refac(docs): MeshCentral Mkdocs rewrite (#7216)

* Sanitation and cleanup.

* More sanitation.

* Good base.

* Conversion of images to jpeg for background and added border-radius.

* sanitation and css addition.

* Moved documents and further expanded documentation.

* Converting images and setting structure.

* Minor text addition

* [ENH] Improve home page documentation, meshcentral index page documentation

* [ENH]Improve submodules & features page

* [ENH]review and improve how-to-contribute page

* [ENH]review and improve Design and Architecture page

* [ENH] Reviewed and improve 'Other' pages

* reworked advanced page

* Small additions and corrections.

* minor removal of dashes

* [ENH] Review and improve install menu (With related pages) in the docs (#16)

* feat: rewrite entire install directory

---------

Co-authored-by: alain.cisirika <cisirikalain@gmail.com>
Co-authored-by: Daan Selen <dselen@systemec.nl>

.gitignore

@@ -18,6 +18,7 @@ meshcentral.db.json
 mesherrors.txt
 bob.json
 .greenlockrc
+venv
 
 ## Ignore Visual Studio temporary files, build results, and
 ## files generated by popular Visual Studio add-ons.

docs/.vscode/launch.json

@@ -0,0 +1,15 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "chrome",
+            "request": "launch",
+            "name": "Launch Chrome against localhost",
+            "url": "http://localhost:8080",
+            "webRoot": "${workspaceFolder}"
+        }
+    ]
+}

docs/docs/design/index.md

@@ -1,55 +1,68 @@
 # Design and Architecture
 
-![](images/2022-05-15-12-57-36.png)
+![](images/2022-05-15-12-57-36.jpg)
 
-Design and Architecture Guide [as .pdf](https://meshcentral.com/docs/MeshCentral2DesignArchitecture.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral Design & Architecture v0.0.4.odt?raw=true)
-## Video Walkthru
+## 🎬 Video Walkthru
 
 <div class="video-wrapper">
-  <iframe width="320" height="180" src="https://www.youtube.com/embed/MOQ0uCUs7_M" frameborder="0" allowfullscreen></iframe>
+  <iframe src="https://www.youtube.com/embed/MOQ0uCUs7_M" frameborder="0" allowfullscreen></iframe>
 </div>
 
-## Abstract
+## 🧾 Abstract
 
-This  document  attempts  to  describe  the  architecture  and  design  of  the  second  version  of MeshCentral on which work started in late 2016. The document covers the overview of the design, goes in details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software. The software and added documentation and tutorial videos are available at:[ https://www.meshcommander.com/meshcentral2 ](https://www.meshcommander.com/meshcentral2)
+This  document  attempts  to  describe  the  architecture  and  design  of  the  second  version  of MeshCentral on which work started in late 2016. The document covers the overview of the design, goes in details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software. 
 
-## Introduction
+---
+> **📌 Note :**
+
+> The software and added documentation and tutorial videos are available at :
+[ https://www.meshcommander.com/meshcentral2 ](https://www.meshcommander.com/meshcentral2)
+
+---
+
+## 📘 Introduction
 
 MeshCentral is a free open source web-based remote computer management software. After over 8 years of working on the first version of MeshCentral, work as moved to version 2 which this document described. In 2010, when MeshCentral v1 was first designed, the Internet was very different. HTML5 and WebSocket did not exists, no such thing as a software container, etc. With MeshCentral version 2, a complete redesign was made to make the software much more in line with modern Internet deployment models. 
 
 The advent of NodeJS, WebSocket, WebRTC and other web technologies coming out in the last 10 years has really made the design of MeshCentral v2 not only possible, but quite amazing. Being able to use a single programming language across platforms to JavaScript. Being able to easily exchange objects using web socket and JSON, being able to scale with WebRTC, deploy quickly with containers, etc. Looking back at the incredible advances in web technologies lead to an almost mandatory MeshCentral redesign. 
 
-## Goals & Requirements
+## 🎯 Goals & Requirements
 
-The goal of MeshCentral is to be the best open source remote management software in the world. Remote computer management is a big area with many different usages and requirements. To best suite this, it’s important to have software that is as flexible as possible. Additionally, there are many other goals: 
+The goal of MeshCentral is to be the best open source remote management software in the world. Remote computer management is a big area with many different usages and requirements. To best suite this, it’s important to have software that is as flexible as possible.
 
-- Must be quick and easy to install. 
-- Must install on all major operating systems and platforms. 
-- Can be deployed on small computers and the cloud. 
-- Can be deployed within containers. 
-- Can be deployed in many network environments. 
-- Must support both software agent and Intel® AMT hardware agent. 
-- Must only use open source dependencies. 
-- Must provide all basic remote management features (desktop, terminal, files…) 
-- Must use the network efficiently. 
-- Must have a real time user interface. 
-- Must be easy to use. 
-- Must be fast. 
-- Etc. 
+Additionally, there are many other goals : 
+
+  > - **Must be quick and easy to install.** 
+  > - **Must install on all major operating systems and platforms.** 
+  > - **Can be deployed on small computers and the cloud.**
+  > - **Can be deployed within containers.** 
+  > - **Can be deployed in many network environments.** 
+  > - **Must support both software agent and Intel® AMT hardware agent.** 
+  > - **Must only use open source dependencies.**
+  > - **Must provide all basic remote management features (desktop, terminal, files…)** 
+  > - **Must use the network efficiently.**
+  > - **Must have a real time user interface.** 
+  > - **Must be easy to use.**
+  > - **Must be fast.** 
+  > - **Etc.**
 
 Basically, all the requirements you would expect from open source software that can go viral. Since this software is sponsored by Intel, it’s going to support Intel® AMT really well, making it possible to manage a remote computer regardless of its OS or power state. Intel® AMT is not required to use this software, however it’s a great fit. 
 
-## Design Overview
+## 🖥️  Design Overview
 
-In this section, we do a very high level overview of MeshCentral’s design. MeshCentral has 3 big components: the server, the agent and the web application. 
+In this section, we do a very high level overview of MeshCentral’s design. MeshCentral has 3 big components :
 
-![](images/2022-05-15-13-01-56.png)
+  - *The server*,
+  - *The agent and* 
+  - *The web application*. 
+
+![](images/2022-05-15-13-01-56.jpg)
 
 There is of course more software that support these 3 components like the Windows Server Installer, ClickOnce application, MeshCentral Discovery Tool and more. These will be covered later. Most of the document will focus on these 3 main components. Another component that is significant but not part of the software itself is Intel® AMT (Intel® Active Management Technology). MeshCentral supports Intel AMT that acts like an optional hardware based agent for MeshCentral. 
 
 When it comes to programming languages used, MeshCentral is mostly built with JavaScript with the agent having significant portable C code. This makes things pretty simple since the browser, server and agents can share some of the code. More importantly, JavaScript is great at parsing JSON and so, the main protocol used between the components is JSON over Web Socket. 
 
-![](images/2022-05-15-13-03-25.png)
+![](images/2022-05-15-13-03-25.jpg)
 
 It’s important to note that while JavaScript is used in all 3 components, the JavaScript runtime is very different. The JavaScript written to run within a browser sandbox uses different calls than the one running in NodeJS on the server or on the agent with DukTape. 
 
@@ -57,57 +70,68 @@ This is probably a good time to introduce DukTape [(https://www.duktape.org/)](h
 
 Another interesting design decision is that MeshCentral makes almost no use of RESTful API’s. Instead, almost everything is done using WebSocket. This allows JSON objects to be exchanged fully asynchronously. There is no pushing the refresh button or polling as events are sent by all actors in real time. 
 
-## MeshCentral server
+## 🗄️ MeshCentral server
 
-The MeshCentral server is a NodeJS application that is published on NPM at: [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using “npm install meshcentral” once NodeJS is installed. MeshCentral will work on Node 6.x and higher. 
+The MeshCentral server is a NodeJS application that is published on NPM at : [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using “npm install meshcentral” once NodeJS is installed. MeshCentral will work on Node 6.x and higher. 
 
-## Dependencies
+## 📦 Dependencies
 
 The server makes use of the following dependencies on NPM. These are all automatically installed by NPM when installing MeshCentral. 
 
-Can be found in the file: `MeshCentralServer.njsproj`
+Can be found in the file : `MeshCentralServer.njsproj`
 
-The main takeaway is that MeshCentral is mostly an ExpressJS application. This is not a complete list of dependencies as many of these packages have their own dependencies creating a large tree. The security of these packages is a concern and all of the dependency tree is a concern. In addition to the dependencies that are “hard coded”, there are a few more that are installed only when needed. These are: 
+The main takeaway is that MeshCentral is mostly an ExpressJS application. This is not a complete list of dependencies as many of these packages have their own dependencies creating a large tree. The security of these packages is a concern and all of the dependency tree is a concern. In addition to the dependencies that are “hard coded”, there are a few more that are installed only when needed. These are : 
 
 ### node-windows
 
-**greenlock, le-store-certbot, le-challenge-fs**: Installed on all Windows install. Allows background service install: 
+- **greenlock, le-store-certbot, le-challenge-fs** :
 
-**le-acme-core**: Installed only when Let’s Encrypt must be used: 
+    > Installed on all Windows install. Allows background service install: 
 
-**mongojs**: Installed when MongoDB is in used. 
+- **le-acme-core** :
 
-**nodemailer**: Installed when SMTP server support is in used. 
+    > Installed only when Let’s Encrypt must be used: 
+
+- **mongojs** :
+
+    > Installed when MongoDB is in used. 
+
+- **nodemailer** :
+
+    > Installed when SMTP server support is in used. 
 
 MeshCentral will run `npm install` automatically when any of these optional modules are needed but not currently available. 
 
-## Understanding the different modes: LAN, WAN and Hybrid
+## 🎬 Understanding the different modes: LAN, WAN and Hybrid
+
 
 <div class="video-wrapper">
   <iframe width="320" height="180" src="https://www.youtube.com/embed/gx5Fh3pQOns" frameborder="0" allowfullscreen></iframe>
 </div>
 
-## Code files and folders
+## 📁 Code files and folders
 
 Someone would think the server is rather simple when taking a look at the MeshCentral server code files. At a high level, the entire server has 3 folders, 3 text files and a manageable number of .js files that are fairly self-descriptive. Here is a list of the source files and folders. 
 
 ### Folders
 
-`agents`:  Compiled agents, install scripts, tools and agent JavaScript.
+  `agents`:  Compiled agents, install scripts, tools and agent JavaScript.
 
-`public`: Static web elements such as images, CSS, HTML and more.
+  `public`: Static web elements such as images, CSS, HTML and more.
 
-`views`: Main web application, login screen and messenger app.
+  `views`: Main web application, login screen and messenger app.
 
 ### Configuration & text files
 
 `package.json`: Description of the MeshCentral package on NPM.
+
 `sample-config.json`: A sample “config.json” file to get started.
+
 `readme.txt`: Readme file published with the MeshCentral package.
 
 ### Code files
 
-```
+```bash
  amtevents.js             | Used to decode Intel AMT WSMAN events.
  amtmanager.js            | Used to handle Intel AMT/CIRA things.
  amtprovisioningserver.js | Used to Provision Intel AMT on a Local Network.
@@ -150,7 +174,15 @@ Someone would think the server is rather simple when taking a look at the MeshCe
                     
 ```
 
-At a high level, the MeshCentral.js file will get the server started. By default, it will start the webserver.js on port 443, redirectserver.js on port 80 and mpssrver.js on port 4433. The webserver.js file will create a meshuser.js or meshagent.js instance each time a user or agent connects. The other files support various usages, but this is the basic working on the server. 
+At a high level, the MeshCentral.js file will get the server started.
+
+By default, it will start :
+
+- `webserver.js` on port `443`,
+- `redirectserver.js` on port `80` and 
+- `mpssrver.js` on port `4433`.
+
+The `webserver.js` file will create a `meshuser.js` or `meshagent.js` instance each time a user or agent connects. The other files support various usages, but this is the basic working on the server. 
 
 ### Server database
 
@@ -158,23 +190,23 @@ One of the big design decision on the server is its database. We want something
 
 By default, MeshCentral will just create and use a NeDB database, but can be configured to use MongoDB. The internal code path for both databases are almost exactly identical so the “db.js” file handles both, almost the same way and the exact database in use is completely abstracted from the rest of the server code. 
 
-## Certificates
+## 🔐 Certificates
 
 MeshCentral makes use of many certificates to accomplish many security tasks. When first running the server or an agent, both of these actors will generate certificates. The agent will generate one or two certificates on the first run and the server will generate four certificates. 
 
-![](images/2022-05-15-13-36-01.png)
+![](images/2022-05-15-13-36-01.jpg)
 
 In this section we review what certificates are created, what are their uses and how they are stored. Most administrators using MeshCentral will not need a deep understanding of this section to run the server, however, a basic understanding of this section can help understand how to best protect the server’s critical security assets. 
 
 ### Server Certificates
 
-As indicated above, the MeshCentral server creates four certificates when it first runs. It uses ForgeJS to perform certificate creation and all four certificates below are saved in the “meshcentral-data” folder. The four certificates are: 
+As indicated above, the MeshCentral server creates four certificates when it first runs. It uses ForgeJS to perform certificate creation and all four certificates below are saved in the `meshcentral-data` folder. The four certificates are: 
 
 #### Server root
 
 `root-cert-public.crt`
 
-This is a self-signed root certificate that is used only to issue the 3 next certificates. This certificate can be useful when it’s installed as a root of trust in some situations. For example, when Intel AMT connects to the MPS server on port 4433, it will correctly connect only if this root certificate is loaded into Intel AMT as a trusted certificate. Browser can also be setup to trust this root certificate in order to create a trusted connection between a browser and the servers HTTPS port. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated. 
+This is a self-signed root certificate that is used only to issue the 3 next certificates. This certificate can be useful when it’s installed as a root of trust in some situations. For example, when Intel AMT connects to the MPS server on port `4433`, it will correctly connect only if this root certificate is loaded into Intel AMT as a trusted certificate. Browser can also be setup to trust this root certificate in order to create a trusted connection between a browser and the servers HTTPS port. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated. 
 
 #### MPS certificate
 
@@ -186,27 +218,31 @@ This is a TLS certificate signed by the root above used as a TLS server certific
 
 `webserver-cert-public.crt`
 
-This is the default certificate used to secure the HTTPS port 443. It is signed by the root above and is the certificate users will first see then connecting the browser to the server. Often, users will need to ignore the browser security warning. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated. In production environments, this certificate is replaced with a real certificate. There are many ways to change this certificate for a more appropriate certificate in production environments: 
+This is the default certificate used to secure the HTTPS port `443`. It is signed by the root above and is the certificate users will first see then connecting the browser to the server. Often, users will need to ignore the browser security warning. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated. In production environments, this certificate is replaced with a real certificate. 
 
-- You can replace the “webserver-cert-\*” files in the “meshcentral-data” folder. 
-- You can use Let’s Encrypt which will override this certificate automatically. 
-- You can use a reverse-proxy in front of the server with “--tlsoffload". 
+There are many ways to change this certificate for a more appropriate certificate in production environments : 
+
+- You can replace the `webserver-cert-\*` files in the `meshcentral-data` folder.
+
+- You can use Let’s Encrypt which will override this certificate automatically.
+
+- You can use a reverse-proxy in front of the server with `--tlsoffload`. 
 
 #### Agent certificate
 
 `agentserver-cert-public.crt`
 
-This certificate is used to authenticate the server to agents. It’s signed by the root above and when installing an agent, the hash of this certificate is given to the agent so that it can connect back to the server securely. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated. 
+This certificate is used to authenticate the server to agents. It’s signed by the root above and when installing an agent, the hash of this certificate is given to the agent so that it can connect back to the server securely. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated. 
 
-The “meshcentral-data” folder contains critical server information including private keys therefore, it’s important that it be well protected. It’s important to backup the “meshcentral-data” folder and keep the backup in a secure place. If, for example the “agent certificate” on the server is lost, there is no hope for agents ever be able to connect back to this server. All agents will need to be re-installed with a new trusted certificate. 
+The `meshcentral-data` folder contains critical server information including private keys therefore, it’s important that it be well protected. It’s important to backup the `meshcentral-data` folder and keep the backup in a secure place. If, for example the “agent certificate” on the server is lost, there is no hope for agents ever be able to connect back to this server. All agents will need to be re-installed with a new trusted certificate. 
 
-If someone re-installs a server, placing the “meshcentral-data” folder back with these certificates should allow the server to resume normal operations and accept connections for Intel AMT and agents as before. 
+If someone re-installs a server, placing the `meshcentral-data` folder back with these certificates should allow the server to resume normal operations and accept connections for Intel AMT and agents as before. 
 
 ### Agent Certificates
 
 The mesh agent generates one or two RSA certificates when it first starts. On smaller IoT devices such as a Raspberry Pi, this can take a little while to do and the CPU will spike to 100% during this time. This is normal and only occurs the first time the agent runs. 
 
-![](images/2022-05-15-13-41-26.png)
+![](images/2022-05-15-13-41-26.jpg)
 
 The certificates are generated a little differently depending on the platform. On Windows, the Mesh Agent will use Microsoft cryptographic providers to harder the agent root cert. If available, the agent will use the platform TPM to harden the certificate. On other platforms, only one certificate is generated and used for both agent authentication to the server and WebRTC session authentication. 
 
@@ -218,13 +254,13 @@ This certificate is the root trust of the agent. The SHA384 hash of this certifi
 
 This is a certificate signed by the agent root above. It’s currently only used by WebRTC to perform dTLS authentication to a remote browser. This certificate does not need to be signed by a trusted CA for WebRTC purposes since the hash of the certificate will be sent to the browser using a trusted path. If the agent root certificate is not hardened using platform cryptography, the secondary certificate is not created and the agent root cert is used for all purposes. 
 
-A possible attack would occur if someone were to be able to access the agent root certificate. They could impersonate the agent to the server. Agents don’t have any rights to perform management operations on the server or other agents, but by impersonating a agent, a rogue agent would pretend to be an office computer to which administrator would login with their username & password, especially when the root is not hardened. Some care should be taken to protect the “meshagent.db” file and to not give important information to untrusted agents. 
+A possible attack would occur if someone were to be able to access the agent root certificate. They could impersonate the agent to the server. Agents don’t have any rights to perform management operations on the server or other agents, but by impersonating a agent, a rogue agent would pretend to be an office computer to which administrator would login with their username & password, especially when the root is not hardened. Some care should be taken to protect the `meshagent.db` file and to not give important information to untrusted agents. 
 
-## TLS Security
+## 🔒 TLS Security
 
 MeshCentral makes heavy use of Transport Layer Security (TLS) and datagram-TLS (dTLS) to authenticate and encrypt network traffic between the browser, server and agent. Configuring TLS settings correctly is essential to making sure communications are secure and to minimize attacks on open ports. 
 
-Probably the most important TLS configuration is for the MeshCentral server ports 443 and 4433. These two ports are exposed to the Internet and so, should be setup as securely as possible. 
+Probably the most important TLS configuration is for the MeshCentral server ports `443` and `4433`. These two ports are exposed to the Internet and so, should be setup as securely as possible. 
 
 ### MeshCentral HTTPS port 443
 
@@ -241,15 +277,15 @@ TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0xc013)
 
 Note that these cipher suites are all perfect forward secrecy (PFS) suites and are considered cryptographically secure as of the writing of this document. When the server is deployed on the Internet,[ https://ssllabs.com ](https://ssllabs.com/)gives the server an A rating with no known vulnerabilities and no weak ciphers detected. 
 
-![](images/2022-05-15-13-44-41.png)
+![](images/2022-05-15-13-44-41.jpg)
 
 SSL Labs confirms that all major browsers should be able to connect correctly to this server. 
 
 ### MeshCentral MPS port 4433
 
-The Manageability Presence Server (MPS) port 4433 is used for incoming Intel AMT CIRA connections. By default it uses a TLS certificate that is signed by a self-signed root certificates. This port is not intended to be connected to by typical browsers, only Intel AMT should connect to this port. Note that the TLS certificate generated by MeshCentral for port 4433 is RSA 2048bits, this is because older Intel AMT firmware don’t support RSA 3072. Because the port is not secured using a trusted certificate, SSL Labs will not rate the security of this server. 
+The Manageability Presence Server (MPS) port `4433` is used for incoming Intel AMT CIRA connections. By default it uses a TLS certificate that is signed by a self-signed root certificates. This port is not intended to be connected to by typical browsers, only Intel AMT should connect to this port. Note that the TLS certificate generated by MeshCentral for port `4433` is RSA 2048bits, this is because older Intel AMT firmware don’t support RSA 3072. Because the port is not secured using a trusted certificate, SSL Labs will not rate the security of this server. 
 
-![](images/2022-05-15-13-47-26.png)
+![](images/2022-05-15-13-47-26.jpg)
 
 This is fully expected. Note that SSL Labs will not test servers that are not on port 443. To perform a test like this MeshCentral must be set temporarily with the MPS port set to 443 and the normal HTTPS port set to a different value. 
 
@@ -271,9 +307,9 @@ TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x2f)
 
 ```
 
-The suites starting with “TLS\_RSA\_” don’t have perfect forward secrecy (PFS) and so, are considered weak by SSL Labs. However, these are generally the suites that are supported by Intel AMT. 
+The suites starting with `TLS\_RSA\_` don’t have perfect forward secrecy (PFS) and so, are considered weak by SSL Labs. However, these are generally the suites that are supported by Intel AMT. 
 
-## Agent to server handshake
+## 🛰️ Agent to server handshake
 
 One interesting aspect of MeshCentral’s design is how the agent connects to the server. We wanted a way for the agent to connect to the server that would be similar to how browsers connect to web servers. This allows for a large number of agents to connect just like if a large number of browsers where connecting. All of the infrastructure that helps web server’s scale would be put to use in the same way for agent connections. For example: TLS offload hardware, load balancers, reverse-proxies, web server scaling, etc. could all be put to use. It also makes the server easier to setup because only one port (HTTPS 443) is needed for both users and agents. 
 
@@ -283,7 +319,7 @@ The public facing web certificate of the server can change frequently. For examp
 
 To handle all this, the agent performs a TLS connection to the server and will first see the web certificate of the server. It will then exchange a set of web socket binary messages to the server to perform a secondary authentication with the server. 
 
-![](images/2022-05-15-13-54-44.png)
+![](images/2022-05-15-13-54-44.jpg)
 
 The secondary check allows the agent to confirm that this server does own the private key of the private certificate expected by the agent. The agent caches the hash of the “outer” web certificate. When re-connecting, if the agent sees the same outer web certificate, it will skip the secondary check. For obvious security raisons, it’s important that the agent not accept any management messages until the secondary check is completed or skipped. 
 
@@ -291,42 +327,44 @@ To prevent man-in-the-middle attacks, the secondary check also “pins” the ou
 
 The agent connection design allows for reverse-proxies and TLS offload hardware. The agent will first connect a TLS session to the offload hardware. Clear traffic flows between the offload hardware and the server which will perform the secondary check if needed. 
 
-![](images/2022-05-15-13-55-28.png)
+![](images/2022-05-15-13-55-28.jpg)
 
 To makes all this work, the MeshCentral server must be able to fetch the hash of the outer web certificate from the reverse proxy. In this case, the server does not need the private key to the web certificate. Note that when the outer web certificate is updated, the server may have to perform many secondary checks at the same time causing a server slowdown during this time. To help with this, MeshCentral will offload the RSA signing operation to many slave processes (as many as the CPU core count on the server) to speed this up. In addition, native NodeJS RSA signing is used (not ForgeJS). 
 
 The details of the secondary certificate check look like the diagram below. To boost speed, the exchange is fully asynchronous and both sides send the first message as soon as the TLS connection completes. 
 
-![](images/2022-05-15-13-56-09.png)
+![](images/2022-05-15-13-56-09.jpg)
 
 Note that these messages are binary (not JSON). The agent must be able to connect to the server independently of the JavaScript that is running in DukTape. So this exchange is handled by native C code in the agent. Binary message 1 is sent immediately after the TLS connection is setup. Both sides will send binary message 2 when message 1 is received and message 3 when message 2 is received. 
 
 In addition, there are two extra messages of interest that can be sent by the agent right at the start. The agent may send the server message number 4 if the secondary check can be skipped and may send binary message number 5 indicating what server hash it expects to verify. Message number 5 is interesting because a server may have many “identities” at the same time, and so, the server will use message number 5 in order to use the right Agent Server certificate. 
 
-In order to be as secure as possible, all hashes use SHA384 and certificates are RSA3072 and nonces are generated on both sides using a cryptographic random source. The server and agent signatures are computed like this: 
+In order to be as secure as possible, all hashes use SHA384 and certificates are RSA3072 and nonces are generated on both sides using a cryptographic random source.
 
-![](images/2022-05-15-13-56-46.png)
+The server and agent signatures are computed like this : 
+
+![](images/2022-05-15-13-56-46.jpg)
 
 While the server will often skip its RSA signature operation due to the agents caching the outer web certificate, the server must perform an RSA verify to each agent connection. This can’t be skipped but is needed to authenticate the agent. 
 
 Once connected, the trust relationship between the server and the agent is one-way. That is, the server has management rights on the agent, but the agent does not have any right on the server. This is important since the agent does not, by default, have any credentials to the server. Any agent can connect to the server and claim to be part of a device group. 
 
-## Browser to agent relay and WebRTC
+## 🌍 Browser to agent relay and WebRTC
 
 Browsers and agents often need to communicate to each other. Data sessions are used for desktop, terminal, file transfers, etc. and must be setup securely. 
 
 To setup a session between a browser and the agent, the server will send a URL to both sides to connect to. The URL is generated by the server and includes a unique connection token. It is sent to both the browser and agent using the web socket control channel and a JSON message. Both sides perform a websocket connection to the target URL and the server will “pipe” both sessions together to act as a passive relay. For security, the agent will only accept connections to the URL given by the server if the server has the same outer web certificate as its control connection. Also note that in this mode, the session is not end-to-end encrypted. The server is performing a TLS decrypt and re-encrypt and the traffic cost is high as each byte of data has to be received and sent again. 
 
 
-![](images/2022-05-15-13-58-06.png)
+![](images/2022-05-15-13-58-06.jpg)
 
-The relay server is just websocket server that will wait for connections with session tokens. When two connection with the same connection token arrive, the server makes sure that at least one of the two connections is an authenticated user, it then sends the character “c” on both sides to inform both parties that the relay is starting and then pipes both sessions together. Once the session is started, the browser and agent are free to send messages to each other. Note that when the server sends the relay URL to the agent, it also sends to the agent the user’s permissions flags. This may be used by the agent to limit what the user can do on this session. 
+The relay server is just websocket server that will wait for connections with session tokens. When two connection with the same connection token arrive, the server makes sure that at least one of the two connections is an authenticated user, it then sends the character `c` on both sides to inform both parties that the relay is starting and then pipes both sessions together. Once the session is started, the browser and agent are free to send messages to each other. Note that when the server sends the relay URL to the agent, it also sends to the agent the user’s permissions flags. This may be used by the agent to limit what the user can do on this session. 
 
 With this design, the flow control between the browser and agent is simple, each session gets its own end-to-end connection and the server will apply appropriate TCP back pressure on both sides as needed. 
 
 A unique feature of MeshCentral is its use of WebRTC. WebRTC was introduced in major browsers as a way to allow browsers to directly communicate to each other and perform audio/video streaming. The mesh agent has a WebRTC data-only stack that is custom built for this project in C code. It’s compatible with Chrome and Firefox implementations and once a session is set up, allows data to flow directly from the browser to the agent, bypassing the server. 
 
-![](images/2022-05-15-13-58-29.png)
+![](images/2022-05-15-13-58-29.jpg)
 
 The use of WebRTC allows MeshCentral to scale better, to offer a faster user experience and lower hosting costs all at the same time. However, WebRTC is not easy, especially when you must maintain the C code for it and have to keep up with browser implementations, but the benefits are clear. 
 
@@ -334,7 +372,7 @@ To setup WebRTC, browsers typically use STUN and TURN servers to get traffic thr
 
 To perform the switch-over, both browser and agent will exchange WebRTC control messages over the newly established web socket relay session. 
 
-![](images/2022-05-15-13-58-56.png)
+![](images/2022-05-15-13-58-56.jpg)
 
 In order to differentiate session traffic from WebRTC control traffic, the browser and agent agree to send WebRTC setup traffic using web socket text fragments. All other session traffic is sent using binary fragments. The agent has a special API allowing a session to be piped for a single fragment type. So we can perform a remote desktop session to the agent while trying to setup WebRTC at the same time. 
 
@@ -342,32 +380,54 @@ The browser will kick off the WebRTC setup sending the initial WebRTC offer with
 
 On the agent side, the new WebRTC session inherits the user access rights of the web socket. Currently, the web socket channel is still maintained open. While it’s not strickly needed, the web socket session terminates more cleanly than WebRTC and so, oddly its closure is used to signal the end of the WebRTC session. 
 
-## Messenger
+## 💬 Messenger
 
-MeshCentral includes its own messaging web application it can be used to chat, transfer files and optionally used for audio and video chat. It’s used to support two different usages: User-to-user and user-to-computer communication. In the first usage, two users that are connected to the same MeshCentral server at the same time can chat. If you are a MeshCentral administrator, you can see the list of currently logged in users and hit the chat button to launch a chat invitation. If accepted, the Messenger is open on both sides and the session starts. Alternatively, while managing a remote computer, an administrator can hit the chat button to cause the remote computer to open a web browser to the chat application. 
+MeshCentral includes its own messaging web application it can be used to chat, transfer files and optionally used for audio and video chat. It’s used to support two different usages :
+
+  - *User-to-user and*
+
+  - *user-to-computer communication.* 
+  
+  In the first usage, two users that are connected to the same MeshCentral server at the same time can chat. If you are a MeshCentral administrator, you can see the list of currently logged in users and hit the chat button to launch a chat invitation. If accepted, the Messenger is open on both sides and the session starts. Alternatively, while managing a remote computer, an administrator can hit the chat button to cause the remote computer to open a web browser to the chat application. 
 
 
-![](images/2022-05-15-13-59-54.png)
+![](images/2022-05-15-13-59-54.jpg)
 
-The chat app is standalone web application that is served by the MeshCentral server using a connection token and title in the URL. Once loaded in its own web frame, the messenger web application will get the connection token and title from the URL and proceed to connect to the URL using web socket. The same web socket relay that is used for browser-to-agent connections is also used in this case for browser-to-browser connections. The server relay acts the same and pipes both sessions together after sending the character “c” to both sides. At this point, the messenger application will show the remote user as connected and chat and file transfers can start. File transfers are just a set of binary messages sent over the web socket session with lots of JSON control messages. 
+The chat app is standalone web application that is served by the MeshCentral server using a connection token and title in the URL. Once loaded in its own web frame, the messenger web application will get the connection token and title from the URL and proceed to connect to the URL using web socket. The same web socket relay that is used for browser-to-agent connections is also used in this case for browser-to-browser connections. The server relay acts the same and pipes both sessions together after sending the character `c` to both sides. At this point, the messenger application will show the remote user as connected and chat and file transfers can start. File transfers are just a set of binary messages sent over the web socket session with lots of JSON control messages. 
 
 Once the web socket session is setup, the messenger application will then attempt to perform a switch over to WebRTC. Both web application start by selecting a random number (not cryptographic) and the highest number will initiate the WebRTC offer. The other party will answer and both sides will trade interface candidates as they are discovered. If successful, the web socket session are flushed and the traffic is switched over to WebRTC. Because the switchover is done cleanly, it can occur while in the middle of a file transfer without the file being corrupted. 
 
 
-![](images/2022-05-15-14-00-21.png)
+![](images/2022-05-15-14-00-21.jpg)
 
 Finally, the web application will determine if the local computer is attached to a microphone and if it has a camera. If so, these options are offered in the chat window and audio/video chat is available for use. The chat app allows for one way setup of audio & video sessions. This is typically what is needed in support scenarios where the audio/video session is one-way. 
 
 The messenger web application will setup a separate WebRTC connection for audio/video in each direction but the code is present to augment the WebRTC control channel with audio/video which is a bit more efficient but more testing is needed before defaulting to this mode. 
 
-## Additional Resources
+## 💡 Additional Resources
 
-In addition to this document, there are a growing set of MeshCentral resources at: [https://www.meshcommander.com/meshcentral2.](https://www.meshcommander.com/meshcentral2) This includes an Installer’s documents, a User’s Guide and plenty of YouTube tutorial videos. For developers, it’s best to start on the MeshCentral GitHub repository at:[ https://github.com/Ylianst/MeshCentral](https://github.com/Ylianst/MeshCentral). If any issues are found, it’s best to create a new issue in GitHub or mail [ylianst@gmail.com](mailto:ylianst@gmail.com)
+In addition to this document, there are a growing set of MeshCentral resources at :
 
-## Conclusion
+  - **[https://www.meshcommander.com/meshcentral2.](https://www.meshcommander.com/meshcentral2)** :
+
+    This includes an Installer’s documents, a User’s Guide and plenty of YouTube tutorial videos.
+
+For developers, it’s best to start on the MeshCentral GitHub repository at :
+
+  - **[ https://github.com/Ylianst/MeshCentral](https://github.com/Ylianst/MeshCentral)**
+
+If any issues are found, it’s best to create a new issue in GitHub or mail [ylianst@gmail.com](mailto:ylianst@gmail.com)
+
+## 🏁 Conclusion
 
 MeshCentral is a free, open source and powerful remote management solution that is cross- platform. In this document, we have covered the goals, overview, design and some details of the software. It’s hoped that this document will encourage developers to take a look at MeshCentral for more usages and review its security in detail. MeshCentral’s use of modern web technologies make it a unique and amazing solution for remote management of computers. As with any good software, MeshCentral will continue to be updated and evolve. 
 
 ## License
 
 MeshCentral and this document are both opens source and licensed using Apache 2.0, the full license can be found at [https://www.apache.org/licenses/LICENSE-2.0](https://www.apache.org/licenses/LICENSE-2.0)
+
+## PDF and ODT handout(s).
+
+[MeshCentral Guide](https://meshcentral.com/docs/MeshCentral2UserGuide.pdf)
+
+MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral User's Guide v0.2.9.odt?raw=true)

docs/docs/how-to-contribute/index.md

@@ -1,56 +1,99 @@
-# Contribute to MeshCentral 
+# Contribute to MeshCentral
 
-## Contributing to MeshCentral via GitHub Pull Request
+---
+## 📤 Contributing to MeshCentral via GitHub Pull Request
 
-If you're looking to contribute beyond translations, such as updating documentation or enhancing the software by adding features or fixing bugs, the process involves several key steps:
+If you're looking to contribute beyond translations, such as updating documentation or enhancing the software by adding features or fixing bugs, the process involves several key steps :
 
-1. **Fork the Repository:** Start by forking the [MeshCentral](https://github.com/Ylianst/MeshCentral) repository on GitHub. This creates a copy of the repository under your own GitHub account, allowing you to make changes without affecting the original project.
+1. **Fork the Repository :**
+
+    > Start by forking the [MeshCentral](https://github.com/Ylianst/MeshCentral) repository on GitHub.
+    
+    > This creates a copy of the repository under your own GitHub account, allowing you to make changes without affecting the original project.
 
 2. **Make Your Changes**
-    - In your forked repository, create a new branch to keep your changes organized. This helps in managing different contributions separately.
-    - Make the necessary changes in your repository. This could involve updating documentation files or modifying code to add new features or fix bugs.
 
-3. **Review Your Changes:** Before submitting your work, carefully review the changes you’ve made. Check the "Files Changed" section on GitHub to ensure that all modifications are intended and correctly implemented.
+    > - In your forked repository, create a new branch to keep your changes organized. This helps in managing different contributions separately.
+
+    > - Make the necessary changes in your repository. This could involve updating documentation files or modifying code to add new features or fix bugs.
+
+3. **Review Your Changes :**
+
+    > Before submitting your work, carefully review the changes you’ve made. Check the "Files Changed" section on GitHub to ensure that all modifications are intended and correctly implemented.
 
 4. **Submit a Pull Request**
-    - Once your changes are ready and reviewed, submit a pull request (PR) from your branch to the `master` branch of the main MeshCentral repository.
-    - When creating the pull request, provide a clear and detailed description of what changes have been made and why. This helps maintainers understand the purpose of your contributions.
 
-5. **Wait for Review:** After submitting your pull request, wait for a project maintainer to review your contribution. Review time can vary depending on the complexity of the changes and the availability of the maintainers.
+    > - Once your changes are ready and reviewed, submit a pull request (PR) from your branch to the `master` branch of the main MeshCentral repository.
+    > - When creating the pull request, provide a clear and detailed description of what changes have been made and why. This helps maintainers understand the purpose of your contributions.
 
-6. **Respond to Feedback:** The maintainer may request further modifications or provide feedback on your pull request. Be prepared to make additional changes based on their suggestions to ensure that your contribution meets the project’s standards and requirements.
+5. **Wait for Review :**
 
-7. **Final Steps:** Once your pull request is approved and merged by a maintainer, your contributions will be incorporated into the MeshCentral project. Congratulations, and thank you for helping improve MeshCentral! 
+    > After submitting your pull request, wait for a project maintainer to review your contribution. Review time can vary depending on the complexity of the changes and the availability of the maintainers.
+
+6. **Respond to Feedback :**
+
+    > The maintainer may request further modifications or provide feedback on your pull request. Be prepared to make additional changes based on their suggestions to ensure that your contribution meets the project’s standards and requirements.
+
+7. **Final Steps :**
+
+    > Once your pull request is approved and merged by a maintainer, your contributions will be incorporated into the MeshCentral project. Congratulations, and thank you for helping improve MeshCentral!
 
 ---
 
-## Contribute to MeshCentral's Multilingual Support
+## 🗣️ Contribute to MeshCentral's Multilingual Support
 
 To make MeshCentral multilingual, your contributions are crucial. Follow these steps to translate the interface into various languages.
 
-1. **Remove Local Translations:** Delete `translate.json` from your `meshcentral-data` folder. This file contains your local copy of translations, which may become outdated as new features and texts are added.
+1. **Remove Local Translations :**
 
-2. **Access MeshCentral:** Ensure you are logged into MeshCentral.
-3. **Open Translation Tool:** Visit `https://YOURMESHCENTRALSERVER.COM/translator.htm` to access the translation interface.
-4. **Choose a Language:** Select the language you wish to translate from the list provided.
+    > Delete `translate.json` from your `meshcentral-data` folder. This file contains your local copy of translations, which may become outdated as new features and texts are added.
 
-5. **Translate Text:** Use the search function or scroll through the list to find text segments you want to translate. Utilize the "show no translations only" checkbox to filter untranslated texts.
-6. **Enter Translations:** For each text segment, enter your translation in the bottom box (not the top one) and click `SET (F1)`.
-7. **Repeat Translation:** Continue translating by repeating steps 5 and 6 for other texts as desired.
+2. **Access MeshCentral :**
+
+    > Ensure you are logged into MeshCentral.
+
+3. **Open Translation Tool:**
+
+    > Visit `https://YOURMESHCENTRALSERVER.COM/translator.htm` to access the translation interface.
+
+4. **Choose a Language :**
+
+    > Select the language you wish to translate from the list provided.
+
+5. **Translate Text :**
+
+    > Use the search function or scroll through the list to find text segments you want to translate. Utilize the "show no translations only" checkbox to filter untranslated texts.
+
+6. **Enter Translations :**
+
+    > For each text segment, enter your translation in the bottom box (not the top one) and click `SET (F1)`.
+
+7. **Repeat Translation :** Continue translating by repeating steps 5 and 6 for other texts as desired.
 
 8. **Save and Apply Translations**
-    - Click `SAVE TO SERVER (F3)` to save your translations to `meshcentral-data/translate.json` locally in your MeshCentral server.
-    - Optionally, click `SAVE TO FILE (F4)` to download the `translate.json` file for offline review or sharing.
 
-9. **Deploy Translations:** Click `TRANSLATE SERVER` and allow some time for the process to complete (approximately 5-15 minutes depending on server specifications). This command line output will indicate when the translation is complete.  
-![](images/translation-msg-output.png)
+    > - Click `SAVE TO SERVER (F3)` to save your translations to `meshcentral-data/translate.json` locally in your MeshCentral server.
+    > - Optionally, click `SAVE TO FILE (F4)` to download the `translate.json` file for offline review or sharing.
 
-10. **Finalize Changes:** It’s crucial to restart MeshCentral to ensure that the translated files are picked up correctly.
-11. **Share your translations:** Once a language translation is complete, take the latest `translation.json` and share it by emailing it to the maintainer (Ylianst, `ylianst@gmail.com`) or by submitting it to the MeshCentral GitHub repository via a pull request.
+9. **Deploy Translations :**
+
+    > Click `TRANSLATE SERVER` and allow some time for the process to complete (approximately 5-15 minutes depending on server specifications). This command line output will indicate when the translation is complete.
+
+    > ![](images/translation-msg-output.png)
+
+10. **Finalize Changes :**
+
+    > It’s crucial to restart MeshCentral to ensure that the translated files are picked up correctly.
+
+11. **Share your translations :**
+
+    > Once a language translation is complete, take the latest `translation.json` and share it by emailing it to the maintainer (Ylianst, `ylianst@gmail.com`) or by submitting it to the MeshCentral GitHub repository via a pull request.
 
 ---
 
-#### Additional Information:
-  - If you make any changes to `default.handlebars`, run the translate server to propagate these modifications to the language-specific handlebar files located in `node_modules/meshcentral/views/translations`.
+!!! note
+    Additional Information :
+    
+    If you make any changes to `default.handlebars`, run the translate server to propagate these modifications to the language-specific handlebar files located in `node_modules/meshcentral/views/translations`.
 
 By following these steps, you help MeshCentral support any language you choose, making it more accessible worldwide. By sharing your translations with us, you also help make these languages available to other users, improving the community and extending the software's reach.

docs/docs/index.md

@@ -4,60 +4,68 @@
 
 MeshCentral is a full computer management web site. With MeshCentral, you can run your own web server to remotely manage and control computers on a local network or anywhere on the internet. Once you get the server started, create device group and download and install an agent on each computer you want to manage. A minute later, the new computer will show up on the web site and you can take control of it. MeshCentral includes full web-based remote desktop, terminal and file management capability.
 
-For more information, [visit MeshCentral.com](https://www.meshcentral.com/).
+For more information, [visit MeshCentral.com](https://meshcentral.com).
 
-## Social Media
+## 🌐 Social Media
 
-[YouTube](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos)
+  ![YouTube](https://img.icons8.com/color/16/youtube-play.png) [YouTube](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos)  
+  ![Reddit](https://img.icons8.com/color/16/reddit.png) [Reddit](https://www.reddit.com/r/MeshCentral/)  
+  ![Telegram](https://img.icons8.com/color/16/telegram-app.png) [Telegram](https://t.me/meshcentral)  
+  ![Discord](https://img.icons8.com/color/16/discord-logo.png) [Discord](https://discord.gg/wF9UT3Vjdj)  
+  ![BlueSky](https://img.icons8.com/color/16/internet--v1.png) [BlueSky](https://bsky.app/profile/meshcentral.bsky.social)  
+  ![BlogSpot](https://img.icons8.com/color/16/blogger.png) [BlogSpot](https://meshcentral2.blogspot.com/)  
 
-[Reddit](https://www.reddit.com/r/MeshCentral/)
+## 📚 Documentation
 
-[BlueSky](https://bsky.app/profile/meshcentral.bsky.social)
+The [User's Guide](meshcentral/index.md) contains information every administrator should know including usage, the server configuration file, databases, TLS offloading, Lets Encrypt, IP Filtering, Email setup, embedding, server port aliasing, reverse proxy setup, multi factor authentication, branding & terms of use, HashiCorp Vault support, and SSO.
 
-[BlogSpot](https://meshcentral2.blogspot.com/)
+The [Installation Guide](install/install.md) has detailed instructions for installing the MeshCentral Server on Windows 8.1, Windows 10, Windows 2012 R2, Amazon Linux 2, Raspberry Pi, Microsoft Azure, Google Cloud, Ubuntu 18, Ubuntu 16 and OpenBSD.
 
-## Documentation
+The [Design and Architecture Guide](design/index.md) is a short document that includes information on the design overview, dependencies, source code descriptions of each file, certificates, TLS security, the agent to server handshake, browser to agent relay and WebRTC and the messenger service.
 
-The [User's Guide](meshcentral) contains information every administrator should know including usage, the server configuration file, databases, TLS offloading, Lets Encrypt, IP Filtering, Email setup, embedding, server port aliasing, reverse proxy setup, multi factor authentication, branding & terms of use, HashiCorp Vault support, and SSO.
+## 📺 Video Tutorials
 
-The [Installation Guide](install/install2.md) has detailed instructions for installing the MeshCentral Server on Windows 8.1, Windows 10, Windows 2012 R2, Amazon Linux 2, Raspberry Pi, Microsoft Azure, Google Cloud, Ubuntu 18, Ubuntu 16 and OpenBSD.
+You can watch many tutorial videos on the [MeshCentral YouTube Channel](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos). Here are some essential ones to get you started :
 
-The [Design and Architecture Guide](design) is a short document that includes information on the design overview, dependencies, source code descriptions of each file, certificates, TLS security, the agent to server handshake, browser to agent relay and WebRTC and the messenger service.
+**[MeshCentral - Installation](https://www.youtube.com/results?search_query=MeshCentral+Installation)**  
+Installing MeshCentral on **Windows**, **Linux**, and **macOS**.
 
-## Video Tutorials
 
-You can watch many tutorial videos on the [MeshCentral YouTube Channel](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos). Two videos to get started involve installation and basic usages.
+**[MeshCentral - Basics](https://www.youtube.com/results?search_query=MeshCentral+Basics)**  
+Learn how to install the agent and use remote **desktop**, **terminal**, and **file access** features.
 
-Installing MeshCentral on Windows, Linux and macOS.
-[MeshCentral - Installation](https://www.youtube.com/watch?v=GsQbWZmRRAU)
 
-Basic Usages including installing the agent and remote desktop, terminal and file access.
-[MeshCentral - Basics](https://www.youtube.com/watch?v=D9Q7M7PdTg0)
+**[MeshCentral - Two Factor Authentication](https://www.youtube.com/results?search_query=MeshCentral+Two+Factor+Authentication)**  
+Secure your MeshCentral instance with **two-factor authentication**.
 
-MeshCentral support for two-factor authentication.
-[MeshCentral - Two Factor Authentication](https://www.youtube.com/watch?v=luLZKcma9l0)
 
-How to setup MeshCentral with the NGINX reverse proxy.
-[MeshCentral - NGINX Reverse Proxy](https://www.youtube.com/watch?v=YSmiLyKSX2I)
+**[MeshCentral - NGINX Reverse Proxy](https://www.youtube.com/results?search_query=MeshCentral+NGINX+Reverse+Proxy)**  
+Configure MeshCentral with an **NGINX reverse proxy** for better security and scalability.
 
-Installing and using the MeshCentral Android agent.
-[MeshCentral - Android](https://www.youtube.com/watch?v=wi1HYdW00Bk)
 
-Using MeshCentral Router to port map TCP connections.
-[MeshCentral - Basics](https://www.youtube.com/watch?v=BubeVRmbCRM)
+**[MeshCentral - Android](https://www.youtube.com/results?search_query=MeshCentral+Android)**  
+Install and use the **MeshCentral Android agent** for mobile device management.
 
-## Feedback
 
-If you encounter a problem or have a suggestion to improve the product, you may file an [issue report](https://github.com/Ylianst/MeshCentral/issues/)
+**[MeshCentral - Basics](https://www.youtube.com/results?search_query=MeshCentral+Router+Port+Mapping)**  
+Use **MeshCentral Router** to **port map TCP connections** securely.
 
+
+## 💬 Feedback
+
+If you encounter a problem or have a suggestion to improve the product, you may file an [GitHub Issue](https://github.com/Ylianst/MeshCentral/issues/).<br>
 If you are filing a problem report, you should include:
 
-* The version of the software you are using
-* The Operating System and version
-* The observed output
-* The expected output
-* Any troubleshooting you took to resolve the issue yourself
-* Any other similar reports~~
+* The version of the software you are using.
+> For example: 1.1.46
+* The Operating System and version.
+> For example: Debian 12
+* Any troubleshooting you took to resolve the issue yourself.
+> For example: Reinstalling MeshCentral (including OS)
+* Any other similar reports.
+> For example: other GitHub issues.
+* The observed output.
+* The expected output.
 
 If you are having issues with the following other products, you should file a report on their respective issue pages
 [MeshAgent](https://github.com/Ylianst/MeshAgent/issues)

docs/docs/install/abstract.md

@@ -0,0 +1,16 @@
+# Installation
+
+## 🧾 Abstract
+
+These guides are specifically intended to help users install and configure MeshCentral.<br>
+Once installed, you can take a look at the MeshCentral user’s guide,<br>
+for information on how to configure MeshCentral for your specific use.<br>
+In this document, we will look at installing MeshCentral on different operating systems like:
+
+And remember! The `config.json` is case insensitive in its keys.
+
+ - 📢 **[Quick-start](./quickstart.md)**
+
+ - 🧐 **[Advanced Information](./advanced.md)**
+
+ - 🪟 **[Windows-specific](./windows.md)**

docs/docs/install/advanced.md

@@ -0,0 +1,91 @@
+# 📦 NPM Installation for Advanced Users
+
+![](images/2022-05-16-23-47-36.jpg)
+
+## Prerequisites and Verification
+
+Before beginning the installation, ensure **Node.js** and **NPM** (Node Package Manager) are installed on your host operating system.
+
+If your server is behind an HTTP/HTTPS proxy, you may need to configure NPM's proxy settings.
+
+### 1\. Verify Node.js and NPM
+
+Open your command-line terminal (CMD/PowerShell on Windows, or Shell on Linux) and run the following commands to check the installed versions:
+
+  * **Node.js:**
+    ```shell
+    node -v
+    ```
+  * **NPM:**
+    ```shell
+    npm -v
+    ```
+
+-----
+
+### 2\. Configure Proxy Settings (If Applicable)
+
+If your server requires a proxy to access the internet, you must set the proxy configurations for NPM. **Skip this step if not needed.**
+
+```shell
+# Set HTTP proxy
+npm config set proxy http://proxy.com:88
+# Set HTTPS proxy
+npm config set https-proxy http://proxy.com:88
+```
+
+-----
+
+## MeshCentral Installation
+
+### 3\. Install MeshCentral
+
+Create a dedicated directory for the installation, change into it, and use NPM to install the MeshCentral package.
+
+**Recommendation:** On Linux, use the `/opt` directory.
+
+> ⚠️ **Important:** Do not use `sudo` when executing the `npm install meshcentral` command.
+
+```shell
+# Create the directory
+mkdir -p /opt/meshcentral
+# Move into the directory
+cd /opt/meshcentral
+# Install MeshCentral
+npm install meshcentral
+```
+
+-----
+
+### 4\. Start the Server
+
+Once the download is complete, start the MeshCentral server.
+
+> ⚠️ **Crucial:** **Do not** `cd` into the `node_modules/meshcentral` directory to run the server. Running it from the directory **above** `node_modules` is required for features like auto-install and self-update to function correctly.
+
+```shell
+node node_modules/meshcentral [arguments]
+```
+
+> **LAN-Only Mode:** If you run the command without arguments, MeshCentral will default to **LAN-only mode**, meaning you can only manage computers on the local network.
+
+-----
+
+### 5\. Configure for WAN/Internet Access (Optional)
+
+To manage computers over the internet (**WAN** or **Hybrid Mode**), your server needs a **static IP** or a **DNS record** that resolves to its public address. This is how remote mesh agents "call home."
+
+While command-line parameters exist, it's **highly recommended to use a configuration file** for persistent settings.
+
+Here are examples of starting the server and generating initial certificates for a public address:
+
+```shell
+# Using a domain name
+node node_modules/meshcentral --cert servername.domain.com
+# Using an IP address
+node node_modules/meshcentral --cert 1.2.3.4
+```
+
+> **Note:** The first time you run in WAN or Hybrid Mode, MeshCentral will generate necessary **certificates**, which may take a few minutes.
+
+Once running, immediately create your **admin account** by navigating to `https://127.0.0.1` (or your public hostname) in a web browser.

docs/docs/install/container.md

@@ -0,0 +1,109 @@
+# 🐳 Container (OCI-specification).
+
+[Open Container Initiative](https://opencontainers.org/)
+
+The following section explains possible ways to install MeshCentral locally with the use of Docker or Podman.
+For the syntax, docker will be used as default. This is done because podman also supports this syntax.<br>
+
+🔗 References:
+
+- [Docker](https://www.docker.com/)  
+- [Podman](https://podman.io/)
+
+!!!warning
+    Do not use the built-in MeshCentral update functionality (when using containers).<br>
+    Update the container the 'docker way', by updating the image itself.
+
+### 🏷️ Basic Tags:
+
+| Tag-name | Explanation |
+|--------|-----|
+| `master` | This tag belongs to the image which is built on every new commit to the main branch, therefor it has the latest code. |
+| `latest` | This tag takes the latest released version of MeshCentral.  |
+| `1.1.51` | You can also specify the specific MeshCentral release with its tag, for example:  `ghcr.io/ylianst/meshcentral:1.1.43` |
+
+### All Tags
+
+All master tags below follow the master branch of MeshCentral, the latest and version numbered versions follow the releases.
+
+| Tag-name | Explanation |
+| -------- | ----------- |
+| `master-slim` | Docker image with no database packages present, which makes it the most lean. Uses NeDB. |
+| `master-mongodb` | Docker image with the MongoDB packages installed. |
+| `master-postgresql` | Docker image with the PostgreSQL packages installed |
+| `master-mysql` | Docker image with the MySQL packages installed |
+| `1.1.51-slim` and `latest-slim` | Docker image with no database packages present, which makes it the most lean. Uses NeDB. |
+| `1.1.51-mongodb` and `latest-mongodb` | Docker image with the MongoDB packages installed. |
+| `1.1.51-postgresql` and `latest-postgresql` | Docker image with the PostgreSQL packages installed. |
+| `1.1.51-mysql` and `latest-mysql` | Docker image with the MySQL packages installed. |
+
+---
+> **📌 Note:**
+Refer to [this page](https://github.com/Ylianst/MeshCentral/pkgs/container/meshcentral) for more information on the container status.
+---
+
+## 🐋 Docker/Podman
+
+For single-machine setups such as Docker and Podman.
+
+### Pulling the image:
+
+To pull the container image use the following container registry.
+
+```sh
+docker pull ghcr.io/ylianst/meshcentral:latest
+```
+
+### Docker CLI:
+
+If you want to run the container from the Terminal, you can use the following command:
+
+```sh linenums="1"
+docker run -d \
+  --name meshcentral \
+  --restart unless-stopped \
+  -p 80:80 \
+  -p 443:443 \
+  -v data:/opt/meshcentral/meshcentral-data \
+  -v user_files:/opt/meshcentral/meshcentral-files \
+  -v backup:/opt/meshcentral/meshcentral-backups \
+  -v web:/opt/meshcentral/meshcentral-web \
+  ghcr.io/ylianst/meshcentral:latest
+```
+
+### Docker Compose:
+
+If you want to use a docker compose yaml file, please refer to the example below.
+
+```yaml linenums="1"
+services:
+  meshcentral:
+    image: ghcr.io/ylianst/meshcentral:latest
+    environment:
+      - DYNAMIC_CONFIG=false # Show the option but disable it by default, for safety.
+    volumes:
+      - meshcentral-data:/opt/meshcentral/meshcentral-data
+      - meshcentral-files:/opt/meshcentral/meshcentral-files
+      - meshcentral-web:/opt/meshcentral/meshcentral-web
+      - meshcentral-backups:/opt/meshcentral/meshcentral-backups
+    ports:
+      - "80:80"
+      - "443:443"
+volumes:
+  meshcentral-data:
+  meshcentral-files:
+  meshcentral-web:
+  meshcentral-backups:
+```
+
+Refer to [the Dockerfile](https://github.com/Ylianst/MeshCentral/blob/5032755c2971955161105922e723461385a6c874/docker/Dockerfile#L70-L123) for its environment variables.
+
+## ☸️ Kubernetes
+
+###
+
+> Using YAML deployment files.
+
+## 📚 Extra sources
+
+> [Github Docker Resources](https://github.com/Ylianst/MeshCentral/tree/master/docker)

docs/docs/install/database/local.md

@@ -0,0 +1,52 @@
+# This section will go into how to configure a local database as backend.
+
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
+
+By default MeshCentral uses NeDB so therefor to change that to another database type, do the following:
+
+---
+
+### MeshCentral Cheatsheet:
+
+Sqlite3:
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "sqlite3": {
+        "name": "meshcentral-db"
+    }
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```
+
+Acebase:
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "acebase": {
+        "sponsor": false
+    }
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```

docs/docs/install/database/mariadb.md

@@ -0,0 +1,84 @@
+# This section will go into how to configure MySQL/MariaDB as a database backend.
+
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
+
+---
+
+### MeshCentral Cheatsheet:
+
+Database specific:
+
+MariaDB:
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "mariaDB": {
+        "host": "my-mariadb-hostname",
+        "port": "3306",
+        "user": "my-mariadb-user",
+        "password": "my-mariadb-password",
+        "database": "meshcentral-database"
+    }
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```
+
+Mysql:
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "mySQL": {
+        "host": "my-mysql-hostname",
+        "port": "3306",
+        "user": "my-mysql-user",
+        "password": "my-mysql-password",
+        "database": "meshcentral-database"
+    }
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```
+
+### MariaDB/MySQL Cheatsheet:
+
+```bash
+mariadb -u root -p
+```
+or
+```bash
+mysql -u root -p
+```
+
+```sql
+-- Create the database
+CREATE DATABASE meshcentral;
+
+-- Create the user (restricting login to localhost)
+CREATE USER 'meshcentral'@'localhost' IDENTIFIED BY 'my-very-secure-password';
+
+-- Grant privileges
+GRANT ALL PRIVILEGES ON meshcentral.* TO 'meshcentral'@'localhost';
+
+-- Apply changes
+FLUSH PRIVILEGES;
+```

docs/docs/install/database/mongodb.md

@@ -0,0 +1,28 @@
+# This section will go into how to configure MongoDB as a database backend.
+
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
+
+---
+
+### MeshCentral Cheatsheet:
+
+MongoDB is configured using the MongoDB connection string.
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "mongoDb": "mongodb://localhost:27017/meshcentral"
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```

docs/docs/install/database/postgresql.md

@@ -0,0 +1,57 @@
+# This section will go into how to configure PostgreSQL as a database backend.
+
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
+
+---
+
+### MeshCentral Cheatsheet:
+
+The postgres installation inside `settings` is rather straightforward if you are familiar with it on MeshCentral its side.
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
+  "__comment__": "Omitted these keys to focus on the database",
+  "settings": {
+    "postgres": {
+        "host": "my-postgresql-hostname",
+        "port": "5432",
+        "user": "my-postgresql-user",
+        "password": "my-postgresql-password",
+        "database": "meshcentral-database"
+    }
+  },
+  "domains": {
+    "": {
+      "__comment__": "Omitted these keys to focus on the database",
+    }
+  },
+  "_letsencrypt": {
+    "__comment__": "Omitted these keys to focus on the database",
+  }
+}
+```
+
+> More options are available if needed. Refer to the schema above.
+
+### Postgres Cheatsheet
+
+```bash
+# Log into the server
+psql -U postgres
+```
+
+```sql
+
+-- Create the database user
+postgres=# CREATE USER meshcentral WITH PASSWORD 'your-very-strong-password';
+CREATE ROLE
+
+-- Create the database and set the above user as owner
+postgres=# CREATE DATABASE meshcentral OWNER meshcentral;
+CREATE DATABASE
+
+-- Exit the database
+postgres=# exit
+```