BAKARSERVER CLIENT 1.0.0
Linux / Python 3.9 or newer. No third-party Python packages or root access required.

This client connects one BakarServer subscription to your server. It reports
subscription status, expiry and whether the observed outgoing public IP matches
the licensed IP. It does not install or activate cPanel, CloudLinux, Softaculous
or other vendor applications, change their license files, stop their services,
modify /etc/hosts, change certificates, or install a background task.

INSTALL
Download bakar-client-1.0.0.zip from https://mirror.bakarserver.com/ and verify its
SHA-256 against the published SHA256SUMS/manifest. Extract into a new directory,
read the included source, and run: python3 install.py
The installer also verifies the bundled client against its embedded checksum.
Default installed file: ~/.local/bin/bakar-client
For a separate installation: python3 install.py --bin-dir /your/private/test/bin
Existing files are not replaced without --replace. No sudo is required.

ENROLL
Open your subscription in NovaFast. Once it is synchronized, choose
Create / replace client token. Copy the token displayed once, then run:
~/.local/bin/bakar-client enroll
Paste the token at the hidden prompt. Never put a token in a shell command, URL,
chat, shared screenshot or support ticket. A new token immediately invalidates
the old token for that subscription. Revoke client token disables existing copies.

Private configuration: ~/.config/bakarserver/client.json (0600). The API stores
only a SHA-256 token digest. The full token is kept locally for HTTPS requests;
the portal shows it once and discards the session copy when displayed or expired.
Use --config /private/path/client.json before a command to keep multiple separate
subscriptions on one host. Each configuration must have its own service token.

CHECK
~/.local/bin/bakar-client status
Exit 0: the BakarServer subscription is active, verified and IP-matched.
Exit 3: the record is pending, suspended, expired, cancelled or IP-mismatched.
Exit 2: no valid token, revocation, HTTPS/network failure or invalid response.
There is no offline authorization fallback. JSON output never contains the token.
The server uses the actual API connection IP, ignoring client-supplied IP headers.
Use the correct public outgoing address when the customer server is behind NAT.
The status endpoint is read-only with respect to service state. Enrollment does
not activate a product or start a trial. Vendor license validation is not performed.

UPDATE
~/.local/bin/bakar-client update
Checks https://mirror.bakarserver.com/releases/stable.json without installing.
~/.local/bin/bakar-client update --apply
Only a strictly newer release can replace the client. HTTPS certificate checking,
fixed download origin/path, size, SHA-256, Python syntax and release version are
validated before an atomic replacement. Token configuration is preserved. Nothing
is downloaded from third-party sites, and no update is run automatically.
Release authenticity relies on verified HTTPS to mirror.bakarserver.com; the
manifest is not independently cryptographically signed in this first release.

REMOVE
Revoke the token from the subscription page, then run:
~/.local/bin/bakar-client forget --yes
Delete only ~/.local/bin/bakar-client when you no longer need the client.
No cron entry, daemon or vendor changes need to be undone.