.NET Engine — Installation

The .NET Engine binds port 80 directly — there is no reverse proxy in front of it. It can also terminate TLS itself on 443.

Register the server in LockFlare Cipher first — add it to an environment and copy the licence key it issues. You need that key in step 2, and it is bound to this machine’s IP address.

Different from the Node Engine. Node listens on 3000 behind nginx; .NET binds 80 and 443 itself. Do not install a web server on a .NET box — it will take the port the engine needs.

Prerequisites — .NET 10 ASP.NET Core runtime

ubuntu 24.04

sudo apt update
sudo apt install -y libssl-dev libcurl4-openssl-dev

Add Microsoft package repository (Ubuntu 24.04)
wget https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
rm packages-microsoft-prod.deb
Install .NET 10 ASP.NET Core Runtime
sudo apt update
sudo apt install -y aspnetcore-runtime-10.0
dotnet --info

Adjust the repository URL if you are not on Ubuntu 24.04 — Microsoft publishes one per distribution and version.

Remove debug tooling

The engine refuses to seal on a machine where strace, gdb or ltrace is installed. Those attach to a running process and read its memory, which is exactly the attack RAM-only execution exists to make expensive.

harden

sudo apt remove -y strace gdb ltrace 2>/dev/null || true

1 · Extract the interpreter

/var/www/interpreter

sudo mkdir -p /var/www/interpreter
sudo chown $USER:$USER /var/www/interpreter
cd /var/www/interpreter
wget https://cdn.lockflare.com/interpreter/lockflare-interpreter-net.tar.gz
tar -xzf lockflare-interpreter-net.tar.gz
rm lockflare-interpreter-net.tar.gz

2 · Run and configure the licence

Start it once by hand. It needs sudo because it binds port 80. On first run it prompts for the licence key.

first run

sudo ./lf-engine-dotnet

expected output

  ╔══════════════════════════════════╗
  ║     LOCKFLARE ENGINE (.NET)      ║
  ╚══════════════════════════════════╝

  First-time setup
  ─────────────────────────────────
  License key: LF-xxxxx-xxxxx-xxxxx-xxxxx
  Validating license...
  ✓ License validated
  Configuration saved to /var/www/interpreter/.env
[ENGINE] License verified
[ENGINE] Fetching interpreter...
[ENGINE] Fetching dependencies (10)...
[ENGINE] All dependencies verified (SHA-256)
[ENGINE] Launching .NET runtime...
[INTERPRETER] Bootstrap complete
[INTERPRETER] 1 domain(s) ready
[INTERPRETER] Listening on http://0.0.0.0:80

Every dependency is verified by SHA-256 before it is loaded. Stop with Ctrl+C once you see the interpreter listening — the next step makes it permanent.

3 · Auto-start with systemd

Required, not optional. The engine must come back after a reboot, and Enclave will not seal a server without a managed service.

run from /var/www/interpreter

sudo tee /etc/systemd/system/lf-engine.service > /dev/null <<EOF
[Unit]
Description=LockFlare .NET Interpreter Engine
After=network-online.target
Wants=network-online.target

[Service]
User=root
Group=root
WorkingDirectory=$(pwd)
ExecStart=$(pwd)/lf-engine-dotnet
EnvironmentFile=$(pwd)/.env
Restart=always
RestartSec=5
Type=simple
TimeoutStartSec=30
TimeoutStopSec=15
KillMode=mixed
KillSignal=SIGTERM
StandardOutput=journal
StandardError=journal
SyslogIdentifier=lf-engine
Slice=system.slice
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable lf-engine
sudo systemctl start lf-engine

Run that block from inside the install directory — $(pwd) is expanded when the unit file is written, so running it from elsewhere bakes in the wrong path.

operations

# Follow logs sudo journalctl -u lf-engine -f

Restart interpreter

sudo systemctl restart lf-engine

Stop interpreter

sudo systemctl stop lf-engine

Check status

sudo systemctl status lf-engine

4 · HTTPS with your own certificates optional

Only needed if this server terminates TLS itself. Behind a CDN or a reverse proxy that already handles HTTPS, skip this entirely.

certbot

sudo apt install -y certbot sudo mkdir -p /var/lib/lockflare/acme

sudo certbot certonly --webroot -w /var/lib/lockflare/acme -d yourdomain.com

Then turn TLS on and restart:

enable tls

echo 'LF_TLS=1' | sudo tee -a /var/www/interpreter/.env
sudo systemctl restart lf-engine

expected output

[TLS] enabled — listening on 443, certificates from /etc/lockflare/certs (falling back to /etc/letsencrypt/live)
[INTERPRETER] Listening on http://0.0.0.0:80 and https://0.0.0.0:443
[TLS] loaded certificate for 'yourdomain.com' (expires 2026-10-21)

verify

curl -vI https://yourdomain.com/

Port 80 stays open after you enable HTTPS. The control plane reaches the server by IP address, so it cannot use a certificate issued for your domain — and certificate renewal needs it too. Closing 80 does not break your site; it breaks reloads, health reporting and sealing.

Confirm it worked

Open Monitoring in Cipher. The server should appear online within a few seconds, reporting latency, heap and uptime.

Node Engine — configuration .NET Engine — configuration