Merge pull request #2121 from wazuh/change/2108-remove-all-filebeat-references-and-update-the-wazuh-app-references-to-opensearch_dashboards

Remove all filebeat references and update the wazuh app references to opensearch dashboards

.github/.goss.yaml

@@ -1,11 +1,4 @@
 file:
-  /etc/filebeat/filebeat.yml:
-    exists: true
-    mode: "0644"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
   /var/ossec/bin/wazuh-control:
     exists: true
     mode: "0750"
@@ -49,10 +42,6 @@ file:
     filetype: file
     contains: []
 package:
-  filebeat:
-    installed: true
-    versions:
-    - 7.10.2
   wazuh-manager:
     installed: true
     versions:
@@ -71,8 +60,6 @@ port:
     ip:
     - 0.0.0.0
 process:
-  filebeat:
-    running: true
   wazuh-analysisd:
     running: true
   wazuh-authd:

.github/multi-node-filebeat-check.sh

@@ -1,39 +0,0 @@
-COMMAND_TO_EXECUTE="filebeat test output"
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'master')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'master' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'worker')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'worker' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi

.github/single-node-filebeat-check.sh

@@ -1,20 +0,0 @@
-COMMAND_TO_EXECUTE="filebeat test output"
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'manager')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'manager' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi

.github/workflows/Procedure_push_docker_images.yml

@@ -18,7 +18,7 @@ on:
       reference:
         description: 'Dev reference'
         type: string
-        default: latest 
+        default: latest
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -47,7 +47,7 @@ on:
       reference:
         description: 'Dev reference'
         type: string
-        default: latest 
+        default: latest
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -97,7 +97,7 @@ jobs:
 
     - name: free disk space
       uses: ./.github/free-disk-space
-    
+
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
 
@@ -155,7 +155,7 @@ jobs:
         if [ "${{ inputs.dev }}" = true ]; then
           IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
           ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
-        else  
+        else
           if [[ "$IMAGE_TAG" == *"-"* ]]; then
             IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
             if [ -z "${tokens[1]}" ]; then

.github/workflows/push.yml

@@ -175,9 +175,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check filebeat output
-      run: ./.github/single-node-filebeat-check.sh
-
     - name: Check Wazuh dashboard service URL
       run: |
        status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk  '{print $2}')
@@ -338,9 +335,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check filebeat output
-      run: ./.github/multi-node-filebeat-check.sh
-
     - name: Check Wazuh dashboard service URL
       run: |
        status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk  '{print $2}')

.gitignore

@@ -4,10 +4,10 @@ build-docker-images/artifacts_env.txt
 single-node/wazuh-certificates
 single-node/wazuh-certificates/*
 single-node/wazuh-certificates-tool.log
-single-node/config.yml
 single-node/wazuh-certs-tool.sh
+single-node/config.yml
 multi-node/wazuh-certificates
 multi-node/wazuh-certificates/*
 multi-node/wazuh-certificates-tool.log
+multi-node/wazuh-certs-tool.sh
 multi-node/config.yml
-multi-node/wazuh-certs-tool.sh

build-docker-images/README.md

@@ -23,7 +23,7 @@ $ build-docker-images/build-images.sh -h
 
 Usage: build-docker-images/build-images.sh [OPTIONS]
 
-    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
+    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
     -r, --revision <rev>         [Optional] Package revision. By default 1
     -ref, --reference <ref>      [Optional] Set the Wazuh reference to build development images. By default, the latest stable release.
     -rg, --registry <reg>        [Optional] Set the Docker registry to push the images.

build-docker-images/build-images.sh

@@ -59,7 +59,7 @@ build() {
         fi
     fi
     awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt
-    
+
     echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
     echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
     echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env

build-docker-images/wazuh-dashboard/Dockerfile

@@ -8,7 +8,6 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard
 ARG TARGETARCH
 ARG wazuh_dashboard_url_amd64_rpm
 ARG wazuh_dashboard_url_arm64_rpm
-ARG wazuh_certs_tool
 ARG wazuh_config_yml
 
 # Update and install dependencies
@@ -27,16 +26,12 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
 
-# Generate certificates
-COPY config/config.sh .
-RUN bash config.sh
-
 ################################################################################
 # Build stage 1 (the current Wazuh dashboard image):
 #
 # Copy wazuh-dashboard from stage 0
 # Add entrypoint
-# Add wazuh_app_config
+# Add wazuh_dashboard_config
 ################################################################################
 FROM amazonlinux:2023
 
@@ -61,7 +56,7 @@ ENV USER="wazuh-dashboard" \
 
 # Copy and set permissions to scripts
 COPY config/entrypoint.sh /
-COPY config/wazuh_app_config.sh /
+COPY config/wazuh_dashboard_config.sh /
 
 # Update and install dependencies
 RUN yum install shadow-utils -y && \
@@ -76,7 +71,7 @@ RUN yum install shadow-utils -y && \
             --comment "$USER user" \
             $USER && \
     chmod 700 /entrypoint.sh && \
-    chmod 700 /wazuh_app_config.sh && \
+    chmod 700 /wazuh_dashboard_config.sh && \
     mkdir -p $INSTALL_DIR && \
     chown 1000:1000 $INSTALL_DIR && \
     chown 1000:1000 /*.sh && \
@@ -84,6 +79,7 @@ RUN yum install shadow-utils -y && \
 
 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR

build-docker-images/wazuh-dashboard/config/config.sh

@@ -1,57 +0,0 @@
-# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-# This has to be exported to make some magic below work.
-export DH_OPTIONS
-
-export NAME=wazuh-dashboard
-export TARGET_DIR=${CURDIR}/debian/${NAME}
-export INSTALLATION_DIR=/usr/share/${NAME}
-export CONFIG_DIR=${INSTALLATION_DIR}/config
-
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Create certs directory
-mkdir -p ${CONFIG_DIR}/certs
-
-# Copy Wazuh dashboard certs to install config dir
-mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
-cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
-# Modify opensearch.yml config paths
-sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
-
-chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*

build-docker-images/wazuh-dashboard/config/entrypoint.sh

@@ -24,6 +24,8 @@ yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --al
 echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
 echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
 
+/wazuh_dashboard_config.sh
+
 opensearch_dashboards_vars=(
     opensearch.hosts
     server.port

build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh

@@ -1,50 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-
-wazuh_url="${WAZUH_API_URL:-https://wazuh}"
-wazuh_port="${API_PORT:-55000}"
-api_username="${API_USERNAME:-wazuh-wui}"
-api_password="${API_PASSWORD:-wazuh-wui}"
-api_run_as="${RUN_AS:-false}"
-
-dashboard_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml"
-
-declare -A CONFIG_MAP=(
-  [pattern]=$PATTERN
-  [checks.pattern]=$CHECKS_PATTERN
-  [checks.template]=$CHECKS_TEMPLATE
-  [checks.api]=$CHECKS_API
-  [checks.setup]=$CHECKS_SETUP
-  [timeout]=$APP_TIMEOUT
-  [api.selector]=$API_SELECTOR
-  [ip.selector]=$IP_SELECTOR
-  [ip.ignore]=$IP_IGNORE
-  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
-  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
-  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
-  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
-)
-
-for i in "${!CONFIG_MAP[@]}"
-do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $dashboard_config_file
-    fi
-done
-
-grep -q 1513629884013 $dashboard_config_file
-_config_exists=$?
-
-if [[ $_config_exists -ne 0 ]]; then
-  cat << EOF >> $dashboard_config_file
-  hosts:
-    - 1513629884013:
-        url: $wazuh_url
-        port: $wazuh_port
-        username: $api_username
-        password: $api_password
-        run_as: $api_run_as
-  EOF
-else
-  echo "Wazuh APP already configured"
-fi

build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+# Environment variables with defaults
+SERVER_HOST="${SERVER_HOST:-0.0.0.0}"
+SERVER_PORT="${SERVER_PORT:-443}"
+OPENSEARCH_HOSTS="${OPENSEARCH_HOSTS:-https://wazuh.indexer:9200}"
+OPENSEARCH_SSL_VERIFICATION_MODE="${OPENSEARCH_SSL_VERIFICATION_MODE:-certificate}"
+OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-}"
+OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}"
+OPENSEARCH_REQUEST_HEADERS_ALLOWLIST="${OPENSEARCH_REQUEST_HEADERS_ALLOWLIST:-[\"securitytenant\",\"Authorization\"]}"
+OPENSEARCH_SECURITY_MULTITENANCY_ENABLED="${OPENSEARCH_SECURITY_MULTITENANCY_ENABLED:-false}"
+OPENSEARCH_SECURITY_READONLY_MODE_ROLES="${OPENSEARCH_SECURITY_READONLY_MODE_ROLES:-[\"kibana_read_only\"]}"
+SERVER_SSL_ENABLED="${SERVER_SSL_ENABLED:-true}"
+SERVER_SSL_KEY="${SERVER_SSL_KEY:-/etc/wazuh-dashboard/certs/dashboard-key.pem}"
+SERVER_SSL_CERTIFICATE="${SERVER_SSL_CERTIFICATE:-/etc/wazuh-dashboard/certs/dashboard.pem}"
+OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES="${OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES:-[/etc/wazuh-dashboard/certs/root-ca.pem]}"
+UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE="${UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE:-/app/wz-home}"
+OPENSEARCH_SECURITY_COOKIE_TTL="${OPENSEARCH_SECURITY_COOKIE_TTL:-900000}"
+OPENSEARCH_SECURITY_SESSION_TTL="${OPENSEARCH_SECURITY_SESSION_TTL:-900000}"
+OPENSEARCH_SECURITY_SESSION_KEEPALIVE="${OPENSEARCH_SECURITY_SESSION_KEEPALIVE:-true}"
+
+# Wazuh API configuration
+WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}"
+API_PORT="${API_PORT:-55000}"
+API_USERNAME="${API_USERNAME:-wazuh-wui}"
+API_PASSWORD="${API_PASSWORD:-wazuh-wui}"
+RUN_AS="${RUN_AS:-false}"
+
+# Optional Wazuh app configurations
+PATTERN="${PATTERN:-}"
+CHECKS_PATTERN="${CHECKS_PATTERN:-}"
+CHECKS_TEMPLATE="${CHECKS_TEMPLATE:-}"
+CHECKS_API="${CHECKS_API:-}"
+CHECKS_SETUP="${CHECKS_SETUP:-}"
+APP_TIMEOUT="${APP_TIMEOUT:-}"
+API_SELECTOR="${API_SELECTOR:-}"
+IP_SELECTOR="${IP_SELECTOR:-}"
+IP_IGNORE="${IP_IGNORE:-}"
+WAZUH_MONITORING_ENABLED="${WAZUH_MONITORING_ENABLED:-}"
+WAZUH_MONITORING_FREQUENCY="${WAZUH_MONITORING_FREQUENCY:-}"
+WAZUH_MONITORING_SHARDS="${WAZUH_MONITORING_SHARDS:-}"
+WAZUH_MONITORING_REPLICAS="${WAZUH_MONITORING_REPLICAS:-}"
+
+# Configuration file path
+DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml}"
+
+# Map of configuration keys to their values
+declare -A CONFIG_MAP=(
+    [server.host]="$SERVER_HOST"
+    [server.port]="$SERVER_PORT"
+    [opensearch.hosts]="$OPENSEARCH_HOSTS"
+    [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
+    [opensearch.username]="$OPENSEARCH_USERNAME"
+    [opensearch.password]="$OPENSEARCH_PASSWORD"
+    [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
+    [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
+    [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
+    [server.ssl.enabled]="$SERVER_SSL_ENABLED"
+    [server.ssl.key]="\"$SERVER_SSL_KEY\""
+    [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
+    [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
+    [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
+    [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
+    [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
+    [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
+    [pattern]="$PATTERN"
+    [checks.pattern]="$CHECKS_PATTERN"
+    [checks.template]="$CHECKS_TEMPLATE"
+    [checks.api]="$CHECKS_API"
+    [checks.setup]="$CHECKS_SETUP"
+    [timeout]="$APP_TIMEOUT"
+    [api.selector]="$API_SELECTOR"
+    [ip.selector]="$IP_SELECTOR"
+    [ip.ignore]="$IP_IGNORE"
+    [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
+    [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
+    [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
+    [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
+)
+
+# Replace configuration values in the dashboard config file
+for key in "${!CONFIG_MAP[@]}"; do
+    value="${CONFIG_MAP[$key]}"
+
+    # Skip empty values for optional configurations
+    if [ -z "$value" ]; then
+        continue
+    fi
+
+    # Escape special characters for sed
+    escaped_key=$(echo "$key" | sed 's/[.[\*^$()+?{|]/\\&/g')
+
+    # Try to replace existing line (commented or uncommented)
+    if grep -q "^[#[:space:]]*${escaped_key}:" "$DASHBOARD_CONFIG_FILE"; then
+        sed -i "s|^[#[:space:]]*${escaped_key}:.*|${key}: ${value}|" "$DASHBOARD_CONFIG_FILE"
+    fi
+done
+
+# Handle wazuh_core.hosts section separately
+if grep -q "^wazuh_core.hosts:" "$DASHBOARD_CONFIG_FILE"; then
+    # Update existing wazuh_core.hosts section
+    sed -i "/^wazuh_core.hosts:/,/^[^ ]/ {
+        s|url:.*|url: $WAZUH_API_URL|
+        s|port:.*|port: $API_PORT|
+        s|username:.*|username: $API_USERNAME|
+        s|password:.*|password: $API_PASSWORD|
+        s|run_as:.*|run_as: $RUN_AS|
+    }" "$DASHBOARD_CONFIG_FILE"
+fi

build-docker-images/wazuh-indexer/Dockerfile

@@ -55,7 +55,7 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \
     mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
     mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
     mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer    
+    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
 
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
 
@@ -72,4 +72,4 @@ EXPOSE 9200
 
 ENTRYPOINT ["/entrypoint.sh"]
 # Dummy overridable parameter parsed by entrypoint
-CMD ["opensearch"]
+CMD ["opensearch"]

build-docker-images/wazuh-indexer/config/config.sh

@@ -7,60 +7,17 @@ export NAME=wazuh-indexer
 # Package build options
 export USER=${NAME}
 export GROUP=${NAME}
-export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
-export LOG_DIR=/var/log/${NAME}
-export LIB_DIR=/var/lib/${NAME}
-export PID_DIR=/run/${NAME}
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
-
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR
-mkdir -p ${CONFIG_DIR}/certs
-mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem
-cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
 # Modify opensearch.yml config paths
+if [ -d "/etc/wazuh-indexer" ]; then
+    mkdir -p ${CONFIG_DIR}
+    mkdir -p ${CONFIG_DIR}/certs
+    mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
+    rmdir /etc/wazuh-indexer
+fi
 sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
 
-sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options
+sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' ${CONFIG_DIR}/jvm.options
 
-chown -R ${USER}:${GROUP} ${CONFIG_DIR}
-chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*

build-docker-images/wazuh-manager/Dockerfile

@@ -9,10 +9,6 @@ ARG S6_VERSION="v2.2.0.3"
 ARG TARGETARCH
 ARG wazuh_manager_url_amd64_rpm
 ARG wazuh_manager_url_arm64_rpm
-ARG wazuh_certs_tool
-ARG wazuh_config_yml
-
-COPY config/config.sh .
 
 RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
     manager_url="${!URL_VAR}" && \
@@ -22,13 +18,13 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
     dnf install /wazuh-manager.rpm -y && \
     rm -rf /wazuh-manager.rpm && \
     dnf clean all && \
-    chmod 755 /config.sh && \
-    /config.sh && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-    -o /tmp/s6-overlay-amd64.tar.gz && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-amd64.tar.gz && \
+    S6_ARCH="amd64" && \
+    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
+    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
+    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
+    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
     rm -f /var/ossec/etc/sslmanager.key && \
     rm -f /var/ossec/etc/sslmanager.cert
 

build-docker-images/wazuh-manager/config/config.sh

@@ -1,40 +0,0 @@
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-CERT_DIR=/etc/filebeat/certs
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-mkdir -p $CERT_DIR
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Copy Wazuh manager certs
-cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem
-cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem

build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init

@@ -184,7 +184,8 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
     TMP_HOSTS=$(mktemp)
     {
         echo "    <hosts>"
-        for NODE in $WAZUH_INDEXER_HOSTS; do
+        IFS=',' read -ra NODES <<< "$WAZUH_INDEXER_HOSTS"
+        for NODE in "${NODES[@]}"; do
             IP="${NODE%:*}"
             PORT="${NODE#*:}"
             echo "      <host>https://$IP:$PORT</host>"
@@ -194,6 +195,7 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
     sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
             -e 'd }}' "$OSSEC_CONF";
     rm -f "$TMP_HOSTS";
+
 fi
 
 # --------------------------

docs/README.md

@@ -7,7 +7,7 @@
 
 In this repository you will find the containers to run:
 
-* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
+* Wazuh manager: it runs the Wazuh manager, and Wazuh API
 * Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status.
 * Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
 * Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited.
@@ -43,43 +43,25 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
 	│   │   └── Dockerfile
 	│   ├── wazuh-dashboard
 	│   │   ├── config
-	│   │   │   ├── check_repository.sh
-	│   │   │   ├── config.sh
-	│   │   │   ├── config.yml
 	│   │   │   ├── entrypoint.sh
-	│   │   │   ├── wazuh_app_config.sh
-	│   │   │   └── wazuh.yml
+	│   │   │   ├── wazuh_dashboard_config.sh
 	│   │   └── Dockerfile
 	│   ├── wazuh-indexer
 	│   │   ├── config
-	│   │   │   ├── action_groups.yml
-	│   │   │   ├── check_repository.sh
 	│   │   │   ├── config.sh
-	│   │   │   ├── config.yml
 	│   │   │   ├── entrypoint.sh
-	│   │   │   ├── internal_users.yml
-	│   │   │   ├── opensearch.yml
-	│   │   │   ├── roles_mapping.yml
-	│   │   │   ├── roles.yml
 	│   │   │   └── securityadmin.sh
 	│   │   └── Dockerfile
 	│   └── wazuh-manager
 	│       ├── config
-	│       │   ├── check_repository.sh
 	│       │   ├── create_user.py
 	│       │   ├── etc
 	│       │   │   ├── cont-init.d
 	│       │   │   │   ├── 0-wazuh-init
-	│       │   │   │   ├── 1-config-filebeat
 	│       │   │   │   └── 2-manager
 	│       │   │   └── services.d
-	│       │   │       ├── filebeat
-	│       │   │       │   ├── finish
-	│       │   │       │   └── run
 	│       │   │       └── ossec-logs
 	│       │   │           └── run
-	│       │   ├── filebeat_module.sh
-	│       │   ├── filebeat.yml
 	│       │   ├── permanent_data.env
 	│       │   └── permanent_data.sh
 	│       └── Dockerfile

multi-node/Migration-to-Wazuh-4.4.md

@@ -97,15 +97,15 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-filebeat-etc \
-           multi-node_master-filebeat-etc
+           --label com.docker.compose.volume=master-wazuh-etc \
+           multi-node_master-wazuh-etc
 ```
 ```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-filebeat-var \
-           multi-node_master-filebeat-var
+           --label com.docker.compose.volume=master-wazuh-var \
+           multi-node_master-wazuh-var
 ```
 ```
 docker volume create \
@@ -160,15 +160,15 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-filebeat-etc \
-           multi-node_worker-filebeat-etc
+           --label com.docker.compose.volume=worker-wazuh-etc \
+           multi-node_worker-wazuh-etc
 ```
 ```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-filebeat-var \
-           multi-node_worker-filebeat-var
+           --label com.docker.compose.volume=worker-wazuh-var \
+           multi-node_worker-wazuh-var
 ```
 **6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
 ```
@@ -233,14 +233,14 @@ docker container run --rm -it \
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-etc:/from \
-           -v multi-node_master-filebeat-etc:/to \
+           -v wazuh-docker-etc:/from \
+           -v multi-node_master-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-var:/from \
-           -v multi-node_master-filebeat-var:/to \
+           -v wazuh-docker-var:/from \
+           -v multi-node_master-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
@@ -287,14 +287,14 @@ docker container run --rm -it \
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-etc:/from \
-           -v multi-node_worker-filebeat-etc:/to \
+           -v wazuh-docker_worker-etc:/from \
+           -v multi-node_worker-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v multi-node_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v multi-node_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 

multi-node/docker-compose.yml

@@ -33,9 +33,9 @@ services:
       - master-wazuh-var-multigroups:/var/ossec/var/multigroups
       - master-wazuh-active-response:/var/ossec/active-response/bin
       - master-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem
-      - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem
-      - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem
   wazuh.worker:
     image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
@@ -65,9 +65,9 @@ services:
       - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
       - worker-wazuh-active-response:/var/ossec/active-response/bin
       - worker-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.worker.pem:/etc/filebeat/certs/filebeat.pem
-      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh1.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -171,11 +171,14 @@ services:
       - DASHBOARD_PASSWORD=kibanaserver
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
+      - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
+      - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
+      - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
     volumes:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
-      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
       - wazuh1.indexer

multi-node/volume-migrator.sh

@@ -61,14 +61,14 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-filebeat-etc \
-           $2_master-filebeat-etc
+           --label com.docker.compose.volume=master-wazuh-etc \
+           $2_master-wazuh-etc
 
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-filebeat-var \
-           $2_master-filebeat-var
+           --label com.docker.compose.volume=master-wazuh-var \
+           $2_master-wazuh-var
 
 docker volume create \
            --label com.docker.compose.project=$2 \
@@ -115,18 +115,18 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-filebeat-etc \
-           $2_worker-filebeat-etc
+           --label com.docker.compose.volume=worker-wazuh-etc \
+           $2_worker-wazuh-etc
 
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-filebeat-var \
-           $2_worker-filebeat-var
+           --label com.docker.compose.volume=worker-wazuh-var \
+           $2_worker-wazuh-var
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v $2_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v $2_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
@@ -180,13 +180,13 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-etc:/from \
-           -v $2_master-filebeat-etc:/to \
+           -v wazuh-docker-etc:/from \
+           -v $2_master-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-var:/from \
-           -v $2_master-filebeat-var:/to \
+           -v wazuh-docker-var:/from \
+           -v $2_master-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
@@ -225,11 +225,11 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-etc:/from \
-           -v $2_worker-filebeat-etc:/to \
+           -v wazuh-docker_worker-etc:/from \
+           -v $2_worker-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v $2_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v $2_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"

single-node/docker-compose.yml

@@ -20,6 +20,7 @@ services:
       - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200
       - WAZUH_NODE_NAME=manager
       - WAZUH_CLUSTER_NODES=wazuh.manager
+      - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
       - API_USERNAME=wazuh-wui
@@ -32,9 +33,9 @@ services:
       - wazuh_var_multigroups:/var/ossec/var/multigroups
       - wazuh_active_response:/var/ossec/active-response/bin
       - wazuh_wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.manager.pem:/etc/filebeat/certs/filebeat.pem
-      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -71,9 +72,8 @@ services:
     hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:5601
+      - 443:443
     environment:
-      - SERVER_PORT=5601
       - SERVER_HOST=0.0.0.0
       - OPENSEARCH_HOSTS=https://wazuh.indexer:9200
       - INDEXER_USERNAME=admin
@@ -83,11 +83,14 @@ services:
       - DASHBOARD_PASSWORD=kibanaserver
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
+      - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem
+      - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
+      - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
     volumes:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
-      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
       - wazuh.indexer