123 lines
5.4 KiB
Markdown
123 lines
5.4 KiB
Markdown
# Fleet Monitoring — End-to-End Setup
|
|
|
|
Connect any machine running the production `rclone-synology-sync` container to
|
|
the monitoring dashboard. Two sides: **collector** (your machine — runs the UI)
|
|
and **agent** (each monitored machine).
|
|
|
|
```
|
|
his machine your machine
|
|
┌──────────────────────────┐ ┌──────────────────────────────┐
|
|
│ existing prod stack │ │ collector (FastAPI) :8000 │
|
|
│ └─ writes Sync_logs/ │ Tailscale │ ├─ MongoDB │
|
|
│ NEW: rclone-agent ───────┼──────────────▶│ ├─ React dashboard │
|
|
│ (reads logs + folders, │ HTTP+token │ └─ rclone verifier → NAS │
|
|
│ changes NOTHING) │ └──────────────────────────────┘
|
|
└──────────────────────────┘
|
|
```
|
|
|
|
---
|
|
|
|
## Part A — Your machine (collector side)
|
|
|
|
Already running via `docker compose up -d` in this repo. To prepare it for
|
|
remote agents:
|
|
|
|
**A1. Set a real agent token.** In `.env`, replace the dev token:
|
|
```bash
|
|
# generate one (WSL): openssl rand -hex 24
|
|
AGENT_TOKEN=<paste the random value>
|
|
```
|
|
Apply it: `wsl -e bash -c "cd /mnt/c/Users/seekr/OneDrive/Desktop/work/R-clone && docker compose up -d collector agent-gcbot agent-riyadh"`
|
|
(recreates with the new env — no rebuild needed).
|
|
|
|
**A2. Install Tailscale inside WSL** (gives your collector an address his
|
|
machine can reach — no router changes, encrypted):
|
|
```bash
|
|
wsl
|
|
curl -fsSL https://tailscale.com/install.sh | sh
|
|
sudo tailscale up # opens a login URL — use a free account
|
|
tailscale ip -4 # ← note this IP, e.g. 100.101.102.103
|
|
```
|
|
|
|
**A3. Keep it reachable.** The WSL VM must stay up: keep a WSL terminal open
|
|
(or add to `C:\Users\seekr\.wslconfig`: `[wsl2]` + `vmIdleTimeout=-1`), and the
|
|
laptop must be on. For an always-on setup, move the collector to an office
|
|
server or small VPS later — everything is compose, so it's a copy-paste move.
|
|
|
|
**A4. Test from your side:** `curl http://localhost:8000/api/health` → `{"ok":true}`.
|
|
|
|
---
|
|
|
|
## Part B — His machine (agent side)
|
|
|
|
**B1. Send him one folder.** Assemble it from this repo:
|
|
```
|
|
agent-deploy/
|
|
├── docker-compose.yml ← deploy/agent-only/docker-compose.yml
|
|
├── .env ← deploy/agent-only/.env.example, filled in
|
|
└── agent/
|
|
├── agent.py ← monitor/agent/agent.py
|
|
└── Dockerfile ← monitor/agent/Dockerfile
|
|
```
|
|
Zip it, send it however you like — **except the AGENT_TOKEN value: share that
|
|
separately** (Signal/WhatsApp/verbally), not inside the zip.
|
|
|
|
**B2. He installs Tailscale** on his machine and joins **your** tailnet:
|
|
```bash
|
|
curl -fsSL https://tailscale.com/install.sh | sh
|
|
sudo tailscale up
|
|
```
|
|
Easiest: log in with the same account, or send him a share invite from the
|
|
Tailscale admin console.
|
|
|
|
**B3. He fills `.env`** (values for his machine are pre-filled in the example;
|
|
for any other machine, read the paths from the header comment + volumes of that
|
|
machine's generated `docker-compose.yml`):
|
|
- `MACHINE_ID` — unique, e.g. `JAGAN-TEST-01`
|
|
- `COLLECTOR_URL=http://<IP from step A2>:8000`
|
|
- `AGENT_TOKEN` — the value you shared
|
|
- the three paths (already correct for his machine)
|
|
|
|
**B4. He starts it:**
|
|
```bash
|
|
cd agent-deploy
|
|
docker compose up -d --build
|
|
docker logs rclone-agent # expect: [agent] JAGAN-TEST-01 (TEST) -> http://100...:8000
|
|
```
|
|
No errors in that log = done. His existing production containers are untouched —
|
|
the agent only reads two folders, both mounted read-only.
|
|
|
|
**B5. Verify on your side:** a `JAGAN-TEST-01` card appears on
|
|
http://localhost:8000 within ~10 s (heartbeat). Pair rows and file counts fill
|
|
in after his next sync round (up to `SYNC_INTERVAL` later).
|
|
|
|
---
|
|
|
|
## Part C — Optional: server-side verification for his machine
|
|
|
|
Your collector currently verifies uploads against the **local fake NAS** only.
|
|
To have it verify his real uploads on the office Synology, the collector needs
|
|
the real NAS reachable + its SFTP creds in the collector env
|
|
(`SYNOLOGY_HOST/PORT/USER/PASS` in compose). Do this only after the team
|
|
rotates the leaked password. Until then his card shows heartbeat, rounds,
|
|
synced files, failures — everything except pending/missing.
|
|
|
|
---
|
|
|
|
## Troubleshooting
|
|
|
|
| Symptom | Cause / fix |
|
|
|---|---|
|
|
| No card appears | `docker logs rclone-agent` — "collector unreachable" → check `tailscale status` both sides, `curl http://<ip>:8000/api/health` from his machine |
|
|
| 401 in agent logs | AGENT_TOKEN mismatch — must be byte-identical both sides |
|
|
| Card but no pairs/files | Normal until his next sync round completes; check `tail Sync_logs/sync.log` is actually growing |
|
|
| Card goes OFFLINE later | Your WSL idled out or laptop slept (see A3) |
|
|
| Wrong/empty pending counts | Paths in his `.env` don't match the sync container's volume host paths |
|
|
|
|
## Security notes
|
|
- The agent sends outbound HTTP only; it opens no ports on his machine.
|
|
- Tailscale traffic is end-to-end encrypted (WireGuard); the token stops
|
|
spoofed agents even inside the tailnet.
|
|
- Never put real NAS credentials in the agent bundle — the agent doesn't need
|
|
them. Only the collector (Part C) ever holds NAS creds.
|