33 lines
1.9 KiB
YAML
33 lines
1.9 KiB
YAML
# REFERENCE (applied ON the SIEM node, wazuh1.bitasylum.org, if you deploy it with
|
|
# the upstream Wazuh single-node compose). NOT used by the fleet serving stack —
|
|
# Wazuh runs on its own node, managed independently. The only fleet-specific bit
|
|
# is publishing the manager's TCP syslog listener so the serving-host
|
|
# audit-collector relay can reach it:
|
|
#
|
|
# cd upstream/single-node
|
|
# docker compose -f docker-compose.yml -f /path/to/docker-compose.override.yml up -d
|
|
#
|
|
# On a dedicated node the indexer gets full resources — no co-location memory caps.
|
|
#
|
|
# ⚠ SERVICE NAME depends on the upstream deployment you used:
|
|
# - single-node compose -> service is `wazuh.manager`
|
|
# - multi-node compose -> service is `wazuh.master` (the syslog receiver)
|
|
# Match your deployment. The upstream publishes 514/UDP only — the fleet relay is
|
|
# TCP, so the ONE required change is adding 514/tcp on whichever node runs the
|
|
# syslog `<remote>` block. (Recreate the container after a port change.)
|
|
services:
|
|
wazuh.master: # rename to wazuh.manager for a single-node deployment
|
|
restart: unless-stopped
|
|
ports:
|
|
- "514:514/tcp" # TCP syslog ingest for the fleet audit relay
|
|
volumes:
|
|
# Declarative custom decoder + rules via the image's /wazuh-config-mount
|
|
# mechanism (entrypoint copies the tree into /var/ossec at startup — correct
|
|
# ownership, survives --force-recreate, no docker cp). In a cluster, put them
|
|
# on the master only; Wazuh syncs etc/decoders + etc/rules to the workers.
|
|
# NOTE: relative bind paths resolve to the COMPOSE PROJECT DIR, so keep these
|
|
# files alongside the compose you run (or use an absolute path). A config
|
|
# change needs a recreate/restart (the copy happens at startup).
|
|
- ./config/local_decoder.xml:/wazuh-config-mount/etc/decoders/local_decoder.xml
|
|
- ./config/local_rules.xml:/wazuh-config-mount/etc/rules/local_rules.xml
|