CERMM/wiki>

Getting started

What CERMM is

Every machine you look after, on one screen. Watch it, patch it, script it, open a shell on it. One small server, one Go agent per machine, nothing in the cloud.

The parts

  • The server is a Node program with a SQLite database. You run it yourself, on a Debian machine, an LXC container or a VM. It serves the web app, the agent downloads and the API.
  • The agent is one Go program per machine (Linux, Windows, macOS; amd64 and arm64, and 32-bit ARM on Linux). It runs as the system's own service and only ever connects out to the server, so there are no ports to open on the machines.
  • The web app is where you work: the Devices list and each device's page, and the pages for software, patches, scripts, docs, tickets, passwords and reports.

What it does today

  • Monitoring: CPU, memory, disks, uptime, network, failed services and pending reboots, with alerts in the app and as notifications (ntfy, email, webhooks). See Devices and Alerts.
  • Patching across apt, dnf, pacman, flatpak and Windows Update, security updates first. See Patches.
  • Scripts (sh and PowerShell) with parameters and live output, a terminal in the browser, and links to open SSH, Remote Desktop or Screen Sharing. See Run.
  • Software from one catalog mapped to winget, apt, dnf, pacman and flatpak, pushed to many machines. See Software.
  • Docker and Podman containers, Proxmox VE guests and Hyper-V VMs on the machines that run them.
  • Ansible playbooks run by each machine's own agent, including capturing a machine into a playbook.
  • Assets with labels and barcode scanning, documentation, basic tickets, an encrypted password vault and a monthly fleet report.
  • People with privileges, two-factor sign-in, a second person's approval for big runs, and an audit log of everything.

The editions

CERMM is planned as two editions built from one codebase, not two branches:

  • MSP: the full PSA/RMM for managed service providers and IT teams: clients, contacts, a service desk, devices, networks, docs, passwords, time and billing.
  • Personal: the same engine for one person's own machines, home lab, containers and network.

Today it's one app. What this wiki describes is v0: devices for real, and the pages that grew around them. Clients, sites, email tickets and time and billing come with the MSP edition; they aren't built yet. The build switch between editions described in CONTRIBUTING.md isn't in the current code either.

What it believes

  • Responsive and informative. An action starts within a second or says exactly why it can't (agent offline, commands not allowed, refused: signature). Every step shows as it happens. Nothing just spins.
  • Think at scale. CERMM calls out only what needs someone: servers down and critical alerts. A workstation going home at night isn't news.
  • Security is not optional. An RMM is a key to every machine. Jobs are signed, agents pin the server's key, two-factor is built in and every action is in the audit log.
  • Nothing on screen that doesn't work yet. If a button is there, it does something.

CERMM is in development. Something here wrong or out of date? Tell us or fix it.