Distributed Remote Streaming

Routewarden supports a distributed agent model inspired by CrowdSec. You can deploy reverse proxies (Traefik, Caddy, NGINX) across multiple edge nodes, cloud virtual machines, and Kubernetes clusters, and stream their live security telemetry to a central Routewarden dashboard.

TIP

Dedicated Guide Available: For the comprehensive multi-page guide covering architecture, key generation, enrollment, daemons, and cryptography, visit the Remote Monitoring & Log Streaming Guide.

---

Architecture Overview

Streaming Topologytext

┌──────────────────────────────────────┐       ┌──────────────────────────────────────┐│        Remote Server A (Edge)        │       │        Remote Server B (Cloud)       ││  [Traefik / Caddy / NGINX Container] │       │  [Traefik / Caddy / NGINX Container] ││                   │                  │       │                   │                  ││             rwarden push             │       │             rwarden push             │└───────────────────┬──────────────────┘       └───────────────────┬──────────────────┘                    │                                              │                    │      X25519 ECDH + AES-256-GCM Encrypted     │                    │        POST /api/v1/events (Bearer Key)      │                    ▼                                              ▼    ┌─────────────────────────────────────────────────────────────────────────────┐    │                 Routewarden Central Dashboard & Ingestion Hub               │    │                                                                             │    │  • Validates API Keys from ~/.routewarden/dashboard/api_keys.json           │    │  • Decrypts payloads using master X25519 server private key                 │    │  • Appends events to Routewarden SOC engine & SSE stream                    │    │  • Live Header Status Ribbon:                                               │    │    🟢 [🐳 local-gateway] [🌐 edge-prod-01 (198.51.100.4)] [🌐 cloud-node]  │    └─────────────────────────────────────────────────────────────────────────────┘

●READONLY│UTF-8│TEXT

Key Security Features

1. Asymmetric End-to-End Encryption: The central server holds the master X25519 private key. Each batch is encrypted by the client using an ephemeral X25519 keypair and AES-256-GCM. Logs cannot be inspected by intermediate proxies or network observers.
2. One-Time Registration: The client registers its credentials once (rwarden register) and saves its encrypted profile to ~/.routewarden/agent.json.
3. In-Memory Ring Buffer: Remote agents buffer up to 2,000 events in memory (~2MB max RAM) with zero disk wear on edge SSDs.
4. Resilient Retry & Backoff: Automatic exponential backoff retry on network drops, plus a 30-second heartbeat ping.

---

Step 1: Generate an Agent Key on Central Server

On your central server running rwarden dashboard:

rwarden keys createbash

rwarden keys create prod-edge-01

●READONLY│UTF-8│BASH

Output:

Generated Token Outputplaintext

🔑 Agent Key Created Successfully!─────────────────────────────────────────────────────────────  Agent Name:   prod-edge-01  Agent ID:     agent_8f9a2b4c1e0d3f7a  Token:        rw_sec_8f9a2b4c1e0d3f7a9b2c4e6f8a0d1c3e4f5a6b7c8d9e0f1a─────────────────────────────────────────────────────────────💡 To connect a remote server, run this on the remote host:   rwarden register --url http://<dashboard-ip>:7890 --key rw_sec_8f9a...   rwarden push

●READONLY│UTF-8│PLAINTEXT

You can view or revoke keys at any time:

Manage Keysbash

# List registered agentsrwarden keys list# Revoke an agent keyrwarden keys revoke prod-edge-01

●READONLY│UTF-8│BASH

---

Step 2: Register the Remote Server Once

On the remote edge or cloud server, register with the central dashboard:

rwarden registerbash

rwarden register --url http://<dashboard-ip>:7890 --key rw_sec_8f9a2b4c1e0d...

●READONLY│UTF-8│BASH

Output:

Registration Outputplaintext

⏳ Connecting to Routewarden Central Dashboard at http://198.51.100.10:7890...✅ Successfully registered with Routewarden Central Dashboard!─────────────────────────────────────────────────────────────  Dashboard URL:     http://198.51.100.10:7890  Agent Name:        prod-edge-01  Agent ID:          agent_8f9a2b4c1e0d3f7a  Server Public Key: xJ9+4kL2vM8...  Config Saved:      ~/.routewarden/agent.json─────────────────────────────────────────────────────────────🚀 You are ready to stream! Start pushing logs with:   rwarden push

●READONLY│UTF-8│PLAINTEXT

---

Step 3: Stream Logs (rwarden push)

Stream live logs using container auto-discovery, targeted containers, or local log files:

# Auto-discover all local gateway containers labeled routewarden=truerwarden push# Run in background (detached daemon mode)rwarden push -d# Check daemon status or stoprwarden push statusrwarden push stop

●READONLY│UTF-8│BASH

---

Running as a Docker Companion on Remote Nodes

You can run rwarden push as a lightweight background companion service in your remote docker-compose.yml:

docker-compose.yml (Remote Edge Companion)yaml

services:  traefik:    image: traefik:v3.1    labels:      - "routewarden=true"    # ... your existing traefik config ...  routewarden-shipper:    # Dedicated lean shipper micro-image (~6MB) or full toolkit ghcr.io/routewarden/cli:latest    image: ghcr.io/routewarden/shipper:latest    container_name: routewarden-shipper    restart: unless-stopped    environment:      - RW_DASHBOARD_URL=http://198.51.100.10:7890      - RW_AGENT_KEY=rw_sec_a8f9c2d1e4b7...      - TZ=Asia/Kolkata    volumes:      - /var/run/docker.sock:/var/run/docker.sock:ro    # Or mount registered profile if preferred:    # volumes:    #   - /var/run/docker.sock:/var/run/docker.sock:ro    #   - ~/.routewarden:/root/.routewarden:ro    command: ["--docker"]

●READONLY│UTF-8│YAML