offline, Trimus doesn't blindly trust the local clock:

  • A — high-water mark (always on). The latest time ever observed is persisted in the database. If the clock is later set backward beyond a small tolerance, that's treated as tampering and the instance degrades to read-only. This works with no external dependency, including fully air-gapped installs.
  • B — opportunistic anchor. When Trimus already calls genuinely third-party HTTPS endpoints (LLM providers), it reads their response Date header to advance the high-water mark — harder to forge than the local clock. B is never required: with no such traffic, the system runs on A alone.

For license issuers (internal)

Minting licenses, the payload schema, and key custody/rotation are covered in the Licensing (issuer guide) — the internal reference for whoever holds the offline signing key.