How-to guide

Activate offline (air-gapped)

When Workbench cannot reach the internet, activation is a three-leg exchange: export a request from the instance, upload it to the Elevarq portal and download the counter-signed activation file, then import that file. This guide covers the exchange and the periodic re-attestation that keeps it valid.

The identity volume must persist

Offline activation is bound to this deployment's identity, which lives in /var/lib/arq/ — the arq_identity named volume in the Compose example (a volumeClaimTemplate under the Helm chart). Back it up separately from the data volume. Losing it means re-activating from scratch.

Step 1 — Export the activation request

With an admin session (the cookie jar from login), and the license key you received when you purchased (the ELV-… handle):

WORKBENCH=http://127.0.0.1:8080

curl -fsS "$WORKBENCH/api/license/activation-request?license_key=ELV-XXXX-XXXX-XXXX-XXXX" \
  -b /tmp/wb.cookies -o activation-request.json

The request carries this deployment's public identity and the license key — no secrets. It is safe to move across the air gap.

Step 2 — Upload to the portal, download the file

In your Elevarq account, open the license under Licenses and upload activation-request.json. The portal verifies it against the license's instance limit (max_instances) — refusing if every slot is already in use — records the activation, sets the re-attestation cadence, counter-signs the file, and offers the signed activation.json for download. Move that file across the air gap to the Workbench host; you can re-download it from the same place later.

Step 3 — Import the activation file

curl -fsS -X POST "$WORKBENCH/api/license/activation" \
  -b /tmp/wb.cookies \
  -H "X-Arq-CSRF: $(grep arq_workbench_csrf /tmp/wb.cookies | awk '{print $7}')" \
  --data-binary @activation.json

# Verify:
curl -fsS "$WORKBENCH/api/licenses" -b /tmp/wb.cookies

A successful import returns 200 OK and the entitlement cache turns fresh.

Re-attestation

Offline activations are valid for a fixed window and must be renewed before they lapse. Renewal exports a fresh request the same way:

curl -fsS -X POST "$WORKBENCH/api/license/activation/renew" \
  -b /tmp/wb.cookies -o activation-request.json

The upload, portal counter-signing, and import repeat exactly as for the first activation — and your install_secretrotates on every re-attestation, so an old activation file can't be replayed on a clone. Renew ahead of the deadline; Workbench surfaces the valid-until date so you can schedule it.