Merge pull request #2220 from wazuh/enhancement/2206-adapt-image-build

Separate Agent/Manager - Docker - Adapt image build process

.env

@@ -1,4 +1,3 @@
 WAZUH_VERSION=5.0.0
 WAZUH_IMAGE_VERSION=5.0.0
 WAZUH_REGISTRY=docker.io
-IMAGE_TAG=5.0.0

.github/.goss.yaml

@@ -1,26 +1,26 @@
 file:
-  /var/ossec/bin/wazuh-control:
+  /var/wazuh-manager/bin/wazuh-control:
     exists: true
     mode: "0750"
     owner: root
     group: root
     filetype: file
     contains: []
-  /var/ossec/etc/ossec.conf:
+  /var/wazuh-manager/etc/wazuh-manager.conf:
     exists: true
     mode: "0660"
     owner: root
-    group: wazuh
+    group: wazuh-manager
     filetype: file
     contains: []
-  /var/ossec/etc/sslmanager.cert:
+  /var/wazuh-manager/etc/sslmanager.cert:
     exists: true
     mode: "0644"
     owner: root
     group: root
     filetype: file
     contains: []
-  /var/ossec/etc/sslmanager.key:
+  /var/wazuh-manager/etc/sslmanager.key:
     exists: true
     mode: "0600"
     owner: root
@@ -28,12 +28,12 @@ file:
     filetype: file
     contains: []
 user:
-  wazuh:
+  wazuh-manager:
     exists: true
     groups:
-    - wazuh
-    home: /var/ossec
+    - wazuh-manager
+    home: /var/wazuh-manager
     shell: /sbin/nologin
 group:
-  wazuh:
-    exists: true
+  wazuh-manager:
+    exists: true

.github/multi-node-log-check.sh

@@ -1,16 +1,16 @@
-log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
 if [[ -z "$log1" ]]; then
-  echo "No errors in master ossec.log"
+  echo "No errors in master wazuh-manager.log"
 else
-  echo "Errors in master ossec.log:"
+  echo "Errors in master wazuh-manager.log:"
   echo "${log1}"
   exit 1
 fi
-log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
 if [[ -z "${log2}" ]]; then
-  echo "No errors in worker ossec.log"
+  echo "No errors in worker wazuh-manager.log"
 else
-  echo "Errors in worker ossec.log:"
+  echo "Errors in worker wazuh-manager.log:"
   echo "${log2}"
   exit 1
-fi
+fi

.github/single-node-log-check.sh

@@ -1,8 +1,8 @@
-log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
 if [[ -z "$log" ]]; then
-  echo "No errors in ossec.log"
+  echo "No errors in wazuh-manager.log"
 else
-  echo "Errors in ossec.log:"
+  echo "Errors in wazuh-manager.log:"
   echo "${log}"
   exit 1
-fi
+fi

.github/workflows/5_pr_check.yml

@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-22.04
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
-      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} 
+      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
     steps:
 
     - name: Check out code
@@ -83,7 +83,7 @@ jobs:
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
-      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} 
+      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
       INDEXER_USERNAME: admin
       INDEXER_PASSWORD: admin
       API_USERNAME: wazuh-wui
@@ -128,9 +128,9 @@ jobs:
             - name: wazuh.indexer
               ip: wazuh.indexer
 
-          # Wazuh server nodes
+          # Wazuh manager nodes
           # Use node_type only with more than one Wazuh manager
-          server:
+          manager:
             - name: wazuh.manager
               ip: wazuh.manager
 
@@ -159,98 +159,90 @@ jobs:
         fi
 
     - name: Start single node stack
+      id: start_single_node_stack
       run: docker compose up -d
       working-directory: ./single-node
 
     - name: Check Wazuh indexer start
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: |
-       for i in {1..20}; do
-        echo "Checking Wazuh indexer health (Attempt $i/20)"
-         RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
-         INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
-         if echo "$RESPONSE" | grep -qE "green|yellow"; then
-           echo "Cluster Online"
-           echo "$RESPONSE"
-           exit 0
-         fi
-         echo "Waiting for cluster to be online"
-         for CONTAINER_NAME in $INDEXER_CONTAINERS; do
-           echo ""
-           echo "========================================================="
-           echo "Container logs for $CONTAINER_NAME"
-           echo "========================================================="
-           docker logs --tail 30 "$CONTAINER_NAME"
-           echo "---------------------------------------------------------"
-         done
-         [ $i -lt 20 ] && sleep 60
-       done
-       status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
-       status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`"
-       if [[ $status_index_green -eq $status_index ]]; then
-        curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
-       else
-        curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
-        exit 1
-       fi
+        for i in {1..20}; do
+          echo "Checking Wazuh indexer health (Attempt $i/20)"
+          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
+          INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
+          if echo "$RESPONSE" | grep -qE "green|yellow"; then
+            echo "Cluster Online"
+            echo "$RESPONSE"
+            exit 0
+          fi
+          echo "Waiting for cluster to be online"
+          for CONTAINER_NAME in $INDEXER_CONTAINERS; do
+            echo ""
+            echo "========================================================="
+            echo "Container logs for $CONTAINER_NAME"
+            echo "========================================================="
+            docker logs --tail 30 "$CONTAINER_NAME"
+            echo "---------------------------------------------------------"
+          done
+          [ $i -lt 20 ] && sleep 60
+        done
+        status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
+        status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`"
+        if [[ $status_index_green -eq $status_index ]]; then
+          curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
+        else
+          curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
+          exit 1
+        fi
 
 
     - name: Check Wazuh indexer nodes
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: |
-       nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
-       if [[ $nodes -eq 1 ]]; then
+        nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
         echo "Wazuh indexer nodes: ${nodes}"
-       else
-        echo "Wazuh indexer nodes: ${nodes}"
-       fi
-
-    - name: Check documents into wazuh-states index
-      run: |
-        for i in {1..20}; do
-          echo "Checking documents in wazuh-states (Attempt $i/20)..."
-          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
-          DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
-          if [[ "$DOCS" -gt 0 ]]; then
-            echo "wazuh-states index has documents: ${DOCS}"
-            exit 0
-          fi
-          echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
-          [ $i -lt 20 ] && sleep 60
-        done
-        echo "Error: No documents found in wazuh-states after 20 attempts."
-        echo "Last response: $RESPONSE"
-        exit 1
 
     - name: Check Wazuh templates
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: |
-       qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
-       templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
-       if [[ $qty_templates -gt 3 ]]; then
-        echo "wazuh templates:"
-        echo "${templates}"
-       else
-        echo "wazuh templates:"
-        echo "${templates}"
-        exit 1
-       fi
+        qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
+        templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
+        if [[ $qty_templates -gt 3 ]]; then
+          echo "wazuh templates:"
+          echo "${templates}"
+        else
+          echo "wazuh templates:"
+          echo "${templates}"
+          exit 1
+        fi
 
     - name: Check Wazuh manager start
-      run: | 
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
+      run: |
         for NODE in "${{ env.MANAGER_NODES }}"; do
+          ok=false
           for i in {1..20}; do
             TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
             services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
-            if [[ $services -gt 9 ]]; then
+            if [[ $services -gt 7 ]]; then
               echo "Wazuh Manager $NODE Services: ${services}"
               echo "OK"
+              ok=true
+              break
             else
               curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
               echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
               [ $i -lt 20 ] && sleep 30
             fi
           done
+          if [[ "$ok" != "true" ]]; then
+            echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
+            exit 1
+          fi
         done
-        
+
     - name: Check Wazuh dashboard service URL
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: |
         for i in {1..20}; do
           echo "Checking Wazuh dashboard (Attempt $i/20)"
@@ -270,9 +262,11 @@ jobs:
         exit 1
 
     - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
 
     - name: Edit Wazuh agent docker-compose file
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       shell: bash
       env:
         WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
@@ -287,17 +281,21 @@ jobs:
         fi
 
     - name: Start Wazuh agent
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: docker compose up -d
       working-directory: ./wazuh-agent
 
     - name: Check Wazuh agent enrollment
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: |
+        enrolled=false
         for i in {1..5}; do
           TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
           agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
           if [[ $agents -gt 1 ]]; then
             echo "Wazuh agents: ${agents}"
             echo "OK"
+            enrolled=true
             break
           else
             curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H  "Authorization: Bearer ${TOKEN}"
@@ -305,27 +303,51 @@ jobs:
             [ $i -lt 5 ] && sleep 10
           fi
         done
+        if [[ "$enrolled" != "true" ]]; then
+          echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
+          exit 1
+        fi
 
-    - name: Check errors in ossec.log for Wazuh manager
+    - name: Check errors in wazuh-manager.log for Wazuh manager
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
       run: ./.github/single-node-log-check.sh
-    
+
+    - name: Check documents into wazuh-states index
+      if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
+      run: |
+        for i in {1..20}; do
+          echo "Checking documents in wazuh-states (Attempt $i/20)..."
+          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
+          DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
+          if [[ "$DOCS" -gt 0 ]]; then
+            echo "wazuh-states index has documents: ${DOCS}"
+            exit 0
+          fi
+          echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
+          [ $i -lt 20 ] && sleep 60
+        done
+        echo "Error: No documents found in wazuh-states after 20 attempts."
+        echo "Last response: $RESPONSE"
+        exit 1
+
     - name: Docker logs
       if: always()
+      continue-on-error: true
       run: |
         INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
         for CONTAINER_NAME in $INDEXER_CONTAINERS; do
-           echo ""
-           echo "========================================================="
-           echo "Container logs for $CONTAINER_NAME"
-           echo "========================================================="
-           docker logs "$CONTAINER_NAME"
-           echo "---------------------------------------------------------"
-         done
+          echo ""
+          echo "========================================================="
+          echo "Container logs for $CONTAINER_NAME"
+          echo "========================================================="
+          docker logs "$CONTAINER_NAME"
+          echo "---------------------------------------------------------"
+        done
       working-directory: ./single-node
 
   check-multi-node:
     name: Check multi node on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }} 
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-22.04, ubuntu-22.04-arm]
@@ -334,7 +356,7 @@ jobs:
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
-      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} 
+      WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
       INDEXER_USERNAME: admin
       INDEXER_PASSWORD: admin
       API_USERNAME: wazuh-wui
@@ -383,9 +405,9 @@ jobs:
             - name: wazuh3.indexer
               ip: wazuh3.indexer
 
-          # Wazuh server nodes
+          # Wazuh manager nodes
           # Use node_type only with more than one Wazuh manager
-          server:
+          manager:
             - name: wazuh.master
               ip: wazuh.master
               node_type: master
@@ -416,89 +438,85 @@ jobs:
         fi
 
     - name: Start multi node stack
+      id: start_multi_node_stack
       run: docker compose up -d
       working-directory: ./multi-node
 
     - name: Check Wazuh indexer start
-      run: |
-       for i in {1..20}; do
-        echo "Checking Wazuh indexer health (Attempt $i/20)"
-         RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
-         INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
-         if echo "$RESPONSE" | grep -qE "green|yellow"; then
-           echo "Cluster Online"
-           echo "$RESPONSE"
-           exit 0
-         fi
-         echo "Waiting for cluster to be online"
-         for CONTAINER_NAME in $INDEXER_CONTAINERS; do
-           echo ""
-           echo "========================================================="
-           echo "Container logs for $CONTAINER_NAME"
-           echo "========================================================="
-           docker logs --tail 30 "$CONTAINER_NAME"
-           echo "---------------------------------------------------------"
-         done
-         [ $i -lt 20 ] && sleep 60
-       done
-       status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
-       status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
-       if [[ $status_index_green -eq $status_index ]]; then
-        curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
-       else
-        curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
-        exit 1
-       fi
-
-    - name: Check Wazuh indexer nodes
-      run: |
-       nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
-       if [[ $nodes -eq 3 ]]; then
-        echo "Wazuh indexer nodes: ${nodes}"
-       else
-        echo "Wazuh indexer nodes: ${nodes}"
-       fi
-
-    - name: Check documents into wazuh-states index
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: |
         for i in {1..20}; do
-          echo "Checking documents in wazuh-states (Attempt $i/20)..."
-          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
-          DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
-          if [[ "$DOCS" -gt 0 ]]; then
-            echo "wazuh-states index has documents: ${DOCS}"
+          echo "Checking Wazuh indexer health (Attempt $i/20)"
+          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
+          INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
+          if echo "$RESPONSE" | grep -qE "green|yellow"; then
+            echo "Cluster Online"
+            echo "$RESPONSE"
             exit 0
           fi
-          echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
+          echo "Waiting for cluster to be online"
+          for CONTAINER_NAME in $INDEXER_CONTAINERS; do
+            echo ""
+            echo "========================================================="
+            echo "Container logs for $CONTAINER_NAME"
+            echo "========================================================="
+            docker logs --tail 30 "$CONTAINER_NAME"
+            echo "---------------------------------------------------------"
+          done
           [ $i -lt 20 ] && sleep 60
         done
-        echo "Error: No documents found in wazuh-states after 20 attempts."
-        echo "Last response: $RESPONSE"
-        exit 1
+        status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
+        status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
+        if [[ $status_index_green -eq $status_index ]]; then
+          curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
+        else
+          curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
+          exit 1
+        fi
+
+    - name: Check Wazuh indexer nodes
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
+      run: |
+        nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
+        if [[ $nodes -eq 3 ]]; then
+          echo "Wazuh indexer nodes: ${nodes}"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          exit 1
+        fi
 
     - name: Check Wazuh templates
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: |
-       qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`"
-       templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`"
-       if [[ $qty_templates -gt 3 ]]; then
-        echo "wazuh templates:"
-        echo "${templates}"
-       else
-        echo "wazuh templates:"
-        echo "${templates}"
-        exit 1
-       fi
+        qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`"
+        templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`"
+        if [[ $qty_templates -gt 3 ]]; then
+          echo "wazuh templates:"
+          echo "${templates}"
+        else
+          echo "wazuh templates:"
+          echo "${templates}"
+          exit 1
+        fi
 
     - name: Check Wazuh manager start
-      run: | 
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
+      run: |
         IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}"
         for NODE in "${NODES[@]}"; do
+          if [[ "$NODE" == "master" ]]; then
+            THRESHOLD=8
+          else
+            THRESHOLD=7
+          fi
+          ok=false
           for i in {1..20}; do
             TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
             services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
-            if [[ $services -gt 9 ]]; then
+            if [[ $services -ge $THRESHOLD ]]; then
               echo "Wazuh Manager $NODE Services: ${services}"
               echo "OK"
+              ok=true
               break
             else
               curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
@@ -506,9 +524,14 @@ jobs:
               [ $i -lt 20 ] && sleep 30
             fi
           done
+          if [[ "$ok" != "true" ]]; then
+            echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
+            exit 1
+          fi
         done
 
     - name: Check Wazuh dashboard service URL
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: |
         for i in {1..20}; do
           echo "Checking Wazuh dashboard (Attempt $i/20)"
@@ -528,9 +551,11 @@ jobs:
         exit 1
 
     - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
 
     - name: Edit Wazuh agent docker-compose file
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       shell: bash
       env:
         WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
@@ -545,16 +570,20 @@ jobs:
         fi
 
     - name: Start Wazuh agent
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: docker compose -f wazuh-agent/docker-compose.yml up -d
 
     - name: Check Wazuh agent enrollment
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: |
+        enrolled=false
         for i in {1..5}; do
           TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
           agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H  "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
           if [[ $agents -gt 1 ]]; then
             echo "Wazuh agents: ${agents}"
             echo "OK"
+            enrolled=true
             break
           else
             curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H  "Authorization: Bearer ${TOKEN}"
@@ -562,20 +591,44 @@ jobs:
             [ $i -lt 5 ] && sleep 10
           fi
         done
+        if [[ "$enrolled" != "true" ]]; then
+          echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
+          exit 1
+        fi
 
-    - name: Check errors in ossec.log for Wazuh manager
+    - name: Check errors in wazuh-manager.log for Wazuh manager
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
       run: ./.github/multi-node-log-check.sh
-    
+
+    - name: Check documents into wazuh-states index
+      if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
+      run: |
+        for i in {1..20}; do
+          echo "Checking documents in wazuh-states (Attempt $i/20)..."
+          RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
+          DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
+          if [[ "$DOCS" -gt 0 ]]; then
+            echo "wazuh-states index has documents: ${DOCS}"
+            exit 0
+          fi
+          echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
+          [ $i -lt 20 ] && sleep 60
+        done
+        echo "Error: No documents found in wazuh-states after 20 attempts."
+        echo "Last response: $RESPONSE"
+        exit 1
+
     - name: Docker logs
       if: always()
+      continue-on-error: true
       run: |
         INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
         for CONTAINER_NAME in $INDEXER_CONTAINERS; do
-           echo ""
-           echo "========================================================="
-           echo "Container logs for $CONTAINER_NAME"
-           echo "========================================================="
-           docker logs "$CONTAINER_NAME"
-           echo "---------------------------------------------------------"
-         done
-      working-directory: ./single-node
+          echo ""
+          echo "========================================================="
+          echo "Container logs for $CONTAINER_NAME"
+          echo "========================================================="
+          docker logs "$CONTAINER_NAME"
+          echo "---------------------------------------------------------"
+        done
+      working-directory: ./multi-node

CHANGELOG.md

@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- Move index documents test ([#2221](https://github.com/wazuh/wazuh-docker/pull/2221))
+- Separate Agent/Manager - Docker - Adapt image build process ([#2220](https://github.com/wazuh/wazuh-docker/pull/2220))
 - Remove revision input ([#2217](https://github.com/wazuh/wazuh-docker/pull/2217))
 - Improve build script and workflow component revisions handling ([#2212](https://github.com/wazuh/wazuh-docker/pull/2212))
 - Add missing documentation sections in the repository ([#2215](https://github.com/wazuh/wazuh-docker/pull/2215))

README.md

@@ -5,7 +5,7 @@
 
 ## Description
 
-The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh server, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search.
+The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh manager, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search.
 
 ## Capabilities
 

build-docker-images/build-images.yml

@@ -22,13 +22,12 @@ services:
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
     volumes:
-      - wazuh_api_configuration:/var/ossec/api/configuration
-      - wazuh_etc:/var/ossec/etc
-      - wazuh_logs:/var/ossec/logs
-      - wazuh_queue:/var/ossec/queue
-      - wazuh_var_multigroups:/var/ossec/var/multigroups
-      - wazuh_active_response:/var/ossec/active-response/bin
-      - wazuh_wodles:/var/ossec/wodles
+      - wazuh_api_configuration:/var/wazuh-manager/api/configuration
+      - wazuh_etc:/var/wazuh-manager/etc
+      - wazuh_logs:/var/wazuh-manager/logs
+      - wazuh_queue:/var/wazuh-manager/queue
+      - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
+      - wazuh_active_response:/var/wazuh-manager/active-response/bin
 
   wazuh.agent:
     build:
@@ -97,5 +96,4 @@ volumes:
   wazuh_queue:
   wazuh_var_multigroups:
   wazuh_active_response:
-  wazuh_wodles:
 

build-docker-images/wazuh-manager/Dockerfile

@@ -24,12 +24,11 @@ RUN URL_VAR="wazuh_manager_${TARGETARCH}_rpm" && \
     tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
     tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
     rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
-    rm -f /var/ossec/etc/sslmanager.key && \
-    rm -f /var/ossec/etc/sslmanager.cert
+    rm -f /var/wazuh-manager/etc/sslmanager.key && \
+    rm -f /var/wazuh-manager/etc/sslmanager.cert
 
 COPY config/etc/ /etc/
-COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
-
+COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547
 
@@ -37,12 +36,12 @@ COPY config/permanent_data.env config/permanent_data.sh /
 
 #Make mount directories for keep permissions
 
-RUN mkdir -p /var/ossec/var/multigroups && \
-    chown root:wazuh /var/ossec/var/multigroups && \
-    chmod 770 /var/ossec/var/multigroups && \
-    mkdir -p /var/ossec/active-response/bin && \
-    chown root:wazuh /var/ossec/active-response/bin && \
-    chmod 770 /var/ossec/active-response/bin && \
+RUN mkdir -p /var/wazuh-manager/var/multigroups && \
+    chown root:wazuh-manager /var/wazuh-manager/var/multigroups && \
+    chmod 770 /var/wazuh-manager/var/multigroups && \
+    mkdir -p /var/wazuh-manager/active-response/bin && \
+    chown root:wazuh-manager /var/wazuh-manager/active-response/bin && \
+    chmod 770 /var/wazuh-manager/active-response/bin && \
     chmod 755 /permanent_data.sh && \
     sync && /permanent_data.sh && \
     sync && rm /permanent_data.sh

build-docker-images/wazuh-manager/config/create_user.py

@@ -8,7 +8,7 @@ import os
 # Set framework path
 sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
 
-USER_FILE_PATH = "/var/ossec/api/configuration/admin.json"
+USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json"
 SPECIAL_CHARS = "@$!%*?&-_"
 
 

build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init

@@ -4,7 +4,7 @@
 # Variables
 source /permanent_data.env
 
-WAZUH_INSTALL_PATH=/var/ossec
+WAZUH_INSTALL_PATH=/var/wazuh-manager
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
 
 ##############################################################################
@@ -119,7 +119,7 @@ remove_data_files() {
 # Create certificates: Manager
 ##############################################################################
 
-create_ossec_key_cert() {
+create_wazuh_key_cert() {
   print "Creating wazuh-authd key and cert"
   exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
   exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
@@ -129,9 +129,9 @@ create_ossec_key_cert() {
 # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
 # destination files permissions
 #
-# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
-# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
-# replace the ossec.conf file in /var/ossec/data/etc with yours.
+# For example, to mount the file /var/wazuh-manager/data/etc/wazuh-manager.conf, mount it at
+# $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf in your container and this code will
+# replace the wazuh-manager.conf file in /var/wazuh-manager/data/etc with yours.
 ##############################################################################
 
 mount_files() {
@@ -150,23 +150,23 @@ mount_files() {
 # container start.
 #
 # To use this:
-# 1. Create your own ossec.conf file
-# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name
-# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
+# 1. Create your own wazuh-manager.conf file
+# 2. In your wazuh-manager.conf file, set to_be_replaced_by_hostname as your node_name
+# 3. Mount your custom wazuh-manager.conf file at $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf
 ##############################################################################
 
 set_custom_hostname() {
-  sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf
 }
 
-function_configure_ossec_conf() {
-OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf"
+function_configure_wazuh_manager_conf() {
+WAZUH_MANAGER_CONF="${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf"
 
 # --------------------------
-# Defaults based on OSSEC_CONF
+# Defaults based on WAZUH_MANAGER_CONF
 # --------------------------
 if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then
-    WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1)
+    WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$WAZUH_MANAGER_CONF" | head -n1)
 fi
 
 # Node type logic
@@ -193,7 +193,7 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
         echo "    </hosts>"
     } > "$TMP_HOSTS";
     sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
-            -e 'd }}' "$OSSEC_CONF";
+            -e 'd }}' "$WAZUH_MANAGER_CONF";
     rm -f "$TMP_HOSTS";
 
 fi
@@ -201,22 +201,22 @@ fi
 # --------------------------
 # Cluster: node_name
 # --------------------------
-sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$OSSEC_CONF"
+sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$WAZUH_MANAGER_CONF"
 
 # --------------------------
 # Cluster: node_type
 # --------------------------
-sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$OSSEC_CONF"
+sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$WAZUH_MANAGER_CONF"
 
 # --------------------------
 # Cluster: key
 # --------------------------
-sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$OSSEC_CONF"
+sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$WAZUH_MANAGER_CONF"
 
 # --------------------------
 # Cluster: bind_addr
 # --------------------------
-sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$OSSEC_CONF"
+sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$WAZUH_MANAGER_CONF"
 
 # --------------------------
 # Cluster: nodes list
@@ -231,7 +231,7 @@ if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then
         echo "    </nodes>"
     } > "$TMP_NODES";
     sed -i -e '/<cluster>/,/<\/cluster>/{ /<nodes>/,/<\/nodes>/{ /<nodes>/r '"$TMP_NODES" \
-            -e 'd }}' "$OSSEC_CONF";
+            -e 'd }}' "$WAZUH_MANAGER_CONF";
     rm -f "$TMP_NODES";
 fi
 
@@ -244,11 +244,11 @@ echo "Wazuh manager config modified successfully."
 ##############################################################################
 
 configure_permissions() {
-  chown -R wazuh:wazuh /var/ossec/queue/rids
+  chown -R wazuh-manager:wazuh-manager /var/wazuh-manager/queue/rids
 }
 
 ##############################################################################
-# Change any ossec user/group to wazuh user/group
+# Change any legacy user/group to wazuh-manager user/group
 ##############################################################################
 
 set_correct_permOwner() {
@@ -262,7 +262,7 @@ set_correct_permOwner() {
 ##############################################################################
 
 main() {
-  # Mount permanent data  (i.e. ossec.conf)
+  # Mount permanent data  (i.e. wazuh-manager.conf)
   mount_permanent_data
 
   # Restore files stored in permanent data that are not permanent  (i.e. internal_options.conf)
@@ -271,7 +271,7 @@ main() {
   # Apply correct permission and ownership
   set_correct_permOwner
 
-  # Rename files stored in permanent data (i.e. queue/ossec)
+  # Rename files stored in permanent data (i.e. queue/wazuh-manager)
   move_data_files
 
   # Remove some files in permanent_data (i.e. .template.db)
@@ -280,7 +280,7 @@ main() {
   # Create wazuh-authd key and cert if not present
   if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
   then
-    create_ossec_key_cert
+    create_wazuh_key_cert
   fi
 
   # Mount selected files (WAZUH_CONFIG_MOUNT) to container
@@ -289,9 +289,8 @@ main() {
   # Allow setting custom hostname
   set_custom_hostname
 
-  # Configure ossec.conf based on environment variables
-  function_configure_ossec_conf
-
+  # Configure wazuh-manager.conf based on environment variables
+  function_configure_wazuh_manager_conf
   # Delete temporary data folder
   rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
 

build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager

@@ -3,7 +3,7 @@
 ##############################################################################
 # Migration sequence
 # Detect if there is a mounted volume on /wazuh-migration and copy the data
-# to /var/ossec, finally it will create a flag ".migration-completed" inside
+# to /var/wazuh-manager, finally it will create a flag ".migration-completed" inside
 # the mounted volume
 ##############################################################################
 
@@ -35,34 +35,33 @@ function_wazuh_migration(){
         return
       fi
 
-      \cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf
-      chown root:wazuh /var/ossec/etc/ossec.conf
-      chmod 640 /var/ossec/etc/ossec.conf
+      \cp -f /wazuh-migration/data/etc/wazuh-manager.conf /var/wazuh-manager/etc/wazuh-manager.conf
+      chown root:wazuh-manager /var/wazuh-manager/etc/wazuh-manager.conf
+      chmod 640 /var/wazuh-manager/etc/wazuh-manager.conf
 
-      \cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys
-      chown wazuh:wazuh /var/ossec/etc/client.keys
-      chmod 640 /var/ossec/etc/client.keys
+      \cp -f /wazuh-migration/data/etc/client.keys /var/wazuh-manager/etc/client.keys
+      chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/client.keys
+      chmod 640 /var/wazuh-manager/etc/client.keys
 
-      \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert
-      \cp -f /wazuh-migration/data/etc/sslmanager.key /var/ossec/etc/sslmanager.key
-      chown root:root /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
-      chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
+      \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.cert
+      \cp -f /wazuh-migration/data/etc/sslmanager.key /var/wazuh-manager/etc/sslmanager.key
+      chown root:root /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
+      chmod 640 /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
 
-      \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf
-      chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf
-      chmod 660 /var/ossec/etc/shared/default/agent.conf
+      \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/wazuh-manager/etc/shared/default/agent.conf
+      chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/shared/default/agent.conf
+      chmod 660 /var/wazuh-manager/etc/shared/default/agent.conf
 
-      \cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/
-      chown wazuh:wazuh /var/ossec/etc/decoders/*
-      chmod 660 /var/ossec/etc/decoders/*
+      \cp -f /wazuh-migration/data/etc/decoders/* /var/wazuh-manager/etc/decoders/
+      chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/decoders/*
+      chmod 660 /var/wazuh-manager/etc/decoders/*
+      \cp -f /wazuh-migration/data/etc/rules/* /var/wazuh-manager/etc/rules/
+      chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/rules/*
+      chmod 660 /var/wazuh-manager/etc/rules/*
 
-      \cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/
-      chown wazuh:wazuh /var/ossec/etc/rules/*
-      chmod 660 /var/ossec/etc/rules/*
-
-      \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
-      chown wazuh:wazuh /var/ossec/queue/db/global.db
-      chmod 640 /var/ossec/queue/db/global.db
+      \cp -f /wazuh-migration/global.db /var/wazuh-manager/queue/db/global.db
+      chown wazuh-manager:wazuh-manager /var/wazuh-manager/queue/db/global.db
+      chmod 640 /var/wazuh-manager/queue/db/global.db
 
       # mark volume as migrated
       touch /wazuh-migration/.migration-completed
@@ -76,7 +75,7 @@ function_wazuh_migration(){
 
 function_create_custom_user() {
   if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
-  cat << EOF > /var/ossec/api/configuration/admin.json
+  cat << EOF > /var/wazuh-manager/api/configuration/admin.json
 {
   "username": "$API_USERNAME",
   "password": "$API_PASSWORD"
@@ -84,9 +83,9 @@ function_create_custom_user() {
 EOF
 
     # create or customize API user
-    if /var/ossec/framework/python/bin/python3  /var/ossec/framework/scripts/create_user.py; then
+    if /var/wazuh-manager/framework/python/bin/python3  /var/wazuh-manager/framework/scripts/create_user.py; then
       # remove json if exit code is 0
-      rm /var/ossec/api/configuration/admin.json
+      rm /var/wazuh-manager/api/configuration/admin.json
     else
       echored "There was an error configuring the API user"
       # terminate container to avoid unpredictable behavior
@@ -109,8 +108,8 @@ function_entrypoint_scripts() {
 function_configure_vulnerability_detection() {
 if [ "$INDEXER_PASSWORD" != "" ]; then
   >&2 echo "Configuring password."
-    echo "$INDEXER_USERNAME" | /var/ossec/bin/wazuh-keystore -f indexer -k username
-    echo "$INDEXER_PASSWORD" | /var/ossec/bin/wazuh-keystore -f indexer -k password
+    echo "$INDEXER_USERNAME" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k username
+    echo "$INDEXER_PASSWORD" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k password
 fi
 }
 
@@ -127,4 +126,4 @@ function_configure_vulnerability_detection
 function_entrypoint_scripts
 
 # Start Wazuh
-/var/ossec/bin/wazuh-control start
+/var/wazuh-manager/bin/wazuh-control start

build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run

@@ -1,4 +0,0 @@
-#!/usr/bin/with-contenv sh
-
-# dumping ossec.log to standard output
-exec tail -F /var/ossec/logs/ossec.log

build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run

@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+
+# dumping wazuh-manager.log to standard output
+exec tail -F /var/wazuh-manager/logs/wazuh-manager.log

build-docker-images/wazuh-manager/config/permanent_data.env

@@ -1,85 +1,41 @@
 # Permanent data mounted in volumes
 i=0
-PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
-PERMANENT_DATA[((i++))]="/var/ossec/etc"
-PERMANENT_DATA[((i++))]="/var/ossec/logs"
-PERMANENT_DATA[((i++))]="/var/ossec/queue"
-PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
-PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
-PERMANENT_DATA[((i++))]="/var/ossec/wodles"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/api/configuration"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups"
+PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin"
 
 export PERMANENT_DATA
 
 # Files mounted in a volume that should not be permanent
 i=0
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws_tools.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/wazuh_integration.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/aws_bucket.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/cloudtrail.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/config.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/guardduty.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/load_balancers.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/server_access.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/umbrella.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/vpcflow.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/waf.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/aws_service.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/cloudwatchlogs.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/inspector.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/s3_log_handler.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_processor.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/orm.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/utils.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_utils.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/__init__.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/analytics.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/graph.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/storage.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null"
+
 export PERMANENT_DATA_EXCP
 
 # Files mounted in a volume that should be deleted
 i=0
-PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db"
+PERMANENT_DATA_DEL[((i++))]="/var/wazuh-manager/queue/db/.template.db"
 export PERMANENT_DATA_DEL
 
 i=0
-PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh"
-PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets"
+PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/logs/ossec /var/wazuh-manager/logs/wazuh"
+PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/queue/ossec /var/wazuh-manager/queue/sockets"
 export PERMANENT_DATA_MOVE

build-docker-images/wazuh-manager/config/permanent_data.sh

@@ -4,7 +4,7 @@
 # Variables
 source /permanent_data.env
 
-WAZUH_INSTALL_PATH=/var/ossec
+WAZUH_INSTALL_PATH=/var/wazuh-manager
 DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp
 mkdir ${DATA_TMP_PATH}
 

docs/README.md

@@ -60,7 +60,7 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
 	│       │   │   │   ├── 0-wazuh-init
 	│       │   │   │   └── 2-manager
 	│       │   │   └── services.d
-	│       │   │       └── ossec-logs
+	│       │   │       └── wazuh-manager-logs
 	│       │   │           └── run
 	│       │   ├── permanent_data.env
 	│       │   └── permanent_data.sh

docs/ref/configuration/configuration-files.md

@@ -2,8 +2,8 @@
 
 ### 1. Wazuh Manager Configuration
 
-* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
-    * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .
+* **`wazuh-manager.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
+    * **Customization**: Mount a custom `wazuh-manager.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/wazuh-manager` (e.g., the file `/var/wazuh-manager/etc/wazuh-manager.conf` must be mounted at `/wazuh-mount-point/etc/wazuh-manager.conf`) .
 
 ### 2. Wazuh Indexer Configuration
 

docs/ref/configuration/configuration.md

@@ -11,7 +11,7 @@ Configuring Wazuh components within a Docker environment typically involves seve
     * These are often used for setting up initial passwords, component versions, cluster names, or basic operational parameters.
 
 2.  **[Configuration Files](configuration-files.md)**:
-    * Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `ossec.conf`, `opensearch.yml`, `opensearch_dashboards.yml`).
+    * Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `wazuh-manager.conf`, `opensearch.yml`, `opensearch_dashboards.yml`).
     * To customize these, you typically mount your custom configuration files into the containers, replacing or supplementing the defaults. This is managed using Docker volumes in your `docker-compose.yml`.
 
 3.  **Docker Compose File (`docker-compose.yml`)**:

docs/ref/getting-started/deployment/multi-node.md

@@ -38,9 +38,9 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
         - name: wazuh3.indexer
           ip: wazuh3.indexer
 
-      # Wazuh server nodes
+      # Wazuh manager nodes
       # Use node_type only with more than one Wazuh manager
-      server:
+      manager:
         - name: wazuh.master
           ip: wazuh.master
           node_type: master

docs/ref/getting-started/deployment/single-node.md

@@ -34,9 +34,9 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
         - name: wazuh.indexer
         ip: wazuh.indexer
 
-    # Wazuh server nodes
+    # Wazuh manager nodes
     # Use node_type only with more than one Wazuh manager
-    server:
+    manager:
         - name: wazuh.manager
         ip: wazuh.manager
 

docs/ref/glossary.md

@@ -60,7 +60,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
 
 **O**
 
--   **`ossec.conf`**: The main configuration file for the Wazuh Manager and Wazuh Agent.
+-   **`ossec.conf`**: The main configuration file for the Wazuh Agent.
 
 **R**
 
@@ -84,6 +84,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
 -   **Wazuh Dashboard**: See Dashboard.
 -   **Wazuh Indexer**: See Indexer.
 -   **Wazuh Manager**: See Manager.
+-   **`wazuh-manager.conf`**: The main configuration file for the Wazuh Manager.
 
 ---
 This glossary provides a starting point. For more detailed definitions or terms not listed here, please refer to the official Wazuh and Docker documentation.

multi-node/Migration-to-Wazuh-4.4.md

@@ -87,13 +87,6 @@ docker volume create \
            multi-node_master-wazuh-active-response
 ```
 ```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-wazuh-wodles \
-           multi-node_master-wazuh-wodles
-```
-```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
@@ -150,13 +143,6 @@ docker volume create \
            multi-node_worker-wazuh-active-response
 ```
 ```
-docker volume create \
-           --label com.docker.compose.project=multi-node \
-           --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-wazuh-wodles \
-           multi-node_worker-wazuh-wodles
-```
-```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
@@ -226,12 +212,6 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
-docker container run --rm -it \
-           -v wazuh-docker_ossec-wodles:/from \
-           -v multi-node_master-wazuh-wodles:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
 docker container run --rm -it \
            -v wazuh-docker-etc:/from \
            -v multi-node_master-etc:/to \
@@ -280,12 +260,6 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-wodles:/from \
-           -v multi-node_worker-wazuh-wodles:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-```
-```
 docker container run --rm -it \
            -v wazuh-docker_worker-etc:/from \
            -v multi-node_worker-wazuh-etc:/to \

multi-node/docker-compose.yml

@@ -27,16 +27,15 @@ services:
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
-      - master-wazuh-api-configuration:/var/ossec/api/configuration
-      - master-wazuh-etc:/var/ossec/etc
-      - master-wazuh-logs:/var/ossec/logs
-      - master-wazuh-queue:/var/ossec/queue
-      - master-wazuh-var-multigroups:/var/ossec/var/multigroups
-      - master-wazuh-active-response:/var/ossec/active-response/bin
-      - master-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem
-      - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem
+      - master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
+      - master-wazuh-etc:/var/wazuh-manager/etc
+      - master-wazuh-logs:/var/wazuh-manager/logs
+      - master-wazuh-queue:/var/wazuh-manager/queue
+      - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
+      - master-wazuh-active-response:/var/wazuh-manager/active-response/bin
+      - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
   wazuh.worker:
     image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
@@ -60,16 +59,15 @@ services:
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
-      - worker-wazuh-api-configuration:/var/ossec/api/configuration
-      - worker-wazuh-etc:/var/ossec/etc
-      - worker-wazuh-logs:/var/ossec/logs
-      - worker-wazuh-queue:/var/ossec/queue
-      - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
-      - worker-wazuh-active-response:/var/ossec/active-response/bin
-      - worker-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem
-      - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem
+      - worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
+      - worker-wazuh-etc:/var/wazuh-manager/etc
+      - worker-wazuh-logs:/var/wazuh-manager/logs
+      - worker-wazuh-queue:/var/wazuh-manager/queue
+      - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
+      - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin
+      - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
 
   wazuh1.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -218,14 +216,12 @@ volumes:
   master-wazuh-queue:
   master-wazuh-var-multigroups:
   master-wazuh-active-response:
-  master-wazuh-wodles:
   worker-wazuh-api-configuration:
   worker-wazuh-etc:
   worker-wazuh-logs:
   worker-wazuh-queue:
   worker-wazuh-var-multigroups:
   worker-wazuh-active-response:
-  worker-wazuh-wodles:
   wazuh-indexer-data-1:
   wazuh-indexer-data-2:
   wazuh-indexer-data-3:

multi-node/volume-migrator.sh

@@ -52,12 +52,6 @@ docker volume create \
            --label com.docker.compose.volume=master-wazuh-active-response \
            $2_master-wazuh-active-response
 
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-wazuh-wodles \
-           $2_master-wazuh-wodles
-
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
@@ -106,12 +100,6 @@ docker volume create \
            --label com.docker.compose.volume=worker-wazuh-active-response \
            $2_worker-wazuh-active-response
 
-docker volume create \
-           --label com.docker.compose.project=$2 \
-           --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-wazuh-wodles \
-           $2_worker-wazuh-wodles
-
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
@@ -174,11 +162,6 @@ docker container run --rm -it \
            -v $2_master-wazuh-active-response:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
-docker container run --rm -it \
-           -v wazuh-docker_ossec-wodles:/from \
-           -v $2_master-wazuh-wodles:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
 docker container run --rm -it \
            -v wazuh-docker-etc:/from \
            -v $2_master-wazuh-etc:/to \
@@ -219,11 +202,6 @@ docker container run --rm -it \
            -v $2_worker-wazuh-active-response:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
-docker container run --rm -it \
-           -v wazuh-docker_worker-ossec-wodles:/from \
-           -v $2_worker-wazuh-wodles:/to \
-           alpine ash -c "cd /from ; cp -avp . /to"
-
 docker container run --rm -it \
            -v wazuh-docker_worker-etc:/from \
            -v $2_worker-wazuh-etc:/to \

single-node/docker-compose.yml

@@ -27,16 +27,15 @@ services:
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
-      - wazuh_api_configuration:/var/ossec/api/configuration
-      - wazuh_etc:/var/ossec/etc
-      - wazuh_logs:/var/ossec/logs
-      - wazuh_queue:/var/ossec/queue
-      - wazuh_var_multigroups:/var/ossec/var/multigroups
-      - wazuh_active_response:/var/ossec/active-response/bin
-      - wazuh_wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem
-      - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem
+      - wazuh_api_configuration:/var/wazuh-manager/api/configuration
+      - wazuh_etc:/var/wazuh-manager/etc
+      - wazuh_logs:/var/wazuh-manager/logs
+      - wazuh_queue:/var/wazuh-manager/queue
+      - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
+      - wazuh_active_response:/var/wazuh-manager/active-response/bin
+      - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
 
   wazuh.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -109,7 +108,6 @@ volumes:
   wazuh_queue:
   wazuh_var_multigroups:
   wazuh_active_response:
-  wazuh_wodles:
   wazuh-indexer-data:
   wazuh-dashboard-config:
   wazuh-dashboard-custom: