kaushik/RMM-UI-BE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
kawsik
2026-06-02 10:37:57 +05:30
commit b4acb8d1df
49 changed files with 15350 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

209
14_rmm_central_production_deployment.md Normal file
View File

@@ -0,0 +1,209 @@
# Seekright Pulse RMM - Central System Production Deployment Manual
## Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup)
This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM).
This guide focuses on a **Transitional ngrok Testing Setup** designed to get your central backend and database running on a remote VM immediately and securely, matching your local network behavior, before transitioning to a full Nginx configuration later.
---
## 1. Why Use ngrok for VM Testing?
Running **ngrok** as a service on the remote VM offers several major benefits for transitional testing:
1. **Zero Open Ports:** You **do not** need to open port `8000` to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners.
2. **URL Reusability:** Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations.
3. **No SSL Setup Required:** ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box.
---
## 2. Production Port Map & Access Control (ngrok Setup)
When using ngrok, the internal ports are locked down strictly to the loopback interface (`127.0.0.1`), ensuring maximum security during testing.
| Service | Local Port | Exposed Globally? | Access Method / Firewall |
|---|---|---|---|
| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel |
| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted |
| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding |
---
## 3. Step-by-Step Installation Guide
Execute these steps chronologically on your remote VM.
### Step 1: OS Preparation
Update system index dependencies, disable sleep loops, and install required tools:
```bash
sudo apt-get update && sudo apt-get upgrade -y
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
sudo apt-get install -y git curl wget build-essential python3 python3-pip python3-venv
```
---
### Step 2: Install and Configure MongoDB
Install MongoDB Community Edition 8.0 and lock it down to the loopback interface.
```bash
# 1. Import the public GPG key
curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-8.0.gpg
# 2. Add the MongoDB 8.0 repository for Ubuntu 24.04 (Noble)
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list
# 3. Update repositories and install packages
sudo apt-get update
sudo apt-get install -y mongodb-org
# 4. Ensure bindIp is set strictly to 127.0.0.1 in the config file
sudo sed -i 's/bindIp: 127.0.0.1/bindIp: 127.0.0.1/g' /etc/mongod.conf
# 5. Start and enable service to survive system reboots
sudo systemctl daemon-reload
sudo systemctl enable mongod
sudo systemctl start mongod
# Verify service is running
sudo systemctl status mongod
```
---
### Step 3: Set Up the FastAPI Backend
Deploy the backend application code under `/opt/rmm-backend` and install dependencies.
```bash
# 1. Create dedicated application directory
sudo mkdir -p /opt/rmm-backend
sudo chown -R $USER:$USER /opt/rmm-backend
cd /opt/rmm-backend
# 2. Copy central_api_prototype.py and commands.json into /opt/rmm-backend/
# 3. Initialize Python Virtual Environment (Venv)
python3 -m venv venv
source venv/bin/activate
# 4. Install production dependencies
pip install --upgrade pip
pip install fastapi uvicorn pymongo dnspython python-dotenv httpx psutil
# 5. Configure production .env file
cat > /opt/rmm-backend/.env << 'EOF'
ROCKETCHAT_WEBHOOK_URL="https://text.seekright.com/hooks/6a0eb41ea88367bc6e101f0c/gvXfD8zSNRti43kEabqdE9tMCvNi9zAAoGfbao7cxcKbiW6R"
MONGODB_URI="mongodb://localhost:27017"
MONGODB_DB="rmm_db"
EOF
# Deactivate the environment
deactivate
```
#### Run FastAPI as a systemd Background Service
Configure Uvicorn to run as a persistent background daemon:
```bash
sudo tee /etc/systemd/system/rmm-backend.service << 'EOF'
[Unit]
Description=Seekright Pulse RMM Backend Service
After=network.target mongod.service
[Service]
Type=simple
User=root
WorkingDirectory=/opt/rmm-backend
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 127.0.0.1 --port 8000 --workers 4
Restart=always
RestartSec=5
EnvironmentFile=/opt/rmm-backend/.env
[Install]
WantedBy=multi-user.target
EOF
# Reload, enable, and launch the daemon
sudo systemctl daemon-reload
sudo systemctl enable rmm-backend
sudo systemctl start rmm-backend
```
---
### Step 4: Install and Run ngrok as a Persistent VM Service
Since a remote VM is managed via SSH, launching `ngrok http 8000` directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a **systemd service**.
#### A. Install ngrok on the VM
```bash
# 1. Clean any previous broken list files
sudo rm -f /etc/apt/sources.list.d/ngrok.list
# 2. Add the official ngrok signing key and repository configuration
curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
| sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
&& echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \
| sudo tee /etc/apt/sources.list.d/ngrok.list
# 3. Update repositories and install ngrok
sudo apt-get update && sudo apt-get install -y ngrok
```
#### B. Authenticate ngrok
Run this command on the VM, substituting `<YOUR_AUTHTOKEN>` with your actual ngrok token:
```bash
sudo ngrok config add-authtoken <YOUR_AUTHTOKEN>
```
#### C. Create the ngrok systemd Service File
```bash
sudo tee /etc/systemd/system/ngrok.service << 'EOF'
[Unit]
Description=ngrok secure tunnel
After=network.target rmm-backend.service
[Service]
ExecStart=/usr/bin/ngrok http 8000 --log=stdout
Restart=always
RestartSec=5
User=root
[Install]
WantedBy=multi-user.target
EOF
# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable ngrok
sudo systemctl start ngrok
```
#### D. Retrieve Your Public ngrok URL from the VM
Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint:
```bash
curl http://localhost:4040/api/tunnels
```
Look for the `"public_url"` value (e.g. `https://xxxx.ngrok-free.app`) in the JSON output.
---
### Step 5: Configure Firewall Protection (UFW)
Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (`22`).
```bash
# Allow SSH access
sudo ufw allow ssh
# Enable the firewall
sudo ufw enable
# Verify
sudo ufw status verbose
```
---
## 4. Testing Your Setup
Once the VM configurations are applied, you can test the entire RMM loop securely:
1. **Remote Agents:** Configure `client_agent_prototype.py` on client machines to target the public ngrok HTTPS URL retrieved from **Step 4 (Part D)** of the VM.
2. **Local Dashboard UI:** Run `rmm-ui` locally on your machine. Update `const API_BASE` in your local `App.jsx` to target the same public ngrok HTTPS URL.
3. **Verify:** Launch your local frontend dashboard. You will see metrics and heartbeat logs from the client nodes streaming securely through your VM's background ngrok tunnel into the VM's MongoDB database.