# REFERENCE for deploying the SIEM node (wazuh1.bitasylum.org) with the upstream
# Wazuh single-node compose. Wazuh is managed on that node, NOT by the fleet
# serving stack — so these creds live there, not in the serving repo's runtime.
# Copy to upstream/single-node/.env on the SIEM node and CHANGE every password.

# Wazuh release — pin to current stable (github.com/wazuh/wazuh-docker/releases).
WAZUH_VERSION=4.12.0

# --- credentials (ROTATE — these are public defaults) ----------------------
INDEXER_USERNAME=admin
INDEXER_PASSWORD=ChangeMe-Indexer-Adm1n!
API_USERNAME=wazuh-wui
API_PASSWORD=ChangeMe-Api-Passw0rd!
DASHBOARD_USERNAME=kibanaserver
DASHBOARD_PASSWORD=ChangeMe-Dash-Passw0rd!

# --- fleet integration (set ON the node / in the manager config) -----------
# TCP syslog ingest port the manager listens on (config/fleet-remote-syslog.xml)
# and the override publishes. The serving-host audit-collector relays here.
WAZUH_SYSLOG_PORT=514
# Source the manager accepts syslog from = the SERVING HOST's IP (goes in the
# <allowed-ips> of config/fleet-remote-syslog.xml). Confirm the real source in the
# manager logs and tighten to /32.
WAZUH_ALLOWED_IPS=SET-TO-SERVING-HOST-IP/32