forked from wazuh/wazuh-docker
Jesus Garcia
f04ed6e608
--- - All relevant content of README.md files was migrated to docs/ section in their respective section. - These README files has been deleted (4 files) - All README.md files (additional to the project's root and docs/) have been edited. --- - Both files build-docker-images/README.md and docs/dev/build-image.md have almost same content, so it was discarded the README file - As the directory and docker image are going to be disused, the certs-gen documentation contents of indexer-certs-creator/README.md was not mig> - The 'bash' command added to the docs/dev/build-image.md was removed - Added workflow usage docs file to the the SUMMARY.md file --- - Removed '$' parameter and added 'bash' to all markdown code blocks headings (```) ---
78 lines
2.6 KiB
Markdown
78 lines
2.6 KiB
Markdown
# Wazuh Docker Deployment
|
|
|
|
## Deploying Wazuh Docker in a Multi-Node Configuration
|
|
|
|
This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration:
|
|
|
|
1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
|
|
|
|
```bash
|
|
sudo sysctl -w vm.max_map_count=262144
|
|
```
|
|
|
|
**Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`.
|
|
|
|
2. Navigate to the `multi-node` directory within your repository:
|
|
|
|
```bash
|
|
cd multi-node
|
|
```
|
|
|
|
3. Download the certificate creation script and config.yml file:
|
|
|
|
```bash
|
|
curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh
|
|
curl -sO https://packages.wazuh.com/5.0/config.yml
|
|
```
|
|
|
|
4. Edit the `config.yml` file with the configuration of the Wazuh components to be deployed
|
|
|
|
```bash
|
|
nodes:
|
|
# Wazuh indexer server nodes
|
|
indexer:
|
|
- name: wazuh1.indexer
|
|
ip: wazuh1.indexer
|
|
- name: wazuh2.indexer
|
|
ip: wazuh2.indexer
|
|
- name: wazuh3.indexer
|
|
ip: wazuh3.indexer
|
|
|
|
# Wazuh server nodes
|
|
# Use node_type only with more than one Wazuh manager
|
|
server:
|
|
- name: wazuh.master
|
|
ip: wazuh.master
|
|
node_type: master
|
|
- name: wazuh.worker
|
|
ip: wazuh.worker
|
|
node_type: worker
|
|
|
|
# Wazuh dashboard node
|
|
dashboard:
|
|
- name: wazuh.dashboard
|
|
ip: wazuh.dashboard
|
|
```
|
|
|
|
5. Run the certificate creation script:
|
|
|
|
```bash
|
|
bash ./wazuh-certs-tool.sh -A
|
|
```
|
|
|
|
6. Start the Wazuh environment using `docker compose`:
|
|
|
|
* To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop):
|
|
|
|
```bash
|
|
docker compose up
|
|
```
|
|
|
|
* To run in the background (detached mode, allowing the containers to run independently of your terminal):
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.
|