feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

README.md

@@ -0,0 +1,127 @@
+# RSMon Worker
+
+Standalone distributed monitoring worker for [rsmon.ru](https://rsmon.ru). It
+connects to the RSMon control plane over WebSocket, executes checks locally,
+delivers delegated notifications, and reports results back to the service.
+
+This repository is **source available, not open source**. Building and running
+the worker with rsmon.ru and private research/evaluation are permitted. See
+[LICENSE](LICENSE) for the complete terms.
+
+## Requirements
+
+- A worker token created in the rsmon.ru worker settings.
+- Outbound HTTPS/WebSocket access to rsmon.ru.
+- Chromium for browser-backed HTTP checks when running the binary directly.
+- `CAP_NET_RAW` or an unprivileged ICMP configuration for ping checks.
+
+## Build
+
+Go 1.26 or newer is required.
+
+```bash
+make build
+./bin/rsmon-worker --version
+```
+
+The binary reads `.env` from its working directory when present. The minimum
+configuration is `RSMON_URL`, `RSMON_TOKEN`, `WORKER_LOGIN`, and
+`WORKER_PASSWORD`.
+
+## Docker Compose
+
+```bash
+cp .env.example .env
+# Edit .env and set the worker token and operator-console password.
+docker compose up -d
+docker compose logs -f worker
+```
+
+The operator console is bound to `127.0.0.1:27401` by default. Set
+`WORKER_BIND_IP` only when a firewall or TLS reverse proxy protects the port.
+Persistent web and cluster state is stored in the `worker-data` volume.
+
+## Docker
+
+```bash
+docker build -t rsmon-worker:local .
+docker run --rm \
+  --cap-add NET_RAW \
+  --env-file .env \
+  -p 127.0.0.1:27401:27401 \
+  -v rsmon-worker-data:/var/lib/rsmon-worker \
+  rsmon-worker:local
+```
+
+Published images use these tags:
+
+- `sha-<12-character-commit>` for every push;
+- `latest` for `master`;
+- the exact `v*` tag for releases.
+
+## systemd
+
+Install host dependencies first. On Debian or Ubuntu:
+
+```bash
+sudo apt-get update
+sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata
+```
+
+Build and install:
+
+```bash
+make build
+cp packaging/systemd/worker.env.example worker.env
+# Edit worker.env.
+sudo ./scripts/install-systemd.sh --env ./worker.env
+```
+
+To install an already downloaded release binary:
+
+```bash
+sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env
+```
+
+Operational commands:
+
+```bash
+systemctl status rsmon-worker
+journalctl -u rsmon-worker -f
+sudo systemctl restart rsmon-worker
+```
+
+The service runs as the dedicated `rsmon-worker` user, stores state below
+`/var/lib/rsmon-worker`, reads secrets from `/etc/rsmon-worker/worker.env`, and
+has only `CAP_NET_RAW` for ICMP checks.
+
+## Configuration
+
+| Variable | Required | Default | Purpose |
+| --- | --- | --- | --- |
+| `RSMON_URL` | yes | `https://rsmon.ru` for health only | Control-plane base URL. |
+| `RSMON_TOKEN` | yes | none | Worker bearer token. |
+| `WORKER_HOST` | no | `0.0.0.0` | Operator-console bind address. |
+| `WORKER_PORT` | no | `27401` | Operator-console port. |
+| `WORKER_URL` | no | none | Public URL advertised to the control plane. |
+| `WORKER_LOGIN` | yes | none | Operator-console basic-auth login. |
+| `WORKER_PASSWORD` | yes | none | Operator-console basic-auth password. |
+| `RSMON_WEBAPP_DATA_DIR` | no | user data directory | SQLite and local UI state. |
+| `WORKER_CLUSTER_ENABLED` | no | `false` | Enable the optional Raft cluster. |
+| `WORKER_CLUSTER_ID` | with cluster | none | Unique Raft node ID. |
+| `WORKER_CLUSTER_PORT` | no | `WORKER_PORT+10000` | Raft transport port. |
+| `WORKER_CLUSTER_PEERS` | no | none | Comma-separated `node@host:port` peers. |
+| `WORKER_CLUSTER_DATA_DIR` | with cluster | none | Persistent Raft state directory. |
+
+The public liveness endpoint is `GET /healthz`. `rsmon-worker health` checks the
+configured control plane's `/up` endpoint and is suitable for container health
+checks.
+
+## Security
+
+- Do not commit `.env`, worker tokens, or operator-console credentials.
+- Expose the operator console only on loopback or behind authenticated TLS.
+- Each worker should have its own control-plane token.
+- Keep `/etc/rsmon-worker/worker.env` mode `0600`.
+
+Report security issues privately through the contact channel at rsmon.ru.