Guide
Licensing
The 30-day trial, Free mode, license tiers and keys, how traffic is metered, and exactly what Heimnull sends to the license server.
Heimnull runs without a key. A new installation starts a 30-day trial with every feature and no traffic limit. After that it keeps running in Free mode, unless you enter a license key. Nothing stored is ever lost when the mode changes.
| Tier | Analytics up to | FlowSpec and blackholes |
|---|---|---|
| Trial (first 30 days, no key) | No limit | Yes |
| Free (no key) | 500 Mbit/s | No: attacks are detected and notified, not mitigated |
| 1 Gbps | 1 Gbit/s | Yes |
| 10 Gbps | 10 Gbit/s | Yes |
| Unlimited | No limit | Yes |
Every tier has the full analytics, detection and notifications. What the paid tiers add is mitigation and a higher metered rate. To buy a license, write to info@heimnull.com.
Enter a key
Section titled “Enter a key”Configure → License. Enter the key (it looks like HN-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX; case and spacing don’t matter) and save. Heimnull checks it with license.heimnull.com at once, and the new tier takes effect immediately. The License page then shows what’s in force: the tier, the metered limit, whether FlowSpec and blackholes are allowed, when it last checked in, and your traffic over the last 24 hours.
The server needs outbound HTTPS to license.heimnull.com.
How traffic is metered
Section titled “How traffic is metered”The limit applies to your clean traffic, averaged over two hours, so bursts and attacks never trip it:
- The traffic of active attacks is left out.
- The licensed rate is the higher of the 2-hour averages of clean inbound and clean outbound, the way transit is billed.
- Traffic that’s neither inbound nor outbound (transit, or traffic Heimnull can’t place because your networks aren’t configured) counts in both directions. Configure your networks so it’s measured right.
Over the limit, nothing stops. Detection and mitigation still see all of your traffic. Analytics (Live, Explore, every chart) keep a random share of the records sized to the limit, so totals read about the licensed rate and the proportions stay true. Records of active attacks are always kept. Every page shows a banner with the 2-hour average and the limit.
After the trial
Section titled “After the trial”- Without a key, Heimnull moves to Free mode on day 31: 500 Mbit/s of analytics, attacks detected and notified but not mitigated. Mitigations still active are withdrawn, and manual mitigation is turned off.
- During the trial, every page shows a banner with the days left and what Free mode will be.
- Once you enter a key, the trial is over for good: if the license later lapses, Heimnull goes to Free mode, never back to the trial.
Check-ins and the grace period
Section titled “Check-ins and the grace period”With a key, Heimnull checks in with license.heimnull.com every 4 hours, every 15 minutes while a check-in is failing, and at once when you press Check now on the License page.
If it can’t reach the server, the license keeps working for 30 days from the last good check-in, with a banner on every page saying since when the server has been unreachable and when Free mode starts. After 30 days, Heimnull drops to Free mode until it checks in again; then the license comes back by itself.
| What happens | Heimnull |
|---|---|
| Renewal due within 14 days | Admins see a renewal banner |
| The license expires, or is suspended or revoked | Free mode at the next check-in, with a banner saying why |
| The license is renewed or reactivated | Back to its tier at the next check-in (or Check now) |
| No check-in for 30 days | Free mode until the next successful check-in |
Only a reply signed by the license server can change or end a license. A failed or tampered reply counts as “server unreachable”. See License states for every state.
What Heimnull sends
Section titled “What Heimnull sends”With a key: the check-in
Section titled “With a key: the check-in”Every 4 hours, over HTTPS:
| Field | What it is |
|---|---|
key |
Your license key |
instance_id |
A random ID made once for this installation |
version |
The Heimnull version, for example v3.1.1 |
usage |
The clean inbound and outbound 2-hour averages in bits per second, and whether analytics are being limited |
nonce |
A random value the signed reply must repeat |
Without a key: the installation report
Section titled “Without a key: the installation report”An installation without a key (in its trial, or in Free mode) sends a short report instead, every 4 hours, so we can count active installations:
| Field | What it is |
|---|---|
instance_id |
A random ID made once for this installation |
version |
The Heimnull version |
state |
trial or free |
trial_started |
When the installation first started |
usage |
The clean inbound and outbound 2-hour averages, and whether analytics are being limited |
As with any connection, the server also sees the address it came from. Nothing else is sent: no addresses from your traffic, no configuration, no host names. A failed report is retried quietly 15 minutes later, with no banner or warning, and it never changes what Heimnull does.
A key allows a set number of installations. The first check-in of a new installation binds it to the key. If the key is already bound to as many installations as it allows, entering it fails with a message saying so: write to us and we’ll release the old one.
Moving to another server
Section titled “Moving to another server”- Restored from a backup (Backups and restore): the server keeps its installation ID and checks in as the same installation. Shut the old server down.
- A fresh install: it’s a new installation. Enter your key; if every seat is in use, write to us to release the old server’s.