forked from wazuh/wazuh-docker
Update docs to meet new requirements
This commit is contained in:
Jesus Garcia
+1
-1
@@ -24,7 +24,7 @@
|
||||
- [Configuration](ref/configuration/configuration.md)
|
||||
- [Environment Variabless](ref/configuration/environment-variables.md)
|
||||
- [Configuration files](ref/configuration/configuration-files.md)
|
||||
- [Change passwords](ref/configuration/change-passwords.md)
|
||||
- [Persistence](ref/configuration/persistence.md)
|
||||
- [Upgrade](ref/upgrade.md)
|
||||
- [Uninstall](ref/uninstall.md)
|
||||
- [Backup and restore](ref/backup-and-restore.md)
|
||||
|
||||
@@ -1,89 +1,6 @@
|
||||
# Backup and restore
|
||||
|
||||
On construction...
|
||||
For backup and restore, refer to the documentation for each component:
|
||||
|
||||
<!-- This section describes how to back up and restore a Wazuh Docker deployment data.
|
||||
|
||||
In this repository, persistence is managed through:
|
||||
|
||||
- Docker volumes created by `docker compose` (Wazuh manager, indexer, and dashboard persistent data).
|
||||
- Local files in the deployment directory, mainly the generated `wazuh-certificates/` folder and any custom configuration files.
|
||||
|
||||
## Backup
|
||||
|
||||
1. Navigate to your deployment directory (`single-node/` or `multi-node/`).
|
||||
|
||||
2. Stop the deployment to create a consistent backup:
|
||||
|
||||
```bash
|
||||
docker compose down --remove-orphans
|
||||
```
|
||||
|
||||
3. Create a backup directory:
|
||||
|
||||
```bash
|
||||
BACKUP_DIR="backup-$(date -u +%Y%m%dT%H%M%SZ)"
|
||||
mkdir -p "${BACKUP_DIR}/files" "${BACKUP_DIR}/volumes"
|
||||
```
|
||||
|
||||
4. Back up local files (certificates and deployment configuration):
|
||||
|
||||
```bash
|
||||
cp -a docker-compose.yml "${BACKUP_DIR}/files/"
|
||||
[ -f config.yml ] && cp -a config.yml "${BACKUP_DIR}/files/"
|
||||
[ -f wazuh-certs-tool.sh ] && cp -a wazuh-certs-tool.sh "${BACKUP_DIR}/files/"
|
||||
[ -d wazuh-certificates ] && tar -czf "${BACKUP_DIR}/files/wazuh-certificates.tgz" wazuh-certificates/
|
||||
[ -d config ] && tar -czf "${BACKUP_DIR}/files/config.tgz" config/
|
||||
```
|
||||
|
||||
5. Back up Docker volumes created by this Compose project:
|
||||
|
||||
```bash
|
||||
PROJECT_NAME="$(basename "${PWD}")"
|
||||
docker volume ls -q --filter "label=com.docker.compose.project=${PROJECT_NAME}" \
|
||||
| while read -r VOLUME; do
|
||||
docker run --rm \
|
||||
-v "${VOLUME}:/volume:ro" \
|
||||
-v "${PWD}/${BACKUP_DIR}/volumes:/backup" \
|
||||
alpine:3.20 \
|
||||
tar -czf "/backup/${VOLUME}.tgz" -C /volume .
|
||||
done
|
||||
```
|
||||
|
||||
## Restore
|
||||
|
||||
1. Navigate to the target deployment directory.
|
||||
|
||||
2. Restore local files (at minimum, the `wazuh-certificates/` folder used by the `docker-compose.yml` bind mounts):
|
||||
|
||||
```bash
|
||||
# If you backed up a tarball
|
||||
[ -f "${BACKUP_DIR}/files/wazuh-certificates.tgz" ] && tar -xzf "${BACKUP_DIR}/files/wazuh-certificates.tgz"
|
||||
```
|
||||
|
||||
3. Restore Docker volumes from the backup archives:
|
||||
|
||||
```bash
|
||||
for ARCHIVE in "${BACKUP_DIR}/volumes/"*.tgz; do
|
||||
[ -f "${ARCHIVE}" ] || continue
|
||||
VOLUME="$(basename "${ARCHIVE}" .tgz)"
|
||||
docker volume create "${VOLUME}" >/dev/null
|
||||
docker run --rm \
|
||||
-v "${VOLUME}:/volume" \
|
||||
-v "${PWD}/${BACKUP_DIR}/volumes:/backup" \
|
||||
alpine:3.20 \
|
||||
sh -c "rm -rf /volume/* && tar -xzf /backup/$(basename "${ARCHIVE}") -C /volume"
|
||||
done
|
||||
```
|
||||
|
||||
4. Start the deployment:
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- Backups are bound to the Docker Compose project name because the created volumes are prefixed automatically. To keep volume names consistent across hosts, run Compose with an explicit project name (for example: `docker compose -p single-node up -d`).
|
||||
- Restoring data into a different Wazuh version is not supported. Keep the same image tags, or follow the official upgrade procedure described in the [Upgrade](upgrade.md) section.
|
||||
- If certificates are missing or replaced, components will fail to establish TLS connections. Ensure the restored `wazuh-certificates/` matches the deployment configuration. -->
|
||||
- [Wazuh central components](https://documentation.wazuh.com/current/migration-guide/index.html)
|
||||
- [Wazuh agent](https://documentation.wazuh.com/current/migration-guide/index.html)
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
# Change passwords
|
||||
|
||||
This section describes how to rotate the credentials used by the provided Docker Compose deployments.
|
||||
|
||||
## Scope
|
||||
|
||||
The Compose files include the following password-controlled integrations:
|
||||
|
||||
- **Wazuh Indexer access (Manager and Dashboard clients)**: `INDEXER_USERNAME`, `INDEXER_PASSWORD`
|
||||
- **Wazuh Dashboard login**: `DASHBOARD_USERNAME`, `DASHBOARD_PASSWORD`
|
||||
- **Wazuh API access (Dashboard client)**: `API_USERNAME`, `API_PASSWORD`
|
||||
|
||||
For variable descriptions, see [Environment variables](environment-variables.md).
|
||||
|
||||
## Rotate credentials
|
||||
|
||||
1. Navigate to your deployment directory:
|
||||
|
||||
- `single-node/` (single-node stack)
|
||||
- `multi-node/` (multi-node stack)
|
||||
|
||||
2. Edit the deployment `docker-compose.yml` and update the required values under `environment`:
|
||||
|
||||
- Single-node: update `wazuh.manager` and `wazuh.dashboard`.
|
||||
- Multi-node: update `wazuh.master`, `wazuh.worker`, and `wazuh.dashboard`.
|
||||
|
||||
Ensure `INDEXER_USERNAME` and `INDEXER_PASSWORD` are consistent anywhere they are defined.
|
||||
|
||||
3. Recreate the containers to apply the new values:
|
||||
|
||||
```bash
|
||||
docker compose down
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
4. Validate access:
|
||||
|
||||
- Log in to the Dashboard with the updated credentials.
|
||||
- Confirm the Dashboard can query data (indirectly validating the Indexer and API credentials).
|
||||
|
||||
## Notes
|
||||
|
||||
- The Manager applies `API_USERNAME` / `API_PASSWORD` at startup by creating or updating the API user.
|
||||
- The Dashboard regenerates its OpenSearch Dashboards keystore on startup; changes take effect after the container is recreated.
|
||||
- Rotating Indexer credentials requires updating both the Indexer user configuration and the Compose client variables (`INDEXER_*`).
|
||||
@@ -0,0 +1,77 @@
|
||||
# Persistence configuration
|
||||
|
||||
When customizing your Wazuh Docker deployment, certain files and directories must be persisted to retain your changes across container restarts and recreations. This is critical for maintaining custom configurations, user credentials, and security settings.
|
||||
|
||||
## Wazuh Indexer
|
||||
|
||||
### Internal Users
|
||||
|
||||
The `internal_users.yml` file contains the initial users and passwords for the Wazuh Indexer. This file is not included by default in the repository and must be created manually if you wish to customize internal users or update passwords.
|
||||
|
||||
#### Creating the Configuration File
|
||||
|
||||
1. Create the directory:
|
||||
```bash
|
||||
mkdir -p ./config/wazuh_indexer/
|
||||
```
|
||||
|
||||
2. Create the file: Create `./config/wazuh_indexer/internal_users.yml` with your user definitions. Here is a basic example:
|
||||
```yaml
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Default users
|
||||
|
||||
admin:
|
||||
hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
||||
reserved: true
|
||||
description: "Kibana server user"
|
||||
```
|
||||
|
||||
> **Important**: This example includes the default `admin` and `kibanaserver` users with their default passwords (hashed). These users are required for the standard `docker-compose.yml` configuration (e.g., `INDEXER_USERNAME=admin` and `DASHBOARD_USERNAME=kibanaserver`) to function correctly. If you change these passwords, you must also update the corresponding environment variables in your `docker-compose.yml`.
|
||||
|
||||
#### Docker Compose Configuration
|
||||
|
||||
To persist the `internal_users.yml` file, add a volume mount to your `docker-compose.yml` for the `wazuh.indexer` service:
|
||||
|
||||
```yaml
|
||||
services:
|
||||
wazuh.indexer:
|
||||
volumes:
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/securityconfig/internal_users.yml
|
||||
```
|
||||
|
||||
> **Note**: Ensure the file exists on your host before starting the containers to prevent Docker from creating it as a directory.
|
||||
|
||||
#### Applying Changes
|
||||
|
||||
After modifying `internal_users.yml`, restart the stack to apply the changes:
|
||||
|
||||
```bash
|
||||
docker-compose down
|
||||
```
|
||||
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
## Other Components
|
||||
|
||||
For other components like the Wazuh Manager and Wazuh Dashboard, persistence is typically handled by mounting their respective configuration directories or using Docker volumes for data storage.
|
||||
|
||||
- **Wazuh Manager**: Persist `/var/ossec/data` and `/var/ossec/etc` (or specific files like `ossec.conf`) to retain rules, decoders, and logs.
|
||||
- **Wazuh Dashboard**: Persist `/usr/share/wazuh-dashboard/data` to retain tenants, dashboards, and visualizations.
|
||||
|
||||
Refer to the [Configuration Files](configuration-files.md) section for more details on mapping specific configuration files.
|
||||
+74
-5
@@ -1,10 +1,79 @@
|
||||
# Upgrading Wazuh in Docker
|
||||
|
||||
To upgrade your Wazuh deployment when using Docker, we recommend following the official Wazuh documentation. It contains the most accurate and up-to-date information for upgrading from previous versions to the current one.
|
||||
To upgrade your Wazuh deployment when using Docker, the process primarily involves updating the image tags in your `docker-compose.yml` file to the desired version.
|
||||
|
||||
> 📘 Please refer to the official guide:
|
||||
> [Upgrading Wazuh Docker](https://documentation.wazuh.com/current/deployment-options/docker/upgrading-wazuh-docker.html)
|
||||
Below is a step-by-step example of how to perform this update:
|
||||
|
||||
This external guide provides detailed upgrade instructions that cover multiple scenarios and configurations.
|
||||
1. **Stop the current deployment**:
|
||||
Stop and remove the existing containers.
|
||||
```bash
|
||||
docker-compose down
|
||||
```
|
||||
|
||||
Following the official documentation ensures a smoother and safer upgrade process, with fewer risks of data loss or configuration issues.
|
||||
2. **Update the image tags**:
|
||||
Edit your `docker-compose.yml` file and update the `image` field for all Wazuh services to the desired version.
|
||||
|
||||
### Single-node configuration
|
||||
Update the image tag for the following services in `single-node/docker-compose.yml`:
|
||||
- `wazuh.manager`
|
||||
- `wazuh.indexer`
|
||||
- `wazuh.dashboard`
|
||||
|
||||
Example (update to 5.0.0):
|
||||
|
||||
```yaml
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:5.0.0
|
||||
...
|
||||
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:5.0.0
|
||||
...
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:5.0.0
|
||||
...
|
||||
```
|
||||
|
||||
### Multi-node configuration
|
||||
Update the image tag for the following services in `multi-node/docker-compose.yml`:
|
||||
- `wazuh.master`
|
||||
- `wazuh.worker`
|
||||
- `wazuh1.indexer`, `wazuh2.indexer`, and `wazuh3.indexer`
|
||||
- `wazuh.dashboard`
|
||||
|
||||
Example (update to 5.0.0):
|
||||
|
||||
```yaml
|
||||
services:
|
||||
wazuh.master:
|
||||
image: wazuh/wazuh-manager:5.0.0
|
||||
...
|
||||
|
||||
wazuh.worker:
|
||||
image: wazuh/wazuh-manager:5.0.0
|
||||
...
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:5.0.0
|
||||
...
|
||||
|
||||
wazuh2.indexer:
|
||||
image: wazuh/wazuh-indexer:5.0.0
|
||||
...
|
||||
|
||||
wazuh3.indexer:
|
||||
image: wazuh/wazuh-indexer:5.0.0
|
||||
...
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:5.0.0
|
||||
...
|
||||
```
|
||||
|
||||
3. **Start the updated deployment**:
|
||||
Start the containers again. Docker will automatically pull the new images.
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user