quartermaster

Quartermaster is a self hosted system for a solo developer who wants to sell software and issue license keys without paying a licensing vendor a cut of every sale forever. The author explains that most licensing platforms cost more the more successful you become, and are built assuming a whole team rather than one person, so this project was built instead: Stripe handles the actual payment, and everything after that, issuing the license, checking it is genuine, and controlling how many machines can use it, is run by the developer themselves at a flat, fixed cost regardless of how many copies sell.

The core idea is a hard separation between two machines. One machine faces the internet and can receive requests, but can never create a valid license on its own. The other machine holds the signing key that can create a license, and it only reaches out to the internet, never accepts connections from it. If the internet facing machine were ever broken into, an attacker could only add requests to a queue, never forge a license. Licenses are stored in a fixed, versioned format designed to keep verifying correctly offline for years, even if the signing key is later rotated.

On the customer side, the project treats a license more like a physical item than a locked in subscription. Deactivating a license frees up that seat so it can be reused elsewhere, similar to reselling a used copy of something. The system does not try to track who owns a license after the first sale, only how many machines are currently using it at once, and a refund does not retroactively break a machine already running. What it does block firmly is one license key being shared publicly and claimed by far more machines than it was sold for.

The repository is organized into a few Go programs: a public facing service that handles Stripe webhooks and activation requests, a separate signer program that only runs on trusted hardware and actually signs licenses, a one time key generation tool, and supporting packages for the license format, the signing request queue, and seat activation tracking. Documentation covers the architecture, the license format and threat model, the API, and operations such as deployment and key rotation. The project notes it was built with the help of AI coding tools during design and implementation, though nothing in the running system depends on AI.