OpenWrt RMM is a self-hosted remote monitoring and management platform for OpenWrt routers. It combines a Go cloud server, a lightweight outbound agent, a responsive web dashboard, temporary SSH/LuCI access, notifications, and signed OpenWrt package feeds.

The agent does not require an inbound port on the router. It connects to the server over HTTPS and opens a restricted reverse tunnel only when an authorized operator requests remote access.

Highlights

Separate user accounts and router ownership.
One-time router enrollment grants.
Live inventory, health metrics, connectivity checks, and LAN client presence.
Safe allowlisted diagnostics and package/UCI operations.
Temporary SSH and LuCI access through an isolated cloud tunnel.
Built-in notification center, e-mail, Telegram, and signed webhooks.
Quiet hours, maintenance pauses, and per-router alert preferences.
Responsive web UI and a LuCI application for agent configuration.
Signed IPK/APK repositories for supported OpenWrt releases.

Components

Browser ──HTTPS──> RMM server ──SQLite
                       │
                       ├── notification workers
                       └── isolated SSH tunnel service
                                      ▲
OpenWrt router ──outbound HTTPS/SSH───┘
  ├── rmm-agent-go-production
  ├── luci-app-rmm-agent
  └── luci-i18n-rmm-agent-ru (optional)

Component	Purpose	License
`server/`, `web/`	API, persistence, dashboard, notifications	AGPL-3.0-only
`deploy/tunnel/`	Restricted reverse SSH tunnel service	AGPL-3.0-only
`agent/`	Go agent, LuCI app, and OpenWrt packages	MIT

Deployment

Requirements:

Docker Engine with Compose v2;
an HTTPS reverse proxy such as NPMplus;
a wildcard DNS record and certificate for cloud LuCI access;
an SSH key dedicated to router tunnels.

Copy the example configuration and follow the production deployment guide:

cp .env.example .env
docker compose -f compose.yaml -f compose.release.yaml pull
docker compose -f compose.yaml -f compose.release.yaml up -d
docker compose -f compose.yaml -f compose.release.yaml ps

Do not start production with the example secrets. Generate the tunnel key and configure the required environment values first.

Installing the OpenWrt agent

The recommended method is the signed package feed:

OpenWrt 24.10 and older: IPK/opkg;
OpenWrt 25.12 and newer: APK;
OpenWrt 21.02, 22.03, and 23.05: legacy support tier.

Install the runtime and LuCI application:

opkg install rmm-agent-go-production luci-app-rmm-agent
# or
apk add rmm-agent-go-production luci-app-rmm-agent

English is the default LuCI language. Install the optional Russian translation:

opkg install luci-i18n-rmm-agent-ru
# or
apk add luci-i18n-rmm-agent-ru

See Signed OpenWrt package repository for feed URLs, verification keys, and architecture-specific instructions.

Development

go test ./...
go vet ./...
node --check web/app.js
docker compose config

Run the server in explicit local development mode:

RMM_INSECURE_DEV_MODE=true \
RMM_OPERATOR_PASSWORD='replace-with-a-long-development-password' \
go run ./server/cmd/rmm-server

Never enable insecure development mode on an internet-facing deployment.

Releases

The server and agent use independent version lines:

server-v* publishes the server and tunnel container images;
agent-v* publishes installable IPK/APK packages;
release descriptions are maintained in English in CHANGELOG.md.

GitHub Releases contain only installable packages. Signed repository indexes and public keys are published through GitHub Pages, while provenance is kept in GitHub attestations. See Release policy.

Security and license

Review the security model before exposing the service publicly. Back up the SQLite volume before every server upgrade.

The cloud application is licensed under AGPL-3.0-only; the OpenWrt agent and LuCI packages are licensed under MIT. See LICENSE.md and NOTICE.md.