# RSMon Worker

Standalone distributed monitoring worker for [rsmon.ru](https://rsmon.ru). It
connects to the RSMon control plane over WebSocket, executes checks locally,
delivers delegated notifications, and reports results back to the service.

This repository is **source available, not open source**. Building and running
the worker with rsmon.ru and private research/evaluation are permitted. See
[LICENSE](LICENSE) for the complete terms.

## Requirements

- A worker token created in the rsmon.ru worker settings.
- Outbound HTTPS/WebSocket access to rsmon.ru.
- Chromium for browser-backed HTTP checks when running the binary directly.
- `CAP_NET_RAW` or an unprivileged ICMP configuration for ping checks.

## Build

Go 1.26 or newer is required.

```bash
make build
./bin/rsmon-worker --version
```

The binary reads `.env` from its working directory when present. The minimum
configuration is `RSMON_URL`, `RSMON_TOKEN`, `WORKER_LOGIN`, and
`WORKER_PASSWORD`.

## Docker Compose

```bash
cp .env.example .env
# Edit .env and set the worker token and operator-console password.
docker compose up -d
docker compose logs -f worker
```

The operator console is bound to `127.0.0.1:27401` by default. Set
`WORKER_BIND_IP` only when a firewall or TLS reverse proxy protects the port.
Persistent web and cluster state is stored in the `worker-data` volume.

## Docker

```bash
docker build -t rsmon-worker:local .
docker run --rm \
  --cap-add NET_RAW \
  --env-file .env \
  -p 127.0.0.1:27401:27401 \
  -v rsmon-worker-data:/var/lib/rsmon-worker \
  rsmon-worker:local
```

Published images use these tags:

- `sha-<12-character-commit>` for every push;
- `latest` for `master`;
- the exact `v*` tag for releases.

## systemd

Install host dependencies first. On Debian or Ubuntu:

```bash
sudo apt-get update
sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata
```

Build and install:

```bash
make build
cp packaging/systemd/worker.env.example worker.env
# Edit worker.env.
sudo ./scripts/install-systemd.sh --env ./worker.env
```

To install an already downloaded release binary:

```bash
sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env
```

Operational commands:

```bash
systemctl status rsmon-worker
journalctl -u rsmon-worker -f
sudo systemctl restart rsmon-worker
```

The service runs as the dedicated `rsmon-worker` user, stores state below
`/var/lib/rsmon-worker`, reads secrets from `/etc/rsmon-worker/worker.env`, and
has only `CAP_NET_RAW` for ICMP checks.

## Configuration

| Variable | Required | Default | Purpose |
| --- | --- | --- | --- |
| `RSMON_URL` | yes | `https://rsmon.ru` for health only | Control-plane base URL. |
| `RSMON_TOKEN` | yes | none | Worker bearer token. |
| `WORKER_HOST` | no | `0.0.0.0` | Operator-console bind address. |
| `WORKER_PORT` | no | `27401` | Operator-console port. |
| `WORKER_URL` | no | none | Public URL advertised to the control plane. |
| `WORKER_LOGIN` | yes | none | Operator-console basic-auth login. |
| `WORKER_PASSWORD` | yes | none | Operator-console basic-auth password. |
| `RSMON_WEBAPP_DATA_DIR` | no | user data directory | SQLite and local UI state. |
| `WORKER_CLUSTER_ENABLED` | no | `false` | Enable the optional Raft cluster. |
| `WORKER_CLUSTER_ID` | with cluster | none | Unique Raft node ID. |
| `WORKER_CLUSTER_PORT` | no | `WORKER_PORT+10000` | Raft transport port. |
| `WORKER_CLUSTER_PEERS` | no | none | Comma-separated `node@host:port` peers. |
| `WORKER_CLUSTER_DATA_DIR` | with cluster | none | Persistent Raft state directory. |

The public liveness endpoint is `GET /healthz`. `rsmon-worker health` checks the
configured control plane's `/up` endpoint and is suitable for container health
checks.

## Security

- Do not commit `.env`, worker tokens, or operator-console credentials.
- Expose the operator console only on loopback or behind authenticated TLS.
- Each worker should have its own control-plane token.
- Keep `/etc/rsmon-worker/worker.env` mode `0600`.

Report security issues privately through the contact channel at rsmon.ru.