RSMon Worker

Standalone distributed monitoring worker for rsmon.ru. It connects to the RSMon control plane over WebSocket, executes checks locally, delivers delegated notifications, and reports results back to the service.

This repository is source available, not open source. Building and running the worker with rsmon.ru and private research/evaluation are permitted. See LICENSE for the complete terms.

Requirements

• A worker token created in the rsmon.ru worker settings.
• Outbound HTTPS/WebSocket access to rsmon.ru.
• Chromium for browser-backed HTTP checks when running the binary directly.
• CAP_NET_RAW or an unprivileged ICMP configuration for ping checks.

Build

Go 1.26 or newer is required.

make build
./bin/rsmon-worker --version

The binary reads .env from its working directory when present. The minimum configuration is RSMON_URL, RSMON_TOKEN, WORKER_LOGIN, and WORKER_PASSWORD.

Docker Compose

cp .env.example .env
# Edit .env and set the worker token and operator-console password.
docker compose up -d
docker compose logs -f worker

The operator console is bound to 127.0.0.1:27401 by default. Set WORKER_BIND_IP only when a firewall or TLS reverse proxy protects the port. Persistent web and cluster state is stored in the worker-data volume.

Docker

docker build -t rsmon-worker:local .
docker run --rm \
  --cap-add NET_RAW \
  --env-file .env \
  -p 127.0.0.1:27401:27401 \
  -v rsmon-worker-data:/var/lib/rsmon-worker \
  rsmon-worker:local

Published images use these tags:

• sha-<12-character-commit> for every push;
• latest for master;
• the v* release ref, with Docker-invalid characters replaced by -.

The Gitea workflow reads HARBOR_REGISTRY, HARBOR_USER, and HARBOR_PASSWORD. HARBOR_REGISTRY may be a host such as reg.rsxx.ru or an HTTP(S) URL; the workflow strips the scheme and trailing slash before composing Docker image references. The Harbor project is appended separately as rsmon.

systemd

Install host dependencies first. On Debian or Ubuntu:

sudo apt-get update
sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata

Build and install:

make build
cp packaging/systemd/worker.env.example worker.env
# Edit worker.env.
sudo ./scripts/install-systemd.sh --env ./worker.env

To install an already downloaded release binary:

sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env

Operational commands:

systemctl status rsmon-worker
journalctl -u rsmon-worker -f
sudo systemctl restart rsmon-worker

The service runs as the dedicated rsmon-worker user, stores state below /var/lib/rsmon-worker, reads secrets from /etc/rsmon-worker/worker.env, and has only CAP_NET_RAW for ICMP checks.

Configuration

Variable	Required	Default	Purpose
RSMON_URL	yes	https://rsmon.ru for health only	Control-plane base URL.
RSMON_TOKEN	yes	none	Worker bearer token.
WORKER_HOST	no	0.0.0.0	Operator-console bind address.
WORKER_PORT	no	27401	Operator-console port.
WORKER_URL	no	none	Public URL advertised to the control plane.
WORKER_LOGIN	yes	none	Operator-console basic-auth login.
WORKER_PASSWORD	yes	none	Operator-console basic-auth password.
RSMON_WEBAPP_DATA_DIR	no	user data directory	SQLite and local UI state.
WORKER_CLUSTER_ENABLED	no	false	Enable the optional Raft cluster.
WORKER_CLUSTER_ID	with cluster	none	Unique Raft node ID.
WORKER_CLUSTER_PORT	no	WORKER_PORT+10000	Raft transport port.
WORKER_CLUSTER_PEERS	no	none	Comma-separated node@host:port peers.
WORKER_CLUSTER_DATA_DIR	with cluster	none	Persistent Raft state directory.

The public liveness endpoint is GET /healthz; the image probes it with rsmon-worker liveness. rsmon-worker health separately checks the configured control plane's /up endpoint for connectivity diagnostics.

Implementation Documentation

Worker architecture, protocol, inventory, private-worker isolation, network diagnostics, web console, and critical-cluster work are specified in docs/README.md. These documents replace worker-owned planning material formerly kept in the RSMon control-plane repository and include a source migration ledger.

Security

• Do not commit .env, worker tokens, or operator-console credentials.
• Expose the operator console only on loopback or behind authenticated TLS.
• Each worker should have its own control-plane token.
• Keep /etc/rsmon-worker/worker.env mode 0600.

Report security issues privately through the contact channel at rsmon.ru.