EMRE-RMM Documentation

Architecture Overview

EMRE-RMM follows a three-tier architecture designed for reliability, scalability, and offline resilience. The system consists of a browser-based dashboard (Next.js 14), a central server (Express.js + PostgreSQL), and lightweight Go agents running as Windows services on managed endpoints.

Technology Stack

• Frontend: Next.js 14 (App Router), React 18, Shadcn UI (Radix), Tailwind CSS, Recharts
• Central Server: Express.js 4.21.1, PostgreSQL 16.8, Redis 8.6.1, TimescaleDB, Prisma ORM 5.22.0
• Agent v2: Go 1.21+ native binary (~15 MB), MQTT communication (EMQX broker)
• Authentication: JWT HS256 (15 min access + 7 day refresh), per-agent tokens (SHA-256 hashed)
• Video Pipeline: FFmpeg + libx264 (H.264), WebCodecs API for browser-side HW decoding
• Network: Cloudflare Tunnel (zero open ports), CORS whitelist, Helmet security headers

Communication Protocols

• MQTT (v2 Agents): QoS 1 command delivery, retained status messages. Topics: emre/cmd/{agentId}, emre/status/{agentId}, emre/broadcast
• HTTP + Redis Pub/Sub (v1 Agents): Command delivery <100ms, sync via REST endpoints
• WebSocket: Binary multiplexed channel with 4 frame types (JPEG, H.264, MsgPack, JSON) for remote desktop
• MsgPack: Binary serialization for control messages, 30-50% smaller than JSON

Database Strategy

Dual database architecture: Each agent maintains a local SQLite database for offline operation, while the central server uses PostgreSQL 16 with TimescaleDB extension for time-series metrics. Prisma ORM manages both schemas with separate generated clients.

• Multi-Tenant RBAC: 4 roles (super_admin, company_admin, company_operator, company_viewer) with company-scoped data isolation
• TimescaleDB Aggregates: Raw metrics (30s) → 5-minute aggregates → 1-hour aggregates
• 17+ tracked tables via Prisma, 12+ untracked specialized tables via raw SQL

System Requirements

• Server: Windows Server 2019/2022, PostgreSQL 16+, Redis 7+, Node.js 18+, 4+ GB RAM, 2+ CPU cores
• Agent: Windows 10/11 or Server 2016+, PowerShell 5.1+, ~15 MB disk space, HTTPS outbound connectivity
• Browser: Chrome, Edge, or Firefox (latest). WebCodecs API support required for H.264 remote desktop

API Reference

EMRE-RMM exposes 65+ REST API endpoints across the agent backend (port 3000) and central server (port 3002). All endpoints require authentication and respect RBAC permissions.

Central Server API (port 3002)

• Agents: GET /api/agents, GET /api/agents/:id — List and query managed agents
• Commands: POST /api/commands — Send commands to agents (PowerShell, service control, reboot, etc.)
• Remote Sessions: POST /api/remote-sessions — Create screen sharing sessions
• Patches: GET /api/patches — Global patch status with CVE enrichment
• Update Rings: GET/POST /api/update-rings — Ring-based deployment management
• Vulnerabilities: GET /api/vulnerabilities — CVE dashboard data
• Scripts: GET/POST/PUT/DELETE /api/scripts — Script library CRUD
• App Store: GET/POST /api/packages — Software package management
• Reports: GET /api/reports/devices|patches|software — CSV exports
• Metrics: GET /api/metrics/:agentId — TimescaleDB time-series data

Rate Limits

• Global API: 100 requests/min per IP
• Login: 5 attempts per 15 min
• Downloads: 20 requests/hour
• Concurrent screen sessions: max 20
• Screen session duration: max 4 hours

WebSocket Endpoint

Remote desktop streaming uses wss://rmm.it-zu.de/ws/screen with binary frame multiplexing. Frame types are identified by the first byte: 0x01 (JPEG), 0x02 (H.264), 0x03 (MsgPack control), 0x04 (JSON fallback).

Agent Deployment

EMRE-RMM agents can be deployed via MSI (GPO deployment) or EXE (manual installation). The agent self-registers with the central server on first startup and begins inventory collection immediately.

Installation Methods

• WiX MSI: For GPO-based mass deployment. Silent install: msiexec /i emre-rmm-agent.msi /qn ENROLLMENT_KEY=... SERVER_URL=...
• Inno Setup EXE: For manual installation with GUI wizard
• Downloads page: Agent binaries available from the EMRE-RMM dashboard

Agent Lifecycle

• Registration: Agent sends initial heartbeat with hardware summary; central server creates/updates agent record
• Heartbeat: Every 30 seconds, agent reports status, metrics, and checks for pending commands
• Offline Detection: Agent marked offline after 90 seconds without heartbeat
• Self-Update: New version detected via heartbeat → download with SHA-256 verification → stop service → backup .bak → replace binary → start service. Automatic rollback on failure.

Prebuilt Binaries

The agent ships with 5 prebuilt helper binaries for screen capture and input control:

• screen-capture-v2.exe — GDI/DXGI screen capture
• screen-input.exe — Mouse/keyboard input injection
• screen-consent.exe — User consent dialog
• sas-trigger.exe — Ctrl+Alt+Delete (Secure Attention Sequence)
• session-helper.exe — Session 0 → Session 1 bridge (CreateProcessAsUser)