RMM-UI-BE/14_rmm_central_production_deployment.md

Seekright Pulse RMM - Central System Production Deployment Manual

Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup)

This document serves as the master production setup and deployment manual for hosting the Seekright Pulse RMM Central System on a dedicated Virtual Machine (VM).

This guide focuses on a Transitional ngrok Testing Setup designed to get your central backend and database running on a remote VM immediately and securely, matching your local network behavior, before transitioning to a full Nginx configuration later.

---

1. Why Use ngrok for VM Testing?

Running ngrok as a service on the remote VM offers several major benefits for transitional testing:

1. Zero Open Ports: You do not need to open port 8000 to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners.
2. URL Reusability: Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations.
3. No SSL Setup Required: ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box.

---

2. Production Port Map & Access Control (ngrok Setup)

When using ngrok, the internal ports are locked down strictly to the loopback interface (127.0.0.1), ensuring maximum security during testing.

Service	Local Port	Exposed Globally?	Access Method / Firewall
FastAPI Backend	8000	No (Directly)	Bound strictly to 127.0.0.1. Exposed externally ONLY via the secure ngrok tunnel
MongoDB Community	27017	No	Bound strictly to 127.0.0.1. No external access permitted
Prometheus Server	9090	No	Bound strictly to 127.0.0.1. Accessible locally on VM or via SSH port forwarding

---

3. Step-by-Step Installation Guide

Execute these steps chronologically on your remote VM.

Step 1: OS Preparation

Update system index dependencies, disable sleep loops, and install required tools:

sudo apt-get update && sudo apt-get upgrade -y
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
sudo apt-get install -y git curl wget build-essential python3 python3-pip python3-venv

---

Step 2: Install and Configure MongoDB

Install MongoDB Community Edition 8.0 and lock it down to the loopback interface.

# 1. Import the public GPG key
curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-8.0.gpg

# 2. Add the MongoDB 8.0 repository for Ubuntu 24.04 (Noble)
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list

# 3. Update repositories and install packages
sudo apt-get update
sudo apt-get install -y mongodb-org

# 4. Ensure bindIp is set strictly to 127.0.0.1 in the config file
sudo sed -i 's/bindIp: 127.0.0.1/bindIp: 127.0.0.1/g' /etc/mongod.conf

# 5. Start and enable service to survive system reboots
sudo systemctl daemon-reload
sudo systemctl enable mongod
sudo systemctl start mongod

# Verify service is running
sudo systemctl status mongod

---

Step 3: Set Up the FastAPI Backend

Deploy the backend application code under /opt/rmm-backend and install dependencies.

# 1. Create dedicated application directory
sudo mkdir -p /opt/rmm-backend
sudo chown -R $USER:$USER /opt/rmm-backend
cd /opt/rmm-backend

# 2. Copy central_api_prototype.py and commands.json into /opt/rmm-backend/

# 3. Initialize Python Virtual Environment (Venv)
python3 -m venv venv
source venv/bin/activate

# 4. Install production dependencies
pip install --upgrade pip
pip install fastapi uvicorn pymongo dnspython python-dotenv httpx psutil

# 5. Configure production .env file
cat > /opt/rmm-backend/.env << 'EOF'
ROCKETCHAT_WEBHOOK_URL="https://text.seekright.com/hooks/6a0eb41ea88367bc6e101f0c/gvXfD8zSNRti43kEabqdE9tMCvNi9zAAoGfbao7cxcKbiW6R"
MONGODB_URI="mongodb://localhost:27017"
MONGODB_DB="rmm_db"
EOF

# Deactivate the environment
deactivate

Run FastAPI as a systemd Background Service

Configure Uvicorn to run as a persistent background daemon:

sudo tee /etc/systemd/system/rmm-backend.service << 'EOF'
[Unit]
Description=Seekright Pulse RMM Backend Service
After=network.target mongod.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/rmm-backend
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 0.0.0.0 --port 8000 --workers 4
Restart=always
RestartSec=5
EnvironmentFile=/opt/rmm-backend/.env

[Install]
WantedBy=multi-user.target
EOF

# Reload, enable, and launch the daemon
sudo systemctl daemon-reload
sudo systemctl enable rmm-backend
sudo systemctl start rmm-backend

---

Step 4: Install and Run ngrok as a Persistent VM Service

Since a remote VM is managed via SSH, launching ngrok http 8000 directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a systemd service.

A. Install ngrok on the VM

# 1. Clean any previous broken list files
sudo rm -f /etc/apt/sources.list.d/ngrok.list

# 2. Add the official ngrok signing key and repository configuration
curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
  | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
  && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \
  | sudo tee /etc/apt/sources.list.d/ngrok.list

# 3. Update repositories and install ngrok
sudo apt-get update && sudo apt-get install -y ngrok

B. Authenticate ngrok

Run this command on the VM, substituting <YOUR_AUTHTOKEN> with your actual ngrok token:

sudo ngrok config add-authtoken <YOUR_AUTHTOKEN>

C. Create the ngrok systemd Service File

sudo tee /etc/systemd/system/ngrok.service << 'EOF'
[Unit]
Description=ngrok secure tunnel
After=network.target rmm-backend.service

[Service]
ExecStart=/usr/bin/ngrok http 8000 --log=stdout
Restart=always
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target
EOF

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable ngrok
sudo systemctl start ngrok

D. Retrieve Your Public ngrok URL from the VM

Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint:

curl http://localhost:4040/api/tunnels

Look for the "public_url" value (e.g. https://xxxx.ngrok-free.app) in the JSON output.

---

Step 5: Configure Firewall Protection (UFW)

Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (22).

# Allow SSH access
sudo ufw allow ssh

# Enable the firewall
sudo ufw enable

# Verify
sudo ufw status verbose

---

4. Testing Your Setup

Once the VM configurations are applied, you can test the entire RMM loop securely:

1. Remote Agents: Configure client_agent_prototype.py on client machines to target the public ngrok HTTPS URL retrieved from Step 4 (Part D) of the VM.
2. Local Dashboard UI: Run rmm-ui locally on your machine. Update const API_BASE in your local App.jsx to target the same public ngrok HTTPS URL.
3. Verify: Launch your local frontend dashboard. You will see metrics and heartbeat logs from the client nodes streaming securely through your VM's background ngrok tunnel into the VM's MongoDB database.