Deploy
Requirements
One machine for the server, and the agent on everything you want to see.
The server
- Debian 13 or 12, on a machine, a VM or an LXC container.
deploy/lxc.shis written for Debian; other Linux systems can run it by hand (Node 26 and Go are all it needs), but that isn't scripted. - amd64 or arm64. The install script stops on anything else.
- Internet access while installing: the script downloads Node 26 and Go (checking their checksums) and the npm packages.
- One port, 4800 by default, reachable by your browser and by every agent. HTTPS and plain HTTP share it (see HTTPS).
- Data is a SQLite database and a few files in
/var/lib/cermm. No other database to run.
No resource figures have been measured yet, so none are given here.
Optional, for some features
- Internet access while running, for the Software catalog: the winget index (Microsoft's
source.msix, downloaded daily), Flathub search and app icons. - A mail server (SMTP) for email notifications and the monthly report.
- A reverse proxy with a real certificate if people reach CERMM from outside your network (see Behind a reverse proxy).
The machines
| System | Builds | Notes |
|---|---|---|
| Linux | amd64, arm64, arm (v7) | Everything: monitoring, patches, scripts, terminal, containers, Proxmox, playbooks. |
| Windows 10, 11, Server 2016 and newer | amd64, arm64 | Windows 7, 8 and 8.1 are told the agent needs Windows 10 or Server 2016 (Go's floor). The terminal and Hyper-V haven't been tried on real machines yet. |
| macOS | Intel, Apple silicon | Monitoring, inventory and scripts. No pending updates, terminal or containers yet. |
Each agent is one static binary, about 7 MB, run by the system's own service manager (systemd, launchd or the Windows Service Control Manager). It only connects out to the server.
Your browser
- Any current browser. The password vault needs HTTPS (it encrypts in the browser with WebCrypto).
- Scanning barcodes with the camera needs a browser with BarcodeDetector (Chrome and Edge on Android, ChromeOS, macOS). Elsewhere you type or use a USB scanner.
- Connect opens your own SSH, Remote Desktop or Screen Sharing app, so your computer must reach the machine (the LAN or Tailscale). The terminal in the browser doesn't need that: it goes through the agent.