rmm-openwrt/docs/openwrt.md

OpenWrt Notes

MVP Agent Install

Manual install example:

cp agent/openwrt/rmm-agent.sh /usr/bin/rmm-agent
chmod +x /usr/bin/rmm-agent
cp agent/openwrt/rmm-agent.init /etc/init.d/rmm-agent
chmod +x /etc/init.d/rmm-agent

Create config:

cat >/etc/rmm-agent.conf <<'EOF'
SERVER_URL="http://server:8080"
ENROLLMENT_TOKEN="dev-enroll-token"
INTERVAL_SECONDS="30"
CHECK_TARGETS="1.1.1.1 8.8.8.8"
TUNNEL_IDENTITY_FILE="/etc/rmm-agent/tunnel_key"
EOF
chmod 600 /etc/rmm-agent.conf

Enable service:

/etc/init.d/rmm-agent enable
/etc/init.d/rmm-agent start

OpenWrt Package Build

The repository includes an MVP package skeleton at:

agent/package/rmm-agent

Copy or symlink it into an OpenWrt buildroot:

cp -R agent/package/rmm-agent /path/to/openwrt/package/rmm-agent
cd /path/to/openwrt
make menuconfig
make package/rmm-agent/compile V=s

The package installs:

• /usr/bin/rmm-agent
• /etc/init.d/rmm-agent
• /etc/rmm-agent.conf

After installing the .ipk on a router:

vi /etc/rmm-agent.conf
/etc/init.d/rmm-agent enable
/etc/init.d/rmm-agent start

The config file is marked as a package conffile, so opkg should preserve local credentials and server settings on upgrade.

Agent Dependencies

Required:

• /bin/sh
• sed
• awk
• ip
• curl or wget

Recommended:

• ubus
• opkg
• traceroute
• openssh-client for Docker Compose reverse SSH access

Current Shell Agent Notes

The MVP shell agent avoids requiring jq. It uses the plain-text POST /api/agent/commands/next endpoint for command polling and JSON endpoints for enrollment, heartbeat, and command results.

The agent supports a first safe UCI workflow through allowlisted commands:

• uci_show
• uci_backup
• uci_preview
• uci_set
• uci_commit
• uci_commit_confirmed
• uci_revert
• uci_restore

The MVP allowlist is limited to network, wireless, dhcp, firewall, and system.

uci_preview stages the requested change, captures before/after output, then reverts the config package. uci_set captures uci export <config> before staging a change, so command output includes a backup snapshot.

The shell agent stores the latest local backup per config in /tmp/rmm-agent-backups. uci_restore imports and commits that backup. uci_commit_confirmed commits, waits for server reachability, and restores the latest backup if the server cannot be reached.

The MVP agent also uses:

• a lock directory at /tmp/rmm-agent.lock;
• a result spool at /tmp/rmm-agent-results;
• heartbeat backoff up to 300 seconds on repeated failures.

CHECK_TARGETS controls heartbeat connectivity probes. The agent pings each target and sends reachable, packet_loss_percent, and latency_ms in metrics.connectivity_checks.

For a router and server in the same LAN, verify the server from the router with the server LAN IP:

ping -c 3 10.10.10.2
curl -i http://10.10.10.2:18080/healthz

Do not use 127.0.0.1 from the router for the RMM server unless the server is running on the router itself.

The shell agent redacts sensitive command output keys before sending command results to the server. This is a defense-in-depth measure; the server also redacts before storing results.

The production agent should either:

• be rewritten in Go;
• include a tiny JSON parser strategy;
• keep a stable shell-oriented command polling endpoint.