Develop installer update

.vscode/settings.json

@@ -69,5 +69,8 @@
     "usePlaceholders": true,
     "completeUnimported": true,
     "staticcheck": true
+  },
+  "files.associations": {
+    "*.cfg": "shellscript"
   }
 }

api/tacticalrmm/core/management/commands/pre_update_tasks.py

@@ -7,6 +7,6 @@ class Command(BaseCommand):
     help = "Collection of tasks to run after updating the rmm, before migrations"
 
     def handle(self, *args, **kwargs):
-        self.stdout.write(self.style.WARNING("Clearning the cache"))
+        self.stdout.write(self.style.WARNING("Clearing the cache"))
         clear_entire_cache()
         self.stdout.write(self.style.SUCCESS("Cache was cleared!"))

api/tacticalrmm/tacticalrmm/utils.py

@@ -211,7 +211,7 @@ def reload_nats() -> None:
 
     conf = os.path.join(settings.BASE_DIR, "nats-rmm.conf")
     with open(conf, "w") as f:
-        json.dump(config, f)
+        json.dump(config, f, indent=4)
 
     if not settings.DOCKER_BUILD:
         time.sleep(0.5)

default-configs/celery/celery.conf

@@ -0,0 +1,16 @@
+CELERYD_NODES="w1"
+
+CELERY_BIN="/rmm/api/env/bin/celery"
+
+CELERY_APP="tacticalrmm"
+
+CELERYD_MULTI="multi"
+
+CELERYD_OPTS="--time-limit=86400 --autoscale=20,2"
+
+CELERYD_PID_FILE="/rmm/api/tacticalrmm/%n.pid"
+CELERYD_LOG_FILE="/var/log/celery/%n%I.log"
+CELERYD_LOG_LEVEL="ERROR"
+
+CELERYBEAT_PID_FILE="/rmm/api/tacticalrmm/beat.pid"
+CELERYBEAT_LOG_FILE="/var/log/celery/beat.log"

default-configs/mesh/config.json

@@ -0,0 +1,34 @@
+{
+  "settings": {
+    "cert": "mesh.example.com",
+    "mongoDb": "mongodb://127.0.0.1:27017",
+    "mongoDbName": "meshcentral",
+    "WANonly": true,
+    "minify": 1,
+    "port": 4443,
+    "agentAliasPort": 443,
+    "aliasPort": 443,
+    "allowLoginToken": true,
+    "allowFraming": true,
+    "_agentPing": 60,
+    "agentPong": 300,
+    "allowHighQualityDesktop": true,
+    "tlsOffload": "127.0.0.1",
+    "agentCoreDump": false,
+    "compression": true,
+    "wsCompression": true,
+    "agentWsCompression": true,
+    "maxInvalidLogin": { "time": 5, "count": 5, "coolofftime": 30 }
+  },
+  "domains": {
+    "": {
+      "title": "Tactical RMM",
+      "title2": "Tactical RMM",
+      "newAccounts": false,
+      "certUrl": "https://mesh.example.com:443/",
+      "geoLocation": true,
+      "cookieIpCheck": false,
+      "mstsc": true
+    }
+  }
+}

default-configs/nginx/frontend.conf

@@ -0,0 +1,41 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name rmm.example.com;
+
+    #location /.well-known/acme-challenge/ {
+        #root /var/www/letsencrypt/;
+    #}
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name rmm.example.com;
+    charset utf-8;
+    location / {
+        root /var/www/rmm/dist;
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        add_header Pragma "no-cache";
+    }
+    error_log  /var/log/nginx/frontend-error.log;
+    access_log /var/log/nginx/frontend-access.log;
+
+    ssl_certificate /etc/letsencrypt/live/rootdomain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/rootdomain/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+    ssl_ecdh_curve secp384r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+    add_header X-Content-Type-Options nosniff;
+}

default-configs/nginx/meshcentral.conf

@@ -0,0 +1,47 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name mesh.example.com;
+
+    #location /.well-known/acme-challenge/ {
+        #root /var/www/letsencrypt/;
+    #}
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    proxy_send_timeout 330s;
+    proxy_read_timeout 330s;
+    server_name mesh.example.com;
+    ssl_certificate /etc/letsencrypt/live/rootdomain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/rootdomain/privkey.pem;
+
+    ssl_session_cache shared:WEBSSL:10m;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+    ssl_ecdh_curve secp384r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+    add_header X-Content-Type-Options nosniff;
+
+    location / {
+        proxy_pass http://127.0.0.1:4443/;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header X-Forwarded-Host $host:$server_port;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

default-configs/nginx/nginx.conf

@@ -0,0 +1,25 @@
+worker_rlimit_nofile 1000000;
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+        worker_connections 4096;
+}
+
+http {
+        sendfile on;
+        tcp_nopush on;
+        types_hash_max_size 2048;
+        server_names_hash_bucket_size 64;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers on;
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+        gzip on;
+        include /etc/nginx/conf.d/*.conf;
+        include /etc/nginx/sites-enabled/*;
+}

default-configs/nginx/rmm.conf

@@ -0,0 +1,88 @@
+server_tokens off;
+
+upstream tacticalrmm {
+    server unix:////rmm/api/tacticalrmm/tacticalrmm.sock;
+}
+
+map $http_user_agent $ignore_ua {
+    "~python-requests.*" 0;
+    "~go-resty.*" 0;
+    default 1;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name api.example.com;
+
+    #location /.well-known/acme-challenge/ {
+        #root /var/www/letsencrypt/;
+    #}
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl reuseport;
+    listen [::]:443 ssl;
+    server_name api.example.com;
+    client_max_body_size 300M;
+    access_log /rmm/api/tacticalrmm/tacticalrmm/private/log/access.log combined if=$ignore_ua;
+    error_log /rmm/api/tacticalrmm/tacticalrmm/private/log/error.log;
+    ssl_certificate /etc/letsencrypt/live/rootdomain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/rootdomain/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+    ssl_ecdh_curve secp384r1;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+    add_header X-Content-Type-Options nosniff;
+
+    location /static/ {
+        root /rmm/api/tacticalrmm;
+    }
+
+    location /private/ {
+        internal;
+        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
+        alias /rmm/api/tacticalrmm/tacticalrmm/private/;
+    }
+
+    location ~ ^/ws/ {
+        proxy_pass http://unix:/rmm/daphne.sock;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_redirect     off;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Host $server_name;
+    }
+
+    location ~ ^/natsws {
+        proxy_pass http://127.0.0.1:9235;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header X-Forwarded-Host $host:$server_port;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        uwsgi_pass  tacticalrmm;
+        include     /etc/nginx/uwsgi_params;
+        uwsgi_read_timeout 300s;
+        uwsgi_ignore_client_abort on;
+    }
+}

default-configs/python/local_settings.py

@@ -0,0 +1,25 @@
+SECRET_KEY = "DJANGO_SEKRET"
+
+DEBUG = False
+
+ALLOWED_HOSTS = ["api.example.com"]
+
+ADMIN_URL = "ADMINURL/"
+
+CORS_ORIGIN_WHITELIST = ["https://rmm.example.com"]
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": "tacticalrmm",
+        "USER": "pgusername",
+        "PASSWORD": "pgpw",
+        "HOST": "localhost",
+        "PORT": "5432",
+    }
+}
+
+MESH_USERNAME = "meshusername"
+MESH_SITE = "https://mesh.example.com"
+REDIS_HOST = "localhost"
+ADMIN_ENABLED = True

default-configs/uwsgi/app.ini

@@ -0,0 +1,24 @@
+[uwsgi]
+chdir = /rmm/api/tacticalrmm
+module = tacticalrmm.wsgi
+home = /rmm/api/env
+master = true
+enable-threads = true
+socket = /rmm/api/tacticalrmm/tacticalrmm.sock
+harakiri = 300
+chmod-socket = 660
+buffer-size = 65535
+vacuum = true
+die-on-term = true
+max-requests = 500
+disable-logging = true
+cheaper-algo = busyness
+cheaper = 4
+cheaper-initial = 4
+workers = 20
+cheaper-step = 2
+cheaper-overload = 3
+cheaper-busyness-min = 5
+cheaper-busyness-max = 10
+# stats = /tmp/stats.socket # uncomment when debugging
+# cheaper-busyness-verbose = true # uncomment when debugging