<!--
  Fragment, not a complete file.

  Merge this into the existing <remote> section of
  /var/wazuh-manager/etc/wazuh-manager.conf, inside <wazuh_config>.
  Restart the manager afterwards: systemctl restart wazuh-manager

  Why: this is the shape of the <remote> block a 5.0 manager runs, kept
  here so you can diff it against your own file.

  Verified on a Wazuh 5.0.0-beta5 stack (23 Sep 2026): the shipped
  configuration already sets bind_addr to 0.0.0.0, so the HTTPS listener
  is reachable from other hosts out of the box. If agents cannot enrol,
  look at the firewall, the certificate and the URL prefix before you
  touch this value.

  global_prefix matters for health checks:
    https://manager:1517/                  -> {"error":"not_found"}
    https://manager:1517/wazuh-manager/    -> {"status":"ok","module":"remoted"}

  Option reference:
  https://documentation.wazuh.com/5.0-beta/user-manual/manager/wazuh-manager-services.html

  The <legacy> block below matches the shipped default, which is ENABLED
  on port 1514/tcp. Comment it out or delete it once no Wazuh 4.x agents
  remain, then close 1514 and 1515 on the firewall.
-->

<remote>
  <https>
    <port>1517</port>
    <bind_addr>0.0.0.0</bind_addr>
    <global_prefix>/wazuh-manager/</global_prefix>
    <certificate>etc/certs/remoted.pem</certificate>
    <key>etc/certs/remoted-key.pem</key>
  </https>

  <!-- Shipped default: enabled. Remove it if you have no 4.x agents. -->
  <legacy>
    <enabled>yes</enabled>
    <port>1514</port>
    <protocol>tcp</protocol>
    <local_ip>0.0.0.0</local_ip>
    <queue_size>131072</queue_size>
  </legacy>

  <agents>
    <allow_higher_versions>no</allow_higher_versions>
  </agents>
</remote>
