From 9ebecf410eb5ac3029a140782a18e90d2b11fcc1 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 3 Dec 2025 11:49:22 -0300
Subject: [PATCH 01/25] Testing the docker images build with filebeat reference
 removed

---
 .github/.goss.yaml                            | 13 -------
 .github/multi-node-filebeat-check.sh          | 39 -------------------
 .github/single-node-filebeat-check.sh         | 20 ----------
 .github/workflows/push.yml                    |  6 ---
 build-docker-images/README.md                 |  1 -
 build-docker-images/build-images.sh           |  2 +-
 .../config/wazuh_app_config.sh                | 18 ++++-----
 .../wazuh-manager/config/config.sh            |  2 +-
 docs/README.md                                |  8 ++--
 multi-node/Migration-to-Wazuh-4.4.md          | 32 +++++++--------
 multi-node/docker-compose.yml                 | 10 ++---
 multi-node/volume-migrator.sh                 | 36 ++++++++---------
 single-node/docker-compose.yml                |  6 +--
 13 files changed, 56 insertions(+), 137 deletions(-)
 delete mode 100755 .github/multi-node-filebeat-check.sh
 delete mode 100755 .github/single-node-filebeat-check.sh

diff --git a/.github/.goss.yaml b/.github/.goss.yaml
index 85c33160..54fb61fa 100644
--- a/.github/.goss.yaml
+++ b/.github/.goss.yaml
@@ -1,11 +1,4 @@
 file:
-  /etc/filebeat/filebeat.yml:
-    exists: true
-    mode: "0644"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
   /var/ossec/bin/wazuh-control:
     exists: true
     mode: "0750"
@@ -49,10 +42,6 @@ file:
     filetype: file
     contains: []
 package:
-  filebeat:
-    installed: true
-    versions:
-    - 7.10.2
   wazuh-manager:
     installed: true
     versions:
@@ -71,8 +60,6 @@ port:
     ip:
     - 0.0.0.0
 process:
-  filebeat:
-    running: true
   wazuh-analysisd:
     running: true
   wazuh-authd:
diff --git a/.github/multi-node-filebeat-check.sh b/.github/multi-node-filebeat-check.sh
deleted file mode 100755
index 3052f69e..00000000
--- a/.github/multi-node-filebeat-check.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-COMMAND_TO_EXECUTE="filebeat test output"
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'master')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'master' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'worker')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'worker' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi
\ No newline at end of file
diff --git a/.github/single-node-filebeat-check.sh b/.github/single-node-filebeat-check.sh
deleted file mode 100755
index 1979d25b..00000000
--- a/.github/single-node-filebeat-check.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-COMMAND_TO_EXECUTE="filebeat test output"
-
-MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'manager')
-
-if [ -z "$MASTER_CONTAINERS" ]; then
-  echo "No containers were found with 'manager' in their name."
-else
-  for MASTER_CONTAINERS in $MASTER_CONTAINERS; do
-    FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE)
-    FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK)
-    if [[ $FILEBEAT_STATUS -eq 7 ]]; then
-      echo "No errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-    else
-      echo "Errors in filebeat"
-      echo "${FILEBEAT_OUTPUT}"
-      exit 1
-    fi
-  done
-fi
\ No newline at end of file
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index e67a9a5b..75e3cf97 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -175,9 +175,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check filebeat output
-      run: ./.github/single-node-filebeat-check.sh
-
     - name: Check Wazuh dashboard service URL
       run: |
        status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk  '{print $2}')
@@ -338,9 +335,6 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
-    - name: Check filebeat output
-      run: ./.github/multi-node-filebeat-check.sh
-
     - name: Check Wazuh dashboard service URL
       run: |
        status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk  '{print $2}')
diff --git a/build-docker-images/README.md b/build-docker-images/README.md
index 11fde42c..f4569449 100644
--- a/build-docker-images/README.md
+++ b/build-docker-images/README.md
@@ -24,7 +24,6 @@ $ build-docker-images/build-images.sh -h
 Usage: build-docker-images/build-images.sh [OPTIONS]
 
     -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
-    -f, --filebeat-module <ref>  [Optional] Set Filebeat module version. By default 0.4.
     -r, --revision <rev>         [Optional] Package revision. By default 1
     -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
     -h, --help                   Show this help.
diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh
index f6895666..5e558e2c 100755
--- a/build-docker-images/build-images.sh
+++ b/build-docker-images/build-images.sh
@@ -59,7 +59,7 @@ build() {
         fi
     fi
     awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt
-    
+
     echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
     echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
     echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 1410d5be..0388465a 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -7,7 +7,7 @@ api_username="${API_USERNAME:-wazuh-wui}"
 api_password="${API_PASSWORD:-wazuh-wui}"
 api_run_as="${RUN_AS:-false}"
 
-dashboard_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml"
+dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml"
 
 declare -A CONFIG_MAP=(
   [pattern]=$PATTERN
@@ -32,18 +32,18 @@ do
     fi
 done
 
-grep -q 1513629884013 $dashboard_config_file
+grep -q default $dashboard_config_file
 _config_exists=$?
 
 if [[ $_config_exists -ne 0 ]]; then
   cat << EOF >> $dashboard_config_file
-  hosts:
-    - 1513629884013:
-        url: $wazuh_url
-        port: $wazuh_port
-        username: $api_username
-        password: $api_password
-        run_as: $api_run_as
+  wazuh_core.hosts:
+    default:
+      url: $wazuh_url
+      port: $wazuh_port
+      username: $api_username
+      password: $api_password
+      run_as: $api_run_as
   EOF
 else
   echo "Wazuh APP already configured"
diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh
index d220151e..211de49d 100644
--- a/build-docker-images/wazuh-manager/config/config.sh
+++ b/build-docker-images/wazuh-manager/config/config.sh
@@ -4,7 +4,7 @@
 # Variables for certificate generation
 CERT_TOOL="wazuh-certs-tool.sh"
 CERT_CONFIG_FILE="config.yml"
-CERT_DIR=/etc/filebeat/certs
+CERT_DIR=/etc/wazuh/certs
 download_package() {
     local url=$1
     local package=$2
diff --git a/docs/README.md b/docs/README.md
index 0eb31d50..e8cd99e3 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,7 +7,7 @@
 
 In this repository you will find the containers to run:
 
-* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
+* Wazuh manager: it runs the Wazuh manager, and Wazuh API
 * Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status.
 * Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
 * Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited.
@@ -70,16 +70,14 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
 	│       │   ├── etc
 	│       │   │   ├── cont-init.d
 	│       │   │   │   ├── 0-wazuh-init
-	│       │   │   │   ├── 1-config-filebeat
+	│       │   │   │   ├── 1-config-
 	│       │   │   │   └── 2-manager
 	│       │   │   └── services.d
-	│       │   │       ├── filebeat
+	│       │   │       ├──
 	│       │   │       │   ├── finish
 	│       │   │       │   └── run
 	│       │   │       └── ossec-logs
 	│       │   │           └── run
-	│       │   ├── filebeat_module.sh
-	│       │   ├── filebeat.yml
 	│       │   ├── permanent_data.env
 	│       │   └── permanent_data.sh
 	│       └── Dockerfile
diff --git a/multi-node/Migration-to-Wazuh-4.4.md b/multi-node/Migration-to-Wazuh-4.4.md
index 0d192f2c..aaa057f8 100644
--- a/multi-node/Migration-to-Wazuh-4.4.md
+++ b/multi-node/Migration-to-Wazuh-4.4.md
@@ -97,15 +97,15 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-filebeat-etc \
-           multi-node_master-filebeat-etc
+           --label com.docker.compose.volume=master-wazuh-etc \
+           multi-node_master-wazuh-etc
 ```
 ```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=master-filebeat-var \
-           multi-node_master-filebeat-var
+           --label com.docker.compose.volume=master-wazuh-var \
+           multi-node_master-wazuh-var
 ```
 ```
 docker volume create \
@@ -160,15 +160,15 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-filebeat-etc \
-           multi-node_worker-filebeat-etc
+           --label com.docker.compose.volume=worker-wazuh-etc \
+           multi-node_worker-wazuh-etc
 ```
 ```
 docker volume create \
            --label com.docker.compose.project=multi-node \
            --label com.docker.compose.version=1.25.0 \
-           --label com.docker.compose.volume=worker-filebeat-var \
-           multi-node_worker-filebeat-var
+           --label com.docker.compose.volume=worker-wazuh-var \
+           multi-node_worker-wazuh-var
 ```
 **6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
 ```
@@ -233,14 +233,14 @@ docker container run --rm -it \
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-etc:/from \
-           -v multi-node_master-filebeat-etc:/to \
+           -v wazuh-docker-etc:/from \
+           -v multi-node_master-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-var:/from \
-           -v multi-node_master-filebeat-var:/to \
+           -v wazuh-docker-var:/from \
+           -v multi-node_master-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
@@ -287,14 +287,14 @@ docker container run --rm -it \
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-etc:/from \
-           -v multi-node_worker-filebeat-etc:/to \
+           -v wazuh-docker_worker-etc:/from \
+           -v multi-node_worker-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 ```
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v multi-node_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v multi-node_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 ```
 
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index aa079f8d..dd08d2d4 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -34,8 +34,8 @@ services:
       - master-wazuh-active-response:/var/ossec/active-response/bin
       - master-wazuh-wodles:/var/ossec/wodles
       - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem
-      - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem
-      - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key
+      - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem
+      - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key
   wazuh.worker:
     image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
@@ -65,9 +65,9 @@ services:
       - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
       - worker-wazuh-active-response:/var/ossec/active-response/bin
       - worker-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.worker.pem:/etc/filebeat/certs/filebeat.pem
-      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem
+      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.worker.pem
+      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key
 
   wazuh1.indexer:
     image: wazuh/wazuh-indexer:5.0.0
diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh
index 21c3d255..196c81ed 100755
--- a/multi-node/volume-migrator.sh
+++ b/multi-node/volume-migrator.sh
@@ -61,14 +61,14 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-filebeat-etc \
-           $2_master-filebeat-etc
+           --label com.docker.compose.volume=master-wazuh-etc \
+           $2_master-wazuh-etc
 
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=master-filebeat-var \
-           $2_master-filebeat-var
+           --label com.docker.compose.volume=master-wazuh-var \
+           $2_master-wazuh-var
 
 docker volume create \
            --label com.docker.compose.project=$2 \
@@ -115,18 +115,18 @@ docker volume create \
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-filebeat-etc \
-           $2_worker-filebeat-etc
+           --label com.docker.compose.volume=worker-wazuh-etc \
+           $2_worker-wazuh-etc
 
 docker volume create \
            --label com.docker.compose.project=$2 \
            --label com.docker.compose.version=$1 \
-           --label com.docker.compose.volume=worker-filebeat-var \
-           $2_worker-filebeat-var
+           --label com.docker.compose.volume=worker-wazuh-var \
+           $2_worker-wazuh-var
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v $2_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v $2_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
@@ -180,13 +180,13 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-etc:/from \
-           -v $2_master-filebeat-etc:/to \
+           -v wazuh-docker-etc:/from \
+           -v $2_master-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_filebeat-var:/from \
-           -v $2_master-filebeat-var:/to \
+           -v wazuh-docker-var:/from \
+           -v $2_master-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
@@ -225,11 +225,11 @@ docker container run --rm -it \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-etc:/from \
-           -v $2_worker-filebeat-etc:/to \
+           -v wazuh-docker_worker-etc:/from \
+           -v $2_worker-wazuh-etc:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
 
 docker container run --rm -it \
-           -v wazuh-docker_worker-filebeat-var:/from \
-           -v $2_worker-filebeat-var:/to \
+           -v wazuh-docker_worker-var:/from \
+           -v $2_worker-wazuh-var:/to \
            alpine ash -c "cd /from ; cp -avp . /to"
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 5b107f72..505f0fc5 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -32,9 +32,9 @@ services:
       - wazuh_var_multigroups:/var/ossec/var/multigroups
       - wazuh_active_response:/var/ossec/active-response/bin
       - wazuh_wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.manager.pem:/etc/filebeat/certs/filebeat.pem
-      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem
+      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem
+      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem
 
   wazuh.indexer:
     image: wazuh/wazuh-indexer:5.0.0

From fc8262b7914d3267132b2ac438ee8b125677ba5b Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 3 Dec 2025 14:15:57 -0300
Subject: [PATCH 02/25] Testing with wazuh certs tool from 4.13

---
 .github/workflows/Procedure_push_docker_images.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml
index e9735cdd..f9d87d8e 100644
--- a/.github/workflows/Procedure_push_docker_images.yml
+++ b/.github/workflows/Procedure_push_docker_images.yml
@@ -18,7 +18,7 @@ on:
       reference:
         description: 'Dev reference'
         type: string
-        default: latest 
+        default: latest
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -47,7 +47,7 @@ on:
       reference:
         description: 'Dev reference'
         type: string
-        default: latest 
+        default: latest
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -97,7 +97,7 @@ jobs:
 
     - name: free disk space
       uses: ./.github/free-disk-space
-    
+
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
 
@@ -145,8 +145,8 @@ jobs:
           wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
-          wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)"
-          wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)"
+          wazuh_certs_tool: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh"
+          wazuh_config_yml: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/config.yml"
           EOF
       working-directory: ./build-docker-images
 
@@ -155,7 +155,7 @@ jobs:
         if [ "${{ inputs.dev }}" = true ]; then
           IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
           ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
-        else  
+        else
           if [[ "$IMAGE_TAG" == *"-"* ]]; then
             IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
             if [ -z "${tokens[1]}" ]; then

From 05aece7433a5543447ab523cb4ba7ccf362aeee6 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 3 Dec 2025 14:45:33 -0300
Subject: [PATCH 03/25] Added debug symbols for config.sh

---
 build-docker-images/wazuh-dashboard/config/config.sh | 5 ++++-
 build-docker-images/wazuh-indexer/config/config.sh   | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
index b6c3b32c..6460677a 100644
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ b/build-docker-images/wazuh-dashboard/config/config.sh
@@ -1,5 +1,6 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
+set -x
 export DH_OPTIONS
 
 export NAME=wazuh-dashboard
@@ -54,4 +55,6 @@ cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
 sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
 
 chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*
\ No newline at end of file
+chmod -R 400 ${CONFIG_DIR}/certs/*
+
+set +x
\ No newline at end of file
diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index f2dd1bbd..ba218c5d 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -1,5 +1,6 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
+set -x
 export DH_OPTIONS
 
 export NAME=wazuh-indexer
@@ -63,4 +64,6 @@ sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-perfo
 
 chown -R ${USER}:${GROUP} ${CONFIG_DIR}
 chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*
\ No newline at end of file
+chmod -R 400 ${CONFIG_DIR}/certs/*
+
+set +x
\ No newline at end of file

From 19dda0c176c3f40a1ac22a5a23ddb889c827b1c8 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 3 Dec 2025 15:03:09 -0300
Subject: [PATCH 04/25] Updated wazuh certs tool url

---
 .github/workflows/Procedure_push_docker_images.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml
index f9d87d8e..8fac0536 100644
--- a/.github/workflows/Procedure_push_docker_images.yml
+++ b/.github/workflows/Procedure_push_docker_images.yml
@@ -145,8 +145,8 @@ jobs:
           wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
-          wazuh_certs_tool: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh"
-          wazuh_config_yml: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/config.yml"
+          wazuh_certs_tool: "https://packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh"
+          wazuh_config_yml: "https://packages-dev.wazuh.com/4.13/config.yml"
           EOF
       working-directory: ./build-docker-images
 

From 0e84e107918082fb29d737d8f635d9544695d12e Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 14:17:59 -0300
Subject: [PATCH 05/25] Updated test of Docker images

---
 .../Procedure_push_docker_images.yml          |  4 +-
 .gitignore                                    |  2 -
 .../wazuh-dashboard/config/config.sh          | 47 ------------------
 build-docker-images/wazuh-indexer/Dockerfile  |  4 +-
 .../wazuh-indexer/config/config.sh            | 49 -------------------
 build-docker-images/wazuh-manager/Dockerfile  |  6 ---
 .../wazuh-manager/config/config.sh            | 40 ---------------
 .../config/etc/cont-init.d/0-wazuh-init       | 12 +++++
 single-node/config.yml                        | 17 +++++++
 single-node/docker-compose.yml                | 14 +++---
 10 files changed, 40 insertions(+), 155 deletions(-)
 delete mode 100644 build-docker-images/wazuh-manager/config/config.sh
 create mode 100644 single-node/config.yml

diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml
index 8fac0536..8813f1d4 100644
--- a/.github/workflows/Procedure_push_docker_images.yml
+++ b/.github/workflows/Procedure_push_docker_images.yml
@@ -145,8 +145,8 @@ jobs:
           wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
           wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
-          wazuh_certs_tool: "https://packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh"
-          wazuh_config_yml: "https://packages-dev.wazuh.com/4.13/config.yml"
+          wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)"
+          wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)"
           EOF
       working-directory: ./build-docker-images
 
diff --git a/.gitignore b/.gitignore
index be72bfa3..0abf79b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,10 +4,8 @@ build-docker-images/artifacts_env.txt
 single-node/wazuh-certificates
 single-node/wazuh-certificates/*
 single-node/wazuh-certificates-tool.log
-single-node/config.yml
 single-node/wazuh-certs-tool.sh
 multi-node/wazuh-certificates
 multi-node/wazuh-certificates/*
 multi-node/wazuh-certificates-tool.log
-multi-node/config.yml
 multi-node/wazuh-certs-tool.sh
\ No newline at end of file
diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
index 6460677a..79739ddb 100644
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ b/build-docker-images/wazuh-dashboard/config/config.sh
@@ -1,60 +1,13 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
-set -x
 export DH_OPTIONS
 
 export NAME=wazuh-dashboard
-export TARGET_DIR=${CURDIR}/debian/${NAME}
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Create certs directory
-mkdir -p ${CONFIG_DIR}/certs
-
-# Copy Wazuh dashboard certs to install config dir
-mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
-cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
 # Modify opensearch.yml config paths
 sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
 
 chmod -R 500 ${CONFIG_DIR}/certs
 chmod -R 400 ${CONFIG_DIR}/certs/*
-
-set +x
\ No newline at end of file
diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile
index 5e8c44e2..ae16f38d 100644
--- a/build-docker-images/wazuh-indexer/Dockerfile
+++ b/build-docker-images/wazuh-indexer/Dockerfile
@@ -55,7 +55,7 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \
     mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
     mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
     mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
-    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer    
+    mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
 
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
 
@@ -72,4 +72,4 @@ EXPOSE 9200
 
 ENTRYPOINT ["/entrypoint.sh"]
 # Dummy overridable parameter parsed by entrypoint
-CMD ["opensearch"]
\ No newline at end of file
+CMD ["opensearch"]
diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index ba218c5d..d2a842c5 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -1,6 +1,5 @@
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
-set -x
 export DH_OPTIONS
 
 export NAME=wazuh-indexer
@@ -8,55 +7,9 @@ export NAME=wazuh-indexer
 # Package build options
 export USER=${NAME}
 export GROUP=${NAME}
-export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
-export LOG_DIR=/var/log/${NAME}
-export LIB_DIR=/var/lib/${NAME}
-export PID_DIR=/run/${NAME}
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
-
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR
-mkdir -p ${CONFIG_DIR}/certs
-mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
-cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem
-cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem
-
 # Modify opensearch.yml config paths
 sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
 
@@ -65,5 +18,3 @@ sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-perfo
 chown -R ${USER}:${GROUP} ${CONFIG_DIR}
 chmod -R 500 ${CONFIG_DIR}/certs
 chmod -R 400 ${CONFIG_DIR}/certs/*
-
-set +x
\ No newline at end of file
diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile
index 251ff5ad..2c01bd80 100644
--- a/build-docker-images/wazuh-manager/Dockerfile
+++ b/build-docker-images/wazuh-manager/Dockerfile
@@ -9,10 +9,6 @@ ARG S6_VERSION="v2.2.0.3"
 ARG TARGETARCH
 ARG wazuh_manager_url_amd64_rpm
 ARG wazuh_manager_url_arm64_rpm
-ARG wazuh_certs_tool
-ARG wazuh_config_yml
-
-COPY config/config.sh .
 
 RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
     manager_url="${!URL_VAR}" && \
@@ -22,8 +18,6 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
     dnf install /wazuh-manager.rpm -y && \
     rm -rf /wazuh-manager.rpm && \
     dnf clean all && \
-    chmod 755 /config.sh && \
-    /config.sh && \
     curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
     -o /tmp/s6-overlay-amd64.tar.gz && \
     tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh
deleted file mode 100644
index 211de49d..00000000
--- a/build-docker-images/wazuh-manager/config/config.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-##############################################################################
-# Downloading Cert Gen Tool
-##############################################################################
-# Variables for certificate generation
-CERT_TOOL="wazuh-certs-tool.sh"
-CERT_CONFIG_FILE="config.yml"
-CERT_DIR=/etc/wazuh/certs
-download_package() {
-    local url=$1
-    local package=$2
-    if curl -fsL "$url" -o "$package"; then
-        echo "Downloaded $package"
-        return 0
-    else
-        echo "Error downloading $package from $url"
-        return 1
-    fi
-}
-mkdir -p $CERT_DIR
-# Download the tool to create the certificates
-echo "Downloading the tool to create the certificates..."
-download_package "$wazuh_certs_tool" $CERT_TOOL
-# Download the config file for the certificate tool
-echo "Downloading the config file for the certificate tool..."
-download_package "$wazuh_config_yml" $CERT_CONFIG_FILE
-
-# Modify the config file to set the IP to localhost
-sed -i 's/  ip:.*/  ip: "127.0.0.1"/' $CERT_CONFIG_FILE
-
-chmod 700 "$CERT_CONFIG_FILE"
-# Create the certificates
-chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A
-
-# Copy Wazuh manager certs
-cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem
-cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem
-cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key
-cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem
-cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem
-cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem
\ No newline at end of file
diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
index e9fea495..3b4a01ca 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
@@ -6,6 +6,10 @@ source /permanent_data.env
 
 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
+CERT_DIR=/etc/wazuh/certs
+WAZUH_INDEXER_SSL_CA=$CERT_DIR/root-ca.pem
+WAZUH_INDEXER_SSL_CERTIFICATE=$CERT_DIR/wazuh.pem
+WAZUH_INDEXER_SSL_KEY=$CERT_DIR/wazuh-key.pem
 
 ##############################################################################
 # Aux functions
@@ -194,6 +198,14 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
     sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
             -e 'd }}' "$OSSEC_CONF";
     rm -f "$TMP_HOSTS";
+
+    # --------------------------
+    # Indexer SSL Configuration
+    # --------------------------
+    sed -i "/<indexer>/,/<\/indexer>/ s|<ca>.*</ca>|<ca>$WAZUH_INDEXER_SSL_CA</ca>|" "$OSSEC_CONF"
+    sed -i "/<indexer>/,/<\/indexer>/ s|<certificate>.*</certificate>|<certificate>$WAZUH_INDEXER_SSL_CERTIFICATE</certificate>|" "$OSSEC_CONF"
+    sed -i "/<indexer>/,/<\/indexer>/ s|<key>.*</key>|<key>$WAZUH_INDEXER_SSL_KEY</key>|" "$OSSEC_CONF"
+
 fi
 
 # --------------------------
diff --git a/single-node/config.yml b/single-node/config.yml
new file mode 100644
index 00000000..b8f678e3
--- /dev/null
+++ b/single-node/config.yml
@@ -0,0 +1,17 @@
+nodes:
+  # Wazuh indexer nodes
+  indexer:
+    - name: wazuh.indexer
+      ip: wazuh.indexer
+
+  # Wazuh server nodes
+  # If there is more than one Wazuh server
+  # node, each one must have a node_type
+  server:
+    - name: wazuh.manager
+      ip: wazuh.manager
+
+  # Wazuh dashboard nodes
+  dashboard:
+    - name: wazuh.dashboard
+      ip: wazuh.dashboard
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 505f0fc5..8a450f3b 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     restart: always
     ulimits:
@@ -20,6 +20,7 @@ services:
       - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200
       - WAZUH_NODE_NAME=manager
       - WAZUH_CLUSTER_NODES=wazuh.manager
+      - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
       - API_USERNAME=wazuh-wui
@@ -33,11 +34,11 @@ services:
       - wazuh_active_response:/var/ossec/active-response/bin
       - wazuh_wodles:/var/ossec/wodles
       - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem
-      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem
+      - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.pem
+      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -67,13 +68,12 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:5601
+      - 443:443
     environment:
-      - SERVER_PORT=5601
       - SERVER_HOST=0.0.0.0
       - OPENSEARCH_HOSTS=https://wazuh.indexer:9200
       - INDEXER_USERNAME=admin

From 70ce270235bf169293d61161eb8d7ae4cc12f5d1 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 14:34:51 -0300
Subject: [PATCH 06/25] Updated wazuh-indexer configuration

---
 build-docker-images/wazuh-indexer/config/config.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index d2a842c5..68cbd2b1 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -11,6 +11,12 @@ export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
 # Modify opensearch.yml config paths
+if [ -d "/etc/wazuh-indexer" ]; then
+    mkdir -p ${CONFIG_DIR}
+    mkdir -p ${CONFIG_DIR}/certs
+    mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
+    rmdir /etc/wazuh-indexer
+fi
 sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
 
 sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options

From 9f5847d2adfab29f7ff4ab74cf978a5cc474b730 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 14:45:56 -0300
Subject: [PATCH 07/25] Updated config.sh for wazuh indexer

---
 build-docker-images/wazuh-dashboard/config/config.sh | 3 ---
 build-docker-images/wazuh-indexer/config/config.sh   | 5 +----
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
index 79739ddb..0ff78844 100644
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ b/build-docker-images/wazuh-dashboard/config/config.sh
@@ -8,6 +8,3 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 
 # Modify opensearch.yml config paths
 sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
-
-chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*
diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index 68cbd2b1..2f34484a 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -19,8 +19,5 @@ if [ -d "/etc/wazuh-indexer" ]; then
 fi
 sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
 
-sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options
+sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' ${CONFIG_DIR}/jvm.options
 
-chown -R ${USER}:${GROUP} ${CONFIG_DIR}
-chmod -R 500 ${CONFIG_DIR}/certs
-chmod -R 400 ${CONFIG_DIR}/certs/*

From 133c6c94a1055e3e6c03bbadfec470256b541803 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 14:55:08 -0300
Subject: [PATCH 08/25] Updated config.sh for Wazuh dashboard

---
 build-docker-images/wazuh-dashboard/config/config.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
index 0ff78844..b106a77e 100644
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ b/build-docker-images/wazuh-dashboard/config/config.sh
@@ -6,5 +6,11 @@ export NAME=wazuh-dashboard
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
-# Modify opensearch.yml config paths
+# Modify opensearch_dashboards.yml config paths
+if [ -d "/etc/wazuh-dashboard" ]; then
+    mkdir -p ${CONFIG_DIR}
+    mkdir -p ${CONFIG_DIR}/certs
+    mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
+    rmdir /etc/wazuh-dashboard
+fi
 sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml

From 09d62e90bffe0620354db2697cd9c10e59c94f66 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 15:32:32 -0300
Subject: [PATCH 09/25] Updated Wazuh app configuration file

---
 build-docker-images/wazuh-dashboard/Dockerfile       |  3 ++-
 .../wazuh-dashboard/config/wazuh_app_config.sh       |  2 +-
 build-docker-images/wazuh-manager/Dockerfile         | 12 +++++++-----
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 483dc0c8..70b2509b 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -80,7 +80,8 @@ RUN yum install shadow-utils -y && \
     mkdir -p $INSTALL_DIR && \
     chown 1000:1000 $INSTALL_DIR && \
     chown 1000:1000 /*.sh && \
-    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom \
+    bash /wazuh_app_config.sh
 
 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 0388465a..4066a262 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -32,7 +32,7 @@ do
     fi
 done
 
-grep -q default $dashboard_config_file
+grep -q wazuh_core.hosts $dashboard_config_file
 _config_exists=$?
 
 if [[ $_config_exists -ne 0 ]]; then
diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile
index 2c01bd80..e6898a49 100644
--- a/build-docker-images/wazuh-manager/Dockerfile
+++ b/build-docker-images/wazuh-manager/Dockerfile
@@ -18,11 +18,13 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
     dnf install /wazuh-manager.rpm -y && \
     rm -rf /wazuh-manager.rpm && \
     dnf clean all && \
-    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-    -o /tmp/s6-overlay-amd64.tar.gz && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
-    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
-    rm  /tmp/s6-overlay-amd64.tar.gz && \
+    S6_ARCH="amd64" && \
+    if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
+    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
+    -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
+    tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
+    rm  /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
     rm -f /var/ossec/etc/sslmanager.key && \
     rm -f /var/ossec/etc/sslmanager.cert
 

From d57dbb9e7690dbf0d01b3459fdf477a65f43dc47 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 15:40:14 -0300
Subject: [PATCH 10/25] Updated script execution

---
 build-docker-images/wazuh-dashboard/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 70b2509b..22dcdc78 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -80,7 +80,7 @@ RUN yum install shadow-utils -y && \
     mkdir -p $INSTALL_DIR && \
     chown 1000:1000 $INSTALL_DIR && \
     chown 1000:1000 /*.sh && \
-    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom \
+    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom && \
     bash /wazuh_app_config.sh
 
 # Copy Install dir from builder to current image

From e539ae625ebbcd1957bb59b237eb4efe672e7065 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 15:51:58 -0300
Subject: [PATCH 11/25] Added EOF to wazuh app config script

---
 build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 4066a262..db84b598 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -44,7 +44,7 @@ if [[ $_config_exists -ne 0 ]]; then
       username: $api_username
       password: $api_password
       run_as: $api_run_as
-  EOF
+EOF
 else
   echo "Wazuh APP already configured"
 fi

From daf6eb643585b72738b7fd1e2e45c82a6d786bcb Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 16:11:36 -0300
Subject: [PATCH 12/25] Removed config.sh file from wazuh dashboard

---
 build-docker-images/wazuh-dashboard/Dockerfile   |  4 ----
 .../wazuh-dashboard/config/config.sh             | 16 ----------------
 .../wazuh-dashboard/config/wazuh_app_config.sh   | 14 ++++++++++++++
 3 files changed, 14 insertions(+), 20 deletions(-)
 delete mode 100644 build-docker-images/wazuh-dashboard/config/config.sh

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 22dcdc78..3656eeea 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -27,10 +27,6 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
 
-# Generate certificates
-COPY config/config.sh .
-RUN bash config.sh
-
 ################################################################################
 # Build stage 1 (the current Wazuh dashboard image):
 #
diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh
deleted file mode 100644
index b106a77e..00000000
--- a/build-docker-images/wazuh-dashboard/config/config.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-# This has to be exported to make some magic below work.
-export DH_OPTIONS
-
-export NAME=wazuh-dashboard
-export INSTALLATION_DIR=/usr/share/${NAME}
-export CONFIG_DIR=${INSTALLATION_DIR}/config
-
-# Modify opensearch_dashboards.yml config paths
-if [ -d "/etc/wazuh-dashboard" ]; then
-    mkdir -p ${CONFIG_DIR}
-    mkdir -p ${CONFIG_DIR}/certs
-    mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
-    rmdir /etc/wazuh-dashboard
-fi
-sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index db84b598..5f43a0e3 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -6,9 +6,23 @@ wazuh_port="${API_PORT:-55000}"
 api_username="${API_USERNAME:-wazuh-wui}"
 api_password="${API_PASSWORD:-wazuh-wui}"
 api_run_as="${RUN_AS:-false}"
+export DH_OPTIONS
+
+export NAME=wazuh-dashboard
+export INSTALLATION_DIR=/usr/share/${NAME}
+export CONFIG_DIR=${INSTALLATION_DIR}/config
 
 dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml"
 
+# Modify opensearch_dashboards.yml config paths
+if [ -d "/etc/wazuh-dashboard" ]; then
+    mkdir -p ${CONFIG_DIR}
+    mkdir -p ${CONFIG_DIR}/certs
+    mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
+    rmdir /etc/wazuh-dashboard
+fi
+sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
+
 declare -A CONFIG_MAP=(
   [pattern]=$PATTERN
   [checks.pattern]=$CHECKS_PATTERN

From f7d2cb2c3d4b55711a06ba74b8d6dfcae706c8c9 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Thu, 4 Dec 2025 16:27:09 -0300
Subject: [PATCH 13/25] Added debug symbols

---
 .../wazuh-dashboard/config/wazuh_app_config.sh      | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 5f43a0e3..5a318aea 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+set -x
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"
@@ -12,7 +13,13 @@ export NAME=wazuh-dashboard
 export INSTALLATION_DIR=/usr/share/${NAME}
 export CONFIG_DIR=${INSTALLATION_DIR}/config
 
-dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml"
+dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml"
+
+printf "Modifying Wazuh App configuration file: %s\n" "$dashboard_config_file"
+ls -la ${CONFIG_DIR}
+
+printf "/etc/wazuh-dashboard contents:\n"
+ls -la /etc/wazuh-dashboard
 
 # Modify opensearch_dashboards.yml config paths
 if [ -d "/etc/wazuh-dashboard" ]; then
@@ -21,7 +28,7 @@ if [ -d "/etc/wazuh-dashboard" ]; then
     mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
     rmdir /etc/wazuh-dashboard
 fi
-sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml
+sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${dashboard_config_file}
 
 declare -A CONFIG_MAP=(
   [pattern]=$PATTERN
@@ -62,3 +69,5 @@ EOF
 else
   echo "Wazuh APP already configured"
 fi
+
+set +x
\ No newline at end of file

From 0aa7750c49d975c68e0abefa208d22f1a7786f5a Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 10:21:33 -0300
Subject: [PATCH 14/25] Added wazuh_app script execution to config.sh file

---
 build-docker-images/wazuh-dashboard/Dockerfile    |  4 +---
 .../wazuh-dashboard/config/entrypoint.sh          |  3 +++
 .../wazuh-dashboard/config/wazuh_app_config.sh    | 15 ---------------
 3 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 3656eeea..eca8fb67 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -8,7 +8,6 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard
 ARG TARGETARCH
 ARG wazuh_dashboard_url_amd64_rpm
 ARG wazuh_dashboard_url_arm64_rpm
-ARG wazuh_certs_tool
 ARG wazuh_config_yml
 
 # Update and install dependencies
@@ -76,8 +75,7 @@ RUN yum install shadow-utils -y && \
     mkdir -p $INSTALL_DIR && \
     chown 1000:1000 $INSTALL_DIR && \
     chown 1000:1000 /*.sh && \
-    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom && \
-    bash /wazuh_app_config.sh
+    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
 
 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
index fbefb543..7ac9e997 100644
--- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh
+++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
@@ -17,6 +17,7 @@ export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard
 export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH
 DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
 DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
+export OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
 
 # Create and configure Wazuh dashboard keystore
 
@@ -24,6 +25,8 @@ yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --al
 echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
 echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
 
+/wazuh_app_config.sh
+
 opensearch_dashboards_vars=(
     opensearch.hosts
     server.port
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 5a318aea..b8b69e74 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -15,21 +15,6 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 
 dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml"
 
-printf "Modifying Wazuh App configuration file: %s\n" "$dashboard_config_file"
-ls -la ${CONFIG_DIR}
-
-printf "/etc/wazuh-dashboard contents:\n"
-ls -la /etc/wazuh-dashboard
-
-# Modify opensearch_dashboards.yml config paths
-if [ -d "/etc/wazuh-dashboard" ]; then
-    mkdir -p ${CONFIG_DIR}
-    mkdir -p ${CONFIG_DIR}/certs
-    mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/
-    rmdir /etc/wazuh-dashboard
-fi
-sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${dashboard_config_file}
-
 declare -A CONFIG_MAP=(
   [pattern]=$PATTERN
   [checks.pattern]=$CHECKS_PATTERN

From 572c8d417e297b6c8ef8a81c35909d548fe7a390 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 11:15:50 -0300
Subject: [PATCH 15/25] Updated Wazuh app configuration script

---
 .../config/wazuh_app_config.sh                | 26 +++++--------------
 1 file changed, 6 insertions(+), 20 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index b8b69e74..28fbf768 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -1,6 +1,5 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-set -x
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"
@@ -16,6 +15,11 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml"
 
 declare -A CONFIG_MAP=(
+  [url]=$wazuh_url
+  [port]=$wazuh_port
+  [username]=$api_username
+  [password]=$api_password
+  [run_as]=$api_run_as
   [pattern]=$PATTERN
   [checks.pattern]=$CHECKS_PATTERN
   [checks.template]=$CHECKS_TEMPLATE
@@ -29,6 +33,7 @@ declare -A CONFIG_MAP=(
   [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
   [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
   [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
+
 )
 
 for i in "${!CONFIG_MAP[@]}"
@@ -37,22 +42,3 @@ do
         sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $dashboard_config_file
     fi
 done
-
-grep -q wazuh_core.hosts $dashboard_config_file
-_config_exists=$?
-
-if [[ $_config_exists -ne 0 ]]; then
-  cat << EOF >> $dashboard_config_file
-  wazuh_core.hosts:
-    default:
-      url: $wazuh_url
-      port: $wazuh_port
-      username: $api_username
-      password: $api_password
-      run_as: $api_run_as
-EOF
-else
-  echo "Wazuh APP already configured"
-fi
-
-set +x
\ No newline at end of file

From 55cd4be54de1d87c9ba1e232d5446363436fea6d Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 13:28:31 -0300
Subject: [PATCH 16/25] Copy wazuh dashboard configuration dir

---
 .../wazuh-dashboard/Dockerfile                |  2 ++
 .../config/wazuh_app_config.sh                | 25 +++++--------------
 2 files changed, 8 insertions(+), 19 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index eca8fb67..49710226 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -5,6 +5,7 @@ ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
 ARG WAZUH_UI_REVISION
 ARG INSTALL_DIR=/usr/share/wazuh-dashboard
+ARG CONFIG_DIR=/etc/wazuh-dashboard
 ARG TARGETARCH
 ARG wazuh_dashboard_url_amd64_rpm
 ARG wazuh_dashboard_url_arm64_rpm
@@ -79,6 +80,7 @@ RUN yum install shadow-utils -y && \
 
 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder --chown=1000:1000 $CONFIG_DIR $INSTALL_DIR/config/
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
index 28fbf768..2cb5b858 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
@@ -1,25 +1,12 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
-wazuh_url="${WAZUH_API_URL:-https://wazuh}"
-wazuh_port="${API_PORT:-55000}"
-api_username="${API_USERNAME:-wazuh-wui}"
-api_password="${API_PASSWORD:-wazuh-wui}"
-api_run_as="${RUN_AS:-false}"
-export DH_OPTIONS
-
-export NAME=wazuh-dashboard
-export INSTALLATION_DIR=/usr/share/${NAME}
-export CONFIG_DIR=${INSTALLATION_DIR}/config
-
-dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml"
-
 declare -A CONFIG_MAP=(
-  [url]=$wazuh_url
-  [port]=$wazuh_port
-  [username]=$api_username
-  [password]=$api_password
-  [run_as]=$api_run_as
+  [url]=$WAZUH_API_URL
+  [port]=$API_PORT
+  [username]=$API_USERNAME
+  [password]=$API_PASSWORD
+  [run_as]=$RUN_AS
   [pattern]=$PATTERN
   [checks.pattern]=$CHECKS_PATTERN
   [checks.template]=$CHECKS_TEMPLATE
@@ -39,6 +26,6 @@ declare -A CONFIG_MAP=(
 for i in "${!CONFIG_MAP[@]}"
 do
     if [ "${CONFIG_MAP[$i]}" != "" ]; then
-        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $dashboard_config_file
+        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $OPENSEARCH_DASHBOARDS_CONFIG
     fi
 done

From 53e3c956371370ef63ddd84c2631258c5d4c7e94 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 15:24:56 -0300
Subject: [PATCH 17/25] Fixed configuration directory from builder

---
 build-docker-images/wazuh-dashboard/Dockerfile | 3 +--
 multi-node/docker-compose.yml                  | 2 +-
 single-node/docker-compose.yml                 | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 49710226..271cd946 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -5,7 +5,6 @@ ARG WAZUH_VERSION
 ARG WAZUH_TAG_REVISION
 ARG WAZUH_UI_REVISION
 ARG INSTALL_DIR=/usr/share/wazuh-dashboard
-ARG CONFIG_DIR=/etc/wazuh-dashboard
 ARG TARGETARCH
 ARG wazuh_dashboard_url_amd64_rpm
 ARG wazuh_dashboard_url_arm64_rpm
@@ -80,7 +79,7 @@ RUN yum install shadow-utils -y && \
 
 # Copy Install dir from builder to current image
 COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
-COPY --from=builder --chown=1000:1000 $CONFIG_DIR $INSTALL_DIR/config/
+COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
 
 # Set workdir and user
 WORKDIR $INSTALL_DIR
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index dd08d2d4..969af678 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -175,7 +175,7 @@ services:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
-      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
       - wazuh1.indexer
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 8a450f3b..3857b15e 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -87,7 +87,7 @@ services:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
       - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
-      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
       - wazuh.indexer

From b0df035478c50c6362dd99d9f4298a4e411de9a5 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 16:01:50 -0300
Subject: [PATCH 18/25] Replaced wazuh_app_config by wazuh_dashboard_config
 script

---
 build-docker-images/wazuh-dashboard/Dockerfile |  6 +++---
 .../wazuh-dashboard/config/entrypoint.sh       |  3 +--
 ...app_config.sh => wazuh_dashboard_config.sh} |  6 ++++++
 docs/README.md                                 | 18 +-----------------
 4 files changed, 11 insertions(+), 22 deletions(-)
 rename build-docker-images/wazuh-dashboard/config/{wazuh_app_config.sh => wazuh_dashboard_config.sh} (68%)

diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index 271cd946..1a8e6955 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -31,7 +31,7 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/b
 #
 # Copy wazuh-dashboard from stage 0
 # Add entrypoint
-# Add wazuh_app_config
+# Add wazuh_dashboard_config
 ################################################################################
 FROM amazonlinux:2023
 
@@ -56,7 +56,7 @@ ENV USER="wazuh-dashboard" \
 
 # Copy and set permissions to scripts
 COPY config/entrypoint.sh /
-COPY config/wazuh_app_config.sh /
+COPY config/wazuh_dashboard_config.sh /
 
 # Update and install dependencies
 RUN yum install shadow-utils -y && \
@@ -71,7 +71,7 @@ RUN yum install shadow-utils -y && \
             --comment "$USER user" \
             $USER && \
     chmod 700 /entrypoint.sh && \
-    chmod 700 /wazuh_app_config.sh && \
+    chmod 700 /wazuh_dashboard_config.sh && \
     mkdir -p $INSTALL_DIR && \
     chown 1000:1000 $INSTALL_DIR && \
     chown 1000:1000 /*.sh && \
diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
index 7ac9e997..e291407e 100644
--- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh
+++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
@@ -17,7 +17,6 @@ export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard
 export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH
 DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
 DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
-export OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
 
 # Create and configure Wazuh dashboard keystore
 
@@ -25,7 +24,7 @@ yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --al
 echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
 echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
 
-/wazuh_app_config.sh
+/wazuh_dashboard_config.sh
 
 opensearch_dashboards_vars=(
     opensearch.hosts
diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
similarity index 68%
rename from build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
rename to build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
index 2cb5b858..dab032c3 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
@@ -1,7 +1,13 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
 
 declare -A CONFIG_MAP=(
+  [server.host]=$SERVER_HOST
+  [opensearch.hosts]=$OPENSEARCH_HOSTS
+  [server.ssl.key]="/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem"
+  [server.ssl.certificate]="/usr/share/wazuh-dashboard/config/certs/dashboard.pem"
+  [server.ssl.certificateAuthorities]="/usr/share/wazuh-dashboard/config/certs/root-ca.pem"
   [url]=$WAZUH_API_URL
   [port]=$API_PORT
   [username]=$API_USERNAME
diff --git a/docs/README.md b/docs/README.md
index e8cd99e3..acb98674 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -43,39 +43,23 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
 	│   │   └── Dockerfile
 	│   ├── wazuh-dashboard
 	│   │   ├── config
-	│   │   │   ├── check_repository.sh
-	│   │   │   ├── config.sh
-	│   │   │   ├── config.yml
 	│   │   │   ├── entrypoint.sh
-	│   │   │   ├── wazuh_app_config.sh
-	│   │   │   └── wazuh.yml
+	│   │   │   ├── wazuh_dashboard_config.sh
 	│   │   └── Dockerfile
 	│   ├── wazuh-indexer
 	│   │   ├── config
-	│   │   │   ├── action_groups.yml
-	│   │   │   ├── check_repository.sh
 	│   │   │   ├── config.sh
-	│   │   │   ├── config.yml
 	│   │   │   ├── entrypoint.sh
-	│   │   │   ├── internal_users.yml
-	│   │   │   ├── opensearch.yml
-	│   │   │   ├── roles_mapping.yml
-	│   │   │   ├── roles.yml
 	│   │   │   └── securityadmin.sh
 	│   │   └── Dockerfile
 	│   └── wazuh-manager
 	│       ├── config
-	│       │   ├── check_repository.sh
 	│       │   ├── create_user.py
 	│       │   ├── etc
 	│       │   │   ├── cont-init.d
 	│       │   │   │   ├── 0-wazuh-init
-	│       │   │   │   ├── 1-config-
 	│       │   │   │   └── 2-manager
 	│       │   │   └── services.d
-	│       │   │       ├──
-	│       │   │       │   ├── finish
-	│       │   │       │   └── run
 	│       │   │       └── ossec-logs
 	│       │   │           └── run
 	│       │   ├── permanent_data.env

From a5e5b82c283ea0b256a4fbb9f441947b5138acf0 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Fri, 5 Dec 2025 16:56:08 -0300
Subject: [PATCH 19/25] Updated wazuh dashboard config script

---
 .../config/wazuh_dashboard_config.sh          | 131 ++++++++++++++----
 1 file changed, 102 insertions(+), 29 deletions(-)

diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
index dab032c3..bbaff92d 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
@@ -1,37 +1,110 @@
 #!/bin/bash
 # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
-OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
 
+# Environment variables with defaults
+SERVER_HOST="${SERVER_HOST:-0.0.0.0}"
+SERVER_PORT="${SERVER_PORT:-443}"
+OPENSEARCH_HOSTS="${OPENSEARCH_HOSTS:-https://wazuh.indexer:9200}"
+OPENSEARCH_SSL_VERIFICATION_MODE="${OPENSEARCH_SSL_VERIFICATION_MODE:-certificate}"
+OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-}"
+OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}"
+OPENSEARCH_REQUEST_HEADERS_ALLOWLIST="${OPENSEARCH_REQUEST_HEADERS_ALLOWLIST:-[\"securitytenant\",\"Authorization\"]}"
+OPENSEARCH_SECURITY_MULTITENANCY_ENABLED="${OPENSEARCH_SECURITY_MULTITENANCY_ENABLED:-false}"
+OPENSEARCH_SECURITY_READONLY_MODE_ROLES="${OPENSEARCH_SECURITY_READONLY_MODE_ROLES:-[\"kibana_read_only\"]}"
+SERVER_SSL_ENABLED="${SERVER_SSL_ENABLED:-true}"
+SERVER_SSL_KEY="${SERVER_SSL_KEY:-/etc/wazuh-dashboard/certs/dashboard-key.pem}"
+SERVER_SSL_CERTIFICATE="${SERVER_SSL_CERTIFICATE:-/etc/wazuh-dashboard/certs/dashboard.pem}"
+OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES="${OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES:-[/etc/wazuh-dashboard/certs/root-ca.pem]}"
+UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE="${UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE:-/app/wz-home}"
+OPENSEARCH_SECURITY_COOKIE_TTL="${OPENSEARCH_SECURITY_COOKIE_TTL:-900000}"
+OPENSEARCH_SECURITY_SESSION_TTL="${OPENSEARCH_SECURITY_SESSION_TTL:-900000}"
+OPENSEARCH_SECURITY_SESSION_KEEPALIVE="${OPENSEARCH_SECURITY_SESSION_KEEPALIVE:-true}"
+
+# Wazuh API configuration
+WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}"
+API_PORT="${API_PORT:-55000}"
+API_USERNAME="${API_USERNAME:-wazuh-wui}"
+API_PASSWORD="${API_PASSWORD:-wazuh-wui}"
+RUN_AS="${RUN_AS:-false}"
+
+# Optional Wazuh app configurations
+PATTERN="${PATTERN:-}"
+CHECKS_PATTERN="${CHECKS_PATTERN:-}"
+CHECKS_TEMPLATE="${CHECKS_TEMPLATE:-}"
+CHECKS_API="${CHECKS_API:-}"
+CHECKS_SETUP="${CHECKS_SETUP:-}"
+APP_TIMEOUT="${APP_TIMEOUT:-}"
+API_SELECTOR="${API_SELECTOR:-}"
+IP_SELECTOR="${IP_SELECTOR:-}"
+IP_IGNORE="${IP_IGNORE:-}"
+WAZUH_MONITORING_ENABLED="${WAZUH_MONITORING_ENABLED:-}"
+WAZUH_MONITORING_FREQUENCY="${WAZUH_MONITORING_FREQUENCY:-}"
+WAZUH_MONITORING_SHARDS="${WAZUH_MONITORING_SHARDS:-}"
+WAZUH_MONITORING_REPLICAS="${WAZUH_MONITORING_REPLICAS:-}"
+
+# Configuration file path
+DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml}"
+
+# Map of configuration keys to their values
 declare -A CONFIG_MAP=(
-  [server.host]=$SERVER_HOST
-  [opensearch.hosts]=$OPENSEARCH_HOSTS
-  [server.ssl.key]="/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem"
-  [server.ssl.certificate]="/usr/share/wazuh-dashboard/config/certs/dashboard.pem"
-  [server.ssl.certificateAuthorities]="/usr/share/wazuh-dashboard/config/certs/root-ca.pem"
-  [url]=$WAZUH_API_URL
-  [port]=$API_PORT
-  [username]=$API_USERNAME
-  [password]=$API_PASSWORD
-  [run_as]=$RUN_AS
-  [pattern]=$PATTERN
-  [checks.pattern]=$CHECKS_PATTERN
-  [checks.template]=$CHECKS_TEMPLATE
-  [checks.api]=$CHECKS_API
-  [checks.setup]=$CHECKS_SETUP
-  [timeout]=$APP_TIMEOUT
-  [api.selector]=$API_SELECTOR
-  [ip.selector]=$IP_SELECTOR
-  [ip.ignore]=$IP_IGNORE
-  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
-  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
-  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
-  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
-
+  [server.host]="$SERVER_HOST"
+  [server.port]="$SERVER_PORT"
+  [opensearch.hosts]="$OPENSEARCH_HOSTS"
+  [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
+  [opensearch.username]="$OPENSEARCH_USERNAME"
+  [opensearch.password]="$OPENSEARCH_PASSWORD"
+  [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
+  [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
+  [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
+  [server.ssl.enabled]="$SERVER_SSL_ENABLED"
+  [server.ssl.key]="\"$SERVER_SSL_KEY\""
+  [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
+  [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
+  [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
+  [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
+  [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
+  [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
+  [pattern]="$PATTERN"
+  [checks.pattern]="$CHECKS_PATTERN"
+  [checks.template]="$CHECKS_TEMPLATE"
+  [checks.api]="$CHECKS_API"
+  [checks.setup]="$CHECKS_SETUP"
+  [timeout]="$APP_TIMEOUT"
+  [api.selector]="$API_SELECTOR"
+  [ip.selector]="$IP_SELECTOR"
+  [ip.ignore]="$IP_IGNORE"
+  [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
+  [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
+  [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
+  [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
 )
 
-for i in "${!CONFIG_MAP[@]}"
-do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $OPENSEARCH_DASHBOARDS_CONFIG
+# Replace configuration values in the dashboard config file
+for key in "${!CONFIG_MAP[@]}"; do
+    value="${CONFIG_MAP[$key]}"
+
+    # Skip empty values for optional configurations
+    if [ -z "$value" ]; then
+        continue
+    fi
+
+    # Escape special characters for sed
+    escaped_key=$(echo "$key" | sed 's/[.[\*^$()+?{|]/\\&/g')
+
+    # Try to replace existing line (commented or uncommented)
+    if grep -q "^[#[:space:]]*${escaped_key}:" "$DASHBOARD_CONFIG_FILE"; then
+        sed -i "s|^[#[:space:]]*${escaped_key}:.*|${key}: ${value}|" "$DASHBOARD_CONFIG_FILE"
     fi
 done
+
+# Handle wazuh_core.hosts section separately
+if grep -q "^wazuh_core.hosts:" "$DASHBOARD_CONFIG_FILE"; then
+    # Update existing wazuh_core.hosts section
+    sed -i "/^wazuh_core.hosts:/,/^[^ ]/ {
+        s|url:.*|url: $WAZUH_API_URL|
+        s|port:.*|port: $API_PORT|
+        s|username:.*|username: $API_USERNAME|
+        s|password:.*|password: $API_PASSWORD|
+        s|run_as:.*|run_as: $RUN_AS|
+    }" "$DASHBOARD_CONFIG_FILE"
+fi

From d58fc84a2ba018a9aa6f6b5ed5cb8d6e09727520 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Tue, 9 Dec 2025 18:08:41 -0300
Subject: [PATCH 20/25] Updated multi node deployment

---
 .../config/wazuh_dashboard_config.sh          | 60 +++++++++----------
 .../config/etc/cont-init.d/0-wazuh-init       |  3 +-
 multi-node/config.yml                         | 25 ++++++++
 multi-node/docker-compose.yml                 | 15 +++--
 single-node/docker-compose.yml                |  3 +
 5 files changed, 69 insertions(+), 37 deletions(-)
 create mode 100644 multi-node/config.yml

diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
index bbaff92d..5e8b9067 100644
--- a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
+++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh
@@ -47,36 +47,36 @@ DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/confi
 
 # Map of configuration keys to their values
 declare -A CONFIG_MAP=(
-  [server.host]="$SERVER_HOST"
-  [server.port]="$SERVER_PORT"
-  [opensearch.hosts]="$OPENSEARCH_HOSTS"
-  [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
-  [opensearch.username]="$OPENSEARCH_USERNAME"
-  [opensearch.password]="$OPENSEARCH_PASSWORD"
-  [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
-  [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
-  [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
-  [server.ssl.enabled]="$SERVER_SSL_ENABLED"
-  [server.ssl.key]="\"$SERVER_SSL_KEY\""
-  [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
-  [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
-  [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
-  [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
-  [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
-  [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
-  [pattern]="$PATTERN"
-  [checks.pattern]="$CHECKS_PATTERN"
-  [checks.template]="$CHECKS_TEMPLATE"
-  [checks.api]="$CHECKS_API"
-  [checks.setup]="$CHECKS_SETUP"
-  [timeout]="$APP_TIMEOUT"
-  [api.selector]="$API_SELECTOR"
-  [ip.selector]="$IP_SELECTOR"
-  [ip.ignore]="$IP_IGNORE"
-  [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
-  [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
-  [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
-  [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
+    [server.host]="$SERVER_HOST"
+    [server.port]="$SERVER_PORT"
+    [opensearch.hosts]="$OPENSEARCH_HOSTS"
+    [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
+    [opensearch.username]="$OPENSEARCH_USERNAME"
+    [opensearch.password]="$OPENSEARCH_PASSWORD"
+    [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
+    [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
+    [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
+    [server.ssl.enabled]="$SERVER_SSL_ENABLED"
+    [server.ssl.key]="\"$SERVER_SSL_KEY\""
+    [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
+    [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
+    [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
+    [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
+    [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
+    [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
+    [pattern]="$PATTERN"
+    [checks.pattern]="$CHECKS_PATTERN"
+    [checks.template]="$CHECKS_TEMPLATE"
+    [checks.api]="$CHECKS_API"
+    [checks.setup]="$CHECKS_SETUP"
+    [timeout]="$APP_TIMEOUT"
+    [api.selector]="$API_SELECTOR"
+    [ip.selector]="$IP_SELECTOR"
+    [ip.ignore]="$IP_IGNORE"
+    [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
+    [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
+    [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
+    [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
 )
 
 # Replace configuration values in the dashboard config file
diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
index 3b4a01ca..334283fa 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
@@ -188,7 +188,8 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
     TMP_HOSTS=$(mktemp)
     {
         echo "    <hosts>"
-        for NODE in $WAZUH_INDEXER_HOSTS; do
+        IFS=',' read -ra NODES <<< "$WAZUH_INDEXER_HOSTS"
+        for NODE in "${NODES[@]}"; do
             IP="${NODE%:*}"
             PORT="${NODE#*:}"
             echo "      <host>https://$IP:$PORT</host>"
diff --git a/multi-node/config.yml b/multi-node/config.yml
new file mode 100644
index 00000000..894882cf
--- /dev/null
+++ b/multi-node/config.yml
@@ -0,0 +1,25 @@
+nodes:
+  # Wazuh indexer nodes
+  indexer:
+    - name: wazuh1.indexer
+      ip: wazuh1.indexer
+    - name: wazuh2.indexer
+      ip: wazuh2.indexer
+    - name: wazuh3.indexer
+      ip: wazuh3.indexer
+
+  # Wazuh server nodes
+  # If there is more than one Wazuh server
+  # node, each one must have a node_type
+  server:
+    - name: wazuh.master
+      ip: wazuh.master
+      node_type: master
+    - name: wazuh.worker
+      ip: wazuh.worker
+      node_type: worker
+
+  # Wazuh dashboard nodes
+  dashboard:
+    - name: wazuh.dashboard
+      ip: wazuh.dashboard
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index 969af678..2a05bec7 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     restart: always
     ulimits:
@@ -37,7 +37,7 @@ services:
       - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem
       - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key
   wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     restart: always
     ulimits:
@@ -70,7 +70,7 @@ services:
       - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -101,7 +101,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -128,7 +128,7 @@ services:
       - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -155,7 +155,7 @@ services:
       - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:
@@ -171,6 +171,9 @@ services:
       - DASHBOARD_PASSWORD=kibanaserver
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
+      - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
+      - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
+      - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
     volumes:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 3857b15e..7a7afd33 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -83,6 +83,9 @@ services:
       - DASHBOARD_PASSWORD=kibanaserver
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
+      - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem
+      - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
+      - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
     volumes:
       - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
       - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem

From 181a6b470b6be818e549671a794214f1634a9e3b Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Tue, 9 Dec 2025 18:57:26 -0300
Subject: [PATCH 21/25] Fixed multi node certificates path

---
 multi-node/docker-compose.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index 2a05bec7..da7c275e 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -33,9 +33,9 @@ services:
       - master-wazuh-var-multigroups:/var/ossec/var/multigroups
       - master-wazuh-active-response:/var/ossec/active-response/bin
       - master-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem
-      - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem
-      - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key
+      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem
+      - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem
   wazuh.worker:
     image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
@@ -66,8 +66,8 @@ services:
       - worker-wazuh-active-response:/var/ossec/active-response/bin
       - worker-wazuh-wodles:/var/ossec/wodles
       - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.worker.pem
-      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key
+      - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.pem
+      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem
 
   wazuh1.indexer:
     image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0

From 232bc0a77d7ccb3ca331bff6581bdf13cf601023 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Tue, 9 Dec 2025 19:02:15 -0300
Subject: [PATCH 22/25] Updated docker images tag

---
 multi-node/docker-compose.yml  | 12 ++++++------
 single-node/docker-compose.yml |  6 +++---
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index da7c275e..121bda33 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     restart: always
     ulimits:
@@ -37,7 +37,7 @@ services:
       - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem
       - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem
   wazuh.worker:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     restart: always
     ulimits:
@@ -70,7 +70,7 @@ services:
       - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem
 
   wazuh1.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -101,7 +101,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -128,7 +128,7 @@ services:
       - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -155,7 +155,7 @@ services:
       - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 7a7afd33..7b1b35f5 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     restart: always
     ulimits:
@@ -38,7 +38,7 @@ services:
       - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem
 
   wazuh.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -68,7 +68,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:

From 8b41c47efc1e13f772a1b3759bc19eb69fc9123c Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 10 Dec 2025 10:18:12 -0300
Subject: [PATCH 23/25] Updated Wazuh manager certificates mounth

---
 .../config/etc/cont-init.d/0-wazuh-init       | 11 ---------
 multi-node/docker-compose.yml                 | 24 +++++++++----------
 single-node/docker-compose.yml                | 12 +++++-----
 3 files changed, 18 insertions(+), 29 deletions(-)

diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
index 334283fa..32eba0a0 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
@@ -6,10 +6,6 @@ source /permanent_data.env
 
 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
-CERT_DIR=/etc/wazuh/certs
-WAZUH_INDEXER_SSL_CA=$CERT_DIR/root-ca.pem
-WAZUH_INDEXER_SSL_CERTIFICATE=$CERT_DIR/wazuh.pem
-WAZUH_INDEXER_SSL_KEY=$CERT_DIR/wazuh-key.pem
 
 ##############################################################################
 # Aux functions
@@ -200,13 +196,6 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
             -e 'd }}' "$OSSEC_CONF";
     rm -f "$TMP_HOSTS";
 
-    # --------------------------
-    # Indexer SSL Configuration
-    # --------------------------
-    sed -i "/<indexer>/,/<\/indexer>/ s|<ca>.*</ca>|<ca>$WAZUH_INDEXER_SSL_CA</ca>|" "$OSSEC_CONF"
-    sed -i "/<indexer>/,/<\/indexer>/ s|<certificate>.*</certificate>|<certificate>$WAZUH_INDEXER_SSL_CERTIFICATE</certificate>|" "$OSSEC_CONF"
-    sed -i "/<indexer>/,/<\/indexer>/ s|<key>.*</key>|<key>$WAZUH_INDEXER_SSL_KEY</key>|" "$OSSEC_CONF"
-
 fi
 
 # --------------------------
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index 121bda33..3778af34 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     restart: always
     ulimits:
@@ -33,11 +33,11 @@ services:
       - master-wazuh-var-multigroups:/var/ossec/var/multigroups
       - master-wazuh-active-response:/var/ossec/active-response/bin
       - master-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem
-      - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem
   wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     restart: always
     ulimits:
@@ -65,12 +65,12 @@ services:
       - worker-wazuh-var-multigroups:/var/ossec/var/multigroups
       - worker-wazuh-active-response:/var/ossec/active-response/bin
       - worker-wazuh-wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.pem
-      - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -101,7 +101,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -128,7 +128,7 @@ services:
       - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -155,7 +155,7 @@ services:
       - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 7b1b35f5..1eaaf80e 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     restart: always
     ulimits:
@@ -33,12 +33,12 @@ services:
       - wazuh_var_multigroups:/var/ossec/var/multigroups
       - wazuh_active_response:/var/ossec/active-response/bin
       - wazuh_wodles:/var/ossec/wodles
-      - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem
-      - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.pem
-      - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem
+      - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem
+      - ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem
+      - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -68,7 +68,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0
+    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:

From c89d4eed9bd20ba95b2f322231f16ddcafd7e1b3 Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Wed, 10 Dec 2025 12:38:27 -0300
Subject: [PATCH 24/25] Updated wazuh images

---
 multi-node/docker-compose.yml  | 12 ++++++------
 single-node/docker-compose.yml |  6 +++---
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index 3778af34..f1b7f63a 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     restart: always
     ulimits:
@@ -37,7 +37,7 @@ services:
       - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem
       - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem
   wazuh.worker:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     restart: always
     ulimits:
@@ -70,7 +70,7 @@ services:
       - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh1.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -101,7 +101,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -128,7 +128,7 @@ services:
       - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -155,7 +155,7 @@ services:
       - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index 1eaaf80e..2481aeff 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     restart: always
     ulimits:
@@ -38,7 +38,7 @@ services:
       - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem
 
   wazuh.indexer:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -68,7 +68,7 @@ services:
       - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     restart: always
     ports:

From 0a9ce33b09d982dad0623891bf889e8c9ce1043b Mon Sep 17 00:00:00 2001
From: Carlos Bordon <carlos.e.bordon@gmail.com>
Date: Mon, 15 Dec 2025 11:03:22 -0300
Subject: [PATCH 25/25] Removed config.yml files

---
 .gitignore             |  4 +++-
 multi-node/config.yml  | 25 -------------------------
 single-node/config.yml | 17 -----------------
 3 files changed, 3 insertions(+), 43 deletions(-)
 delete mode 100644 multi-node/config.yml
 delete mode 100644 single-node/config.yml

diff --git a/.gitignore b/.gitignore
index 0abf79b9..302fbb6d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,7 +5,9 @@ single-node/wazuh-certificates
 single-node/wazuh-certificates/*
 single-node/wazuh-certificates-tool.log
 single-node/wazuh-certs-tool.sh
+single-node/config.yml
 multi-node/wazuh-certificates
 multi-node/wazuh-certificates/*
 multi-node/wazuh-certificates-tool.log
-multi-node/wazuh-certs-tool.sh
\ No newline at end of file
+multi-node/wazuh-certs-tool.sh
+multi-node/config.yml
diff --git a/multi-node/config.yml b/multi-node/config.yml
deleted file mode 100644
index 894882cf..00000000
--- a/multi-node/config.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-nodes:
-  # Wazuh indexer nodes
-  indexer:
-    - name: wazuh1.indexer
-      ip: wazuh1.indexer
-    - name: wazuh2.indexer
-      ip: wazuh2.indexer
-    - name: wazuh3.indexer
-      ip: wazuh3.indexer
-
-  # Wazuh server nodes
-  # If there is more than one Wazuh server
-  # node, each one must have a node_type
-  server:
-    - name: wazuh.master
-      ip: wazuh.master
-      node_type: master
-    - name: wazuh.worker
-      ip: wazuh.worker
-      node_type: worker
-
-  # Wazuh dashboard nodes
-  dashboard:
-    - name: wazuh.dashboard
-      ip: wazuh.dashboard
diff --git a/single-node/config.yml b/single-node/config.yml
deleted file mode 100644
index b8f678e3..00000000
--- a/single-node/config.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-nodes:
-  # Wazuh indexer nodes
-  indexer:
-    - name: wazuh.indexer
-      ip: wazuh.indexer
-
-  # Wazuh server nodes
-  # If there is more than one Wazuh server
-  # node, each one must have a node_type
-  server:
-    - name: wazuh.manager
-      ip: wazuh.manager
-
-  # Wazuh dashboard nodes
-  dashboard:
-    - name: wazuh.dashboard
-      ip: wazuh.dashboard