Getting started

What you need, installing the server on Linux or Windows, and your first ten minutes.

NeverLapse RMM runs on one server that you own (or that we host for you with the Hosted by LiveIT add-on). That server holds everything: the web app your techs use, its PostgreSQL database, remote control (MeshCentral) and HTTPS certificates (Caddy). Your managed machines run a small agent that reports to it.

What you need

  • A server: Ubuntu 22.04 / 24.04, Debian 12 / 13, or Windows Server 2019 / 2022 / 2025. 64-bit, 4 CPU, 8 GB RAM and 60 GB of disk is plenty for a few thousand machines.
  • Two DNS names pointing at it, for example rmm.example.com (the web app) and remote.example.com (remote control).
  • Open ports (inbound TCP): 443 for both names, 80 for Let's Encrypt and the HTTP to HTTPS redirect, and 4433 for remote control. Managed machines must be able to reach the server on 443 and 4433.
  • A certificate choice for HTTPS (see The web certificate below): Let's Encrypt (just an email address), your own certificate (a PFX file, or PEM certificate + key) covering both names, or self-signed for a lab.
  • Your license key from your NeverLapse account (a free 14-day trial key works too; see Your license).

Behind Cloudflare

NeverLapse RMM 1.3.9 and newer works behind Cloudflare (orange cloud) for the web app and agent traffic, and still sees each machine's real address (it trusts Cloudflare's CF-Connecting-IP header only from Cloudflare's own address ranges). Two things to set in Cloudflare:

  • Keep the remote control name (for example remote.example.com) unproxied (grey cloud): it uses port 4433 and checks the server's own certificate.
  • Turn off Bot Fight Mode and challenges for /api/agent/*, /download/* and /i/*, or agents and installers get a challenge page instead of the server.

Install on Linux

Download the Linux package from your account, copy it to the server, then:

tar -xzf neverlapse-rmm-server-linux-x64.tar.gz
cd neverlapse-rmm-server-*
sudo ./install.sh --rmm-host rmm.example.com --remote-host remote.example.com --email you@example.com

Without options it asks you each question. Other options:

Option Meaning
--pfx cert.pfx Your own certificate as a PFX / P12 file (instead of --email)
--cert fullchain.pem --key key.pem Your own certificate as PEM files: the certificate followed by its intermediates, and the private key
--cert-password-file pw.txt The PFX password, or the key's password if it is encrypted (a file, so it never shows in your shell history)
--self-signed Self-signed certificates instead of Let's Encrypt (instead of --email)
--db "Host=...;Database=...;Username=...;Password=..." Use your own PostgreSQL 15 or newer instead of the bundled one
--yes Don't ask anything (for scripted installs)

The installer sets up three services: neverlapse-rmm (the web app), neverlapse-remote (remote control) and neverlapse-proxy (HTTPS). Settings live in /etc/neverlapse-rmm-server, data in /var/lib/neverlapse-rmm-server, and the install log in /var/log/neverlapse-rmm-install.log.

Install on Windows Server

Run NeverLapseRMM-Server-Setup.exe as an administrator and enter the two names, your certificate choice and your database choice. Setup downloads PostgreSQL 17 (about 350 MB). For a server without internet access, put postgresql-17.6-1-windows-x64.exe (from EnterpriseDB) in the same folder as the setup first.

Silent install:

NeverLapseRMM-Server-Setup.exe /VERYSILENT /RMMHOST=rmm.example.com /REMOTEHOST=remote.example.com /EMAIL=you@example.com

Instead of /EMAIL: /PFX=C:\certs\rmm.pfx, or /CERT=C:\certs\fullchain.pem /KEY=C:\certs\key.pem (add /CERTPASSWORDFILE=C:\certs\pw.txt when the file has a password), or /SELFSIGNED=1. /DB="Host=..." uses your own PostgreSQL.

Services: NeverLapseRmm, NeverLapseRemote and NeverLapseProxy. Settings and data are in C:\ProgramData\NeverLapse RMM Server (secrets in its secrets folder, administrators only); the install log is install.log in the same folder.

Install with Docker

From the deploy/docker folder of the source:

./setup.sh rmm.example.com remote.example.com you@example.com     # Let's Encrypt
./setup.sh rmm.example.com remote.example.com rmm.pfx             # your own PFX (asks for its password)
./setup.sh rmm.example.com remote.example.com fullchain.pem key.pem
./setup.sh rmm.example.com remote.example.com self-signed

To update later, run ./setup.sh rmm.example.com remote.example.com keep with the new release: it keeps the certificate chosen in the app.

The web certificate (HTTPS)

Both names are served over HTTPS by the server's front door (Caddy). Three choices, at install and later in Settings › Web certificate (admins), where a change takes effect at once, without a restart:

  • Let's Encrypt: free and renewed automatically. Both names need public DNS pointing at the server, and ports 80 and 443 open to the internet.
  • Your own certificate: upload a PFX / P12 file (with its password), or a PEM certificate + private key (the key may be encrypted). It must cover both names; a wildcard such as *.example.com works. The page shows who issued it and when it expires, and admins see a reminder on every page from 21 days before expiry. Your own certificates don't renew themselves: upload the renewed one in the same place.
  • Self-signed: for labs only. Browsers warn, and agents must be installed with --insecure.

Before switching, the server checks the certificate (password, both names, not expired); after switching it checks that the new certificate is really served. If anything fails, the previous certificate stays in use. The password is only used to open the file and is never stored; the private key is kept readable only by the server.

Your first ten minutes

  1. Open https://rmm.example.com/. The first person to open a new install creates the first administrator, so do this straight after installing.
  2. License: enter your key on the License page. Until then the app is read-only.
  3. Branding (optional, Settings › Branding): your company name, colour and logo. They are also what your customers see on remote support. Needs the Branding add-on.
  4. Sites: add a site for each customer (or location). See Sites and groups.
  5. Add a computer: download RMM-Installer.exe, run it on a machine and paste the site's install code. It shows up within a minute. See Adding devices.
  6. Alerts: tell NeverLapse where to send alerts (your PSA's ticketing webhook, a Teams channel, or any webhook). See Alerts and ticketing.

Security software: before installing agents, add the exclusions listed under Adding devices. EDR products often stop remote-support tools otherwise.

NextYour license