88 lines
5.0 KiB
Markdown
88 lines
5.0 KiB
Markdown
# Master Deployment Manual: Scalable RMM & Monitoring Infrastructure
|
|
|
|
This document serves as the master reference guide for deploying, connecting, and managing the end-to-end Remote Monitoring and Management (RMM) infrastructure.
|
|
|
|
---
|
|
|
|
## 1. System Architecture Overview
|
|
|
|
The infrastructure is split into two primary environments:
|
|
|
|
### A. The Central System (`vm3`)
|
|
The central command center. It is responsible for gathering data, alerting admins, and providing remote terminal access.
|
|
* **Grafana (Port 3000):** The visualization UI where humans view metrics.
|
|
* **Prometheus (Port 9090):** The time-series database that reaches out to scrape metrics from clients.
|
|
* **Alertmanager (Port 9093):** Evaluates Prometheus rules and fires emails or Rocket.Chat messages.
|
|
* **MeshCentral (Port 4430):** The RMM dashboard that allows admins to open secure remote terminals to any client.
|
|
|
|
### B. The Remote Systems (Client Nodes)
|
|
The 100+ endpoints distributed globally that are being monitored.
|
|
* **Node Exporter (Port 9100):** Exposes base hardware metrics (CPU, RAM, Disk).
|
|
* **Nvidia GPU Exporter (Port 9835):** Exposes GPU metrics (Temperature, VRAM, Utilization).
|
|
* **MeshAgent:** A lightweight background process that connects back to MeshCentral.
|
|
|
|
---
|
|
|
|
## 2. The Network Connectivity Layer
|
|
|
|
Because Prometheus relies on a "Pull" architecture (scraping), the Central System must have a secure, encrypted tunnel to reach the Remote Systems without exposing them to the public internet. We support two models:
|
|
|
|
### Model A: Zero-Trust Mesh VPN (Tailscale) - *Primary Recommendation*
|
|
* **Why:** Peer-to-peer, automated key rotation, zero IP sub-net collisions, and no router configuration required.
|
|
* **How it's done:**
|
|
1. Admin generates a "Reusable, Pre-Approved Auth Key" in the Tailscale web console.
|
|
2. On the remote client, run: `curl -fsSL https://tailscale.com/install.sh | sh && sudo tailscale up --authkey=YOUR_KEY`
|
|
3. The machine instantly joins the `100.x.x.x` network.
|
|
|
|
### Model B: Traditional Hub-and-Spoke (Synology OpenVPN) - *Alternative*
|
|
* **Why:** 100% self-hosted; prevents reliance on third-party SaaS servers.
|
|
* **How it's done:**
|
|
1. **DDNS:** Configure Synology to broadcast to `yourcompany.synology.me`.
|
|
2. **Port Forwarding:** The office IT Admin configures the Cisco Router to forward `UDP Port 1194` to the Synology's Local IP.
|
|
3. **Certificates:** Admin exports the `VPNConfig.ovpn` file and edits the IP to match the DDNS name.
|
|
4. **Client Setup:** Move the `.ovpn` file to `/etc/openvpn/client.conf`, create an `auth.txt` file for automated login, and run `sudo systemctl enable --now openvpn@client`.
|
|
|
|
---
|
|
|
|
## 3. Central System Setup Guide
|
|
|
|
To stand up the central server (`vm3`), execute the automated `setup_central_server.sh` script.
|
|
|
|
**What the script does autonomously:**
|
|
1. Installs Tailscale to join the secure network.
|
|
2. Creates the `meshcentral` user and securely installs Node.js and the MeshCentral package.
|
|
3. Downloads the latest Prometheus and Alertmanager binaries, extracts them, and places them in `/usr/local/bin`.
|
|
4. Creates Prometheus configuration files (`prometheus.yml`), mapping it to the Alertmanager target.
|
|
5. Installs Grafana via the official APT repository.
|
|
6. Creates robust `systemd` service files for every component to ensure they auto-restart if the server reboots.
|
|
|
|
---
|
|
|
|
## 4. Remote Client Setup Guide
|
|
|
|
To onboard a new remote server, execute the `deploy_exporters.sh` script on the client machine.
|
|
|
|
**What the script does autonomously:**
|
|
1. Installs Node Exporter and sets it to run as a systemd background service.
|
|
2. Detects if an Nvidia GPU is present using `nvidia-smi`.
|
|
3. If a GPU is found, downloads and installs the Nvidia GPU Exporter.
|
|
4. Uses a `curl` webhook to fire a notification to a Rocket.Chat channel, alerting the admin that the deployment succeeded and providing the exporter statuses.
|
|
|
|
**MeshAgent Deployment:**
|
|
1. Log into the MeshCentral web UI (`https://100.x.x.x:4430`).
|
|
2. Create a Device Group.
|
|
3. Click "Add Agent" and copy the provided bash script.
|
|
4. Paste it into the client terminal to install the MeshAgent.
|
|
|
|
---
|
|
|
|
## 5. Security Protocols & Client Objections
|
|
|
|
When dealing with B2B deployments, clients may object to installing VPNs or Remote Control agents on their internal servers.
|
|
|
|
**Objection 1: "We do not want you to have unattended remote terminal access to our servers."**
|
|
* **Solution:** Configure MeshCentral to use **User-Consent Mode**. The MeshAgent will still run, but if an admin tries to open a terminal, a prompt will appear on the client's screen forcing them to click "Accept" before the connection is allowed.
|
|
|
|
**Objection 2: "We do not allow external VPNs (Tailscale/OpenVPN) inside our network."**
|
|
* **Solution:** Abandon the "Pull" architecture. Do not install Tailscale or OpenVPN. Instead, install a **Prometheus Agent** (like Grafana Alloy) on the client machine. The agent will "Push" metrics outbound over standard HTTPS (Port 443) to your Central Server. This requires zero inbound open ports and ensures you have no network access to their internal systems, providing maximum security for paranoid clients.
|