Skip to content

Home

Jump to bottom
Tyler Hatfield edited this page Nov 12, 2026 · 5 revisions

Vitrine RMM Documentation (v2.5.1 Stable)

Welcome to the official Vitrine RMM documentation wiki. Vitrine RMM is an enterprise-grade, glassmorphic self-hosted Remote Monitoring and Management (RMM) platform engineered for NinjaRMM feature parity and beyond, powered by MeshCentral 2 as its remote execution and transport engine.

📚 Documentation Index

1. Getting Started & Operations

  • Installation & Setup — System requirements (Node.js 20+), bare-metal systemd installation (safe alongside existing /opt/meshcentral), multi-arch (linux/amd64 & linux/arm64) Docker Compose deployments, First-Run Super Admin bootstrap, and Reverse Proxy & TLS OOBE Wizard.
  • Architecture & Security — Scrypt & OpenID Connect (S256 PKCE) SSO authentication, HttpOnly sessions with live WebSocket revocation, strict multi-tenant RBAC (super_admin, technician, client_admin), AES-256-GCM at-rest secret vault (including encrypted secret custom attributes), per-user RFC 6238 Step-Up TOTP MFA, strict Content-Security-Policy (CSP), DNS-rebinding SSRF protection, and Scoped Vendor Guest Portal (/guest/:id).
  • Backups, Self-Updater & Disaster Recovery — Unified AES-256-GCM encrypted .vrmm-backup.gz (VRMMENC1) archives, MFA-gated Backup Recovery Key Reveal & Escrow reminders, reboot-resilient scheduled snapshots, AWS Signature V4 S3/R2/MinIO/B2 offsite sync, cross-machine live vault key reload, and full bare-metal Git + build + auto-rollback self-updater.

2. Fleet Governance, Offboarding & Remote Orchestration

  • Offboarding & Data Archive Vault — Clean endpoint & client offboarding, offline pending queue & auto-archive timers, preserved BitLocker/LAPS Data Archive Vault, automatic resurrection on wake, and deleted-client Tombstone Registry for quiet self-offboarding.
  • Hierarchical Policy & Condition Alerting Engine — 4-tier cascading governance (Global -> Client -> Site -> Device Role), customizable LAPS local admin username, offline LAPS rotation deferral, and multi-channel state notifications (tenant-scoped Web UI, SMTP Email, Direct PSA Ticket).
  • MeshCentral 2 Federation & QuickSupport Portal — Multi-instance MeshCentral 2 federation, toggleable customer-facing QuickSupport portal (/remote), 6-stage Authenticode signing pipeline, zero-touch Intel AMT/vPro CIRA, and 5-tier peer-relayed Wake-on-LAN.
  • Silent Background Management Suite — Interactive background PowerShell/Bash PTY shells, live Process & Services controller, Remote Registry/Config editor, Dual-Pane File Manager, Event Viewer, and Task Scheduler.
  • Patch Management & Deployments — OS & 3rd-party patching, NVD CVE / CVSS v3.1 vulnerability scoring, OEM driver catalogs, and DISM/WUSA KB rollback.

3. Proactive Monitoring, Hypervisors, Specialty Devices & Integrations

  • Specialty Endpoints, Vendor APIs, Topology & Virtualization — Live hypervisor polling & VM power/snapshot actions (Proxmox VE, VMware vSphere/ESXi, Hyper-V), plus vendor-native polling for Ubiquiti UniFi OS, DMTF Redfish (iDRAC/iLO/BMC), FortiOS, Synology DSM, APC NMC3, VoIP PBXs, Printers, and SNMP/TCP/TLS probes with step-by-step setup guides.
  • Self-Healing & Script Orchestration — Condition watchdogs with circuit-breaker flap protection, RBAC-scoped script library, and $vitrine.* runtime token injection.
  • Two-Way PSA & REST API — Bidirectional ITFlow ticketing, HMAC-SHA256 webhook verification, full v2.5.1 REST/WebSocket API reference, and Executive QBR reporting.

💡 System Architecture Overview

graph TD
    Client["Managed Endpoints (Windows / Linux / macOS)"] -->|TLS WebSocket Tunnel & CIRA| MC["MeshCentral 2 Federation"]
    Appliances["Specialty Endpoints & Hypervisors (Proxmox / vSphere / UniFi / Redfish)"] -->|Vendor REST & Probes| API["Vitrine Fastify Control Plane"]
    IdP["Enterprise OIDC IdP (Authentik / Okta / Entra ID)"] <-->|Auth Code + S256 PKCE| API
    UI["Code-Split Glassmorphic SPA + /remote & /guest Portals"] -->|Strict CSP + Session Auth + WS| API
    API <-->|Control Channel / RPC| MC
    API --> DB[("SQLite WAL Database (Schema v16)")]
    API --> Vault[("AES-256-GCM At-Rest Secret Vault")]
    API --> Archive[("Data Archive Vault & Tombstone Registry")]
    API --> Policy["4-Tier Policy & Condition Alert Matrix"]
    API -->|VRMMENC1 Encrypted Archives| Backup["Atomic Backups & S3 SigV4 Offsite Sync"]
    API -->|RFC 3161 Authenticode| Signer["6-Stage Code Signing & Installer Pipeline"]
    API <-->|Bi-Directional Sync| PSA["ITFlow PSA / Ticketing API"]
    API -->|TLS SMTP| Mail["Outbound SMTP Notification Relay"]
Loading

Clone this wiki locally