Absorbs the standalone rclone fleet monitor into the RMM, per plan:
- deploy_agent.sh: embedded agent v3.6-sync gains a fail-soft sync-monitor
module — tails the rclone-synology-sync container's log (docker inspect
discovery), parses rounds/pairs/skips/transfers, inventories upload dirs,
POSTs to /api/sync-ingest every 10s. Machines without the container
report no_container and stay silent. Heartbeat loop untouched.
- central_api_prototype.py: POST /api/sync-ingest (agent-token auth) into
new sync_* collections; native /api/sync-monitor/* read API (overview,
alerts, stats, timeseries, per-machine events, delete) with JWT auth;
NAS verification loop (rclone lsjson, Mongo-shared listings across
workers) + per-volume NAS health via rclone about (NAS_VOLUMES).
- .env: NAS creds + sync-monitor tuning keys.
Rolled out fleet-wide 2026-08-18 (25 clients on 3.6-sync). Standalone
collector still runs in parallel pending retirement.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The probe changed (4/2 MB once a day instead of 8/4 MB every 6h) after the
fleet was already on 3.4-net, so the version had to move for the rollout to
be trackable — identical version strings with different agent code is the
drift the install banner fix was meant to prevent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- deploy_agent.sh download now requires auth in EVERY mode (agent token via
header/?token=, or a dashboard session). It was gated on strict mode only,
so in grace mode the served installer published the live fleet token to the
internet
- accept AGENT_TOKEN_PREVIOUS alongside AGENT_TOKEN so a rotation can roll
through the fleet; record agent_token_current per node to know when the
previous token can be dropped
- /api/agent-token (dashboard-auth) so the UI can build the install command
- installer: fall back to the default server URL when an inherited one is
unreachable (stale Tailscale address stranded a fresh install), and derive
the version banner from the embedded agent instead of a hardcoded string
- CPU thermal alerts to Rocket.Chat at 85C with hysteresis clearing at 75C
- telemetry_history: 1-minute vitals samples, 7-day TTL (~37 MB fleet-wide),
plus /api/history and /api/history-bulk for dashboard sparklines
- server watches its own disk (85%) after the 2026-07-23 full-disk outage that
killed mongod; per-heartbeat telemetry logging now opt-in via VERBOSE_TELEMETRY
- /api/logs returns the newest 25 slim entries per client instead of the full
history (2.2 MB every 3s was most of the server's egress); gzip middleware
- agent speed probe right-sized to 4/2 MB once a day
- server file listing/delete endpoints, search clearing, WAN IP capture
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- deploy_agent.sh: agent v3.3-shift — use dashboard-configured SHIFT path for
file fetch/search (SR/SHIFT sites have no TAKELEAP folder), date fast-path;
fix installer discarding the injected agent token (sentinel was being
rewritten by the server's placeholder replace, agents ended up tokenless)
- central_api_prototype.py: replace only the token assignment when serving the
installer; add cpu_temp to TelemetryPayload (agents already send it, it was
silently dropped); new endpoints set-shift-path, request-search,
search-results; heartbeat response now carries shift_path + pending search
- commands.json: restore last_reboot/dummy, add update_diag diagnostic
- CLAUDE.md: document deployment layout, procedures, and gotchas
