Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Portal Overview

The Rockfish Portal is a self-service web application that combines the marketing website with license management. It provides:

  • Marketing pages — product information, features, pricing
  • Shop — dynamic pricing from Stripe with tier comparison
  • Registration — passwordless email-based authentication (magic links)
  • License management — purchase, download, and manage licenses
  • Stripe integration — payment processing with webhook support
  • License server integration — delegates license signing to the license server

Architecture

User → Portal (Axum) → Stripe (payments)
                     → License Server (signing)
                     → S3 (data persistence)
                     → SMTP (email)

The portal is a single Rust binary (rockfish-portal) that serves both the static marketing site and the dynamic commerce functionality.

URL Structure

PathDescriptionAuth
/Marketing landing pagePublic
/features.htmlFeature overviewPublic
/shopDynamic pricing (from Stripe)Public
/enterEmail entry / loginPublic
/auth?token=...Magic link authenticationPublic
/dashboardLicense listLogged in
/dashboard/buyPurchase a licenseLogged in
/checkoutStripe checkout redirectLogged in
/webhook/stripeStripe payment webhookStripe
/termsTerms & ConditionsPublic
/privacyPrivacy PolicyPublic

Authentication

The portal uses passwordless magic link authentication:

  1. User enters email at /enter
  2. If email is new → account created automatically
  3. Magic link sent via SMTP
  4. User clicks link → session cookie set
  5. First-time users complete profile (name, company, accept terms)
  6. New users → redirected to Buy tab
  7. Returning users → redirected to Licenses tab

License Flow

  1. User selects a tier on the Buy tab
  2. Enters an Installation Name (min 5 characters, identifies the Suricata instance)
  3. Redirected to Stripe Checkout
  4. On payment confirmation:
    • Stripe sends webhook to /webhook/stripe
    • Portal asynchronously requests license from the license server
    • License stored in DuckDB and synced to S3
    • User can download or copy the license JSON from their dashboard

45-Day Enterprise Trial

Every license includes 45 days of Enterprise features from the issue date:

  • The NDR engine checks issued_at in the license
  • If within 45 days → grants Enterprise features regardless of tier
  • After 45 days → settles to purchased tier
  • Re-checked once per day

Tiers

TierPriceEvents/minFeatures
Basic$0.99/yr25,000GeoIP, Parquet to S3 export, Reports
Professional$99/yr100,000+ IP Reputation, MCP
Enterprise$999/yrUnlimited+ SIGMA, Hunt, ML, Anomaly

Prices are fetched dynamically from Stripe and cached for 8 hours.

Portal Control

  • PORTAL_DISABLED=true — shows “Coming Soon” page, allows pre-registration but disables purchasing
  • When disabled, users can still log in and view existing licenses

Data Persistence

The portal uses DuckDB locally and syncs to S3 after every write:

  • New user registration
  • Profile completion
  • License issuance

On startup, data is loaded from S3 into local DuckDB. This supports ephemeral environments like DigitalOcean App Platform.

CLI Commands

# Run the portal server
rockfish-portal

# List registered users
rockfish-portal --list-users

# List licenses
rockfish-portal --list-licenses

# Verbose mode
rockfish-portal -v