Self-Hosted RMM Tools: Tactical RMM vs MeshCentral vs OpenRMM Guide

Remote Monitoring and Management (RMM) platforms are essential tools for IT teams and Managed Service Providers (MSPs). They allow you to monitor server health, deploy software patches, run scripts remotely, and manage endpoints — all from a centralized web dashboard.

While commercial RMM solutions can cost hundreds of dollars per technician per month, open-source alternatives give you the same capabilities without licensing fees or vendor lock-in. This guide compares three self-hosted RMM platforms: Tactical RMM, MeshCentral, and OpenRMM.

Quick Comparison Table

Tactical RMM — The MSP-Focused Platform

Tactical RMM is a full-featured RMM platform built with Django, Vue, and Go. It’s designed specifically for MSPs who need to manage multiple client environments from a single dashboard.

Key Features

• Multi-tenant architecture: Separate client sites with granular access controls
• Windows patch management: Automated Windows Update approval and deployment
• Remote control: Integrated MeshCentral for instant remote desktop sessions
• Script automation: Run PowerShell, Bash, or Python scripts on agents
• Software management: Install, uninstall, and audit software across endpoints
• Monitoring and alerting: Real-time CPU, memory, disk, and service monitoring
• Ticketing integration: Connects with popular ticketing systems
• Asset management: Track hardware inventory across all managed devices

Docker Compose Configuration

Tactical RMM provides an official Docker Compose setup that deploys the entire stack:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

version: "3.7"

networks:
  proxy:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/24
  api-db:
  redis:
  mesh-db:

volumes:
  tactical_data:
  postgres_data:
  mongo_data:
  redis_data:

services:
  tactical-postgres:
    container_name: trmm-postgres
    image: postgres:13-alpine
    restart: always
    environment:
      POSTGRES_DB: tacticalrmm
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASS}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - api-db

  tactical-redis:
    container_name: trmm-redis
    image: redis:6.0-alpine
    user: "1000:1000"
    command: redis-server
    restart: always
    volumes:
      - redis_data:/data
    networks:
      - redis

  tactical-rmm:
    container_name: trmm-app
    image: rmm:latest
    restart: always
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASS: ${POSTGRES_PASS}
      APP_HOST: ${APP_HOST}
      API_HOST: ${API_HOST}
      MESH_USER: ${MESH_USER}
      MESH_PASS: ${MESH_PASS}
    depends_on:
      - tactical-postgres
      - tactical-redis
    networks:
      - proxy
      - api-db
      - redis
    volumes:
      - tactical_data:/opt/tactical
      - /var/run/docker.sock:/var/run/docker.sock

  nats:
    container_name: trmm-nats
    image: nats:2.9-alpine
    restart: always
    command: ["-js", "-sd", "/data"]
    volumes:
      - nats_data:/data
    networks:
      - proxy

volumes:
  nats_data:

networks:
  proxy:
    driver: bridge

Environment Setup

Create a .env file with your configuration:

1
2
3
4
5
6
7

# Tactical RMM environment
POSTGRES_USER=tactical
POSTGRES_PASS=your-secure-postgres-password
APP_HOST=rmm.yourdomain.com
API_HOST=api.yourdomain.com
MESH_USER=meshcentral
MESH_PASS=your-meshcentral-password

Install Agent on Endpoints

After deploying the server, install agents on managed endpoints:

1
2
3
4
5
6
7
8
9

# On Windows (PowerShell)
# Download the agent installer from the Tactical RMM web UI
# The installer is per-client and per-site scoped

# On Linux
curl -sSL https://api.yourdomain.com/installer/agent-linux.sh | sudo bash

# Verify agent connection
systemctl status tacticalrmm-agent

MeshCentral — The Remote Access Specialist

MeshCentral is a web-based remote management platform that excels at remote desktop, remote terminal, and file management. Originally designed around Intel AMT (Active Management Technology), it now supports a wide range of platforms.

Key Features

• Intel AMT support: Out-of-band management (works even if OS is down)
• Remote desktop: Web-based RDP, VNC, and terminal sessions
• File manager: Browse, upload, and download files on remote machines
• Event logging: Track all remote access sessions and commands
• Multi-platform agents: Windows, Linux, macOS, and Intel AMT
• Group management: Organize devices into hierarchical groups
• User accounts: Role-based access with two-factor authentication
• No database required: Uses built-in NeDB for simplicity

Docker Deployment

MeshCentral doesn’t have an official Docker Compose, but it runs well in Docker:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

version: "3.8"

services:
  meshcentral:
    image: ghcr.io/ylianst/meshcentral:latest
    container_name: meshcentral
    restart: always
    ports:
      - "443:443"
      - "4433:4433"  # Agent relay port
    volumes:
      - meshcentral-data:/opt/meshcentral/meshcentral-data
      - meshcentral-files:/opt/meshcentral/meshcentral-files
      - meshcentral-backups:/opt/meshcentral/meshcentral-backups
    environment:
      - NODE_ENV=production
      - MESHCTRL_ADMIN_USER=admin
      - MESHCTRL_ADMIN_PASS=your-admin-password
    networks:
      - mesh-net

volumes:
  meshcentral-data:
  meshcentral-files:
  meshcentral-backups:

networks:
  mesh-net:
    driver: bridge

Configuration File

MeshCentral uses a config.json file for advanced settings:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

{
  "settings": {
    "Cert": "meshcentral.example.com",
    "_WANonly": true,
    "_LANonly": true,
    "_Port": 443,
    "_RedirPort": 80,
    "_AgentPong": 300
  },
  "domains": {
    "": {
      "Title": "My RMM Platform",
      "Title2": "MeshCentral",
      "_Minify": true,
      "_NewAccounts": true,
      "_UserNameIsEmail": true
    }
  }
}

OpenRMM — The Emerging Alternative

OpenRMM is a newer open-source RMM platform that aims to provide a lightweight, modular alternative to commercial RMM tools. While still in active development, it offers a foundation for teams that want full control over their RMM stack.

Key Features

• Modular architecture: Plugin-based design for extensibility
• Agent management: Deploy and manage agents across endpoints
• Basic monitoring: Track system health metrics
• Script execution: Run remote commands and scripts
• Simple UI: Clean web interface for managing devices

Installation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# Clone the repository
git clone https://github.com/redanthrax/openrmm.git
cd openrmm

# Install dependencies
pip install -r requirements.txt

# Run database migrations
python manage.py migrate

# Create admin user
python manage.py createsuperuser

# Start the server
python manage.py runserver 0.0.0.0:8000

Docker Setup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

version: "3.8"

services:
  openrmm:
    build: .
    container_name: openrmm
    restart: always
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=sqlite:///data/openrmm.db
      - SECRET_KEY=your-secret-key-here
    volumes:
      - openrmm-data:/app/data

volumes:
  openrmm-data:

Choosing the Right RMM Platform

Use Tactical RMM When:

• You’re an MSP managing multiple client environments
• You need Windows patch management integrated into your RMM
• You want a modern web UI with real-time monitoring dashboards
• You need multi-tenant support with per-client isolation

Use MeshCentral When:

• Remote desktop and out-of-band management are your primary needs
• You manage Intel AMT-capable devices
• You want a lightweight, self-contained solution without complex dependencies
• You need file transfer and terminal access across mixed platforms

Use OpenRMM When:

• You want a lightweight, customizable RMM foundation
• You prefer a modular architecture you can extend with plugins
• You have specific RMM requirements not met by existing platforms
• You want to contribute to an emerging open-source RMM project

Why Self-Host Your RMM Infrastructure?

Self-hosted RMM platforms eliminate per-technician licensing fees, keep all device data under your control, and remove dependency on cloud services that may change pricing or terms. For organizations managing dozens or hundreds of endpoints, the cost savings can be substantial.

For broader infrastructure monitoring beyond endpoint management, see our infrastructure monitoring comparison. If you need database-specific monitoring, our database monitoring guide covers specialized tools. For remote access without a full RMM, our remote desktop guide covers standalone solutions.

FAQ

What is an RMM platform?

RMM (Remote Monitoring and Management) is software that allows IT teams to monitor, manage, and troubleshoot computers, servers, and network devices remotely. Key capabilities include system monitoring, patch deployment, remote desktop access, script execution, and alerting. RMM tools are essential for MSPs and internal IT teams managing distributed infrastructure.

Is Tactical RMM production-ready?

Yes, Tactical RMM is actively developed and used by many MSPs in production. It includes automatic agent updates, Windows patch management, script automation, and integrated remote desktop via MeshCentral. However, like any self-hosted tool, you should test thoroughly in a staging environment before deploying to production clients.

Does MeshCentral require Intel AMT?

No, Intel AMT is optional. MeshCentral works with regular agent-based connections on Windows, Linux, and macOS. Intel AMT provides out-of-band management that works even when the operating system is down or the machine is powered off, but it’s not required for basic remote desktop and file management functionality.

Can I manage both Windows and Linux endpoints?

Yes, all three platforms support Windows and Linux agents. Tactical RMM and MeshCentral also support macOS. Tactical RMM provides the most comprehensive cross-platform monitoring with unified dashboards, while MeshCentral offers the best remote desktop experience across all platforms.

How do RMM tools differ from monitoring tools like Nagios or Zabbix?

RMM tools focus on endpoint management — remote control, patch deployment, software distribution, and IT operations. Monitoring tools like Nagios or Zabbix focus on infrastructure observability — uptime checks, metric collection, alerting, and capacity planning. They serve different purposes and are often used together: RMM for managing endpoints and monitoring for watching infrastructure health.

Do I need a reverse proxy for RMM web access?

Yes, for production use you should place the RMM web interface behind a reverse proxy with TLS termination. Nginx, Caddy, or Traefik can handle SSL certificates, load balancing, and access control. For MeshCentral, the built-in TLS can be used directly, but a reverse proxy adds an extra layer of security and enables integration with existing infrastructure.