# REFERENCE (applied ON the SIEM node, wazuh1.bitasylum.org, if you deploy it with
# the upstream Wazuh single-node compose). NOT used by the fleet serving stack —
# Wazuh runs on its own node, managed independently. The only fleet-specific bit
# is publishing the manager's TCP syslog listener so the serving-host
# audit-collector relay can reach it:
#
#   cd upstream/single-node
#   docker compose -f docker-compose.yml -f /path/to/docker-compose.override.yml up -d
#
# On a dedicated node the indexer gets full resources — no co-location memory caps.
#
# ⚠ SERVICE NAME depends on the upstream deployment you used:
#   - single-node compose -> service is `wazuh.manager`
#   - multi-node compose  -> service is `wazuh.master` (the syslog receiver)
# Match your deployment. The upstream publishes 514/UDP only — the fleet relay is
# TCP, so the ONE required change is adding 514/tcp on whichever node runs the
# syslog `<remote>` block. (Recreate the container after a port change.)
services:
  wazuh.master:            # rename to wazuh.manager for a single-node deployment
    restart: unless-stopped
    ports:
      - "514:514/tcp"      # TCP syslog ingest for the fleet audit relay
    volumes:
      # Declarative custom decoder + rules via the image's /wazuh-config-mount
      # mechanism (entrypoint copies the tree into /var/ossec at startup — correct
      # ownership, survives --force-recreate, no docker cp). In a cluster, put them
      # on the master only; Wazuh syncs etc/decoders + etc/rules to the workers.
      # NOTE: relative bind paths resolve to the COMPOSE PROJECT DIR, so keep these
      # files alongside the compose you run (or use an absolute path). A config
      # change needs a recreate/restart (the copy happens at startup).
      - ./config/local_decoder.xml:/wazuh-config-mount/etc/decoders/local_decoder.xml
      - ./config/local_rules.xml:/wazuh-config-mount/etc/rules/local_rules.xml