License Required (Self-Hosted)

A self-hosted Infracast server (Docker, Kubernetes, bare metal, air-gapped) will not start without a valid signed license. This is checked at startup, before the database is opened:

• INFRACAST_LICENSE_FILE — path to the license file, or
• INFRACAST_LICENSE_JSON — the license contents (raw JSON or base64).

If both are set, both must be valid.

The server exits with a non-zero status and prints the reason to stderr when:

Situation	Message contains
Neither variable is set	no license configured
File missing or unreadable	missing or unreadable
Not a license file / corrupt	not a valid Infracast license
Signature does not verify (modified file, wrong issuer)	signature does not verify
License has expired	expired licenses are refused

Expired licenses are refused. An air-gapped enclave cannot renew by connecting out, so the server does not silently keep running on a lapsed license: install the renewed file and restart.

Example (Docker Compose):

services:
  infracast:
    environment:
      - INFRACAST_LICENSE_FILE=/etc/infracast/license.json
    volumes:
      - ./license.json:/etc/infracast/license.json:ro

Check a file before deploying it (works without a running server or license):

infracast license validate --file ./license.json
infracast license info --file ./license.json

Request a license from your AZgardTek contact, or through the license request form.

SaaS

The hosted platform (app.infracast.io) is licensed per tenant through your subscription and has no license file. Its deployment sets INFRACAST_DEPLOYMENT_MODE=saas, which skips the startup check. Do not set this on a self-hosted server: it is not a license bypass for entitlements, only for the startup gate, and any value other than saas or selfhosted is rejected.

First login: initial admin password

On first start with an empty database the server creates a system-admin user named admin. There is no default password:

• If INFRACAST_ADMIN_PASSWORD is set, that is the initial password (never logged).
• Otherwise a random 20-character password is generated and logged once at WARN: initial admin password: ... — change required at first login.

Either way the account is flagged must change password: you can sign in, but every API call other than change-password, logout and /me returns 403 {"code":"password_change_required"} until you choose a new password (the UI shows a change-password screen that cannot be dismissed). Accounts created with infracast user create and passwords set with infracast user reset-password behave the same by default; pass --must-change=false to opt out.