Registration¶

Registration is how an appliance is matched to its licence and offered updates. It is not a licence check on the software: Bambuddy is AGPL-3.0 and is never gated, whatever the registrar says about your box.

There are three kinds of unit, and they behave differently:

A self-built appliance not contacting anything is not a setting you have to find and switch off. It is what "no batch identifier and no key" means in the code, and you can confirm it in a file (see Checking for yourself).

The licence key¶

The key arrives by email after the purchase, twenty characters in four groups. The setup wizard asks for it, and the appliance sends it every time it registers or heartbeats.

Every customer downloads the same image, so the batch identifier inside it is worth nothing as authorisation — anyone who ever got hold of the file would have it. The purchase is what authorises, and the key is what carries the purchase.

sudo bambuddy-appliance license XXXXX-XXXXX-XXXXX-XXXXX

What is sent¶

No printer data. No print history. No user accounts. No credentials. Nothing about what you print, when, or with what.

The registrar records the connecting IP address as a salted hash, never in the clear, and uses it only to notice when one identity turns up from many places at once.

The unit claims once on first boot, then heartbeats roughly once a day. In between, an hourly timer asks one question — am I still entitled? — which writes nothing on the registrar and exists so that a revoked, renewed or upgraded unit finds out within the hour rather than at its next heartbeat.

What registration buys¶

One thing: appliance updates. The archive that serves the appliance package answers only a registered unit whose licence is active (Updates).

Two things it does not touch:

• Bambuddy itself. It is never intercepted, gated or watermarked. The API, websockets and the camera stream are untouched, and the container is the ordinary AGPL one from ghcr.io/maziggy/bambuddy.
• Debian security updates. The archive's package index is open to everyone, so apt keeps working on a unit that is not entitled. Revocation stops the appliance layer, not the operating system.

A unit the registrar has flagged or revoked gets one more consequence: the appliance's own admin panel goes read-only behind a notice explaining why. That panel is the proprietary part, and it is the only part that is ever gated.

When the registrar says no¶

A claim is refused when the batch is unknown, when the batch needs a key and none was sent, when the key is not recognised, when the licence's updates have ended or it was withdrawn, or when a reseller's batch has already used every unit it was cut for.

The reason is the registrar's own sentence, and the appliance keeps it:

sudo bambuddy-appliance license          # shows the key state and the last refusal
journalctl -u bambuddy-register.service -b

The admin panel shows the same sentence on its Dashboard, with an Enter a key button beside it — except after a re-flash, where a key is not what is missing and no button appears. A unit that has a key but has not reached the registrar yet reads Waiting for the registrar: that is a first boot without a network, and it resolves itself on the next tick. Retrying on its own will not fix a refusal — something has to change first, usually the key.

Checking for yourself¶

cat /etc/bambuddy/provisioning.json

An empty batch_id is what a self-built appliance looks like. With no key either, the unit never contacts the registrar at all:

{ "batch_id": "", "registrar_url": "https://appliance.bambuddy.cool" }

The rest of the state lives in /var/lib/bambuddy/registrar/, on the data partition:

systemctl status bambuddy-register.timer          # is it scheduled?
journalctl -u bambuddy-register.service -b        # what did it do?

Re-flashing a registered unit¶

A unit's identity comes from the board's serial number, so a re-flashed card comes back as the same device — but with no token, because the token lived on the card.

With a licence key, it fixes itself. The key is the proof of purchase, it is your secret, and it is not readable off the board — so a unit that comes back presenting the key it activated with re-claims on its next tick, with nobody pressing anything.

Without a key — a reseller unit, where the board serial is the only identifier — the registrar will not hand over a replacement, because a serial is readable by anyone holding the board. The unit is refused, and says so, until an operator opens a one-shot re-claim window for it. It then mints and stores a fresh token by itself; there is nothing for you to copy anywhere.