RMM-UI-BE/14_rmm_central_production_deployment.md

# Seekright Pulse RMM - Central System Production Deployment Manual

## Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup)

This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM).

This guide focuses on a **Transitional ngrok Testing Setup** designed to get your central backend and database running on a remote VM immediately and securely, matching your local network behavior, before transitioning to a full Nginx configuration later.

---

## 1. Why Use ngrok for VM Testing?

Running **ngrok** as a service on the remote VM offers several major benefits for transitional testing:

1. **Zero Open Ports:** You **do not** need to open port `8000` to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners.
2. **URL Reusability:** Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations.
3. **No SSL Setup Required:** ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box.

---

## 2. Production Port Map & Access Control (ngrok Setup)

When using ngrok, the internal ports are locked down strictly to the loopback interface (`127.0.0.1`), ensuring maximum security during testing.

| Service               | Local Port | Exposed Globally? | Access Method / Firewall                                                           |
| --------------------- | ---------- | ----------------- | ---------------------------------------------------------------------------------- |
| **FastAPI Backend**   | `8000`     | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel |
| **MongoDB Community** | `27017`    | **No**            | Bound strictly to `127.0.0.1`. No external access permitted                        |
| **Prometheus Server** | `9090`     | **No**            | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding |

---

## 3. Step-by-Step Installation Guide

Execute these steps chronologically on your remote VM.

### Step 1: OS Preparation

Update system index dependencies, disable sleep loops, and install required tools:

```bash
sudo apt-get update && sudo apt-get upgrade -y
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
sudo apt-get install -y git curl wget build-essential python3 python3-pip python3-venv
```

---

### Step 2: Install and Configure MongoDB

Install MongoDB Community Edition 8.0 and lock it down to the loopback interface.

```bash
# 1. Import the public GPG key
curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-8.0.gpg

# 2. Add the MongoDB 8.0 repository for Ubuntu 24.04 (Noble)
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list

# 3. Update repositories and install packages
sudo apt-get update
sudo apt-get install -y mongodb-org

# 4. Ensure bindIp is set strictly to 127.0.0.1 in the config file
sudo sed -i 's/bindIp: 127.0.0.1/bindIp: 127.0.0.1/g' /etc/mongod.conf

# 5. Start and enable service to survive system reboots
sudo systemctl daemon-reload
sudo systemctl enable mongod
sudo systemctl start mongod

# Verify service is running
sudo systemctl status mongod
```

---

### Step 3: Set Up the FastAPI Backend

Deploy the backend application code under `/opt/rmm-backend` and install dependencies.

```bash
# 1. Create dedicated application directory
sudo mkdir -p /opt/rmm-backend
sudo chown -R $USER:$USER /opt/rmm-backend
cd /opt/rmm-backend

# 2. Copy central_api_prototype.py and commands.json into /opt/rmm-backend/

# 3. Initialize Python Virtual Environment (Venv)
python3 -m venv venv
source venv/bin/activate

# 4. Install production dependencies
pip install --upgrade pip
pip install fastapi uvicorn pymongo dnspython python-dotenv httpx psutil

# 5. Configure production .env file
cat > /opt/rmm-backend/.env << 'EOF'
ROCKETCHAT_WEBHOOK_URL="https://text.seekright.com/hooks/6a0eb41ea88367bc6e101f0c/gvXfD8zSNRti43kEabqdE9tMCvNi9zAAoGfbao7cxcKbiW6R"
MONGODB_URI="mongodb://localhost:27017"
MONGODB_DB="rmm_db"
EOF

# Deactivate the environment
deactivate
```

#### Run FastAPI as a systemd Background Service

Configure Uvicorn to run as a persistent background daemon:

```bash
sudo tee /etc/systemd/system/rmm-backend.service << 'EOF'
[Unit]
Description=Seekright Pulse RMM Backend Service
After=network.target mongod.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/rmm-backend
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 0.0.0.0 --port 8000 --workers 4
Restart=always
RestartSec=5
EnvironmentFile=/opt/rmm-backend/.env

[Install]
WantedBy=multi-user.target
EOF

# Reload, enable, and launch the daemon
sudo systemctl daemon-reload
sudo systemctl enable rmm-backend
sudo systemctl start rmm-backend
```

---

### Step 4: Install and Run ngrok as a Persistent VM Service

Since a remote VM is managed via SSH, launching `ngrok http 8000` directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a **systemd service**.

#### A. Install ngrok on the VM

```bash
# 1. Clean any previous broken list files
sudo rm -f /etc/apt/sources.list.d/ngrok.list

# 2. Add the official ngrok signing key and repository configuration
curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
  | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
  && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \
  | sudo tee /etc/apt/sources.list.d/ngrok.list

# 3. Update repositories and install ngrok
sudo apt-get update && sudo apt-get install -y ngrok
```

#### B. Authenticate ngrok

Run this command on the VM, substituting `<YOUR_AUTHTOKEN>` with your actual ngrok token:

```bash
sudo ngrok config add-authtoken <YOUR_AUTHTOKEN>
```

#### C. Create the ngrok systemd Service File

```bash
sudo tee /etc/systemd/system/ngrok.service << 'EOF'
[Unit]
Description=ngrok secure tunnel
After=network.target rmm-backend.service

[Service]
ExecStart=/usr/bin/ngrok http 8000 --log=stdout
Restart=always
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target
EOF

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable ngrok
sudo systemctl start ngrok
```

#### D. Retrieve Your Public ngrok URL from the VM

Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint:

```bash
curl http://localhost:4040/api/tunnels
```

Look for the `"public_url"` value (e.g. `https://xxxx.ngrok-free.app`) in the JSON output.

---

### Step 5: Configure Firewall Protection (UFW)

Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (`22`).

```bash
# Allow SSH access
sudo ufw allow ssh

# Enable the firewall
sudo ufw enable

# Verify
sudo ufw status verbose
```

---

## 4. Testing Your Setup

Once the VM configurations are applied, you can test the entire RMM loop securely:

1. **Remote Agents:** Configure `client_agent_prototype.py` on client machines to target the public ngrok HTTPS URL retrieved from **Step 4 (Part D)** of the VM.
2. **Local Dashboard UI:** Run `rmm-ui` locally on your machine. Update `const API_BASE` in your local `App.jsx` to target the same public ngrok HTTPS URL.
3. **Verify:** Launch your local frontend dashboard. You will see metrics and heartbeat logs from the client nodes streaming securely through your VM's background ngrok tunnel into the VM's MongoDB database.