Fleet Monitoring — End-to-End Setup

Connect any machine running the production rclone-synology-sync container to the monitoring dashboard. Two sides: collector (your machine — runs the UI) and agent (each monitored machine).

his machine                                your machine
┌──────────────────────────┐               ┌──────────────────────────────┐
│ existing prod stack      │               │ collector (FastAPI) :8000    │
│  └─ writes Sync_logs/    │   Tailscale   │  ├─ MongoDB                  │
│ NEW: rclone-agent ───────┼──────────────▶│  ├─ React dashboard          │
│  (reads logs + folders,  │  HTTP+token   │  └─ rclone verifier → NAS    │
│   changes NOTHING)       │               └──────────────────────────────┘
└──────────────────────────┘

Part A — Your machine (collector side)

Already running via docker compose up -d in this repo. To prepare it for remote agents:

A1. Set a real agent token. In .env, replace the dev token:

# generate one (WSL):  openssl rand -hex 24
AGENT_TOKEN=<paste the random value>

Apply it: wsl -e bash -c "cd /mnt/c/Users/seekr/OneDrive/Desktop/work/R-clone && docker compose up -d collector agent-gcbot agent-riyadh" (recreates with the new env — no rebuild needed).

A2. Install Tailscale inside WSL (gives your collector an address his machine can reach — no router changes, encrypted):

wsl
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up          # opens a login URL — use a free account
tailscale ip -4            # ← note this IP, e.g. 100.101.102.103

A3. Keep it reachable. The WSL VM must stay up: keep a WSL terminal open (or add to C:\Users\seekr\.wslconfig: [wsl2] + vmIdleTimeout=-1), and the laptop must be on. For an always-on setup, move the collector to an office server or small VPS later — everything is compose, so it's a copy-paste move.

A4. Test from your side: curl http://localhost:8000/api/health → {"ok":true}.

Part B — His machine (agent side)

B1. Send him one folder. Assemble it from this repo:

agent-deploy/
├── docker-compose.yml    ← deploy/agent-only/docker-compose.yml
├── .env                  ← deploy/agent-only/.env.example, filled in
└── agent/
    ├── agent.py          ← monitor/agent/agent.py
    └── Dockerfile        ← monitor/agent/Dockerfile

Zip it, send it however you like — except the AGENT_TOKEN value: share that separately (Signal/WhatsApp/verbally), not inside the zip.

B2. He installs Tailscale on his machine and joins your tailnet:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Easiest: log in with the same account, or send him a share invite from the Tailscale admin console.

B3. He fills .env (values for his machine are pre-filled in the example; for any other machine, read the paths from the header comment + volumes of that machine's generated docker-compose.yml):

MACHINE_ID — unique, e.g. JAGAN-TEST-01
COLLECTOR_URL=http://<IP from step A2>:8000
AGENT_TOKEN — the value you shared
the three paths (already correct for his machine)

B4. He starts it:

cd agent-deploy
docker compose up -d --build
docker logs rclone-agent      # expect: [agent] JAGAN-TEST-01 (TEST) -> http://100...:8000

No errors in that log = done. His existing production containers are untouched — the agent only reads two folders, both mounted read-only.

B5. Verify on your side: a JAGAN-TEST-01 card appears on http://localhost:8000 within ~10 s (heartbeat). Pair rows and file counts fill in after his next sync round (up to SYNC_INTERVAL later).

Part C — Optional: server-side verification for his machine

Your collector currently verifies uploads against the local fake NAS only. To have it verify his real uploads on the office Synology, the collector needs the real NAS reachable + its SFTP creds in the collector env (SYNOLOGY_HOST/PORT/USER/PASS in compose). Do this only after the team rotates the leaked password. Until then his card shows heartbeat, rounds, synced files, failures — everything except pending/missing.

Troubleshooting

Symptom	Cause / fix
No card appears	`docker logs rclone-agent` — "collector unreachable" → check `tailscale status` both sides, `curl http://<ip>:8000/api/health` from his machine
401 in agent logs	AGENT_TOKEN mismatch — must be byte-identical both sides
Card but no pairs/files	Normal until his next sync round completes; check `tail Sync_logs/sync.log` is actually growing
Card goes OFFLINE later	Your WSL idled out or laptop slept (see A3)
Wrong/empty pending counts	Paths in his `.env` don't match the sync container's volume host paths

Security notes

The agent sends outbound HTTP only; it opens no ports on his machine.
Tailscale traffic is end-to-end encrypted (WireGuard); the token stops spoofed agents even inside the tailnet.
Never put real NAS credentials in the agent bundle — the agent doesn't need them. Only the collector (Part C) ever holds NAS creds.

5.4 KiB Raw Blame History