<!--
  Manager-side settings that decide whether agents can connect, and when they
  are declared disconnected.

  Merge into the existing <wazuh_config> root of:
    /var/wazuh-manager/etc/wazuh-manager.conf

  This is a fragment. Unknown elements cause a manager startup error, and the
  file already contains logging, indexer, vulnerability-detection,
  agent-upgrade, task-manager, wdb and cluster sections. Merge, do not replace.

  Apply with:
    systemctl restart wazuh-manager

  Lesson: https://maheshtata.com/wazuh/wazuh-agent-disconnected/
-->

<wazuh_config>

  <!-- The global section holds exactly two options in Wazuh 5.0, and both are
       present in the shipped configuration. Verified on 5.0.0-beta5. -->
  <global>
    <!-- Time without communication before the manager marks an agent
         disconnected. Default 15m, minimum 1s. Keep the agent's
         <notify_time> lower than this value. -->
    <agents_disconnection_time>15m</agents_disconnection_time>

    <!-- Time an agent must stay disconnected before the manager alerts on it.
         Default 0. The 5.0 manager-configuration migration guide marks this
         option for removal; beta5 still ships it in the default file, so it is
         valid today. Plan to move disconnected-agent notifications onto the
         indexer before it goes. -->
    <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
  </global>

  <remote>
    <https>
      <!-- Port for Wazuh 5.0 agents: enrolment and communication both. -->
      <port>1517</port>

      <!-- Verified on 5.0.0-beta5: the shipped configuration already sets
           0.0.0.0, so the listener accepts agents from other hosts out of the
           box. The enrolment requirements page claiming 127.0.0.1 does not
           match the package default. Check your own file before changing it. -->
      <bind_addr>0.0.0.0</bind_addr>

      <!-- URL prefix for every agent request, and for your health check.
           https://manager:1517/               -> {"error":"not_found"}
           https://manager:1517/wazuh-manager/ -> {"status":"ok","module":"remoted"} -->
      <global_prefix>/wazuh-manager/</global_prefix>

      <certificate>etc/certs/remoted.pem</certificate>
      <key>etc/certs/remoted-key.pem</key>

      <!-- Client certificate verification: none (default), certificate, full.
           full additionally requires the peer address in the certificate SAN,
           which breaks agents behind NAT. -->
      <verification_mode>none</verification_mode>
    </https>

    <!-- Legacy channel for Wazuh 4.x agents only. This block is present and
         enabled in the shipped 5.0.0-beta5 configuration, so a stock manager
         listens on 1514 1515 1516 1517 55000. Remove it once no 4.x agents
         remain, then close 1514 and 1515 on the firewall. -->
    <legacy>
      <enabled>yes</enabled>
      <port>1514</port>
      <protocol>tcp</protocol>
      <local_ip>0.0.0.0</local_ip>
      <queue_size>131072</queue_size>
      <!-- Seconds before a new connection may replace an existing one for the
           same agent. 0 disables the protection. Default 60. -->
      <connection_overtake_time>60</connection_overtake_time>
    </legacy>

    <!-- Connection gate for agents newer than the manager. The matching
         option under <auth><agents> is the enrolment gate; BOTH must be yes
         for a higher-version agent to enrol and communicate. -->
    <agents>
      <allow_higher_versions>no</allow_higher_versions>
    </agents>
  </remote>

  <auth>
    <disabled>no</disabled>
    <port>1515</port>

    <!-- The installer sets this to yes. The password is read from
         /var/wazuh-manager/etc/authd.pass and generated at first start if the
         file is absent. An existing but empty or invalid file stops authd. -->
    <use_password>yes</use_password>

    <ssl_manager_cert>etc/certs/remoted.pem</ssl_manager_cert>
    <ssl_manager_key>etc/certs/remoted-key.pem</ssl_manager_key>

    <!-- Conditions under which an existing agent record can be replaced.
         If a re-enrolment is being refused, these four options are why. -->
    <force>
      <enabled>yes</enabled>
      <key_mismatch>yes</key_mismatch>
      <disconnected_time enabled="yes">1h</disconnected_time>
      <after_registration_time>1h</after_registration_time>
    </force>

    <!-- yes removes a deleted record outright; no keeps a !-prefixed
         placeholder line in client.keys so the ID and name are not reused. -->
    <purge>yes</purge>
  </auth>

</wazuh_config>
