kaushik/RMM-UI-BE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: improve formatting and update FastAPI host configuration in production deployment manual

Browse Source
This commit is contained in:
kawsik
2026-06-02 11:51:15 +05:30
parent 3b2aa2ff95
commit 19f06ba94a
1 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
14_rmm_central_production_deployment.md
View File

@@ -1,4 +1,5 @@
# Seekright Pulse RMM - Central System Production Deployment Manual
## Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup)
This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM).
@@ -8,7 +9,9 @@ This guide focuses on a **Transitional ngrok Testing Setup** designed to get you
---
## 1. Why Use ngrok for VM Testing?
Running **ngrok** as a service on the remote VM offers several major benefits for transitional testing:
1. **Zero Open Ports:** You **do not** need to open port `8000` to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners.
2. **URL Reusability:** Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations.
3. **No SSL Setup Required:** ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box.
@@ -19,11 +22,11 @@ Running **ngrok** as a service on the remote VM offers several major benefits fo
When using ngrok, the internal ports are locked down strictly to the loopback interface (`127.0.0.1`), ensuring maximum security during testing.
| Service | Local Port | Exposed Globally? | Access Method / Firewall |
|---|---|---|---|
| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel |
| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted |
| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding |
| Service | Local Port | Exposed Globally? | Access Method / Firewall |
| --------------------- | ---------- | ----------------- | ---------------------------------------------------------------------------------- |
| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel |
| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted |
| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding |
---
@@ -32,7 +35,9 @@ When using ngrok, the internal ports are locked down strictly to the loopback in
Execute these steps chronologically on your remote VM.
### Step 1: OS Preparation
Update system index dependencies, disable sleep loops, and install required tools:
```bash
sudo apt-get update && sudo apt-get upgrade -y
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
@@ -42,6 +47,7 @@ sudo apt-get install -y git curl wget build-essential python3 python3-pip python
---
### Step 2: Install and Configure MongoDB
Install MongoDB Community Edition 8.0 and lock it down to the loopback interface.
```bash
@@ -70,6 +76,7 @@ sudo systemctl status mongod
---
### Step 3: Set Up the FastAPI Backend
Deploy the backend application code under `/opt/rmm-backend` and install dependencies.
```bash
@@ -100,7 +107,9 @@ deactivate
```
#### Run FastAPI as a systemd Background Service
Configure Uvicorn to run as a persistent background daemon:
```bash
sudo tee /etc/systemd/system/rmm-backend.service << 'EOF'
[Unit]
@@ -111,7 +120,7 @@ After=network.target mongod.service
Type=simple
User=root
WorkingDirectory=/opt/rmm-backend
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 127.0.0.1 --port 8000 --workers 4
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 0.0.0.0 --port 8000 --workers 4
Restart=always
RestartSec=5
EnvironmentFile=/opt/rmm-backend/.env
@@ -129,9 +138,11 @@ sudo systemctl start rmm-backend
---
### Step 4: Install and Run ngrok as a Persistent VM Service
Since a remote VM is managed via SSH, launching `ngrok http 8000` directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a **systemd service**.
#### A. Install ngrok on the VM
```bash
# 1. Clean any previous broken list files
sudo rm -f /etc/apt/sources.list.d/ngrok.list
@@ -147,12 +158,15 @@ sudo apt-get update && sudo apt-get install -y ngrok
```
#### B. Authenticate ngrok
Run this command on the VM, substituting `<YOUR_AUTHTOKEN>` with your actual ngrok token:
```bash
sudo ngrok config add-authtoken <YOUR_AUTHTOKEN>
```
#### C. Create the ngrok systemd Service File
```bash
sudo tee /etc/systemd/system/ngrok.service << 'EOF'
[Unit]
@@ -176,15 +190,19 @@ sudo systemctl start ngrok
```
#### D. Retrieve Your Public ngrok URL from the VM
Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint:
```bash
curl http://localhost:4040/api/tunnels
```
Look for the `"public_url"` value (e.g. `https://xxxx.ngrok-free.app`) in the JSON output.
---
### Step 5: Configure Firewall Protection (UFW)
Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (`22`).
```bash