IT-ZU RMM Documentation

Architecture Overview

IT-ZU RMM consists of a web dashboard (SvelteKit), a central server (Go + PostgreSQL) and lightweight Go agents running as Windows services on managed endpoints, plus a tray app for end users.

Technology Stack

• Frontend: SvelteKit 2, Svelte 5, TypeScript 5, Tailwind CSS 4, bits-ui, Chart.js
• Central Server: Go 1.25, Fiber, pgx, PostgreSQL 17, Redis (cache)
• Agent: native Go binary running as a Windows service; REST + WebSocket
• Authentication: JWT HS256 (access tokens max. 8 h, 7-day refresh), per-agent tokens (SHA-256 hashed)
• Remote desktop: MeshCentral (open source), opened via one-time login from the dashboard
• Network: External access to dashboard and API via Cloudflare Tunnel

Communication Protocols

• WebSocket (agents): persistent connection /ws/agent for command delivery and status
• HTTP polling fallback: agents fetch pending commands via REST at least every 2 minutes if the WebSocket is unavailable
• WebSocket (dashboard): /ws/dashboard for live updates in the browser
• MsgPack: binary serialization alongside JSON for agent and dashboard API calls

Data Storage

The central server stores all data in PostgreSQL 17; schema changes are applied as versioned SQL migrations. Redis is used as an optional cache.

• Multi-Tenant RBAC: 4 roles (super_admin, company_admin, company_operator, company_viewer) with company-scoped data isolation
• Metrics: CPU, RAM and disk utilization snapshots, retained for 30 days

System Requirements

• Server: hosted by IT-ZU on servers in Germany (Debian 12, PostgreSQL 17, Redis)
• Agent: Windows 10/11 or Windows Server, PowerShell, outbound HTTPS connectivity
• Browser: current version of Chrome, Edge or Firefox

API Reference

IT-ZU RMM exposes a REST API under https://rmm.it-zu.de/api/v1. All endpoints require authentication and respect RBAC permissions and company-scoped data isolation.

Central Server API (examples)

• Agents: GET /api/v1/agents, GET /api/v1/agents/:id — List and query managed agents
• Commands: POST /api/v1/commands, POST /api/v1/commands/bulk — Send commands to agents (allow-listed command types)
• Remote desktop: GET /api/v1/devices/:id/mesh-rd — One-time MeshCentral login link for a device
• Patches: GET /api/v1/patches — Patch status across devices
• Update Rings: /api/v1/update-rings — Ring-based deployment management
• Vulnerabilities: GET /api/v1/cves — CVE overview data
• Scripts: GET/POST/PUT/DELETE /api/v1/scripts — Script library CRUD
• App Store: /api/v1/app-catalog — Software catalog and deployment

Rate Limits

• Dashboard API: 120 requests/min per IP
• Login: 5 requests/min per IP, plus account lockout after repeated failures
• Write operations: 60 requests/min per IP

WebSocket Endpoints

Agents connect to wss://rmm.it-zu.de/ws/agent; the dashboard receives live updates via /ws/dashboard. Messages are encoded as JSON or MsgPack.

Agent Deployment

IT-ZU RMM agents are deployed via MSI (e.g. GPO mass deployment or manual installation). The agent registers with the central server on first start and begins inventory collection.

Installation Methods

• WiX MSI: For GPO-based mass deployment. Silent install: msiexec /i agent.msi /qn ENROLLMENT_KEY=... SERVER_URL=...
• Company MSI: per-company MSI with a preconfigured enrollment key, available in the dashboard
• Downloads page: Agent binaries available from the IT-ZU RMM dashboard

Agent Lifecycle

• Registration: the agent registers with the central server using the enrollment key; the server creates the agent record
• Heartbeat: every 30 seconds, the agent reports status (hostname, OS, IP addresses, uptime, pending restart)
• Offline Detection: agent marked offline after 180 seconds without heartbeat
• Self-Update: new version downloaded with SHA-256 verification → backup of the current binary → binary replaced; the backup is restored if the replacement fails.