fd1a010e31
Все проверки выполнены успешно
CI / test (push) Successful in 30s
Docker / Build and publish worker image (push) Successful in 10m49s
141 строка
4.7 KiB
Markdown
141 строка
4.7 KiB
Markdown
# RSMon Worker
|
|
|
|
Standalone distributed monitoring worker for [rsmon.ru](https://rsmon.ru). It
|
|
connects to the RSMon control plane over WebSocket, executes checks locally,
|
|
delivers delegated notifications, and reports results back to the service.
|
|
|
|
This repository is **source available, not open source**. Building and running
|
|
the worker with rsmon.ru and private research/evaluation are permitted. See
|
|
[LICENSE](LICENSE) for the complete terms.
|
|
|
|
## Requirements
|
|
|
|
- A worker token created in the rsmon.ru worker settings.
|
|
- Outbound HTTPS/WebSocket access to rsmon.ru.
|
|
- Chromium for browser-backed HTTP checks when running the binary directly.
|
|
- `CAP_NET_RAW` or an unprivileged ICMP configuration for ping checks.
|
|
|
|
## Build
|
|
|
|
Go 1.26 or newer is required.
|
|
|
|
```bash
|
|
make build
|
|
./bin/rsmon-worker --version
|
|
```
|
|
|
|
The binary reads `.env` from its working directory when present. The minimum
|
|
configuration is `RSMON_URL`, `RSMON_TOKEN`, `WORKER_LOGIN`, and
|
|
`WORKER_PASSWORD`.
|
|
|
|
## Docker Compose
|
|
|
|
```bash
|
|
cp .env.example .env
|
|
# Edit .env and set the worker token and operator-console password.
|
|
docker compose up -d
|
|
docker compose logs -f worker
|
|
```
|
|
|
|
The operator console is bound to `127.0.0.1:27401` by default. Set
|
|
`WORKER_BIND_IP` only when a firewall or TLS reverse proxy protects the port.
|
|
Persistent web and cluster state is stored in the `worker-data` volume.
|
|
|
|
## Docker
|
|
|
|
```bash
|
|
docker build -t rsmon-worker:local .
|
|
docker run --rm \
|
|
--cap-add NET_RAW \
|
|
--env-file .env \
|
|
-p 127.0.0.1:27401:27401 \
|
|
-v rsmon-worker-data:/var/lib/rsmon-worker \
|
|
rsmon-worker:local
|
|
```
|
|
|
|
Published images use these tags:
|
|
|
|
- `sha-<12-character-commit>` for every push;
|
|
- `latest` for `master`;
|
|
- the `v*` release ref, with Docker-invalid characters replaced by `-`.
|
|
|
|
The Gitea workflow reads `HARBOR_REGISTRY`, `HARBOR_USER`, and
|
|
`HARBOR_PASSWORD`. `HARBOR_REGISTRY` may be a host such as `reg.rsxx.ru` or an
|
|
HTTP(S) URL; the workflow strips the scheme and trailing slash before composing
|
|
Docker image references. The Harbor project is appended separately as `rsmon`.
|
|
|
|
## systemd
|
|
|
|
Install host dependencies first. On Debian or Ubuntu:
|
|
|
|
```bash
|
|
sudo apt-get update
|
|
sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata
|
|
```
|
|
|
|
Build and install:
|
|
|
|
```bash
|
|
make build
|
|
cp packaging/systemd/worker.env.example worker.env
|
|
# Edit worker.env.
|
|
sudo ./scripts/install-systemd.sh --env ./worker.env
|
|
```
|
|
|
|
To install an already downloaded release binary:
|
|
|
|
```bash
|
|
sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env
|
|
```
|
|
|
|
Operational commands:
|
|
|
|
```bash
|
|
systemctl status rsmon-worker
|
|
journalctl -u rsmon-worker -f
|
|
sudo systemctl restart rsmon-worker
|
|
```
|
|
|
|
The service runs as the dedicated `rsmon-worker` user, stores state below
|
|
`/var/lib/rsmon-worker`, reads secrets from `/etc/rsmon-worker/worker.env`, and
|
|
has only `CAP_NET_RAW` for ICMP checks.
|
|
|
|
## Configuration
|
|
|
|
| Variable | Required | Default | Purpose |
|
|
| --- | --- | --- | --- |
|
|
| `RSMON_URL` | yes | `https://rsmon.ru` for health only | Control-plane base URL. |
|
|
| `RSMON_TOKEN` | yes | none | Worker bearer token. |
|
|
| `WORKER_HOST` | no | `0.0.0.0` | Operator-console bind address. |
|
|
| `WORKER_PORT` | no | `27401` | Operator-console port. |
|
|
| `WORKER_URL` | no | none | Public URL advertised to the control plane. |
|
|
| `WORKER_LOGIN` | yes | none | Operator-console basic-auth login. |
|
|
| `WORKER_PASSWORD` | yes | none | Operator-console basic-auth password. |
|
|
| `RSMON_WEBAPP_DATA_DIR` | no | user data directory | SQLite and local UI state. |
|
|
| `WORKER_CLUSTER_ENABLED` | no | `false` | Enable the optional Raft cluster. |
|
|
| `WORKER_CLUSTER_ID` | with cluster | none | Unique Raft node ID. |
|
|
| `WORKER_CLUSTER_PORT` | no | `WORKER_PORT+10000` | Raft transport port. |
|
|
| `WORKER_CLUSTER_PEERS` | no | none | Comma-separated `node@host:port` peers. |
|
|
| `WORKER_CLUSTER_DATA_DIR` | with cluster | none | Persistent Raft state directory. |
|
|
|
|
The public liveness endpoint is `GET /healthz`; the image probes it with
|
|
`rsmon-worker liveness`. `rsmon-worker health` separately checks the configured
|
|
control plane's `/up` endpoint for connectivity diagnostics.
|
|
|
|
## Implementation Documentation
|
|
|
|
Worker architecture, protocol, inventory, private-worker isolation, network
|
|
diagnostics, web console, and critical-cluster work are specified in
|
|
[`docs/README.md`](docs/README.md). These documents replace worker-owned planning
|
|
material formerly kept in the RSMon control-plane repository and include a
|
|
source migration ledger.
|
|
|
|
## Security
|
|
|
|
- Do not commit `.env`, worker tokens, or operator-console credentials.
|
|
- Expose the operator console only on loopback or behind authenticated TLS.
|
|
- Each worker should have its own control-plane token.
|
|
- Keep `/etc/rsmon-worker/worker.env` mode `0600`.
|
|
|
|
Report security issues privately through the contact channel at rsmon.ru.
|