rmm-openwrt/server/README.md

RMM OpenWrt Server

MVP backend for OpenWrt RMM.

Run

RMM_INSECURE_DEV_MODE=true go run ./server/cmd/rmm-server

Environment variables:

• RMM_ADDR - listen address, default :8080
• RMM_DB_PATH - SQLite database path, default rmm.db
• RMM_OPERATOR_PASSWORD - required bootstrap administrator password
• RMM_OPERATOR_TOKEN - optional emergency/API bearer token
• RMM_OPERATOR_USERNAME - web UI username, default admin
• RMM_COOKIE_SECURE - defaults to true outside explicit development mode
• RMM_DEVICE_DOMAIN - wildcard device domain, for example routers.example.com
• RMM_ALLOW_LEGACY_ENROLLMENT - opt-in shared enrollment compatibility mode
• RMM_METRIC_RETENTION_DAYS - metric history retention, default 30
• RMM_WEB_DIR - static web UI directory, default web

Docker Compose

The repository includes a Compose stack with the RMM server and a reverse SSH tunnel sidecar:

docker compose up -d --build

See docs/docker-compose.md for router key installation and remote access setup.

MVP API

Agent API:

• POST /api/agent/enroll
• POST /api/agent/heartbeat
• POST /api/agent/commands/next
• POST /api/agent/commands/{id}/result

Operator API:

• POST /api/auth/login

• GET /api/auth/me

• GET|POST /api/users (administrator only)

• POST /api/enrollment-grants

• GET /api/devices

• GET /api/devices/{id}

• POST /api/devices/{id}/commands

• GET /api/devices/{id}/commands

• GET /api/devices/{id}/commands/{command_id}

• POST /api/devices/{id}/commands/{command_id}/cancel

• GET /api/audit-events

The web UI uses revocable, server-side sessions. Each normal user only sees and controls devices enrolled with their own one-time grants. The optional bootstrap bearer token is administrator-scoped:

Authorization: Bearer <RMM_OPERATOR_TOKEN>

See KeenDNS-like cloud mode for wildcard DNS, wildcard TLS, and the isolated LuCI access flow.