-
Notifications
You must be signed in to change notification settings - Fork 0
Remote Access
The golden rule: autormm grants full control of every enrolled host, so the
hub is a crown-jewel target. Keep it on your LAN as plain IP:port and never
expose it directly to the open internet.
To reach your lab from outside your network, put a zero-trust overlay in front of it rather than opening a port. autormm is plain HTTP/WebSocket on a port, so it works with all of these out of the box — no special configuration.
- Deploy a Twingate Connector inside your network (if you don't have one).
- Add a Resource pointing at the hub's
IP:port(or a DNS alias). - Assign it to your group.
Now anyone with the Twingate app (and access) can open http://<hub-ip>:8765
from anywhere — no inbound ports opened. Hosts that roam off your LAN can also
reach the hub the same way.
Put the hub, your client devices, and (optionally) roaming agents on the overlay network. Reach the hub at its overlay address. This is the simplest option if you also want traveling agents to phone home.
A reverse proxy is not required. If you want a hostname or TLS termination,
Traefik / nginx / Caddy work fine — deploy/traefik-autormm.yml is a LAN-only
example. Do not use a reverse proxy as your only barrier to the internet;
put a zero-trust layer or VPN in front regardless.
When traffic leaves a trusted link, run behind TLS — either your reverse proxy /
overlay handles it, or use the hub's built-in -tls-cert / -tls-key. Agents
verify certificates unless started with --insecure.
The admin and enroll tokens are effectively root over your whole fleet. Guard them, and rotate them if they leak.