benya/rmm-openwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add cloud router access and polish UI

Browse Source
This commit is contained in:
benya
2026-07-21 19:55:32 +03:00
parent 6e9b5a99c2
commit 5e4e659cae
18 changed files with 752 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keendns.md
+12
View File
@@ -34,6 +34,8 @@ DNS module. Store the resulting certificate and key outside Git, set:
```text
RMM_DEVICE_DOMAIN=routers.example.com
RMM_TUNNEL_PUBLIC_HOST=rmm.example.com
RMM_TUNNEL_PUBLIC_PORT=2222
RMM_WILDCARD_CERT_PATH=./secrets/routers-wildcard.crt
RMM_WILDCARD_KEY_PATH=./secrets/routers-wildcard.key
```
@@ -45,6 +47,16 @@ docker compose -f compose.yaml -f compose.proxy.yaml -f compose.keendns.yaml con
docker compose -f compose.yaml -f compose.proxy.yaml -f compose.keendns.yaml up -d --build
```
`RMM_TUNNEL_PUBLIC_HOST` is the public address reached by the router's outbound SSH
connection. It defaults to the hostname from `RMM_PUBLIC_URL`; set it explicitly when
the tunnel uses another hostname. `RMM_TUNNEL_PUBLIC_PORT` must match the public port
published for `tunnel-ssh` (2222 by default).
The operator UI uses `/api/devices/{id}/cloud-access` as a single cloud-access flow. It
reuses an existing healthy tunnel, waits while a new tunnel starts, and distinguishes an
offline router from a tunnel that never became reachable. Host, ports, and LuCI scheme
remain available only under the expert settings.
Do not enable `RMM_ALLOW_LEGACY_LUCI_PROXY` in production. It exists only for migration
from the old same-origin `/luci/...` route.
docs/npmplus.md
+31
View File
@@ -43,6 +43,37 @@ The RMM login page remains the authentication boundary for operators. Agents con
Because NPMplus shares the Linux host network namespace, `127.0.0.1:18080` points to the RMM port published on the host.
## Wildcard host for cloud LuCI
Cloud access needs a second NPMplus Proxy Host. It always points to the RMM server; it
never points to a router WAN address.
| Field | Value |
|---|---|
| Domain Names | `*.routers.example.com` |
| Scheme | `http` |
| Forward Hostname / IP | `127.0.0.1` |
| Forward Port | `18080` |
| Certificate | wildcard `*.routers.example.com` certificate |
| Force SSL | enabled |
| Access List | public / none |
Create a DNS wildcard `*.routers.example.com` pointing to the cloud server. A public
wildcard certificate normally requires DNS-01 validation in NPMplus. Preserve the
original `Host` header so RMM can select the correct router subdomain.
Configure RMM with:
```env
RMM_PUBLIC_URL=https://rmm.example.com
RMM_DEVICE_DOMAIN=routers.example.com
RMM_TUNNEL_PUBLIC_HOST=rmm.example.com
RMM_TUNNEL_PUBLIC_PORT=2222
```
The last two values are used by the router's outbound SSH connection. Port 2222 is not
HTTP and must remain directly reachable or be published through an NPMplus TCP Stream.
## SSH Reverse Tunnel Ports
HTTP Proxy Hosts do not handle SSH. The current tunnel service publishes: