Configuration files
master.conf and agent.conf, key by key.
Most options are managed in the panel. The two configuration files hold what the programs need before the panel is available. After editing one, restart its service:
sudo systemctl restart 3rmonitor-master # after editing master.conf
sudo systemctl restart 3rmonitor-agent # after editing agent.confmaster.conf
/etc/3rmonitor/master.conf
listen = 0.0.0.0:8899
data_dir = /var/lib/3rmonitor
public_url = https://monitor.example.com/
dist_dir = /opt/3rmonitor/dist
trust_proxy = auto
tls_cert =
tls_key =
tls_listen =
update_url =| Key | Meaning |
|---|---|
listen | Address and port of the panel. 127.0.0.1:8899 = reachable only through a reverse proxy on the same server. |
data_dir | Where the database and the IP-to-country database are kept |
public_url | Public panel URL. After the first start it is managed in Settings → General; this value is only the initial one. |
dist_dir | Agent packages that agents download from the master |
trust_proxy | auto: take the real client IP from requests forwarded by this machine, the local network or Cloudflare. true or false to force it. |
tls_cert, tls_key | Certificate and private key (PEM) to serve HTTPS directly. See HTTPS, option 2. |
tls_listen | HTTPS port, for example 0.0.0.0:8443; listen stays HTTP. Empty with a certificate: listen itself becomes HTTPS. |
update_url | Where to check for new versions. Empty = https://3rsoft.com.pa/api/releases/latest. |
The file belongs to root and is readable by the 3rmonitor group (permissions 640).
agent.conf
/etc/3rmonitor/agent.conf. It contains the token, so only root and the agent can read it: owner root, group 3rmonitor-agent, permissions 640 (600 on agents older than 1.1.0).
master_url = https://monitor.example.com
token = …
insecure = false
auto_update = true
mysql_defaults_file =
access_logs =
public_ip = auto
project_dirs =
firewall = auto
ai = on
sandbox_networks_max = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, fc00::/7
protected_ips =
ai_auto_per_day = 20The last four keys are not in the file until you set them; the values shown are the defaults.
| Key | Meaning |
|---|---|
master_url | The master's address. Change it, or use 3rmonitor bind, when the master moves. |
token | This server's token. Written by the installer or by 3rmonitor bind. |
insecure | true if the master uses a self-signed certificate |
auto_update | true: update to the master's version automatically |
mysql_defaults_file | Credentials file for reading the MySQL / MariaDB status. Debian uses /etc/mysql/debian.cnf automatically. |
access_logs | Access log locations, comma-separated, wildcards allowed (for example /var/log/nginx/*.log). Empty = find the usual locations; off = no request statistics. |
public_ip | auto = network interfaces → cloud metadata → external query (1.1.1.1); off; or a fixed IP |
project_dirs | Extra directories where the vulnerability checks look for lock files, comma-separated. The usual ones are found automatically. |
firewall | auto = enforce the panel's blocklist / allowlist once it is turned on in the server's settings; off = never (written by 3rmonitor firewall off) |
ai | What the panel's AI may run on this server: on (default), read = only read-only and sandboxed diagnostics, off = nothing. Written by 3rmonitor ai on / read / off. See AI on-call. |
sandbox_networks_max | The networks the AI sandbox may ever reach from this server, comma-separated. The networks allowed in Servers → Settings only work inside these. Default: the private networks. |
protected_ips | IPs or ranges this server's helper never blocks, comma-separated, in addition to the master and the panel's protected addresses |
ai_auto_per_day | How many repairs approved only by the reviewer AI (without an administrator) this server runs in 24 hours. Default 20; 0 = no limit on the server (the panel's Automatic repairs per day still applies). The same repair also runs at most 3 times an hour. Changes apply right away, without restarting anything. |
Agents keep no data apart from this file, and the keys the server trusts for AI approvals, in /var/lib/3rmonitor-helper (managed with 3rmonitor approvers).
Example: MySQL credentials for the agent
The agent reads the MySQL / MariaDB status with the mysql client (which must be installed), run as root by its helper. That works without configuration on Debian and Ubuntu, and wherever root can sign in through the local socket. Otherwise the server's Software section shows "Cannot log in to the database to read its status". To fix it, create a database user with no privileges at all:
CREATE USER 'monitor'@'localhost' IDENTIFIED BY 'YOUR_PASSWORD';Save its credentials in /etc/3rmonitor/mysql.cnf:
[client]
user = monitor
password = YOUR_PASSWORDsudo chmod 600 /etc/3rmonitor/mysql.cnfThen set mysql_defaults_file = /etc/3rmonitor/mysql.cnf in agent.conf and restart the agent. Reading the status and version needs no privileges on any database.