RSMon Worker

Standalone distributed monitoring worker for rsmon.ru. It connects to the RSMon control plane over WebSocket, executes checks locally, delivers delegated notifications, and reports results back to the service.

This repository is source available, not open source. Building and running the worker with rsmon.ru and private research/evaluation are permitted. See LICENSE for the complete terms.

Requirements

• A worker token created in the rsmon.ru worker settings.
• Outbound HTTPS/WebSocket access to rsmon.ru.
• Chromium for browser-backed HTTP checks when running the binary directly.
• CAP_NET_RAW or an unprivileged ICMP configuration for ping checks.

Build

Go 1.26 or newer is required.

make build
./bin/rsmon-worker --version

The binary reads .env from its working directory when present. The minimum configuration is RSMON_URL, RSMON_TOKEN, WORKER_LOGIN, and WORKER_PASSWORD.

Docker Compose

cp .env.example .env
# Edit .env and set the worker token and operator-console password.
docker compose up -d
docker compose logs -f worker

The operator console is bound to 127.0.0.1:27401 by default. Set WORKER_BIND_IP only when a firewall or TLS reverse proxy protects the port. Persistent web and cluster state is stored in the worker-data volume.

Docker

docker build -t rsmon-worker:local .
docker run --rm \
  --cap-add NET_RAW \
  --env-file .env \
  -p 127.0.0.1:27401:27401 \
  -v rsmon-worker-data:/var/lib/rsmon-worker \
  rsmon-worker:local

Published images use these tags:

• sha-<12-character-commit> for every push;
• latest for master;
• the exact v* tag for releases.

systemd

Install host dependencies first. On Debian or Ubuntu:

sudo apt-get update
sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata

Build and install:

make build
cp packaging/systemd/worker.env.example worker.env
# Edit worker.env.
sudo ./scripts/install-systemd.sh --env ./worker.env

To install an already downloaded release binary:

sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env

Operational commands:

systemctl status rsmon-worker
journalctl -u rsmon-worker -f
sudo systemctl restart rsmon-worker

The service runs as the dedicated rsmon-worker user, stores state below /var/lib/rsmon-worker, reads secrets from /etc/rsmon-worker/worker.env, and has only CAP_NET_RAW for ICMP checks.

Configuration

Variable	Required	Default	Purpose
RSMON_URL	yes	https://rsmon.ru for health only	Control-plane base URL.
RSMON_TOKEN	yes	none	Worker bearer token.
WORKER_HOST	no	0.0.0.0	Operator-console bind address.
WORKER_PORT	no	27401	Operator-console port.
WORKER_URL	no	none	Public URL advertised to the control plane.
WORKER_LOGIN	yes	none	Operator-console basic-auth login.
WORKER_PASSWORD	yes	none	Operator-console basic-auth password.
RSMON_WEBAPP_DATA_DIR	no	user data directory	SQLite and local UI state.
WORKER_CLUSTER_ENABLED	no	false	Enable the optional Raft cluster.
WORKER_CLUSTER_ID	with cluster	none	Unique Raft node ID.
WORKER_CLUSTER_PORT	no	WORKER_PORT+10000	Raft transport port.
WORKER_CLUSTER_PEERS	no	none	Comma-separated node@host:port peers.
WORKER_CLUSTER_DATA_DIR	with cluster	none	Persistent Raft state directory.

The public liveness endpoint is GET /healthz. rsmon-worker health checks the configured control plane's /up endpoint and is suitable for container health checks.

Security

• Do not commit .env, worker tokens, or operator-console credentials.
• Expose the operator console only on loopback or behind authenticated TLS.
• Each worker should have its own control-plane token.
• Keep /etc/rsmon-worker/worker.env mode 0600.

Report security issues privately through the contact channel at rsmon.ru.