# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
#
# ANNOTATED COPY of wazuh-agent/docker-compose.yml from
# https://github.com/wazuh/wazuh-docker at tag v5.0.0-beta5.
# Service, image, and environment variables are unchanged; comment lines
# marked "NOTE:" are additions.
#
# Lesson: https://maheshtata.com/wazuh/wazuh-docker/
#
# NOTE: a containerised agent cannot access or monitor the host it runs on.
# The Wazuh documentation states this plainly. Use it for receiving forwarded
# logs and for integrations. To monitor a Docker host, install the agent on
# the host instead.
#
# NOTE: the Docker documentation page for the agent shows an older variable,
# WAZUH_MANAGER_SERVER. The repository at the v5.0.0-beta5 tag uses
# WAZUH_MANAGER_ENDPOINT, reproduced below. Where the two disagree, trust the
# tag you cloned.
#
# NOTE: enrolment in 5.0 needs the enrolment password from
# /var/wazuh-manager/etc/authd.pass on the manager, and any group you intend
# the agent to join must already exist on the manager.

services:
  wazuh.agent:
    image: wazuh/wazuh-agent:5.0.0-beta5
    restart: always
    environment:
      # The whole manager connection as one host[:port][/prefix] value. Required.
      # The port and the prefix may be left out, defaulting to 1517 and
      # /wazuh-manager/.
      - WAZUH_MANAGER_ENDPOINT=<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>:1517/wazuh-manager/
      #- WAZUH_AGENT_NAME=<WAZUH_AGENT_NAME>
      - WAZUH_REGISTRATION_PASSWORD=<authd.pass-PASSWORD>