228 lines
7.8 KiB
Markdown
228 lines
7.8 KiB
Markdown
# Seekright Pulse RMM - Central System Production Deployment Manual
|
|
|
|
## Fresh Linux Production VM Setup & Operations Guide (Transitional ngrok Testing Setup)
|
|
|
|
This document serves as the master production setup and deployment manual for hosting the **Seekright Pulse RMM Central System** on a dedicated Virtual Machine (VM).
|
|
|
|
This guide focuses on a **Transitional ngrok Testing Setup** designed to get your central backend and database running on a remote VM immediately and securely, matching your local network behavior, before transitioning to a full Nginx configuration later.
|
|
|
|
---
|
|
|
|
## 1. Why Use ngrok for VM Testing?
|
|
|
|
Running **ngrok** as a service on the remote VM offers several major benefits for transitional testing:
|
|
|
|
1. **Zero Open Ports:** You **do not** need to open port `8000` to the public internet on the VM firewall. ngrok creates a secure outbound TCP connection, protecting your VM backend from external scanners.
|
|
2. **URL Reusability:** Remote client agents can continue connecting to your established public ngrok HTTPS URL without requiring any code edits or DNS configurations.
|
|
3. **No SSL Setup Required:** ngrok automatically provides secure, pre-configured HTTPS certificates out-of-the-box.
|
|
|
|
---
|
|
|
|
## 2. Production Port Map & Access Control (ngrok Setup)
|
|
|
|
When using ngrok, the internal ports are locked down strictly to the loopback interface (`127.0.0.1`), ensuring maximum security during testing.
|
|
|
|
| Service | Local Port | Exposed Globally? | Access Method / Firewall |
|
|
| --------------------- | ---------- | ----------------- | ---------------------------------------------------------------------------------- |
|
|
| **FastAPI Backend** | `8000` | **No** (Directly) | Bound strictly to `127.0.0.1`. Exposed externally ONLY via the secure ngrok tunnel |
|
|
| **MongoDB Community** | `27017` | **No** | Bound strictly to `127.0.0.1`. No external access permitted |
|
|
| **Prometheus Server** | `9090` | **No** | Bound strictly to `127.0.0.1`. Accessible locally on VM or via SSH port forwarding |
|
|
|
|
---
|
|
|
|
## 3. Step-by-Step Installation Guide
|
|
|
|
Execute these steps chronologically on your remote VM.
|
|
|
|
### Step 1: OS Preparation
|
|
|
|
Update system index dependencies, disable sleep loops, and install required tools:
|
|
|
|
```bash
|
|
sudo apt-get update && sudo apt-get upgrade -y
|
|
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
|
|
sudo apt-get install -y git curl wget build-essential python3 python3-pip python3-venv
|
|
```
|
|
|
|
---
|
|
|
|
### Step 2: Install and Configure MongoDB
|
|
|
|
Install MongoDB Community Edition 8.0 and lock it down to the loopback interface.
|
|
|
|
```bash
|
|
# 1. Import the public GPG key
|
|
curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-8.0.gpg
|
|
|
|
# 2. Add the MongoDB 8.0 repository for Ubuntu 24.04 (Noble)
|
|
echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list
|
|
|
|
# 3. Update repositories and install packages
|
|
sudo apt-get update
|
|
sudo apt-get install -y mongodb-org
|
|
|
|
# 4. Ensure bindIp is set strictly to 127.0.0.1 in the config file
|
|
sudo sed -i 's/bindIp: 127.0.0.1/bindIp: 127.0.0.1/g' /etc/mongod.conf
|
|
|
|
# 5. Start and enable service to survive system reboots
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable mongod
|
|
sudo systemctl start mongod
|
|
|
|
# Verify service is running
|
|
sudo systemctl status mongod
|
|
```
|
|
|
|
---
|
|
|
|
### Step 3: Set Up the FastAPI Backend
|
|
|
|
Deploy the backend application code under `/opt/rmm-backend` and install dependencies.
|
|
|
|
```bash
|
|
# 1. Create dedicated application directory
|
|
sudo mkdir -p /opt/rmm-backend
|
|
sudo chown -R $USER:$USER /opt/rmm-backend
|
|
cd /opt/rmm-backend
|
|
|
|
# 2. Copy central_api_prototype.py and commands.json into /opt/rmm-backend/
|
|
|
|
# 3. Initialize Python Virtual Environment (Venv)
|
|
python3 -m venv venv
|
|
source venv/bin/activate
|
|
|
|
# 4. Install production dependencies
|
|
pip install --upgrade pip
|
|
pip install fastapi uvicorn pymongo dnspython python-dotenv httpx psutil
|
|
|
|
# 5. Configure production .env file
|
|
cat > /opt/rmm-backend/.env << 'EOF'
|
|
ROCKETCHAT_WEBHOOK_URL="https://text.seekright.com/hooks/6a0eb41ea88367bc6e101f0c/gvXfD8zSNRti43kEabqdE9tMCvNi9zAAoGfbao7cxcKbiW6R"
|
|
MONGODB_URI="mongodb://localhost:27017"
|
|
MONGODB_DB="rmm_db"
|
|
EOF
|
|
|
|
# Deactivate the environment
|
|
deactivate
|
|
```
|
|
|
|
#### Run FastAPI as a systemd Background Service
|
|
|
|
Configure Uvicorn to run as a persistent background daemon:
|
|
|
|
```bash
|
|
sudo tee /etc/systemd/system/rmm-backend.service << 'EOF'
|
|
[Unit]
|
|
Description=Seekright Pulse RMM Backend Service
|
|
After=network.target mongod.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
WorkingDirectory=/opt/rmm-backend
|
|
ExecStart=/opt/rmm-backend/venv/bin/uvicorn central_api_prototype:app --host 0.0.0.0 --port 8000 --workers 4
|
|
Restart=always
|
|
RestartSec=5
|
|
EnvironmentFile=/opt/rmm-backend/.env
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
# Reload, enable, and launch the daemon
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable rmm-backend
|
|
sudo systemctl start rmm-backend
|
|
```
|
|
|
|
---
|
|
|
|
### Step 4: Install and Run ngrok as a Persistent VM Service
|
|
|
|
Since a remote VM is managed via SSH, launching `ngrok http 8000` directly in the shell will terminate as soon as the SSH connection closes. To keep ngrok running persistently in the background on the VM, install and run it as a **systemd service**.
|
|
|
|
#### A. Install ngrok on the VM
|
|
|
|
```bash
|
|
# 1. Clean any previous broken list files
|
|
sudo rm -f /etc/apt/sources.list.d/ngrok.list
|
|
|
|
# 2. Add the official ngrok signing key and repository configuration
|
|
curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
|
|
| sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
|
|
&& echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \
|
|
| sudo tee /etc/apt/sources.list.d/ngrok.list
|
|
|
|
# 3. Update repositories and install ngrok
|
|
sudo apt-get update && sudo apt-get install -y ngrok
|
|
```
|
|
|
|
#### B. Authenticate ngrok
|
|
|
|
Run this command on the VM, substituting `<YOUR_AUTHTOKEN>` with your actual ngrok token:
|
|
|
|
```bash
|
|
sudo ngrok config add-authtoken <YOUR_AUTHTOKEN>
|
|
```
|
|
|
|
#### C. Create the ngrok systemd Service File
|
|
|
|
```bash
|
|
sudo tee /etc/systemd/system/ngrok.service << 'EOF'
|
|
[Unit]
|
|
Description=ngrok secure tunnel
|
|
After=network.target rmm-backend.service
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/ngrok http 8000 --log=stdout
|
|
Restart=always
|
|
RestartSec=5
|
|
User=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
# Enable and start the service
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable ngrok
|
|
sudo systemctl start ngrok
|
|
```
|
|
|
|
#### D. Retrieve Your Public ngrok URL from the VM
|
|
|
|
Because the ngrok agent runs silently in the background, query the local ngrok client API to find the active HTTPS endpoint:
|
|
|
|
```bash
|
|
curl http://localhost:4040/api/tunnels
|
|
```
|
|
|
|
Look for the `"public_url"` value (e.g. `https://xxxx.ngrok-free.app`) in the JSON output.
|
|
|
|
---
|
|
|
|
### Step 5: Configure Firewall Protection (UFW)
|
|
|
|
Since ngrok tunnels traffic privately, secure your server by locking down all ports except SSH (`22`).
|
|
|
|
```bash
|
|
# Allow SSH access
|
|
sudo ufw allow ssh
|
|
|
|
# Enable the firewall
|
|
sudo ufw enable
|
|
|
|
# Verify
|
|
sudo ufw status verbose
|
|
```
|
|
|
|
---
|
|
|
|
## 4. Testing Your Setup
|
|
|
|
Once the VM configurations are applied, you can test the entire RMM loop securely:
|
|
|
|
1. **Remote Agents:** Configure `client_agent_prototype.py` on client machines to target the public ngrok HTTPS URL retrieved from **Step 4 (Part D)** of the VM.
|
|
2. **Local Dashboard UI:** Run `rmm-ui` locally on your machine. Update `const API_BASE` in your local `App.jsx` to target the same public ngrok HTTPS URL.
|
|
3. **Verify:** Launch your local frontend dashboard. You will see metrics and heartbeat logs from the client nodes streaming securely through your VM's background ngrok tunnel into the VM's MongoDB database.
|