# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) # # ANNOTATED COPY of single-node/docker-compose.yml from # https://github.com/wazuh/wazuh-docker at tag v5.0.0-beta5. # # Every service, image, port, environment variable and volume below is # unchanged from the upstream file. The only additions are the comment # lines marked "NOTE:". Do not treat this as a replacement for the # upstream file; clone the repository and compare before using it. # # Lesson: https://maheshtata.com/wazuh/wazuh-docker/ # # NOTE: the Wazuh 5.0 Docker documentation says that when testing beta5 you # should append "-latest" to each image tag, e.g. # image: wazuh/wazuh-manager:5.0.0-beta5-latest # The upstream file carries the plain tags reproduced here. # # NOTE: before "docker compose up -d", on the Docker host run # sysctl -w vm.max_map_count=262144 # and make it persistent. The indexer will not work correctly below 262144. services: wazuh.manager: image: wazuh/wazuh-manager:5.0.0-beta5 hostname: wazuh.manager container_name: single-node-wazuh.manager restart: always depends_on: wazuh.indexer: condition: service_healthy healthcheck: # NOTE: wazuh-manager-control lives under /var/wazuh-manager/bin in 5.0. # The 4.x path /var/ossec/bin does not exist in these images. test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ] interval: 15s timeout: 5s retries: 5 start_period: 60s ulimits: memlock: soft: -1 hard: -1 nofile: soft: 655360 hard: 655360 ports: # NOTE: 1517 is the only port Wazuh 5.x agents use. Point agents at the # DOCKER HOST address on this port, not at the container name. - "1517:1517" # NOTE: 1514 / 1515 serve Wazuh 4.x agents only. Verified on 5.0.0-beta5, # the shipped wazuh-manager.conf has yes # and 1515, so both listeners are up inside the # container already. Delete these two mappings unless you run 4.x agents; # the lab stack ran without them. - "1514:1514" - "1515:1515" # NOTE: the upstream beta5 compose still publishes 514/udp, but the # manager's syslog listener was removed in 5.0 (see the migration guide # and wazuh-log-collection/rsyslog-10-remote.conf). Kept verbatim so the # file matches upstream; remove the line below on a real deployment. - "514:514/udp" # NOTE: manager API. Do not publish this to an untrusted network. - "55000:55000" environment: - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 - WAZUH_NODE_NAME=manager - WAZUH_CLUSTER_NODES=wazuh.manager - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager # NOTE: default credentials, in plain text, visible to anyone who can # read this file or run "docker inspect". Change before exposing 443. - INDEXER_USERNAME=wazuh-manager - INDEXER_PASSWORD=wazuh-manager volumes: # NOTE: 5.0 manager paths. wazuh_etc holds client.keys, authd.pass and # the manager certificates, so "docker compose down -v" loses your # agent estate's keys. - wazuh_api_configuration:/var/wazuh-manager/api/configuration - wazuh_etc:/var/wazuh-manager/etc - wazuh_logs:/var/wazuh-manager/logs - wazuh_queue:/var/wazuh-manager/queue - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/indexer-connector.pem - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/indexer-connector-key.pem wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0-beta5 hostname: wazuh.indexer container_name: single-node-wazuh.indexer restart: always ports: # NOTE: indexer API. Keep this off any untrusted network. - "9200:9200" environment: # NOTE: 1 GB heap. Fine for a lab, far too small for real ingest. # Keep Xms and Xmx equal and make sure the host has the memory. - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g - bootstrap.memory_lock=true - network.host=0.0.0.0 - node.name=wazuh.indexer - cluster.initial_cluster_manager_nodes=wazuh.indexer - node.max_local_storage_nodes=1 - plugins.security.allow_default_init_securityindex=true # NOTE: this DN must match the certificate generated for wazuh.indexer. # Renaming the service means regenerating certificates. - NODES_DN=CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 healthcheck: test: [ "CMD-SHELL", "curl -fks https://localhost:9200/_plugins/_security/health | grep -q '\"status\":\"UP\"'" ] interval: 30s timeout: 10s retries: 5 start_period: 60s volumes: # NOTE: all indexed data. Put this volume on a dedicated device for # anything beyond a lab, and alert on its usage. - wazuh-indexer-data:/var/lib/wazuh-indexer - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - ./config/wazuh_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0-beta5 hostname: wazuh.dashboard container_name: single-node-wazuh.dashboard restart: always healthcheck: test: [ "CMD", "curl", "-k", "-s", "-o", "/dev/null", "https://localhost:5601/login" ] interval: 30s timeout: 10s retries: 3 start_period: 30s ports: # NOTE: the dashboard listens on 5601 inside the container and is # published on 443. Change the left side only to move the external port. - 443:5601 environment: - SERVER_PORT=5601 - SERVER_HOST=0.0.0.0 - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - WAZUH_API_URL=https://wazuh.manager # NOTE: another default credential pair to change. - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem volumes: - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: wazuh.indexer: condition: service_healthy wazuh.manager: condition: service_healthy volumes: wazuh_api_configuration: wazuh_etc: wazuh_logs: wazuh_queue: wazuh_var_multigroups: wazuh-indexer-data: wazuh-dashboard-config: wazuh-dashboard-custom: