Services

VPS agent

Agent AutoIt chạy trên mỗi VPS MT5: gửi heartbeat (CPU / RAM / Disk / Net, danh sách login MT5) về fxconsole, nhận lệnh deploy / gỡ / nâng cấp tài khoản và tự nâng cấp chính nó. Trang này hướng dẫn cài đặt, cấu hình, luồng heartbeat và lệnh, gói deploy và xử lý sự cố. The AutoIt agent on every MT5 VPS: it pushes heartbeats (CPU / RAM / Disk / Net, MT5 login list) to fxconsole, receives deploy / remove / upgrade commands for accounts, and upgrades itself. This page covers install, configuration, the heartbeat and command flows, deploy packages and troubleshooting.

• Cập nhậtUpdated 18/09/2026
• NguồnSource monitor/vps-agent/README.html
• monitor/vps-agent/HeartbeatAgent.au3 · CmdAgent.au3 · prepare-vm.ps1 · upgrade.ps1
• monitor/vps-agent/DEPLOYMENT_GUIDE.html · DEPLOY/README.txt

Tổng quan nhanhAt a glance

Kiến trúcArchitecture

flowchart LR
  subgraph VPS["Windows VPS (AutoLogon session)"]
    HB["HeartbeatAgent.exe"]
    CA["CmdAgent.exe"]
    ST["stunnel.exe 127.0.0.1:9605"]
    VNC["TightVNC :5900"]
    MT["MT5 terminals in C:\fxconsole-mt5 (one folder per login)"]
  end
  subgraph HOST["Docker host"]
    VB["VpsStreamBroker :9605"]
    APP["fxconsole app (HTTPS)"]
    RED[("Redis")]
    MY[("MySQL vpses / vps_commands")]
    GD["guacd"]
  end
  HB -- "spawn + supervise" --> CA
  HB -- "IPC NDJSON 127.0.0.1:9606" --- CA
  HB -- "plain TCP" --> ST
  ST -- "TLS" --> VB
  HB -. "HTTPS fallback /api/vps/heartbeat" .-> APP
  CA -- "HTTPS payload + package download" --> APP
  CA -- "launch / GUI automation" --> MT
  VB --> RED
  VB --> MY
  APP --> MY
  GD -- "VNC" --> VNC

Luồng heartbeatHeartbeat flow

sequenceDiagram
  participant HB as HeartbeatAgent
  participant ST as stunnel (local 9605)
  participant VB as VpsStreamBroker
  participant DB as Redis + MySQL
  participant UI as Trình duyệt admin
  participant WEB as fxconsole HTTPS
  HB->>ST: TCP loopback
  ST->>VB: TLS (verify=2, CAfile broker-ca.cert)
  HB->>VB: hello (secret_key, agent_v)
  VB->>DB: tìm vps_id theo secret_key
  VB-->>HB: hello_ok (vps_id)
  UI->>VB: admin mở /vps (WebSocket live)
  VB-->>HB: stream_on
  loop mỗi heartbeat_interval
    HB->>VB: hb (cpu, ram, disk, net, accts, logins)
    VB->>DB: cập nhật trạng thái + account_logins
    VB-->>HB: hb_ok (interval chuẩn)
  end
  VB-->>HB: stream_off (tab admin cuối đóng)
  Note over HB: chỉ gửi hb_min, bỏ qua WMI
  VB-->>HB: ping mỗi 30 s
  HB->>VB: pong
  alt broker không khoẻ (HELLO lỗi hoặc 60 s không có frame)
    HB->>WEB: POST /api/vps/heartbeat + X-Vps-Secret (full + command_acks)
    WEB-->>HB: 200 (status, heartbeat_interval, commands)
  end

sequenceDiagram
  participant HB as HeartbeatAgent
  participant ST as stunnel (local 9605)
  participant VB as VpsStreamBroker
  participant DB as Redis + MySQL
  participant UI as Admin browser
  participant WEB as fxconsole HTTPS
  HB->>ST: TCP loopback
  ST->>VB: TLS (verify=2, CAfile broker-ca.cert)
  HB->>VB: hello (secret_key, agent_v)
  VB->>DB: resolve vps_id from secret_key
  VB-->>HB: hello_ok (vps_id)
  UI->>VB: admin opens /vps (live WebSocket)
  VB-->>HB: stream_on
  loop every heartbeat_interval
    HB->>VB: hb (cpu, ram, disk, net, accts, logins)
    VB->>DB: update state + account_logins
    VB-->>HB: hb_ok (canonical interval)
  end
  VB-->>HB: stream_off (last admin tab closed)
  Note over HB: sends hb_min only, skips WMI
  VB-->>HB: ping every 30 s
  HB->>VB: pong
  alt broker unhealthy (HELLO failed or no frame for 60 s)
    HB->>WEB: POST /api/vps/heartbeat + X-Vps-Secret (full + command_acks)
    WEB-->>HB: 200 (status, heartbeat_interval, commands)
  end

Mô hình trạng tháiStatus model

lost  ⇔  now − last_heartbeat_at > heartbeat_interval × staleness_multiplier

Phát hiện và liên kết tài khoảnAccount discovery & linkage

Pipeline mỗi heartbeatPer-heartbeat pipeline

1. WMI: SELECT ProcessId, CommandLine FROM Win32_Process WHERE Name='terminal64.exe', giữ các PID có /portable trong CommandLine.WMI: SELECT ProcessId, CommandLine FROM Win32_Process WHERE Name='terminal64.exe', keep PIDs whose CommandLine contains /portable.
2. WinList() lấy mọi cửa sổ top-level; với mỗi cửa sổ, hWnd → PID bằng WinGetProcess; nếu PID thuộc tập portable thì lấy dãy chữ số đầu tiêu đề (login MT5).WinList() lists every top-level window; for each, hWnd → PID via WinGetProcess; if the PID is in the portable set, take the leading digit run of the title (the MT5 login).
3. Khử trùng lặp rồi gửi trong heartbeat.Dedupe, then send in the heartbeat.
4. Server kiểm tra (mảng, ≤1000 phần tử, mỗi phần tử ≤32 ký tự) và ghi đè (không merge) cột JSON vpses.account_logins: ảnh chụp của đúng heartbeat này.The server validates (array, ≤1000 entries, each ≤32 chars) and overwrites (not merges) the JSON column vpses.account_logins: a snapshot of this heartbeat only.
5. Khi mở /vps/{id}, VpsController::show tra từng login: admin dùng AccountStatusStore::findAny($login), người thường dùng ::findForSecretKey($userSecret, $login), rồi hiển thị account_id, name, server, balance, equity, profit, badge.On /vps/{id}, VpsController::show looks up each login: admins via AccountStatusStore::findAny($login), others via ::findForSecretKey($userSecret, $login), then renders account_id, name, server, balance, equity, profit and the status badge.

Quy tắc đọc tiêu đề cửa sổWindow-title parsing rules

Ai thấy gì trên /vps/{id}Visibility on /vps/{id}

Trường hợp biênEdge cases

Quy trình admin trên webAdmin workflow (web)

1. Đăng nhập fxconsole bằng tài khoản admin; sidebar → VPS (biểu tượng Server).Log in to fxconsole as an admin; sidebar → VPS (the Server icon).
2. Bấm Add VPS, đặt tên (ví dụ vps-tokyo-01), tuỳ chọn Max accounts (0 = không giới hạn). Với zero-touch, nhập thêm MAC address và heartbeat interval.Click Add VPS, give it a name (e.g. vps-tokyo-01), optionally set Max accounts (0 = unlimited). For zero-touch, also enter the MAC address and heartbeat interval.
3. Dòng mới có trạng thái pending. Bấm biểu tượng mắt để hiện secret 64 ký tự tự sinh và copy.The row appears as pending. Click the eye icon to reveal the auto-generated 64-char secret and copy it.
4. Dán secret vào vps-agent.ini trên VPS (xem phần cài đặt).Paste the secret into the VPS's vps-agent.ini (see install).
5. Ở heartbeat đầu tiên dòng chuyển sang running, các cột có số liệu, cột Last heartbeat đếm giây.On the first heartbeat the row flips to running, columns fill with live numbers, and Last heartbeat shows seconds.

Cài agent (từng VPS)Agent install (per VPS)

Yêu cầuRequirements

File cần có trong C:\VpsAgent\Files in C:\VpsAgent\

Các bướcSteps

1. Compile HeartbeatAgent.au3 + CmdAgent.au3 ở chế độ GUI (xem Compile), hoặc dùng gói setup.Compile HeartbeatAgent.au3 + CmdAgent.au3 in GUI mode (see Compiling), or use the setup package.
2. Copy các file trên vào C:\VpsAgent\.Copy the files above into C:\VpsAgent\.
3. Chỉ với Windows cài mới, lần đầu cho mỗi image, chạy bằng Administrator rồi snapshot VM (mọi bản clone thừa hưởng chỉnh registry và bỏ qua bước này):Fresh Windows only, first time per OS image, run as Administrator, then snapshot the VM (every clone inherits the registry tweaks and skips this step):

   cd C:\VpsAgent
   powershell -ExecutionPolicy Bypass -File .\bootstrap-fresh-vm.ps1

4. Chạy script cài chính bằng Administrator (sau bước 3 không cần cờ -ExecutionPolicy):Run the main installer as Administrator (no -ExecutionPolicy flag needed after step 3):

   cd C:\VpsAgent
   .\prepare-vm.ps1

   Script lo chuẩn bị AutoLogon, gỡ MOTW, shortcut Startup cho HeartbeatAgent, cài stunnel cho broker stream và cài TightVNC service.It handles AutoLogon prep, MOTW stripping, the HeartbeatAgent Startup shortcut, the stunnel install for the broker stream and the TightVNC service install.
5. Reboot. Sau AutoLogon, HeartbeatAgent tự chạy trong session tương tác và spawn CmdAgent. Mở heartbeat-agent.log để kiểm tra.Reboot. After AutoLogon, HeartbeatAgent starts in the interactive session and spawns CmdAgent. Open heartbeat-agent.log to verify.

[2026-06-04 14:22:01] Starting HeartbeatAgent 1.3.2-phase9 -- interval=5s host=WIN-VPS-01
[2026-06-04 14:22:01] IPC listening on 127.0.0.1:9606
[2026-06-04 14:22:02] BROKER: HELLO ok — stream healthy
[2026-06-04 14:22:02] HB via broker stream cpu=8.4 ram=42.1 disk=33.7 net=0.6 acc=0

Compile binaryCompiling the binaries

Aut2Exe.exe /in HeartbeatAgent.au3 /out HeartbeatAgent.exe /gui /icon icon.ico
Aut2Exe.exe /in CmdAgent.au3       /out CmdAgent.exe       /gui /icon icon.ico

VM headless (AutoLogon)Headless VM setup (AutoLogon)

WARN: WebRequest GUI automation didn't complete -- configure manually:
  https://your-url-1
  https://your-url-2

Cài Sysinternals AutoLogonInstall Sysinternals AutoLogon

1. Tải AutoLogon.zip từ https://learn.microsoft.com/en-us/sysinternals/downloads/autologon (bản copy có sẵn trong monitor/vps-agent/AutoLogon.zip và trong gói setup), giải nén, lấy Autologon64.exe đặt vào ví dụ C:\Tools\.Download AutoLogon.zip from https://learn.microsoft.com/en-us/sysinternals/downloads/autologon (a copy ships in monitor/vps-agent/AutoLogon.zip and in the setup package), extract, and put Autologon64.exe in e.g. C:\Tools\.
2. Kiểm tra mật khẩu trước: runas /user:Administrator cmd. Mở được cửa sổ cmd mới = đúng. Lỗi 1326: The username or password is incorrect → đặt lại mật khẩu rồi quay lại.Test the password first: runas /user:Administrator cmd. A new cmd window = correct. Error 1326: The username or password is incorrect → reset the password, then come back.
3. Chuột phải Autologon64.exe → Run as administrator; lần đầu tick Agree ở EULA.Right-click Autologon64.exe → Run as administrator; on first run tick Agree on the EULA.
4. Điền Username = Administrator, Domain = trống hoặc tên máy (ví dụ fxbot001), Password = mật khẩu thật của Administrator.Fill Username = Administrator, Domain = blank or the computer name (e.g. fxbot001), Password = the Administrator account's real password.
5. Bấm Enable. Thành công → popup Autologon successfully configured; sai mật khẩu → báo lỗi ngay.Click Enable. Success → popup Autologon successfully configured; a wrong password errors immediately.

bootstrap-fresh-vm.ps1 (Windows mới, một lần mỗi image)bootstrap-fresh-vm.ps1 (fresh Windows, once per image)

cd C:\VpsAgent
# ONE-TIME bypass needed -- the script itself sets bypass permanent for next runs
powershell -ExecutionPolicy Bypass -File .\bootstrap-fresh-vm.ps1

prepare-vm.ps1 làm gìWhat prepare-vm.ps1 does

1. Dọn trạng thái cũ: dừng VpsAgent / HeartbeatAgent / CmdAgent / stunnel để thay được file exe; xoá shortcut Startup cũ (kể cả VpsAgent.lnk); gỡ im lặng stunnel và TightVNC cũ để lần cài sau luôn sạch.Clean previous state: stop VpsAgent / HeartbeatAgent / CmdAgent / stunnel so the exe files can be replaced; drop stale Startup shortcuts (including VpsAgent.lnk); silently uninstall any old stunnel and TightVNC so every run reinstalls cleanly.
2. Chuẩn bị cho AutoLogon: DisableCAD tắt Ctrl+Alt+Del (cần cho Windows Server, vô hại trên 10/11); powercfg không bao giờ sleep / tắt màn hình / hibernate; NoLockScreen + tắt screensaver (session bị khoá không còn là session tương tác cho Send).AutoLogon-friendly prep: DisableCAD removes the Ctrl+Alt+Del prompt (required on Windows Server, harmless on 10/11); powercfg never sleeps / blanks / hibernates; NoLockScreen + screensaver off (a locked session is NOT interactive for Send).
3. Unblock-File gỡ MOTW khỏi hai binary agent để SmartScreen không hỏi mỗi lần chạy.Unblock-File strips MOTW off both agent binaries so SmartScreen doesn't prompt on each launch.
4. Tạo HeartbeatAgent.lnk trong thư mục Startup. CmdAgent không nằm trong Startup: HeartbeatAgent spawn nó.Creates HeartbeatAgent.lnk in the Startup folder. CmdAgent is NOT in Startup: HeartbeatAgent spawns it.
5. Broker stream: cài stunnel, gọi GET /api/agent/broker-config, ghi stunnel.conf + CA, tạo shortcut Startup cho stunnel và chạy nó (chi tiết ở Broker stream).Broker stream: installs stunnel, calls GET /api/agent/broker-config, writes stunnel.conf + CA, adds a Startup shortcut for stunnel and launches it (details in Broker stream).
6. TightVNC: cài làm Windows Service với mật khẩu riêng của VPS lấy từ response bootstrap, nghe cổng 5900.TightVNC: installs it as a Windows Service with the per-VPS password from the bootstrap response, listening on 5900.
7. Smoke test Test-NetConnection 127.0.0.1 cổng 9605 và 5900, ghi init = provisioned, rồi reboot sau đếm ngược 10 s có thể huỷ.Smoke-tests Test-NetConnection 127.0.0.1 on ports 9605 and 5900, writes init = provisioned, then reboots after a cancellable 10 s countdown.

Gỡ Windows Service VpsAgent cũ (chỉ máy nâng cấp)Remove the legacy VpsAgent Windows Service (upgraded hosts only)

sc.exe query VpsAgent
Stop-Service VpsAgent -ErrorAction SilentlyContinue
sc.exe delete VpsAgent

Chạy HeartbeatAgent khi đăng nhậpRun HeartbeatAgent at logon

$action = New-ScheduledTaskAction -Execute "C:\VpsAgent\HeartbeatAgent.exe"
$trigger = New-ScheduledTaskTrigger -AtLogOn -User "Administrator"

# CRITICAL: LogonType Interactive — task runs in the user's session,
# not Session 0.
$principal = New-ScheduledTaskPrincipal `
    -UserId "Administrator" `
    -RunLevel Highest `
    -LogonType Interactive

$settings = New-ScheduledTaskSettingsSet `
    -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
    -StartWhenAvailable `
    -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)

Register-ScheduledTask -TaskName "fxconsole-HeartbeatAgent" `
    -Action $action -Trigger $trigger `
    -Principal $principal -Settings $settings

Reboot và kiểm traReboot and verify

1. Restart-Computer, rồi mở console Proxmox (noVNC / SPICE), KHÔNG dùng RDP, để thử AutoLogon riêng.Restart-Computer, then open the Proxmox console (noVNC / SPICE), NOT RDP, to test AutoLogon in isolation.
2. Phải thấy desktop đã đăng nhập Administrator, không có màn Ctrl+Alt+Del hay login.You should see the desktop already logged in as Administrator, with no Ctrl+Alt+Del or login screen.
3. Task Manager → Details: HeartbeatAgent.exe, CmdAgent.exe, stunnel.exe đều chạy với user Administrator.Task Manager → Details: HeartbeatAgent.exe, CmdAgent.exe and stunnel.exe all run as Administrator.
4. Từ máy khác, deploy thử một tài khoản; sau 1–2 phút /deployments phải chuyển sang running.From another machine, trigger one deploy; after 1–2 minutes /deployments should show running.
5. Mở /admin/vps/{id}/logs (admin) và tìm WebReq: starting for …, WebReq: main hwnd=…, WebRequest URLs configured via GUI (N). Dòng cuối nghĩa là GUI automation đã chạy thật.Open /admin/vps/{id}/logs (admin) and look for WebReq: starting for …, WebReq: main hwnd=…, WebRequest URLs configured via GUI (N). The last line means the GUI automation really ran.

Khi WebRequest vẫn lỗiWhen WebRequest still fails

Vì sao VNC mà không RDPWhy VNC and not RDP

Mẹo Proxmox và đánh đổi bảo mậtProxmox tips and security trade-offs

Zero-touch provisioningZero-touch provisioning

flowchart TD
  A["init = pending (clone mới)"] --> B["Lấy MAC các NIC đang chạy"]
  B --> C["POST /api/agent/init-config (Bearer init_token, macs, server_url)"]
  C -- "401 / 404 / không tới được" --> X["Dừng, in lỗi"]
  C -- "200: secret_key, name, interval, mt5_root, computer_name" --> D["Ghi lại ini (bỏ init_token), init = installing"]
  D --> E["Rename-Computer, reboot sau 5 s"]
  E --> F["Cài đặt thường: stunnel, TightVNC, Startup"]
  F --> G["init = provisioned, reboot"]
  G --> H["Các lần chạy sau: thoát ngay (trừ -Force)"]

flowchart TD
  A["init = pending (fresh clone)"] --> B["Collect active NIC MACs"]
  B --> C["POST /api/agent/init-config (Bearer init_token, macs, server_url)"]
  C -- "401 / 404 / unreachable" --> X["Abort with error"]
  C -- "200: secret_key, name, interval, mt5_root, computer_name" --> D["Rewrite ini (init_token removed), init = installing"]
  D --> E["Rename-Computer, reboot in 5 s"]
  E --> F["Normal install: stunnel, TightVNC, Startup"]
  F --> G["init = provisioned, reboot"]
  G --> H["Later runs: exit immediately (unless -Force)"]

Tham chiếu cấu hình vps-agent.inivps-agent.ini reference

[agent]
server_url = https://fxconsole.gamelau.uk
secret_key = <secret>
heartbeat_interval = 5
mt5_root = C:\fxconsole-mt5
auto_relaunch_on_boot = true
init = provisioned

Broker stream qua stunnelBroker stream via stunnel

Agent tìm broker thế nào (một nguồn sự thật)How the agent discovers the broker (single source of truth)

vps-agent.ini
  server_url = https://fxconsole.gamelau.uk    ← fxconsole web URL, NOT the broker
  secret_key = <secret>                        ← per-VPS opaque token
       │  prepare-vm.ps1 reads these
       ▼
GET ${server_url}/api/agent/broker-config
    X-Vps-Secret: <secret>
       │  Laravel reads app_setting('vps_broker_host'), app_setting('vps_broker_port')
       │  (live from /admin/settings) + the broker CA cert (+ per-VPS VNC password)
       ▼
{ "broker_host":"fxconsole.gamelau.uk", "broker_port":9605,
  "broker_ca":"-----BEGIN CERTIFICATE-----\n..." }
       ▼
prepare-vm.ps1 renders stunnel\config\stunnel.conf + broker-ca.cert
       ▼
stunnel listens on 127.0.0.1:9605 → ${broker_host}:${broker_port}
       ▼
HeartbeatAgent.au3 (hard-coded) connects to 127.0.0.1:9605

Cert của broker trên Docker hostBroker cert on the Docker host

docker cp fxconsole-vps-stream-broker:/app/certs/server.cert /tmp/broker-ca.cert
docker cp /tmp/broker-ca.cert fxconsole-app:/tmp/broker-ca.cert
docker exec fxconsole-app php artisan vps-stream-broker:cert-import /tmp/broker-ca.cert

stunnel trên từng VPSstunnel on each VPS

1. Đọc server_url + secret_key từ vps-agent.ini.Read server_url + secret_key from vps-agent.ini.
2. Tải installer stunnel (mặc định 5.78 win64; đổi bằng -StunnelInstallerUrl hoặc dùng -StunnelInstallerLocalPath).Download the stunnel installer (default 5.78 win64; override with -StunnelInstallerUrl or use -StunnelInstallerLocalPath).
3. Cài NSIS im lặng (/S /D=...) vào thư mục stunnel dưới C:\VpsAgent\.Silent NSIS install (/S /D=...) into a stunnel folder under C:\VpsAgent\.
4. GET /api/agent/broker-config với header X-Vps-Secret → {broker_host, broker_port, broker_ca}.GET /api/agent/broker-config with the X-Vps-Secret header → {broker_host, broker_port, broker_ca}.
5. Ghi stunnel\config\broker-ca.cert (PEM) và stunnel\config\stunnel.conf ở chế độ client: accept 127.0.0.1:9605, connect ${broker_host}:${broker_port}, verify = 2, checkHost, CAfile.Write stunnel\config\broker-ca.cert (PEM) and stunnel\config\stunnel.conf in client mode: accept 127.0.0.1:9605, connect ${broker_host}:${broker_port}, verify = 2, checkHost, CAfile.
6. Tạo shortcut Startup fxconsole-stunnel.lnk (cửa sổ thu nhỏ) để stunnel chạy cùng session với agent và MT5.Create the Startup shortcut fxconsole-stunnel.lnk (minimised) so stunnel runs in the same session as the agents and MT5.
7. Chạy stunnel ngay và smoke test Test-NetConnection 127.0.0.1 -Port 9605.Launch stunnel immediately and smoke-test Test-NetConnection 127.0.0.1 -Port 9605.

# From a fresh PowerShell window on the VPS:
Test-NetConnection 127.0.0.1 -Port 9605
# TcpTestSucceeded : True   ← stunnel is listening locally
Test-NetConnection fxconsole.gamelau.uk -Port 9605
# TcpTestSucceeded : True   ← TLS path to the remote broker is open

Get-Content C:\VpsAgent\stunnel\stunnel.log -Tail 20
# "Service [vps-broker] accepted connection from 127.0.0.1"
# then "Service [vps-broker] connected remote server"

Lệnh và luồng deployCommands and deploy flow

sequenceDiagram
  participant U as Người dùng / admin
  participant APP as fxconsole app
  participant DB as MySQL
  participant VB as VpsStreamBroker
  participant HB as HeartbeatAgent
  participant CA as CmdAgent
  participant MT as MT5 terminal
  U->>APP: Deploy (package, VPS, login)
  APP->>DB: INSERT vps_commands status=queued
  APP->>VB: Redis PUBLISH vps:cmd (vps_id, cmd_id, kind)
  VB->>HB: cmd (cmd_id, kind), không kèm payload
  HB->>CA: IPC do_cmd_pull (cmd_id, kind)
  CA->>APP: GET /api/vps/cmd/ID/payload + X-Vps-Secret
  APP-->>CA: id, type, payload
  CA->>CA: tải ZIP, kiểm SHA-256, giải nén, inject .set, ghi profile ini
  CA->>MT: terminal64.exe /portable /config:profile
  CA->>MT: bấm Later cho LiveUpdate, quét journal, thêm WebRequest URL
  CA-->>HB: IPC ack (cmd_id, success, log, error)
  alt broker khoẻ
    HB->>VB: event (cmd_id, finished, status)
    VB->>DB: UPDATE vps_commands
  else broker sập
    HB->>APP: command_acks trong heartbeat HTTPS kế tiếp
    APP->>DB: UPDATE vps_commands
  end

sequenceDiagram
  participant U as User / admin
  participant APP as fxconsole app
  participant DB as MySQL
  participant VB as VpsStreamBroker
  participant HB as HeartbeatAgent
  participant CA as CmdAgent
  participant MT as MT5 terminal
  U->>APP: Deploy (package, VPS, login)
  APP->>DB: INSERT vps_commands status=queued
  APP->>VB: Redis PUBLISH vps:cmd (vps_id, cmd_id, kind)
  VB->>HB: cmd (cmd_id, kind), no payload
  HB->>CA: IPC do_cmd_pull (cmd_id, kind)
  CA->>APP: GET /api/vps/cmd/ID/payload + X-Vps-Secret
  APP-->>CA: id, type, payload
  CA->>CA: download ZIP, check SHA-256, unzip, inject .set, write profile ini
  CA->>MT: terminal64.exe /portable /config:profile
  CA->>MT: answer Later to LiveUpdate, scan journal, add WebRequest URLs
  CA-->>HB: IPC ack (cmd_id, success, log, error)
  alt broker healthy
    HB->>VB: event (cmd_id, finished, status)
    VB->>DB: UPDATE vps_commands
  else broker down
    HB->>APP: command_acks in the next HTTPS heartbeat
    APP->>DB: UPDATE vps_commands
  end

Chi tiết add_accountadd_account in detail

[Common]
Login=<login>
Password=<secret>
Server=<server>
EnableLiveUpdate=0
KeepPrivate=1

[Experts]
AllowLiveTrading=1
AllowDllImport=1
Enabled=1
Account=0
Profile=0

Khung dữ liệu IPC và brokerIPC and broker frames

HeartbeatAgent → CmdAgent:
  {"t":"do_cmd",      "cmd_index":N, "hb_resp":"<raw heartbeat JSON>"}   ← HTTPS fallback path
  {"t":"do_cmd_pull", "cmd_id":N,    "kind":"add_account"}               ← broker push path

CmdAgent → HeartbeatAgent:
  {"t":"ready", "cmd_v":"…", "ts":…}                                    ← on every IPC connect
  {"t":"ack",   "cmd_id":N,  "success":bool, "log":"…", "error":"…"}    ← terminal result
  {"t":"log",   "msg":"…"}                                               ← optional

HeartbeatAgent → broker:
  {"t":"hello",  "v":1, "secret":"<secret_key>", "agent_v":"1.3.2-phase9", "ts":…}
  {"t":"hb",     "cpu":12.4, "ram":34.0, "disk":78.2, "net":5.1, "accts":3, "logins":[…], "ts":…}
  {"t":"hb",     "ts":…}                                                 ← hb_min while stream_off
  {"t":"event",  "cmd_id":N, "phase":"finished", "status":"success", "log":"…", "error":"", "ts":…}
  {"t":"pong",   "ts":…}

Broker → HeartbeatAgent:
  {"t":"hello_ok",  "vps_id":42, "server_t":…}
  {"t":"hello_err", "reason":"bad_secret"|"timeout"|"unknown_vps"}
  {"t":"hb_ok",     "ts":…, "interval":N}
  {"t":"cmd",       "cmd_id":N, "kind":"add_account", "ts":…}
  {"t":"stream_on"} / {"t":"stream_off"}
  {"t":"ping",      "ts":…}                                              ← every PING_INTERVAL (broker .env)
  {"t":"bye",       "reason":"shutdown"}

Dấu vết log một lần deploy qua brokerEnd-to-end log trace (deploy via broker)

fxconsole-app                 INSERT vps_commands … status=queued
VpsCommand::booted            PUBLISH laravel-database-vps:cmd {vps_id:42,cmd_id:1234,kind:add_account}
fxconsole-vps-stream-broker   cmd push → vps=42 cmd_id=1234 kind=add_account
heartbeat-agent.log           BROKER: cmd push cmd_id=1234 kind=add_account — forwarding to CmdAgent
cmd-agent.log                 CMD #1234 pulling payload via HTTPS (kind=add_account)
                              CMD recv #1234 type=add_account
                              CMD #1234 downloading...
                              … (install, unzip, inject, launch MT5, journal scan) …
                              CMD #1234 add_account ok login=12345678
heartbeat-agent.log           ACK via broker stream cmd_id=1234 success=true
fxconsole-vps-stream-broker   [vps=42] event cmd_id=1234 → success
fxconsole MySQL               vps_commands.id=1234 status=success completed_at=now

Gói deploy tài khoảnAccount deploy packages

Gói hiện có trong monitor/vps-agentPackages currently in monitor/vps-agent

Chuẩn bị ZIPPreparing the ZIP

my-package.zip
├── terminal64.exe                ← MT5 main binary
├── metaeditor64.exe              ← optional
├── MQL5/
│   ├── Experts/                  ← your EAs (.ex5)
│   ├── Presets/                  ← .set files for value injection
│   └── Profiles/Charts/Default/  ← chart01.chr, chart02.chr … attach the EAs
├── config/                       ← MT5 writes here at first launch (keep empty)
└── …other MT5 standard folders

1. ZIP phải giải nén thẳng ra thư mục MT5 portable dùng được: agent giải nén vào C:\fxconsole-mt5\<login>\ và chạy terminal64.exe ở gốc.The ZIP must unzip directly into a usable MT5 portable folder: the agent extracts into C:\fxconsole-mt5\<login>\ and runs terminal64.exe from the root.
2. Không để lại config/origin.ini hay tài khoản đã lưu từ máy chuẩn bị: chúng mã hoá bằng DPAPI của máy đó và không giải mã được ở máy khác. Xoá nội dung config/ (giữ thư mục) nếu từng đăng nhập bằng bản copy đó.Do not include config/origin.ini or saved accounts from the prep machine: they are DPAPI-encrypted to that machine and won't decrypt elsewhere. Empty config/ (keep the folder) if you ever logged in from that copy.
3. Chạy bản portable, mở chart, gắn EA, cấu hình input, lưu profile (File → Profiles → Save As…); tên profile nhập vào trường Profile của package.Run the portable, open a chart, attach the EA, configure inputs, save the profile (File → Profiles → Save As…); put that name in the package's Profile field.
4. Input nào cần khác nhau theo người dùng thì đặt trong file .set dưới MQL5/Presets/ với giá trị placeholder (ví dụ REPLACE_ME), rồi trong MT5 bấm Load chọn file .set đó và lưu lại template chart.Inputs that differ per user go into a .set file under MQL5/Presets/ with a placeholder value (e.g. REPLACE_ME); in MT5 click Load, pick that .set, and save the chart template again.
5. Nén toàn bộ thư mục, upload lên URL HTTPS (máy chủ riêng, S3, Cloudflare R2, GitHub release, link tải trực tiếp Dropbox / Google Drive). Không dùng HTTP thường.Zip the whole folder and upload it to an HTTPS URL (own server, S3, Cloudflare R2, a GitHub release, a Dropbox / Google Drive direct-download link). Never plain HTTP.
6. Tính SHA-256 (64 ký tự hex) và nhập vào package. Agent tính lại sau khi tải; lệch là huỷ deploy.Compute the SHA-256 (64 hex chars) and enter it on the package. The agent recomputes after download; a mismatch aborts the deploy.

certutil -hashfile package.zip SHA256      # Windows
shasum -a 256 package.zip                  # Linux / macOS
openssl dgst -sha256 package.zip

Trường của packagePackage fields

Trạng thái deploymentDeployment statuses

Tự nâng cấp agentAgent self-upgrade

1. Admin upload zip nâng cấp ở /admin/agent-releases, rồi bấm nâng cấp một VPS (POST /admin/vps/{id}/upgrade-agent) hoặc nhiều VPS (POST /admin/vps/upgrade-agent-bulk).The admin uploads the upgrade zip on /admin/agent-releases, then upgrades one VPS (POST /admin/vps/{id}/upgrade-agent) or many (POST /admin/vps/upgrade-agent-bulk).
2. CmdAgent nhận payload {release_id, download_url, expected_hash, label, version, size_bytes}, đọc lại secret_key từ ini, ACK thành công trước (script sắp kill nó), chờ 2 s, chạy upgrade.ps1 -DownloadUrl … -ExpectedHash … -SecretKey <secret> -AgentDir … (hiện cửa sổ) rồi thoát.CmdAgent receives {release_id, download_url, expected_hash, label, version, size_bytes}, re-reads secret_key from the ini, ACKs success first (the script is about to kill it), waits 2 s, runs upgrade.ps1 -DownloadUrl … -ExpectedHash … -SecretKey <secret> -AgentDir … (visible window), then exits.
3. upgrade.ps1 tải zip từ /api/agent/release/{id}/download (header X-Vps-Secret), kiểm SHA-256, kill các tiến trình agent, chờ -KillSettleSeconds (3 s), giải nén (làm phẳng nếu zip có một thư mục gốc), robocopy đè lên AgentDir, Unblock-File, rồi reboot sau -RebootCountdownSeconds (10 s, Ctrl+C để huỷ). Log ở upgrade.log.upgrade.ps1 downloads the zip from /api/agent/release/{id}/download (X-Vps-Secret header), verifies SHA-256, kills the agent processes, waits -KillSettleSeconds (3 s), extracts (flattening a single-folder zip), robocopies over AgentDir, runs Unblock-File, then reboots after -RebootCountdownSeconds (10 s, Ctrl+C aborts). It logs to upgrade.log.
4. Sau reboot, AutoLogon → Startup chạy binary mới; agent_v mới hiện trên thẻ /vps.After the reboot, AutoLogon → Startup runs the new binaries; the new agent_v shows on the /vps card.

Tham chiếu APIAPI reference

POST /api/vps/heartbeat

{
  "agent_version": "1.3.2-phase9",
  "heartbeat_interval": 15,
  "mt5_root": "C:\\fxconsole-mt5",
  "lan_ip": "192.168.1.10",
  "cpu_name": "…",
  "cpu_pct": 12.40,
  "ram_pct": 42.18,
  "disk_pct": 33.70,
  "net_pct": 0.60,
  "account_count": 1,
  "account_logins": ["12345678"],
  "command_acks": []
}

Mô hình bảo mậtSecurity model

Xử lý sự cốTroubleshooting

Ghi chú vận hànhOperational notes

tasklist | findstr /I "HeartbeatAgent CmdAgent stunnel"
Get-Content C:\VpsAgent\heartbeat-agent.log -Tail 20
# Supervisor: spawned CmdAgent pid=…
# BROKER: TCP connected (TLS via stunnel) — sending HELLO
# IPC: CmdAgent READY cmd_v=1.3.2-phase9
# BROKER: HELLO ok — stream healthy
# HB via broker stream cpu=… logins=…
Get-Content C:\VpsAgent\cmd-agent.log -Tail 10
# Starting CmdAgent 1.3.2-phase9 -- mt5_root=C:\fxconsole-mt5
# RelaunchExistingDeploys: done -- N candidate(s), N launched, …
docker logs fxconsole-vps-stream-broker   # on the broker host: [vps=N] HELLO ok (agent_v=…)

Lộ trình (chưa làm)Roadmap (not implemented)

Bản đồ fileFile map