18: Installing Netdata Director - Multi-Server Monitoring Hub

How It WorksArchitecture

Netdata

Parent-Child Director uses a parent-child architecture:

Director (Parent)Streaming

• TheDirector central(Parent): Central dashboard server receiving streams
• Receives metrics from all child nodes
• Displays unified view of all servers
• Manages alerts for all servers

Child Nodes

• Regular Netdata installations on each server
• Stream metricsstreaming to the Director
• CanStream stillAPI haveKey: theirAuthentication owntoken dashboardsfor (optional)child-to-parent connection
• AutomaticallyUnidirectional: appearMetrics inflow Directorchild dashboard→ parent only

Step 1: Verify Pro+ License

Before installing, make sure you have a Pro+ license. The installation script will check for this automatically.

If you don't have a Pro+ license:

• Visit: https://speedbits.io/infinity-tools/
• Email: sales@speedbits.io
• Support: support@speedbits.io

Step 2: Start Infinity Tools

sudo infinity-tools

Step 3: Install Netdata Director

1. Go to 📱 APPLICATIONS
2. Select Netdata Director
3. Choose Install Netdata Director

Using the Infinity Tools GUIContainer

• Use ↑/↓netdata-director to- move,Director Enterinstance to select, Esc to go back(netdata/netdata:latest)
• Look for the turquoise cursornetdata-director-ssl-proxy indicating- theNginx currentSSL selection
proxy
• Each(standalone screenHTTPS showsmode a short description at the top explaining what's neededonly)

StepData 3.1: Choose SSL ModePersistence

You'll see two options. Here's what each means:

• Traefik (recommended)Config:
  • What it is: Uses your domain name with a trusted HTTPS certificate from Let's Encrypt
  • What you need: A subdomain (e.g., monitoring.yourdomain.com) pointing to your server (see Chapter 4.5)
  • What you get: Professional URL like https://monitoring.yourdomain.com with trusted SSL
  • Pick this if: You want secure, easy access with a domain name (recommended)
• Standalone HTTP
  • What it is: Uses HTTP with direct port access (no SSL)
  • What you need: Just a free port (default: 19999)
  • What you get: URL like http://SERVER_IP:19999opt/speedbits/netdata-director/netdata/
  • Pick this if:Lib: You're/opt/speedbits/netdata-director/netdata/lib/ just(metrics testing or only using it on your local networkdatabase)

Step 3.2: If You Choose Traefik

1. Enter your subdomain, e.g.,Cache: monitoring.yourdomain.com/opt/speedbits/netdata-director/netdata/cache/
2. Ensure the subdomain's DNS A record points to your server (see Chapter 4.5)
3. Infinity Tools will configure HTTPS automatically via Let's Encrypt

After install: Your Netdata Director will be available at https://monitoring.yourdomain.com

Step 3.3: Apprise Notifications (Optional)

If you have Apprise installed (Chapter 5), you can enable centralized alert notifications:

• Yes
  • What it does: Sends alerts from ALL monitored servers to Apprise
  • What you get: One notification channel for all servers
  • Pick this if: You want centralized alerting
• No
  • What it does: No alert notifications
  • Pick this if: You just want monitoring, no alerts

Step 3.4: Save Your Stream API Key

⚠️ CRITICAL:Key: During installation, a Stream API Key will be generated. This key is used to connect child nodes to the Director.

• Write down the API key immediately!
• Save it in a password manager (like Vaultwarden)
• You'll need this key when configuring child nodes
• The key is also saved in: /opt/speedbits/netdata-director/stream-api-key.txt

Deployment Modes

WhatTraefik HappensMode During(Default)

Uses Traefik for SSL termination and domain routing:

• Automatic Let's Encrypt certificate provisioning
• Domain-based access: https://monitoring.example.com
• Security headers configured
• Requires: Traefik running, DNS A record configured

Standalone Mode

Direct access with HTTP or HTTPS (self-signed):

• HTTP: http://SERVER_IP:19999
• HTTPS: https://SERVER_IP:19999 (self-signed cert via nginx proxy)
• Default port: 19999 (configurable)

Stream API Key

Generation

• Netdata32-character Directorrandom containerkey isgenerated createdduring installation
• DataSaved directoriesin arestream-api-key.txt
set
• Used upfor atchild node authentication
• Must be kept secret

Usage

Child nodes use this key to authenticate when streaming metrics:

• Configured in child node's stream.conf
• Director validates key before accepting streams
• Multiple children can use same key (or separate keys per child)

Streaming Configuration

Director Configuration

File: /opt/speedbits/netdata-directordirector/netdata/stream.conf

[stream]
    enabled = no  # Director doesn't stream to anyone

[$STREAM_API_KEY]
    enabled = yes
    default memory mode = dbengine
    health enabled by default = auto
    default postpone alarms on connect seconds = 60
    default history = 3600
    allow from = *

Child Node Configuration

Configured during child node installation:

• Director hostname/IP
• Director port (default: 19999)
• Stream API key is generated and saved
• Optional domain + Traefik HTTPS routing (if using Traefik)
• Optional Apprise integration (if enabled)
• Service starts and becomes accessible

Step 4: Access Netdata DirectorMethods

IfTraefik Using TraefikMode

https://monitoring.example.com

1. Wait

   Direct 30-60web secondsaccess forafter DNS propagation and SSL certificate generation

2. Open(30-60 https://monitoring.yourdomain.com in your browser
3. You'll see the Director dashboard!

IfStandalone Using StandaloneMode

HTTP:

1. Open

   http://SERVER_IP:19999 in your browser

2. You'll see the Director dashboard!

⚠️ IMPORTANT SECURITY NOTE:HTTPS: Netdata Director has NO username/password protection by default! However, you CANNOT use Basic Auth because it blocks child nodes from streaming data. Instead, use firewall rules, VPN access, or Netdata Cloud for security.

Step 5: Connect Child Nodes

Now that Director is running, you need to connect your other servers (child nodes) to it.

On Each Server You Want to Monitor

1. SSH into the server
2. Run:

   sudo infinity-toolshttps://SERVER_IP:19999

3. Go to 📱 APPLICATIONS → Netdata → Install
4. When asked about streaming, choose Yes
5. Enter Director details:
   • Director hostname/IP: The Director server's IP or domain
   • Director port: 19999 (or your custom port)
   • Stream API key: The key you saved during Director installation
6. Complete the installation

What Happens Next

• Child node starts streaming metrics to Director
• Wait 1-2 minutes for connection to establish
• Child node appears in Director dashboard dropdown
• You can now switch between servers in the Director dashboard!

Step 6: Using the Director Dashboard

Switching Between Servers

1. Open the Director dashboard
2. Look for a dropdown menu (usually top-left or top-right)
3. Select a server from the dropdown
4. Dashboard updates to show that server's metrics

What You'll See

• 📊 Unified view - All servers listed in dropdown
• 📈 Real-time metrics - Same as regular Netdata, but for all servers
• 🔔 Centralized alerts - Alerts from all servers
• 📉 Historical data - Long-term storage for all servers
• 🔍 Node comparison - Compare metrics across servers

Security RecommendationsConfiguration

Access Security

• ✅ Use Traefik mode -uses ProvidesLet's trustedEncrypt SSL (production-ready)
• ✅ Standalone HTTPS uses self-signed certificates
• ✅ Security headers configured
• ⚠️ NO default authentication - Dashboard is publicly accessible
• ⚠️ Basic Auth incompatible - Blocks child node streaming

Authentication Limitations

⚠️ CRITICAL: Basic Auth cannot be used with Director because:

• Child nodes use HTTP API to stream metrics
• Basic Auth blocks unauthenticated API requests
• Child nodes cannot authenticate via Basic Auth
• Result: Child nodes cannot connect

Security Alternatives

• Firewall protectionRules: - Restrict access to trusted IPs only
• ✅ VPN accessAccess: -Access UseDirector via WireGuard VPN (Chapter 18) for secure remote access
• ✅Netdata Cloud: Use official Netdata Cloud service
• Network Isolation: Keep Director on private network

Stream API Key Security

• API key provides authentication for child nodes
• Keep key secret - Only(only share with trusted serversservers)
• ⚠️Director NOvalidates Basickey Authbefore -accepting Cannotstreams
• Can use Basicseparate Authkeys (blocksper child nodes)
node
• ⚠️ Protect Director - Director shows ALL server metrics - protect it!(advanced)

Alert Configuration

SecurityApprise OptionsIntegration

SinceIf BasicApprise Authis doesn'tenabled, workDirector withsends Director,alerts usefor theseALL alternatives:child nodes:

• OptionCentralized 1: Firewall (Best)
  • Use UFW to allow only trusted IPs
  • Example: ufw allow from CHILD_NODE_IP to any port 443
• Option 2: VPN/WireGuard
  • Access Director only through WireGuard VPN
  • Keep Director on internal network
• Option 3: Netdata Cloud
  • Use Netdata's official cloud service
  • Includes authentication and teamalert management
  • Visit:Alerts https://app.netdata.cloudinclude server hostname
• Single
notification

Troubleshooting

Can't Access Director

• Traefik mode: Wait 30-60 seconds after installationchannel for SSLall certificate generationservers
• CheckConfig containers: Runfile: docker ps | grep netdata-director to see if container is running
• Check logs: Run docker logs netdata-director to see error messages

Child Nodes Not Appearing

• Wait 1-2 minutes after connecting (connection takes time)
• Verify API key is correct on child node
• Check network connectivity between child and Director
• Check Director logs: docker logs netdata-director
• Verify child node is streaming: Check child node logs

Lost API Key

• View saved key: cat /opt/speedbits/netdata-director/stream-api-key.txt
• Or check Director configuration: cat /opt/speedbits/netdata-director/netdata/stream.health_alarm_notify.conf

Where

Alert Flow

1. Child node detects issue
2. Alert sent to Find Netdata Director After Install
   • On the finish screen, Infinity Tools prints the access URL
   • YouDirector canforwards alsoto see it in 📊 STATUS & HEALTH → STATUSApprise
   • CheckApprise thesends installationto directory:configured /opt/speedbits/netdata-directorchannels
   • API key saved in: /opt/speedbits/netdata-director/stream-api-key.txt
   • Configuration files: /opt/speedbits/netdata-director/netdata/

UsefulData FeaturesRetention

DataRetention RetentionPeriods

Director stores historical data for all servers:

• High-resolution: 1 hour (1-second granularity)
• Mid-resolution: 1 day (1-minute granularity)
• Low-resolution: 30 days (15-minute granularity)

Centralized AlertsStorage

If Apprise is enabled, you'll get alerts from all servers:

• AlertsMetrics includestored serverin hostnamedbengine mode
• OneConfigurable notificationretention channelin for all serversnetdata.conf
• EasierStorage toscales managewith thannumber individualof alertschild nodes

You'reChild Ready!Node Connection

Connection Process

1. Install Netdata on child server (Chapter 17)
2. Enable streaming during installation
3. Provide Director hostname/IP
4. Provide Director port (default: 19999)
5. Provide Stream API key
6. Child node connects automatically

Connection Verification

• Wait 1-2 minutes for connection to establish
• Check Director dashboard dropdown for child node
• Verify metrics appearing in Director
• Check Director logs: docker logs netdata-director

Troubleshooting

Child Nodes Not Connecting

• Verify API key is correct
• Check network connectivity (firewall rules)
• Verify Director port is accessible
• Check child node logs for connection errors
• Check Director logs: docker logs netdata-director

Streaming Issues

• Verify stream.conf configuration
• Check API key matches between child and parent
• Verify Director is nowaccepting installedconnections
and
• Check readynetwork toconnectivity
monitor

Production servers! Remember:

Considerations

• 🔐Access ProtectMethod: yourUse DirectorTraefik withmode for production (trusted SSL)
• Security: Implement firewall rules or VPN access (cannot use Basic Auth)
• 🔑Network: KeepEnsure yourDirector Streamis accessible from all child nodes
• Storage: Plan storage capacity based on number of child nodes
• API Key Management: Use separate keys per child for enhanced security
• Monitoring: Monitor Director itself (resource usage, connectivity)

Advanced Configuration

Multiple API keyKeys

Create separate API keys for different child nodes:

# In stream.conf, add multiple sections:
[api-key-1]
    enabled = yes
    allow from = 192.168.1.10

[api-key-2]
    enabled = yes
    allow from = 192.168.1.20

IP Restrictions

Restrict which IPs can connect:

[$STREAM_API_KEY]
    enabled = yes
    allow from = 192.168.1.0/24  # Only allow from this subnet

Integration with Infinity Tools

Netdata Director complements Infinity Tools by providing:

• Centralized monitoring of all Infinity Tools servers
• 📊Unified alerting for entire infrastructure
• Historical data retention for capacity planning
• Cross-server performance comparison

Next Steps

Netdata Director is now operational. Use it to:

• Connect child nodes tofrom startall monitoringyour servers
• 🔔Monitor entire infrastructure from one dashboard
• Set up centralized alertsalerting
for
• Analyze allperformance trends across servers
• 📈Plan Usecapacity thebased unifiedon dashboardhistorical to monitor everythingdata

NextFor steps:advanced Connectfeatures, yourstreaming firstconfiguration, childAPI node,usage, verifyand itdevelopment appearsguides, inrefer to the dashboard,official andNetdata start monitoring all your servers from one place!documentation.