Generic TCP Forwarding over the Existing Agent WebSocket

Summary:

Add a generic TCP forwarding capability to PatchMon that allows local TCP services running on an agent to securely reach predefined server-side services through the existing PatchMon WebSocket connection.

The feature should act as a transparent TCP transport layer, without understanding or inspecting the application protocol.

A first implementation (V1) should intentionally remain simple:

• no UI
• file-based configuration on the agent
• environment-based configuration on the server
• no arbitrary destination chosen by the agent
• only predefined logical services exposed by the server
• opaque TCP byte forwarding

This feature would make PatchMon useful for many monitoring and management protocols while keeping a very small security surface.

Motivation :

Many monitoring agents and infrastructure tools initiate outbound TCP connections to central services.

In environments protected by firewalls or NAT, opening inbound ports is often undesirable or impossible.

PatchMon already maintains a secure WebSocket connection between the agent and the server. This connection could also transport arbitrary TCP streams, allowing local applications to communicate with centrally exposed services without requiring additional firewall rules.

Rather than implementing protocol-specific integrations, PatchMon could provide a generic TCP transport reusable for multiple use cases.

Potential examples include:

• Zabbix active agent
• proprietary monitoring agents
• custom TCP applications