From 19f06ba94ae87f582a8bb623b1016bd27baf3f0a Mon Sep 17 00:00:00 2001 From: kawsik Date: Tue, 2 Jun 2026 11:51:15 +0530 Subject: [PATCH] docs: improve formatting and update FastAPI host configuration in production deployment manual --- 14_rmm_central_production_deployment.md | 32 +++++++++++++++++++------ 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/14_rmm_central_production_deployment.md b/14_rmm_central_production_deployment.md index 57c00bf..5029970 100644 --- a/14_rmm_central_production_deployment.md +++ b/14_rmm_central_production_deployment.md @@ -1,14 +1,17 @@ # Seekright Pulse RMM - Central System Production Deployment Manual + ## Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup) -This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM). +This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM). This guide focuses on a **Transitional ngrok Testing Setup** designed to get your central backend and database running on a remote VM immediately and securely, matching your local network behavior, before transitioning to a full Nginx configuration later. --- ## 1. Why Use ngrok for VM Testing? + Running **ngrok** as a service on the remote VM offers several major benefits for transitional testing: + 1. **Zero Open Ports:** You **do not** need to open port `8000` to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners. 2. **URL Reusability:** Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations. 3. **No SSL Setup Required:** ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box. @@ -19,11 +22,11 @@ Running **ngrok** as a service on the remote VM offers several major benefits fo When using ngrok, the internal ports are locked down strictly to the loopback interface (`127.0.0.1`), ensuring maximum security during testing. -| Service | Local Port | Exposed Globally? | Access Method / Firewall | -|---|---|---|---| -| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel | -| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted | -| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding | +| Service | Local Port | Exposed Globally? | Access Method / Firewall | +| --------------------- | ---------- | ----------------- | ---------------------------------------------------------------------------------- | +| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel | +| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted | +| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding | --- @@ -32,7 +35,9 @@ When using ngrok, the internal ports are locked down strictly to the loopback in Execute these steps chronologically on your remote VM. ### Step 1: OS Preparation + Update system index dependencies, disable sleep loops, and install required tools: + ```bash sudo apt-get update && sudo apt-get upgrade -y sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target @@ -42,6 +47,7 @@ sudo apt-get install -y git curl wget build-essential python3 python3-pip python --- ### Step 2: Install and Configure MongoDB + Install MongoDB Community Edition 8.0 and lock it down to the loopback interface. ```bash @@ -70,6 +76,7 @@ sudo systemctl status mongod --- ### Step 3: Set Up the FastAPI Backend + Deploy the backend application code under `/opt/rmm-backend` and install dependencies. ```bash @@ -100,7 +107,9 @@ deactivate ``` #### Run FastAPI as a systemd Background Service + Configure Uvicorn to run as a persistent background daemon: + ```bash sudo tee /etc/systemd/system/rmm-backend.service << 'EOF' [Unit] @@ -111,7 +120,7 @@ After=network.target mongod.service Type=simple User=root WorkingDirectory=/opt/rmm-backend -ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 127.0.0.1 --port 8000 --workers 4 +ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 0.0.0.0 --port 8000 --workers 4 Restart=always RestartSec=5 EnvironmentFile=/opt/rmm-backend/.env @@ -129,9 +138,11 @@ sudo systemctl start rmm-backend --- ### Step 4: Install and Run ngrok as a Persistent VM Service + Since a remote VM is managed via SSH, launching `ngrok http 8000` directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a **systemd service**. #### A. Install ngrok on the VM + ```bash # 1. Clean any previous broken list files sudo rm -f /etc/apt/sources.list.d/ngrok.list @@ -147,12 +158,15 @@ sudo apt-get update && sudo apt-get install -y ngrok ``` #### B. Authenticate ngrok + Run this command on the VM, substituting `` with your actual ngrok token: + ```bash sudo ngrok config add-authtoken ``` #### C. Create the ngrok systemd Service File + ```bash sudo tee /etc/systemd/system/ngrok.service << 'EOF' [Unit] @@ -176,15 +190,19 @@ sudo systemctl start ngrok ``` #### D. Retrieve Your Public ngrok URL from the VM + Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint: + ```bash curl http://localhost:4040/api/tunnels ``` + Look for the `"public_url"` value (e.g. `https://xxxx.ngrok-free.app`) in the JSON output. --- ### Step 5: Configure Firewall Protection (UFW) + Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (`22`). ```bash