customer-engineering/wallarm
3
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

refactor: make wallarm-native.sh the sole native deployment script

Browse source 
Remove the native/wallarm-ct-*.sh scripts (NGINX-module based native
deployment) so the wallarm-ct-* family is Docker-only and the native
deployment is represented by the unified wallarm-native.sh manager.
Update setup.sh (native downloads only wallarm-native.sh), README and
changelog.
This commit is contained in:
Sechpoint Admin 2026-08-01 08:53:07 +01:00
parent 537beed957
commit d9b53c6c18
7 changed files with 109 additions and 1730 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

243
README.md
View file

@ -6,9 +6,10 @@ A comprehensive solution for deploying Wallarm filtering nodes on virtual machin
| | **Docker** | **Native** | | | **Docker** | **Native** |
|---|---|---| |---|---|---|
| Runtime | Wallarm container on Docker engine | Wallarm NGINX module installed directly on the OS | | Runtime | Wallarm container on Docker engine | Wallarm Native Node (go-node, `connector-server` mode) installed directly on the OS |
| Artifacts | Docker static binaries + Wallarm image (from Git repo or local) | Wallarm all-in-one installer (`meganode.wallarm.com`) | | Artifacts | Docker static binaries + Wallarm image (from Git repo or local) | Wallarm all-in-one installer (`repo.wallarm.com`) |
| Multi-node on one host | ✅ Yes (unique ports) | ⚠️ One node per host (single system NGINX) | | Multi-node on one host | ✅ Yes (unique ports) | ✅ Yes (per-node systemd template units) |
| Management | 4 scripts (`check`/`deploy`/`reconfigure`/`uninstall`) | 1 unified script (`wallarm-native.sh`) |
| Directory | `docker/` | `native/` | | Directory | `docker/` | `native/` |
| Requires Docker | ✅ (installed automatically) | ❌ Never installed | | Requires Docker | ✅ (installed automatically) | ❌ Never installed |
| Best for | LXC/containers, multiple nodes, air-gapped | Simple single VM, minimal footprint, no containers | | Best for | LXC/containers, multiple nodes, air-gapped | Simple single VM, minimal footprint, no containers |
@ -17,11 +18,11 @@ A comprehensive solution for deploying Wallarm filtering nodes on virtual machin
- **Automated Preflight Checks** – Validates system readiness, network connectivity, and resource availability (per deployment type) - **Automated Preflight Checks** – Validates system readiness, network connectivity, and resource availability (per deployment type)
- **Smart Artifact Management** – Git Repositorys-first approach with local fallback support (Docker type) - **Smart Artifact Management** – Git Repositorys-first approach with local fallback support (Docker type)
- **Multiple Node Support (Docker)** – Deploy multiple Wallarm instances on the same VM with unique port configurations - **Multiple Node Support** – Deploy multiple Wallarm instances on the same VM with unique port configurations (Docker) or per-node systemd units (Native)
- **Interactive Configuration** – User-friendly prompts for cloud region, ports, token, and upstream applications - **Interactive Configuration** – User-friendly prompts for cloud region, ports, token, and upstream applications
- **Comprehensive Validation** – Network tests, port availability checks, and deployment verification - **Comprehensive Validation** – Network tests, port availability checks, and deployment verification
- **Persistence & Management** – Automatic service creation (systemd/OpenRC/SysV), start scripts, and health monitoring - **Persistence & Management** – Automatic service creation and health monitoring (systemd/OpenRC/SysV for Docker; systemd template units for Native)
- **Post‑Deployment Reconfiguration** – Easily update trusted proxy IPs and change operation mode without redeploying - **Post‑Deployment Reconfiguration** – Easily update trusted proxy IPs and change operation mode without redeploying (Docker) or node address/token/labels (Native)
- **Clean Uninstallation** – Safe removal of containers, packages, and configuration files - **Clean Uninstallation** – Safe removal of containers, packages, and configuration files
## Prerequisites ## Prerequisites
@ -37,7 +38,7 @@ A comprehensive solution for deploying Wallarm filtering nodes on virtual machin
- **Bash**: Version 4.0+ (included with most Linux distributions) - **Bash**: Version 4.0+ (included with most Linux distributions)
- **curl** or **wget**: For downloading scripts and artifacts - **curl** or **wget**: For downloading scripts and artifacts
- **sudo**: For package installation and system configuration - **sudo**: For package installation and system configuration
- **systemd**, **OpenRC** or **sysvinit**: For service management - **systemd**: Required for Native deployment (per-node template units); Docker also supports OpenRC/sysvinit
## Quick Start ## Quick Start
@ -62,10 +63,6 @@ The setup script downloads the shared library and makes executable:
- `docker/wallarm-ct-deploy.sh` – Main deployment script (Docker) - `docker/wallarm-ct-deploy.sh` – Main deployment script (Docker)
- `docker/wallarm-ct-reconfigure.sh` – Modify configuration after deployment (Docker) - `docker/wallarm-ct-reconfigure.sh` – Modify configuration after deployment (Docker)
- `docker/wallarm-ct-uninstall.sh` – Remove a Wallarm node (Docker) - `docker/wallarm-ct-uninstall.sh` – Remove a Wallarm node (Docker)
- `native/wallarm-ct-check.sh` – Preflight validation (Native)
- `native/wallarm-ct-deploy.sh` – Main deployment script (Native)
- `native/wallarm-ct-reconfigure.sh` – Modify configuration after deployment (Native)
- `native/wallarm-ct-uninstall.sh` – Remove a Wallarm node (Native)
- `native/wallarm-native.sh` – Unified single-script manager for the Wallarm Native Node (connector mode) - `native/wallarm-native.sh` – Unified single-script manager for the Wallarm Native Node (connector mode)
### 2. Run Preflight Check ### 2. Run Preflight Check
@ -75,15 +72,14 @@ The setup script downloads the shared library and makes executable:
./docker/wallarm-ct-check.sh ./docker/wallarm-ct-check.sh
# Native deployment # Native deployment
./native/wallarm-ct-check.sh sudo ./native/wallarm-native.sh --preflight
``` ```
The preflight check will: The preflight checks will:
- Verify system compatibility (OS, architecture, init system) - Verify system compatibility (OS, architecture, init system)
- Test network connectivity to Wallarm cloud endpoints - Test network connectivity to Wallarm cloud endpoints and installers
- Validate artifact availability (Docker: Git repo / local files; Native: all-in-one installer) - Validate artifact availability (Docker: Git repo / local files; Native: all-in-one installer)
- Validate resource availability - Validate resource availability and listen-port availability
- Generate a `.env` file with results
### 3. Deploy Wallarm Node ### 3. Deploy Wallarm Node
@ -91,15 +87,15 @@ The preflight check will:
# Docker deployment # Docker deployment
sudo ./docker/wallarm-ct-deploy.sh sudo ./docker/wallarm-ct-deploy.sh
# Native deployment # Native deployment (interactive, multi-node)
sudo ./native/wallarm-ct-deploy.sh sudo ./native/wallarm-native.sh --install
``` ```
The deployment script will: The deployment script will:
1. Read preflight check results 1. Run preflight checks (Native) / read preflight results (Docker)
2. Prompt for configuration (ports, upstream application, Wallarm token, trusted proxies) 2. Prompt for configuration (Docker: ports, upstream, token, proxies; Native: node names, listen addresses, token)
3. **Docker**: Install Docker, download and load the Wallarm image, configure and start the container 3. **Docker**: Install Docker, download and load the Wallarm image, configure and start the container
4. **Native**: Download and run the Wallarm all-in-one installer, configure NGINX, reload and verify 4. **Native**: Download and run the Wallarm all-in-one installer, register nodes, start per-node systemd units
5. Verify deployment with health checks 5. Verify deployment with health checks
## Required Information Before Deployment ## Required Information Before Deployment
@ -108,18 +104,19 @@ To ensure a smooth deployment, have the following information ready before start
| Item | Description | Example | Notes | | Item | Description | Example | Notes |
|------|-------------|---------|-------| |------|-------------|---------|-------|
| **Inbound Port** | The port on which the Wallarm node will listen for incoming HTTP traffic. | `80` (HTTP) or `8080` | Must be unused on the server. If port 80 is already in use, choose another. | | **Inbound Port / Listen Address** | Docker: port the node listens on. Native: `IP:Port` connector address per node. | `80` or `0.0.0.0:8081` | Must be unused on the server. Native can run multiple nodes on different ports. |
| **Application Server (Upstream) IP/Hostname** | The IP address or hostname of the backend application that Wallarm will forward traffic to. | `192.168.1.100` or `app.internal.local` | Must be reachable from the Wallarm node. If the application runs on the same physical machine, do **not** use `127.0.0.1` – use the host's actual IP. | | **Application Server (Upstream) IP/Hostname** (Docker) | The IP address or hostname of the backend application that Wallarm will forward traffic to. | `192.168.1.100` or `app.internal.local` | Must be reachable from the Wallarm node. Do **not** use `127.0.0.1` for a local app – use the host's actual IP. |
| **Application Server Port** | The port on which the backend application listens. | `8080` | Must be open and listening. | | **Application Server Port** (Docker) | The port on which the backend application listens. | `8080` | Must be open and listening. |
| **Wallarm Node Token** | A token obtained from the Wallarm Console when creating a new "Wallarm node". | `base64_encoded_string` | Copy it exactly. It will be pasted during the deployment process. | | **Wallarm Node Token** | A token obtained from the Wallarm Console when creating a new "Wallarm node". | `base64_encoded_string` | Copy it exactly. It will be pasted during the deployment process. Native requires a token with the Deploy role. |
| **Trusted Proxy IPs/CIDRs** (Optional) | The IP address(es) of any load balancers, firewalls, or CDNs that sit in front of the Wallarm node and set the `X-Real-IP` header. | `10.0.0.10` or `192.168.0.0/24` | If the node is directly accessible from the internet (no proxy in front), leave empty. Multiple entries can be space-separated. | | **Node Labels** (Native, optional) | Labels applied to the node (defaults to `group=<node-name>`). | `group=prod` | Can be changed later via `--config --labels`. |
| **Wallarm Cloud Region** | Which Wallarm cloud to use – US or EU. | `US` or `EU` | The script will test connectivity to both and only show reachable ones. | | **Trusted Proxy IPs/CIDRs** (Docker, optional) | IP(s) of load balancers/firewalls in front of the node that set the `X-Real-IP` header. | `10.0.0.10` or `192.168.0.0/24` | Leave empty if no proxy in front. Multiple entries space-separated. |
| **Operation Mode** (Optional, can be changed later) | The initial operation mode. `monitoring` only logs attacks, `block` actively blocks. | `monitoring` (recommended for first deployment) | The script defaults to `monitoring`. You can change it later using the reconfigure script. | | **Wallarm Cloud Region** | Which Wallarm cloud to use – US or EU. | `US` or `EU` | Scripts test connectivity to both and only show reachable ones. |
| **Operation Mode** (Docker, optional) | Initial operation mode. `monitoring` logs attacks, `block` blocks. | `monitoring` | Defaults to `monitoring`; changeable later via the reconfigure script. |
### Additional Preparation Steps ### Additional Preparation Steps
- **Ensure the backend application is running** and reachable from the Wallarm server. Test with `telnet <upstream_ip> <upstream_port>`. - **Ensure the backend application is running** and reachable from the Wallarm server. Test with `telnet <upstream_ip> <upstream_port>`.
- **If you plan to use a custom domain**, be prepared to configure DNS to point to the server's public IP (or the load balancer) – the Wallarm node itself does not require a domain for basic setup. - **If you plan to use a custom domain**, be prepared to configure DNS to point to the server's public IP (or the load balancer).
- **If the server is behind a firewall**, open the inbound port (e.g., 80) to allow traffic from the internet or the load balancer. - **If the server is behind a firewall**, open the inbound port (e.g., 80) to allow traffic from the internet or the load balancer.
## Detailed Usage ## Detailed Usage
@ -136,7 +133,7 @@ Before deployment, you need a Wallarm Node Token from the Wallarm Console:
- **Token Format**: Base64 encoded string (alphanumeric with `+`, `/`, `=`, `-`, `_`) - **Token Format**: Base64 encoded string (alphanumeric with `+`, `/`, `=`, `-`, `_`)
- **Documentation**: [Official Wallarm Documentation](https://docs.wallarm.com/) - **Documentation**: [Official Wallarm Documentation](https://docs.wallarm.com/)
#### Header Configuration for Firewalls/Ingress Controllers #### Header Configuration for Firewalls/Ingress Controllers (Docker)
To ensure proper IP address detection and metadata forwarding, configure your firewall or ingress controller to include these headers: To ensure proper IP address detection and metadata forwarding, configure your firewall or ingress controller to include these headers:
```nginx ```nginx
@ -146,7 +143,7 @@ proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Host $host;
``` ```
**Note**: The deployment scripts configure the first three headers automatically. You must manually add `X-Forwarded-Host: "$host"` to your existing firewall/ingress configuration. **Note**: The Docker deployment script configures the first three headers automatically. You must manually add `X-Forwarded-Host: "$host"` to your existing firewall/ingress configuration.
## Docker Deployment (`docker/`) ## Docker Deployment (`docker/`)
@ -176,33 +173,16 @@ You can deploy multiple Wallarm nodes on the same virtual machine by:
## Native Deployment (`native/`) ## Native Deployment (`native/`)
The native deployment installs Wallarm directly on the operating system **without Docker**, using the official Wallarm **all-in-one installer**: The native deployment installs the **Wallarm Native Node** (go-node, `connector-server` mode) directly on the operating system **without Docker**, using a single unified manager script.
- The installer is downloaded from `https://meganode.wallarm.com/` (version configurable via the `WALLARM_VERSION` environment variable, default `6.12.7`)
- It automatically detects your OS and NGINX version, adds the Wallarm repositories, installs `wallarm-node` + the NGINX dynamic module, and registers the node
- Node registration is performed by the installer itself in batch mode (using your Wallarm token)
- The node configuration is written to `/opt/wallarm/etc/wallarm/node.yaml`
- The system NGINX is configured with a `wallarm-<instance>.conf` server block in `/etc/nginx/conf.d/`
**Notes on native deployment:**
- **One node per host**: native uses the system NGINX, so multiple Wallarm nodes on one host are not supported (unlike Docker). Use unique ingress ports only if you run a single node alongside other services.
- The deploy script keeps a copy of the generated NGINX config in `/opt/wallarm/<instance-name>/nginx.conf` and a log of the `nginx -t` test.
- `curl http://127.0.0.8/wallarm-status` reports Wallarm module statistics after deployment.
### Example: Version Pinning
```bash
WALLARM_VERSION=6.12.7 sudo ./native/wallarm-ct-deploy.sh
```
### Unified Node Manager (`native/wallarm-native.sh`) ### Unified Node Manager (`native/wallarm-native.sh`)
For the **Wallarm Native Node** product (go-node, `connector-server` mode, no NGINX module), the repository provides a unified single-script manager. It manages multiple isolated nodes under `/opt/wallarm/nodes/` via a systemd template unit (`wallarm-node@<name>.service`): `wallarm-native.sh` manages multiple isolated nodes under `/opt/wallarm/nodes/` via a systemd template unit (`wallarm-node@<name>.service`):
```bash ```bash
sudo ./native/wallarm-native.sh --preflight # preflight checks only sudo ./native/wallarm-native.sh --preflight # preflight checks only
sudo ./native/wallarm-native.sh --install # interactive multi-node install (parallel) sudo ./native/wallarm-native.sh --install # interactive multi-node install (parallel)
sudo ./native/wallarm-native.sh --config --node node1 --address 0.0.0.0:9090 sudo ./native/wallarm-native.sh --config --node node1 --address 0.0.0.0:9090 [--token TOKEN] [--labels LABELS]
sudo ./native/wallarm-native.sh --remove --node node2 sudo ./native/wallarm-native.sh --remove --node node2
sudo ./native/wallarm-native.sh --status [NODE] # node status (all or one) sudo ./native/wallarm-native.sh --status [NODE] # node status (all or one)
``` ```
@ -212,39 +192,37 @@ Key characteristics:
- Per-node isolated directories (`etc/`, `var/log/`, `var/run/`), with the Wallarm token stored in a `chmod 600` env file - Per-node isolated directories (`etc/`, `var/log/`, `var/run/`), with the Wallarm token stored in a `chmod 600` env file
- All-in-one installer is downloaded from `https://repo.wallarm.com/linux/wallarm-native-node/latest/all-in-one/` (override with `WALLARM_INSTALLER_URL`, architecture with `WALLARM_INSTALLER_ARCH`) - All-in-one installer is downloaded from `https://repo.wallarm.com/linux/wallarm-native-node/latest/all-in-one/` (override with `WALLARM_INSTALLER_URL`, architecture with `WALLARM_INSTALLER_ARCH`)
- Parallel installation with per-node install logs (`install.log`) - Parallel installation with per-node install logs (`install.log`)
- Nodes are started automatically via systemd and restart on failure
> **Note:** This script targets the Wallarm **Native Node** (connector mode). The `native/wallarm-ct-*.sh` scripts target the **NGINX-module** native deployment. Both are no-Docker options; choose the one that matches your Wallarm product. ## Reconfiguration
## Reconfiguration Script (`wallarm-ct-reconfigure.sh`) ### Docker
The reconfigure script safely modifies the configuration of an existing instance, creates a backup, and restarts the container:
After deployment, you may need to adjust:
- **Trusted proxy IPs/CIDRs** – When the network topology changes (new load balancer, CDN, firewall)
- **Operation mode** – Switch from `monitoring` to `block` after verifying correct operation
The reconfigure script safely modifies the configuration of an existing instance, creates a backup, and applies the changes (Docker: restarts the container; Native: tests and reloads NGINX).
**Usage**:
```bash ```bash
# Docker
sudo ./docker/wallarm-ct-reconfigure.sh sudo ./docker/wallarm-ct-reconfigure.sh
```
It can update trusted proxy IPs/CIDRs and switch the operation mode (`monitoring` ↔ `block`).
# Native ### Native
sudo ./native/wallarm-ct-reconfigure.sh Use the unified manager to update an existing node:
```bash
sudo ./native/wallarm-native.sh --config --node node1 --address 0.0.0.0:9090
sudo ./native/wallarm-native.sh --config --node node1 --token <NEW_TOKEN>
sudo ./native/wallarm-native.sh --config --node node1 --labels "group=prod"
``` ```
It will detect installed instances, show current settings, and guide you through the changes. ## Uninstallation
## Uninstallation (`wallarm-ct-uninstall.sh`)
To completely remove a Wallarm node:
### Docker
```bash ```bash
# Docker: remove container/image and optionally Docker # Remove container/image and optionally Docker
sudo ./docker/wallarm-ct-uninstall.sh sudo ./docker/wallarm-ct-uninstall.sh
```
# Native: remove NGINX config, Wallarm packages, and node data ### Native
sudo ./native/wallarm-ct-uninstall.sh ```bash
# Remove a single node (stops systemd unit, deletes its directory)
sudo ./native/wallarm-native.sh --remove --node node2
``` ```
## Artifact Sources ## Artifact Sources
@ -269,7 +247,7 @@ The Docker deployment uses a smart fallback approach for artifact retrieval:
### Native Deployment (Source) ### Native Deployment (Source)
The native deployment downloads the Wallarm **all-in-one installer** directly from `https://meganode.wallarm.com/`. No Docker artifacts are required. Current versions are listed at [node-artifact-versions](https://docs.wallarm.com/updating-migrating/node-artifact-versions/). The native deployment downloads the Wallarm **all-in-one installer** directly from `https://repo.wallarm.com/linux/wallarm-native-node/latest/all-in-one/`. No Docker artifacts are required. Current versions are listed at [node-artifact-versions](https://docs.wallarm.com/updating-migrating/node-artifact-versions/).
## Suggested Resources ## Suggested Resources
@ -306,26 +284,26 @@ The native deployment downloads the Wallarm **all-in-one installer** directly fr
- Validation helpers (IP address, CIDR, port availability) - Validation helpers (IP address, CIDR, port availability)
- Artifact download and checksum verification - Artifact download and checksum verification
### `docker/wallarm-ct-check.sh` / `native/wallarm-ct-check.sh` ### `docker/wallarm-ct-check.sh`
**Purpose**: System validation and preflight checks **Purpose**: System validation and preflight checks (Docker)
**Key Functions**: **Key Functions**:
- OS compatibility verification (Ubuntu, CentOS, Debian, Alpine) - OS compatibility verification (Ubuntu, CentOS, Debian, Alpine)
- Network connectivity testing (US/EU cloud endpoints) - Network connectivity testing (US/EU cloud endpoints)
- Resource availability assessment - Resource availability assessment
- Artifact source validation (Docker: binaries/images; Native: installer) - Docker artifact source validation (Git repo / local binaries/images)
- Environment file generation (`.env`) - Environment file generation (`.env`)
**Usage**: **Usage**:
```bash ```bash
# Run check with default settings # Run check with default settings
./<type>/wallarm-ct-check.sh ./docker/wallarm-ct-check.sh
# Enable debug output # Enable debug output
DEBUG=1 ./<type>/wallarm-ct-check.sh DEBUG=1 ./docker/wallarm-ct-check.sh
# Disable SSL certificate validation (for self-signed certs) # Disable SSL certificate validation (for self-signed certs)
WALLARM_INSECURE_SSL=0 ./<type>/wallarm-ct-check.sh WALLARM_INSECURE_SSL=0 ./docker/wallarm-ct-check.sh
``` ```
### `docker/wallarm-ct-deploy.sh` ### `docker/wallarm-ct-deploy.sh`
@ -348,31 +326,37 @@ sudo ./docker/wallarm-ct-deploy.sh
WALLARM_TOKEN="your_token_here" sudo ./docker/wallarm-ct-deploy.sh WALLARM_TOKEN="your_token_here" sudo ./docker/wallarm-ct-deploy.sh
``` ```
### `native/wallarm-ct-deploy.sh` ### `docker/wallarm-ct-reconfigure.sh`
**Purpose**: Wallarm node deployment and configuration (Native, no Docker) **Purpose**: Modify configuration of an existing Docker Wallarm node
**Key Functions**: **Key Functions**:
- Interactive configuration wizard - Update `set_real_ip_from` (trusted proxy IPs/CIDRs)
- Downloads and runs the Wallarm all-in-one installer (batch mode) - Change `wallarm_mode` (monitoring/block)
- Node registration with your Wallarm token - Create backup of current configuration
- NGINX server block configuration (proxy, wallarm_mode, trusted proxies, health endpoint) - Restart container to apply changes
- NGINX test + reload
- Health check and deployment verification
**Usage**: **Usage**:
```bash ```bash
# Interactive deployment sudo ./docker/wallarm-ct-reconfigure.sh
sudo ./native/wallarm-ct-deploy.sh ```
# Pin a specific Wallarm version ### `docker/wallarm-ct-uninstall.sh`
WALLARM_VERSION=6.12.7 sudo ./native/wallarm-ct-deploy.sh **Purpose**: Safe removal of Docker Wallarm nodes
# Add node labels (group) **Key Functions**:
WALLARM_LABELS='group=prod' sudo ./native/wallarm-ct-deploy.sh - Interactive confirmation with safety checks
- Container/image removal
- Docker cleanup (service files, binaries, config, group)
- Configuration directory removal
**Usage**:
```bash
# Interactive uninstallation
sudo ./docker/wallarm-ct-uninstall.sh
``` ```
### `native/wallarm-native.sh` ### `native/wallarm-native.sh`
**Purpose**: Unified single-script manager for the Wallarm Native Node (connector mode, no Docker/NGINX module) **Purpose**: Unified single-script manager for the Wallarm Native Node (connector mode, no Docker)
**Key Functions**: **Key Functions**:
- Preflight checks (root, systemd, architecture, commands, connectivity, resources, ports) - Preflight checks (root, systemd, architecture, commands, connectivity, resources, ports)
@ -394,42 +378,13 @@ sudo ./native/wallarm-native.sh --remove --node node2
sudo ./native/wallarm-native.sh --status sudo ./native/wallarm-native.sh --status
``` ```
### `wallarm-ct-reconfigure.sh`
**Purpose**: Modify configuration of an existing Wallarm node
**Key Functions**:
- Update `set_real_ip_from` (trusted proxy IPs/CIDRs)
- Change `wallarm_mode` (monitoring/block)
- Create backup of current configuration
- Apply changes (Docker: container restart; Native: NGINX reload)
**Usage**:
```bash
sudo ./<type>/wallarm-ct-reconfigure.sh
```
### `wallarm-ct-uninstall.sh`
**Purpose**: Safe removal of Wallarm nodes
**Key Functions**:
- Interactive confirmation with safety checks
- Docker: container/image removal, Docker cleanup; Native: NGINX config + package removal
- Configuration directory removal
- Optional artifact cleanup
**Usage**:
```bash
# Interactive uninstallation
sudo ./<type>/wallarm-ct-uninstall.sh
```
## Troubleshooting ## Troubleshooting
### Common Issues ### Common Issues
#### 1. Preflight Check Fails #### 1. Preflight Check Fails
```bash ```bash
# Check detailed errors # Docker: check detailed errors
cat .env cat .env
# Verify network connectivity manually # Verify network connectivity manually
@ -473,19 +428,18 @@ groups $USER
docker run --rm hello-world docker run --rm hello-world
``` ```
#### 5. Native Installer Fails #### 5. Native Installer / Node Fails
```bash ```bash
# The all-in-one installer logs its output to the terminal and to files
# Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/ # Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/
# Override the installer URL if needed:
WALLARM_INSTALLER_URL="<custom-url>" sudo ./native/wallarm-native.sh --install
# Verify node registration # Check a node's install log and service status
ls -la /opt/wallarm/etc/wallarm/node.yaml sudo cat /opt/wallarm/nodes/<node>/install.log
sudo systemctl status wallarm-node@<node> --no-pager
# Check Wallarm module status
curl http://127.0.0.8/wallarm-status
``` ```
#### 6. Header Configuration Warnings #### 6. Header Configuration Warnings (Docker)
Ensure your upstream firewall/load balancer includes: Ensure your upstream firewall/load balancer includes:
- `X-Real-IP: "$remote_addr"` - `X-Real-IP: "$remote_addr"`
- `X-Forwarded-For: "$proxy_add_x_forwarded_for"` - `X-Forwarded-For: "$proxy_add_x_forwarded_for"`
@ -493,10 +447,10 @@ Ensure your upstream firewall/load balancer includes:
- `X-Forwarded-Host: "$host"` - `X-Forwarded-Host: "$host"`
### Log Files ### Log Files
- **Preflight Check**: `~/logs/wallarm-check.log` (Docker) / `~/logs/wallarm-check-native.log` (Native) - **Docker Preflight Check**: `~/logs/wallarm-check.log`
- **Deployment**: `~/logs/wallarm-deployment.log` (Docker) / `~/logs/wallarm-deployment-native.log` (Native) - **Docker Deployment**: `~/logs/wallarm-deployment.log`
- **Docker Container Logs**: `/opt/wallarm-<instance-name>/container.log` - **Docker Container Logs**: `/opt/wallarm-<instance-name>/container.log`
- **NGINX Logs (Native)**: `/var/log/nginx/error.log` - **Native Node Logs**: `/opt/wallarm/nodes/<node>/install.log` and `/opt/wallarm/nodes/<node>/var/log/`
- **System Logs**: `/var/log/syslog` or `/var/log/messages` - **System Logs**: `/var/log/syslog` or `/var/log/messages`
## Security Considerations ## Security Considerations
@ -509,25 +463,26 @@ Ensure your upstream firewall/load balancer includes:
### Access Control ### Access Control
- Restrict `sudo` access to deployment scripts - Restrict `sudo` access to deployment scripts
- Use separate service accounts for Wallarm services - Use separate service accounts for Wallarm services
- Implement proper secret management for Wallarm tokens - Implement proper secret management for Wallarm tokens (Native stores them in `chmod 600` env files)
### Monitoring & Auditing ### Monitoring & Auditing
- Enable logging with rotation - Enable logging with rotation
- Monitor resource usage - Monitor resource usage
- Regular security updates for Docker/NGINX and host OS - Regular security updates for Docker and host OS
## Maintenance ## Maintenance
### Regular Tasks ### Regular Tasks
1. **Log Rotation**: Configure logrotate for logs 1. **Log Rotation**: Configure logrotate for logs
2. **Updates**: Periodically update Docker engine/NGINX and Wallarm node 2. **Updates**: Periodically update Docker/NGINX and Wallarm node
3. **Image/Version Updates**: Check for new Wallarm node versions 3. **Image/Version Updates**: Check for new Wallarm node versions
4. **Backup**: Regular backup of configuration directories 4. **Backup**: Regular backup of configuration directories
### Version Updates ### Version Updates
When updating Wallarm node version: When updating the Wallarm Native Node version:
1. **Docker**: Pull new image from Git Repositorys or official registry, stop existing container, deploy new container with updated image, verify functionality before removing old container 1. Check the latest version at [node-artifact-versions](https://docs.wallarm.com/updating-migrating/node-artifact-versions/)
2. **Native**: Set `WALLARM_VERSION` to the new version and re-run the deploy script, or follow the [official upgrade guide](https://docs.wallarm.com/updating-migrating/) 2. Re-download via the latest all-in-one installer (or pin with `WALLARM_INSTALLER_URL`)
3. Remove and re-install the node, or follow the [official upgrade guide](https://docs.wallarm.com/updating-migrating/)
## Repository Structure ## Repository Structure
@ -546,10 +501,6 @@ wallarm/
│ ├── binaries/ # Docker static binaries │ ├── binaries/ # Docker static binaries
│ └── images/ # Wallarm Docker images │ └── images/ # Wallarm Docker images
└── native/ # Native deployment (no Docker) └── native/ # Native deployment (no Docker)
├── wallarm-ct-check.sh
├── wallarm-ct-deploy.sh
├── wallarm-ct-reconfigure.sh
├── wallarm-ct-uninstall.sh
└── wallarm-native.sh # Unified single-script node manager (Native Node product) └── wallarm-native.sh # Unified single-script node manager (Native Node product)
``` ```

19
changelog.md
View file

@ -10,12 +10,7 @@ and this project adheres to date-based versioning (YYYY-MM.x).
- **setup.sh interactive prompt broken under `curl ... | bash`**: the deployment-type prompt and overwrite confirmation read from stdin, which is the script pipe (not the terminal) when piped to bash — the prompt was silently skipped and only Docker scripts were downloaded. setup.sh is now **non-interactive by default and downloads BOTH deployment types** (`docker/` + `native/`), so the native option is always available. Use `DEPLOYMENT_TYPE=docker|native` to download only one type. - **setup.sh interactive prompt broken under `curl ... | bash`**: the deployment-type prompt and overwrite confirmation read from stdin, which is the script pipe (not the terminal) when piped to bash — the prompt was silently skipped and only Docker scripts were downloaded. setup.sh is now **non-interactive by default and downloads BOTH deployment types** (`docker/` + `native/`), so the native option is always available. Use `DEPLOYMENT_TYPE=docker|native` to download only one type.
### Added ### Added
- **Native deployment type**: Wallarm filtering node can now be deployed directly on the OS **without Docker** - **Native deployment**: Wallarm filtering node can now be deployed directly on the OS **without Docker** via the unified manager `native/wallarm-native.sh` (Wallarm Native Node, go-node, `connector-server` mode)
- `native/wallarm-ct-check.sh` – Preflight validation for native deployment (no Docker artifact checks)
- `native/wallarm-ct-deploy.sh` – Downloads and runs the official Wallarm all-in-one installer (`meganode.wallarm.com`, version configurable via `WALLARM_VERSION`), configures the NGINX server block, reloads and verifies the node
- `native/wallarm-ct-reconfigure.sh` – Update trusted proxies / `wallarm_mode` via NGINX test + reload
- `native/wallarm-ct-uninstall.sh` – Remove NGINX config, Wallarm packages/repos, and `/opt/wallarm` data
- **Unified node manager**: `native/wallarm-native.sh` – single-script manager for the Wallarm Native Node (go-node, connector-server mode)
- `--preflight` checks (root, systemd, architecture, required commands, installer + Wallarm cloud connectivity, disk/memory, listen-port availability); auto-run before `--install` - `--preflight` checks (root, systemd, architecture, required commands, installer + Wallarm cloud connectivity, disk/memory, listen-port availability); auto-run before `--install`
- Interactive parallel multi-node installation with per-node systemd template units (`wallarm-node@<name>.service`) - Interactive parallel multi-node installation with per-node systemd template units (`wallarm-node@<name>.service`)
- `--config` (address/token/labels, safe env rewrite), `--remove`, `--status [NODE]` - `--config` (address/token/labels, safe env rewrite), `--remove`, `--status [NODE]`
@ -30,18 +25,18 @@ and this project adheres to date-based versioning (YYYY-MM.x).
- **Repository structure** now separates deployment types: - **Repository structure** now separates deployment types:
- `docker/` – all Docker-based scripts moved here (`git mv`, history preserved) - `docker/` – all Docker-based scripts moved here (`git mv`, history preserved)
- `docker/binaries/` and `docker/images/` – Docker artifacts moved into the Docker tree - `docker/binaries/` and `docker/images/` – Docker artifacts moved into the Docker tree
- `native/` – new native (no-Docker) deployment scripts - `native/` – native (no-Docker) deployment, containing only the unified `wallarm-native.sh`
- `common/` – shared library - `common/` – shared library
- **Removed** the `native/wallarm-ct-*.sh` scripts (NGINX-module based native deployment) so the native deployment is represented solely by the unified `wallarm-native.sh`; the `wallarm-ct-*` family is now Docker-only
- **Artifact URLs** updated to the `docker/` prefix (`/docker/binaries/...`, `/docker/images/...`) - **Artifact URLs** updated to the `docker/` prefix (`/docker/binaries/...`, `/docker/images/...`)
- **Docker scripts** refactored to source `common/wallarm-lib.sh` (removed duplicated helper functions; behavior preserved) - **Docker scripts** refactored to source `common/wallarm-lib.sh` (removed duplicated helper functions; behavior preserved)
- **setup.sh** downloads the shared library and scripts per deployment type into `docker/`/`native/` (native includes `wallarm-native.sh`); supports `DEPLOYMENT_TYPE=docker|native` to download only one type - **setup.sh** downloads the shared library and scripts per deployment type into `docker/`/`native/` (native = `wallarm-native.sh`); supports `DEPLOYMENT_TYPE=docker|native` to download only one type
- **README.md** rewritten to document both deployment types, the new structure, the unified manager, and native-specific usage - **README.md** rewritten to document both deployment types, the new structure, and the unified native manager
### Notes ### Notes
- Native deployment supports one node per host (system NGINX); multi-node remains a Docker feature - The `wallarm-ct-*` script family is Docker-only; native deployment uses `wallarm-native.sh`
- Native installer version defaults to `6.12.7` and can be pinned via `WALLARM_VERSION` - Native multi-node is supported via per-node systemd template units
- Docker deployment behavior is unchanged apart from the new directory layout - Docker deployment behavior is unchanged apart from the new directory layout
- The unified manager targets the Wallarm **Native Node** product; the `native/wallarm-ct-*.sh` scripts target the **NGINX-module** native deployment. Both are no-Docker options
## [2026-04.1] - 2026-04-21 ## [2026-04.1] - 2026-04-21
### Added ### Added

364
native/wallarm-ct-check.sh
View file

@ -1,364 +0,0 @@
#!/bin/bash
# ==============================================================================
# WALLARM PREFLIGHT CHECK SCRIPT - V1.0 (Native deployment)
# ==============================================================================
# Purpose: Validate system readiness for native (no-Docker) Wallarm deployment
# Features:
# - Non-interactive system validation (sudo, OS, architecture, init system)
# - Network connectivity testing (US/EU cloud + Wallarm all-in-one installer)
# - Resource availability assessment
# - Outputs results to .env file for deployment script
# - DAU-friendly error messages with remediation
# ==============================================================================
# Script location and shared library (colors, logging, validation, detection, connectivity)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh"
# Strict error handling
set -euo pipefail
trap early_error_handler ERR
# Configuration
ENV_FILE=".env"
LOG_FILE="${HOME:-.}/logs/wallarm-check-native.log"
# Native install artifacts (Wallarm all-in-one installer)
WALLARM_VERSION="${WALLARM_VERSION:-6.12.7}"
INSTALLER_BASE_URL="https://meganode.wallarm.com/${WALLARM_VERSION%.*}"
INSTALLER_NAME="wallarm-${WALLARM_VERSION}.x86_64-glibc.sh"
INSTALLER_URL="${INSTALLER_BASE_URL}/${INSTALLER_NAME}"
# Cloud endpoints (from Wallarm documentation)
EU_DATA_NODES=("api.wallarm.com" "node-data0.eu1.wallarm.com" "node-data1.eu1.wallarm.com")
US_DATA_NODES=("us1.api.wallarm.com" "node-data0.us1.wallarm.com" "node-data1.us1.wallarm.com")
# Global result tracking
CHECK_RESULT="pass"
CHECK_ERRORS=()
INSTALLER_REACHABLE="false"
# ==============================================================================
# RESULT TRACKING & ENV FILE
# ==============================================================================
add_error() {
local error_msg="$1"
CHECK_ERRORS+=("$error_msg")
CHECK_RESULT="fail"
log_message "ERROR" "$error_msg"
}
write_env_file() {
local os_name="$1"
local os_version="$2"
local architecture="$3"
local init_system="$4"
local us_cloud_reachable="$5"
local eu_cloud_reachable="$6"
local installer_reachable="${7:-false}"
cat > "$ENV_FILE" << EOF
# Wallarm Preflight Check Results (Native deployment)
# Generated: $(date '+%Y-%m-%d %H:%M:%S')
# Script: $0
result=$CHECK_RESULT
os_name=$os_name
os_version=$os_version
architecture=$architecture
init_system=$init_system
us_cloud_reachable=$us_cloud_reachable
eu_cloud_reachable=$eu_cloud_reachable
installer_reachable=$installer_reachable
EOF
if [ ${#CHECK_ERRORS[@]} -gt 0 ]; then
echo "# Errors:" >> "$ENV_FILE"
for i in "${!CHECK_ERRORS[@]}"; do
echo "error_$i=\"${CHECK_ERRORS[$i]}\"" >> "$ENV_FILE"
done
fi
log_message "SUCCESS" "Check results written to $ENV_FILE"
}
# ==============================================================================
# PRE-FLIGHT VALIDATION FUNCTIONS
# ==============================================================================
validate_sudo_access() {
log_message "INFO" "Validating sudo access..."
local os_name
os_name=$(uname -s | tr '[:upper:]' '[:lower:]')
if ! command -v sudo >/dev/null 2>&1; then
add_error "sudo command not found"
return 1
fi
if [ "$os_name" = "darwin" ]; then
log_message "WARNING" "macOS detected: sudo authentication test skipped (may prompt during deployment)"
log_message "INFO" "Note: macOS is not a supported deployment target. This check is for Linux servers."
return 0
fi
if ! sudo -v; then
add_error "sudo authentication failed"
return 1
fi
log_message "SUCCESS" "Sudo access validated"
return 0
}
validate_required_commands() {
log_message "INFO" "Validating required system commands..."
local missing_commands=()
local os_name
os_name=$(uname -s | tr '[:upper:]' '[:lower:]')
# Core commands required for native check and deployment scripts
local core_commands=(
"curl" # Required for downloading the all-in-one installer
"grep" # Used extensively
"cut" # Used for parsing output
"tr" # Used for text transformations
"sed" # Used for text processing
"head" # Used for limiting output
"tail" # Used for limiting output
"ls" # Used for file listing
"date" # Used for logging timestamps
"mkdir" # Used for creating directories
"chmod" # Used for permission changes
"tee" # Required for writing configuration files
"rm" # Required for cleanup operations
)
# Check each core command (command_exists comes from common library)
local cmd
for cmd in "${core_commands[@]}"; do
if ! command_exists "$cmd"; then
missing_commands+=("$cmd")
fi
done
# Check for port checking utility (ss or netstat)
if [ "$os_name" != "darwin" ]; then
if ! command_exists ss && ! command_exists netstat; then
missing_commands+=("ss or netstat")
fi
fi
# Detect init system and validate its control command
if [ "$os_name" != "darwin" ]; then
local init_system
init_system=$(detect_init_system)
case "$init_system" in
"systemd")
if ! command_exists systemctl; then
missing_commands+=("systemctl")
fi
;;
"openrc")
if ! command_exists rc-service; then
missing_commands+=("rc-service")
fi
;;
"sysvinit")
if ! command_exists service; then
missing_commands+=("service")
fi
;;
"upstart")
if ! command_exists initctl; then
missing_commands+=("initctl")
fi
;;
*)
log_message "WARNING" "Unknown init system '$init_system', cannot validate init command"
;;
esac
else
log_message "INFO" "Skipping init system validation on macOS (not a deployment target)"
fi
if [ ${#missing_commands[@]} -gt 0 ]; then
local missing_list
missing_list=$(IFS=', '; echo "${missing_commands[*]}")
add_error "Missing required commands: $missing_list"
log_message "ERROR" "Please install missing commands and run the check again."
return 1
fi
log_message "SUCCESS" "All required system commands are available"
return 0
}
# ==============================================================================
# NETWORK CONNECTIVITY TESTING
# ==============================================================================
perform_network_tests() {
log_message "INFO" "=== NETWORK CONNECTIVITY TESTING ==="
# Test US cloud endpoints
local us_reachable
us_reachable=$(test_cloud_endpoints "US" "${US_DATA_NODES[@]}")
# Test EU cloud endpoints
local eu_reachable
eu_reachable=$(test_cloud_endpoints "EU" "${EU_DATA_NODES[@]}")
# Test Wallarm all-in-one installer reachability (needed for native install)
log_message "INFO" "Testing Wallarm all-in-one installer availability..."
if test_connectivity "$INSTALLER_URL" "Wallarm all-in-one installer"; then
INSTALLER_REACHABLE="true"
log_message "SUCCESS" "Wallarm installer is reachable (version $WALLARM_VERSION)"
else
log_message "WARNING" "Wallarm installer is not reachable at $INSTALLER_URL"
log_message "INFO" "Check https://docs.wallarm.com/updating-migrating/node-artifact-versions/ for the latest version."
fi
echo "$us_reachable:$eu_reachable:$INSTALLER_REACHABLE"
}
# ==============================================================================
# MAIN FUNCTION
# ==============================================================================
main() {
clear
echo -e "${BLUE}${BOLD}"
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ WALLARM PREFLIGHT CHECK SCRIPT (Native) - V1.0 ║"
echo "║ System Readiness Validation for Deployment ║"
echo "╚══════════════════════════════════════════════════════════════╝${NC}"
echo -e "\n${YELLOW}Starting preflight check at: $(date)${NC}"
# Initialize logging
local log_dir="${HOME:-.}/logs"
if [ ! -d "$log_dir" ]; then
if ! mkdir -p "$log_dir"; then
echo -e "${YELLOW}Cannot create log directory $log_dir, falling back to current directory...${NC}"
log_dir="."
fi
fi
LOG_FILE="$log_dir/wallarm-check-native.log"
if ! : > "$LOG_FILE"; then
echo -e "${RED}Cannot create log file at $LOG_FILE${NC}"
echo -e "${YELLOW}Falling back to current directory...${NC}"
LOG_FILE="./wallarm-check-native.log"
: > "$LOG_FILE" 2>/dev/null || true
fi
if ! chmod 644 "$LOG_FILE" 2>/dev/null; then
echo -e "${YELLOW}Warning: Could not set permissions on log file${NC}"
fi
log_message "INFO" "=== Wallarm Preflight Check (Native) Started ==="
if [ "$INSECURE_SSL" = "1" ]; then
log_message "WARNING" "SSL certificate validation is DISABLED (insecure). Set WALLARM_INSECURE_SSL=0 to enable validation."
fi
# Phase 1: System validation
log_message "INFO" "=== PHASE 1: SYSTEM VALIDATION ==="
if ! validate_required_commands; then
add_error "Required system commands validation failed"
fi
if ! validate_sudo_access; then
add_error "Sudo access validation failed"
fi
local os_info
os_info=$(detect_os_and_version)
local os_name
os_name=$(echo "$os_info" | cut -d: -f1)
local os_version
os_version=$(echo "$os_info" | cut -d: -f2)
local architecture
architecture=$(detect_architecture)
if [ "$architecture" = "unknown" ]; then
add_error "Unsupported architecture detected"
fi
local init_system
init_system=$(detect_init_system)
log_message "SUCCESS" "System validation completed:"
log_message "SUCCESS" " OS: $os_name $os_version"
log_message "SUCCESS" " Architecture: $architecture"
log_message "SUCCESS" " Init System: $init_system"
# Phase 2: Network connectivity testing
log_message "INFO" "=== PHASE 2: NETWORK CONNECTIVITY TESTING ==="
local network_results
network_results=$(perform_network_tests)
local us_reachable
us_reachable=$(echo "$network_results" | cut -d: -f1)
local eu_reachable
eu_reachable=$(echo "$network_results" | cut -d: -f2)
local installer_reachable
installer_reachable=$(echo "$network_results" | cut -d: -f3)
log_message "SUCCESS" "Network testing completed:"
log_message "SUCCESS" " US Cloud Reachable: $us_reachable"
log_message "SUCCESS" " EU Cloud Reachable: $eu_reachable"
log_message "SUCCESS" " Wallarm Installer Reachable: $installer_reachable"
# Phase 3: Write results
log_message "INFO" "=== PHASE 3: WRITING RESULTS ==="
write_env_file "$os_name" "$os_version" "$architecture" "$init_system" \
"$us_reachable" "$eu_reachable" "$installer_reachable"
# Final summary
if [ "$CHECK_RESULT" = "pass" ]; then
log_message "SUCCESS" "=== PREFLIGHT CHECK PASSED ==="
echo -e "\n${GREEN}${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}${BOLD}║ PREFLIGHT CHECK PASSED - SYSTEM READY ║${NC}"
echo -e "${GREEN}${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
echo -e "\n${CYAN}System is ready for native Wallarm deployment.${NC}"
echo -e "${YELLOW}Check results: $ENV_FILE${NC}"
echo -e "${YELLOW}Full log: $LOG_FILE${NC}"
echo -e "\n${GREEN}Next step: Run ./native/wallarm-ct-deploy.sh to proceed with deployment${NC}"
exit 0
else
log_message "ERROR" "=== PREFLIGHT CHECK FAILED ==="
echo -e "\n${RED}${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${RED}${BOLD}║ PREFLIGHT CHECK FAILED - SYSTEM NOT READY ║${NC}"
echo -e "${RED}${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
echo -e "\n${YELLOW}${BOLD}Issues found:${NC}"
for error in "${CHECK_ERRORS[@]}"; do
echo -e " ${RED}•${NC} $error"
done
echo -e "\n${YELLOW}Check results: $ENV_FILE${NC}"
echo -e "${YELLOW}Full log: $LOG_FILE${NC}"
echo -e "\n${CYAN}Please fix the issues above and run the check again.${NC}"
exit 1
fi
}
# ==============================================================================
# SCRIPT EXECUTION
# ==============================================================================
# Ensure we're in bash
if [ -z "$BASH_VERSION" ]; then
echo "Error: This script must be run with bash" >&2
exit 1
fi
# Run main function
main "$@"

673
native/wallarm-ct-deploy.sh
View file

@ -1,673 +0,0 @@
#!/bin/bash
# ==============================================================================
# WALLARM DEPLOYMENT SCRIPT - V1.0 (Native deployment)
# ==============================================================================
# Purpose: Deploy Wallarm filtering node natively (NO Docker) after preflight
# Features:
# - Reads preflight check results from .env file
# - Interactive configuration (cloud region, ports, token, upstream)
# - Downloads and runs the official Wallarm all-in-one installer (meganode.wallarm.com)
# - Configures NGINX server block (proxy, wallarm_mode, trusted proxies, health)
# - Deployment verification (health endpoint, wallarm-status, node registration)
# - DAU-friendly error handling with remediation
# ==============================================================================
# Script location and shared library (colors, logging, validation, detection, connectivity)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh"
# Strict error handling
set -euo pipefail
trap early_error_handler ERR
# Configuration
ENV_FILE=".env"
LOG_FILE="${HOME:-.}/logs/wallarm-deployment-native.log"
# Wallarm all-in-one installer (current recommended native install method)
# Override WALLARM_VERSION to pin a different version.
WALLARM_VERSION="${WALLARM_VERSION:-6.12.7}"
INSTALLER_BASE_URL="https://meganode.wallarm.com/${WALLARM_VERSION%.*}"
# Optional node labels for the installer (e.g. 'group=prod')
WALLARM_LABELS="${WALLARM_LABELS:-}"
# Deployment variables (set during execution)
CLOUD_REGION=""
API_HOST=""
INGRESS_PORT=""
UPSTREAM_IP=""
UPSTREAM_PORT=""
WALLARM_TOKEN=""
INSTANCE_NAME=""
INSTANCE_DIR=""
NGINX_CONFIG=""
# Resource reachability from check script
US_CLOUD_REACHABLE="false"
EU_CLOUD_REACHABLE="false"
INSTALLER_REACHABLE="false"
# ==============================================================================
# PREFLIGHT CHECK VERIFICATION
# ==============================================================================
verify_preflight_check() {
log_message "INFO" "Verifying preflight check results..."
if [ ! -f "$ENV_FILE" ]; then
log_message "ERROR" "Preflight check file not found: $ENV_FILE"
echo -e "\n${YELLOW}Preflight check has not been run or .env file is missing.${NC}"
echo -e "${YELLOW}Would you like to run the preflight check now?${NC}"
read -r -p "$(echo -e "${YELLOW}Run preflight check? (Y/n): ${NC}")" -n 1
echo
if [[ ! $REPLY =~ ^[Nn]$ ]]; then
echo -e "${CYAN}Running preflight check...${NC}"
if ! "$SCRIPT_DIR/wallarm-ct-check.sh"; then
fail_with_remediation "Preflight check failed" \
"Run the preflight check manually and fix any issues:
1. $SCRIPT_DIR/wallarm-ct-check.sh
2. Review the errors in $ENV_FILE
3. Fix the issues and run this script again"
fi
else
fail_with_remediation "Preflight check required" \
"Run the preflight check before deployment:
1. $SCRIPT_DIR/wallarm-ct-check.sh
2. Review results in $ENV_FILE
3. Run this script again"
fi
fi
# Load environment variables from .env file (from shared library)
if ! load_env_file "$ENV_FILE"; then
fail_with_remediation "Cannot load preflight results" \
"The preflight check results file could not be read.
1. Run the preflight check: $SCRIPT_DIR/wallarm-ct-check.sh
2. Verify $ENV_FILE exists and is readable
3. Run this script again"
fi
if [ "${CHECK_RESULT:-}" != "pass" ]; then
log_message "ERROR" "Preflight check failed (result: $CHECK_RESULT)"
echo -e "\n${YELLOW}Preflight check found issues. Please review:${NC}"
echo -e "${YELLOW}1. Check file: $ENV_FILE${NC}"
echo -e "${YELLOW}2. Run: $SCRIPT_DIR/wallarm-ct-check.sh${NC}"
echo -e "${YELLOW}3. Fix the issues and try again${NC}"
exit 1
fi
log_message "SUCCESS" "Preflight check verified:"
log_message "SUCCESS" " OS: $OS_NAME $OS_VERSION"
log_message "SUCCESS" " Architecture: $ARCHITECTURE"
log_message "SUCCESS" " Init System: $INIT_SYSTEM"
log_message "SUCCESS" " US Cloud Reachable: $US_CLOUD_REACHABLE"
log_message "SUCCESS" " EU Cloud Reachable: $EU_CLOUD_REACHABLE"
log_message "SUCCESS" " Wallarm Installer Reachable: $INSTALLER_REACHABLE"
# Validate we have at least one cloud region reachable
if [ "$US_CLOUD_REACHABLE" = "false" ] && [ "$EU_CLOUD_REACHABLE" = "false" ]; then
fail_with_remediation "No Wallarm cloud region reachable" \
"Network connectivity issues detected:
1. Check firewall rules for Wallarm cloud endpoints
2. Verify network connectivity
3. Run preflight check again: $SCRIPT_DIR/wallarm-ct-check.sh"
fi
# The all-in-one installer must be reachable for a native deployment
if [ "$INSTALLER_REACHABLE" != "true" ]; then
fail_with_remediation "Wallarm all-in-one installer not reachable" \
"Native deployment requires access to the Wallarm all-in-one installer:
1. Verify network access to $INSTALLER_BASE_URL
2. Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/
3. Pin the version with: WALLARM_VERSION=<version> sudo ./$0"
fi
}
# ==============================================================================
# CONFIGURATION COLLECTION
# ==============================================================================
# select_cloud_region, validate_ip_address and check_port_available are provided
# by the shared library (../common/wallarm-lib.sh).
collect_configuration() {
log_message "INFO" "Collecting deployment configuration..."
# Get ingress port
local default_port=80
local ingress_port=""
while [[ ! "$ingress_port" =~ ^[0-9]+$ ]] || [ "$ingress_port" -lt 1 ] || [ "$ingress_port" -gt 65535 ]; do
read -r -p "$(echo -e "${YELLOW}Enter inbound port [${default_port}]: ${NC}")" ingress_port
ingress_port="${ingress_port:-$default_port}"
if [[ ! "$ingress_port" =~ ^[0-9]+$ ]]; then
echo -e "${RED}Port must be a number${NC}"
elif [ "$ingress_port" -lt 1 ] || [ "$ingress_port" -gt 65535 ]; then
echo -e "${RED}Port must be between 1 and 65535${NC}"
elif ! check_port_available "$ingress_port"; then
echo -e "${RED}Port $ingress_port is already in use${NC}"
ingress_port=""
fi
done
# Get application server details
local upstream_ip=""
local upstream_port=""
echo -e "\n${CYAN}${BOLD}Application Server Configuration:${NC}"
echo -e "${YELLOW}Enter the IP/hostname and port of your backend application${NC}"
while [[ -z "$upstream_ip" ]]; do
read -r -p "$(echo -e "${YELLOW}Upstream App IP/Hostname [127.0.0.1]: ${NC}")" upstream_ip
upstream_ip="${upstream_ip:-127.0.0.1}"
if ! validate_ip_address "$upstream_ip" && \
! [[ "$upstream_ip" =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]$ ]]; then
echo -e "${RED}Invalid IP/hostname format${NC}"
upstream_ip=""
fi
done
while [[ ! "$upstream_port" =~ ^[0-9]+$ ]] || [ "$upstream_port" -lt 1 ] || [ "$upstream_port" -gt 65535 ]; do
read -r -p "$(echo -e "${YELLOW}Upstream App Port [8080]: ${NC}")" upstream_port
upstream_port="${upstream_port:-8080}"
if [[ ! "$upstream_port" =~ ^[0-9]+$ ]]; then
echo -e "${RED}Port must be a number${NC}"
elif [ "$upstream_port" -lt 1 ] || [ "$upstream_port" -gt 65535 ]; then
echo -e "${RED}Port must be between 1 and 65535${NC}"
fi
done
# Verify application server reachability
log_message "INFO" "Verifying application server reachability..."
if timeout 5 bash -c "cat < /dev/null > /dev/tcp/$upstream_ip/$upstream_port" 2>/dev/null; then
log_message "SUCCESS" "Application server $upstream_ip:$upstream_port is reachable"
else
log_message "WARNING" "Application server $upstream_ip:$upstream_port is not reachable"
echo -e "${YELLOW}${BOLD}Warning:${NC} Cannot reach application server at $upstream_ip:$upstream_port"
echo -e "${YELLOW}This may cause the Wallarm node to fail. Possible reasons:${NC}"
echo -e "1. Application server is not running"
echo -e "2. Firewall blocking port $upstream_port"
echo -e "3. Wrong IP/hostname"
echo -e "4. Application server not listening on that port"
read -r -p "$(echo -e "${YELLOW}Continue anyway? (y/N): ${NC}")" -n 1
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
fail_with_remediation "Application server unreachable" \
"Ensure your application server is accessible:
1. Start your application server
2. Check it's listening: sudo ss -tlnp | grep :$upstream_port
3. Verify firewall rules allow inbound connections
4. Test connectivity: telnet $upstream_ip $upstream_port
5. If using hostname, verify DNS resolution: nslookup $upstream_ip"
fi
fi
# Get Wallarm node token
local wallarm_token=""
echo -e "\n${CYAN}${BOLD}Wallarm Node Token:${NC}"
echo -e "${YELLOW}Get your token from Wallarm Console:${NC}"
echo -e "Create a new 'Wallarm node' and copy the token (will be visible as you type)"
while [[ -z "$wallarm_token" ]]; do
read -r -p "$(echo -e "${YELLOW}Paste Wallarm Node Token: ${NC}")" wallarm_token
wallarm_token=$(echo "$wallarm_token" | tr -d '[:space:]')
if [[ -z "$wallarm_token" ]]; then
echo -e "${RED}Token cannot be empty${NC}"
elif [[ ! "$wallarm_token" =~ ^[A-Za-z0-9_+/=\-]+$ ]]; then
echo -e "${RED}Token contains invalid characters. Wallarm tokens are base64 strings (A-Z, a-z, 0-9, _, -, +, /, =)${NC}"
echo -e "${YELLOW}First 20 chars of what you entered: '${wallarm_token:0:20}...'${NC}"
wallarm_token=""
else
token_length=${#wallarm_token}
echo -e "${GREEN}Token accepted (${token_length} characters).${NC}"
echo -e "${YELLOW}First 8 chars for verification: ${wallarm_token:0:8}...${NC}"
fi
done
# Get trusted proxy IPs for real IP configuration
local trusted_proxies=""
echo -e "\n${CYAN}${BOLD}Real Client IP Configuration:${NC}"
echo -e "${YELLOW}For Wallarm to see the real client IP, specify the IP address(es) of trusted proxies"
echo -e "(e.g., load balancers, firewalls, CDNs) that forward traffic to this node.${NC}"
echo -e "${YELLOW}You can enter:${NC}"
echo -e " - Single IP: 10.0.0.10"
echo -e " - CIDR range: 10.0.0.0/24"
echo -e " - Multiple entries separated by spaces: 10.0.0.10 10.0.1.0/24 192.168.1.1"
echo -e "${YELLOW}If unsure, you can leave empty and configure later${NC}"
read -r -p "$(echo -e "${YELLOW}Trusted proxy IPs/CIDRs (space-separated): ${NC}")" trusted_proxies_input
local validated_proxies=()
if [[ -n "$trusted_proxies_input" ]]; then
IFS=' ' read -ra proxy_array <<< "$trusted_proxies_input"
for proxy in "${proxy_array[@]}"; do
proxy=$(echo "$proxy" | xargs)
if [[ -n "$proxy" ]]; then
if validate_ip_or_cidr "$proxy"; then
validated_proxies+=("$proxy")
else
echo -e "${RED}Invalid IP/CIDR format: $proxy${NC}"
echo -e "${YELLOW}Example valid formats: 10.0.0.10, 10.0.0.0/24, 192.168.1.1${NC}"
fi
fi
done
if [[ ${#validated_proxies[@]} -eq 0 ]]; then
echo -e "${YELLOW}No valid proxy IPs provided. Will skip set_real_ip_from configuration.${NC}"
echo -e "${YELLOW}You can configure it later with the reconfigure script.${NC}"
trusted_proxies=""
else
trusted_proxies="${validated_proxies[*]}"
echo -e "${GREEN}Trusted proxies configured: $trusted_proxies${NC}"
fi
else
echo -e "${YELLOW}No trusted proxies specified. The node will see the last hop IP only.${NC}"
fi
# Generate instance name and directory
local instance_name
instance_name="wallarm-$(hostname -s | tr '[:upper:]' '[:lower:]')-$(date +%Y%m%d)"
local instance_dir="/opt/wallarm/$instance_name"
sudo mkdir -p "$instance_dir"
log_message "SUCCESS" "Configuration collected:"
log_message "SUCCESS" " Ingress Port: $ingress_port"
log_message "SUCCESS" " Upstream: $upstream_ip:$upstream_port"
if [[ -n "$trusted_proxies" ]]; then
log_message "SUCCESS" " Trusted Proxies: $trusted_proxies"
else
log_message "INFO" " Trusted Proxies: Not configured (will need manual setup)"
fi
log_message "SUCCESS" " Instance: $instance_name"
log_message "SUCCESS" " Directory: $instance_dir"
INGRESS_PORT="$ingress_port"
UPSTREAM_IP="$upstream_ip"
UPSTREAM_PORT="$upstream_port"
WALLARM_TOKEN="$wallarm_token"
INSTANCE_NAME="$instance_name"
INSTANCE_DIR="$instance_dir"
TRUSTED_PROXIES="$trusted_proxies"
}
# ==============================================================================
# WALLARM NATIVE INSTALLATION (all-in-one installer)
# ==============================================================================
install_wallarm_native() {
log_message "INFO" "Installing Wallarm filtering node natively (all-in-one installer)..."
# Select the correct installer for the detected architecture
local arch_suffix
case "$ARCHITECTURE" in
"x86_64") arch_suffix="x86_64-glibc" ;;
"aarch64") arch_suffix="aarch64-glibc" ;;
*)
fail_with_remediation "Unsupported architecture for native install: $ARCHITECTURE" \
"The Wallarm all-in-one installer supports x86_64 and aarch64.
1. Check architecture: uname -m
2. If you are on a 32-bit system, consider the Docker deployment instead.
3. See https://docs.wallarm.com/installation/nginx/all-in-one/ for supported platforms."
;;
esac
local installer_name="wallarm-${WALLARM_VERSION}.${arch_suffix}.sh"
local installer_url="${INSTALLER_BASE_URL}/${installer_name}"
log_message "INFO" "Downloading Wallarm installer: $installer_name"
if ! download_from_git "$installer_url" "$installer_name" "Wallarm all-in-one installer"; then
fail_with_remediation "Failed to download Wallarm installer" \
"Could not download $installer_url
1. Verify network access to meganode.wallarm.com
2. Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/
3. Pin the version with: WALLARM_VERSION=<version> sudo ./$0"
fi
chmod +x "$installer_name"
# Build installer arguments (batch mode)
local install_args="-- --batch -t $WALLARM_TOKEN"
if [ "$CLOUD_REGION" = "US" ]; then
install_args="$install_args -c US"
log_message "INFO" "Using US cloud (us1.api.wallarm.com)"
else
log_message "INFO" "Using EU cloud (api.wallarm.com)"
fi
# Run the installer (batch mode). The installer registers the node with the
# token and configures NGINX + the Wallarm module automatically.
log_message "INFO" "Running Wallarm all-in-one installer (this may take several minutes)..."
if [ -n "$WALLARM_LABELS" ]; then
log_message "INFO" "Using node labels: $WALLARM_LABELS"
if ! sudo env WALLARM_LABELS="$WALLARM_LABELS" sh "$installer_name" $install_args; then
rm -f "$installer_name"
fail_with_remediation "Wallarm installer failed" \
"The all-in-one installer exited with an error. Check:
1. The installer log output above for the exact error
2. Token validity in the Wallarm Console
3. Network access to Wallarm repositories (the installer adds them automatically)
4. Disk space and memory: df -h / && free -h
5. Retry with a higher log verbosity, or see https://docs.wallarm.com/installation/nginx/all-in-one/"
fi
else
if ! sudo sh "$installer_name" $install_args; then
rm -f "$installer_name"
fail_with_remediation "Wallarm installer failed" \
"The all-in-one installer exited with an error. Check:
1. The installer log output above for the exact error
2. Token validity in the Wallarm Console
3. Network access to Wallarm repositories (the installer adds them automatically)
4. Disk space and memory: df -h / && free -h
5. Retry with a higher log verbosity, or see https://docs.wallarm.com/installation/nginx/all-in-one/"
fi
fi
rm -f "$installer_name"
log_message "SUCCESS" "Wallarm all-in-one installer completed"
# Verify the node was registered
if [ -f "/opt/wallarm/etc/wallarm/node.yaml" ]; then
log_message "SUCCESS" "Wallarm node configuration found: /opt/wallarm/etc/wallarm/node.yaml"
else
log_message "WARNING" "Wallarm node configuration not found at /opt/wallarm/etc/wallarm/node.yaml"
echo -e "${YELLOW}The node may not have been registered. Check the installer output.${NC}"
fi
}
# ==============================================================================
# NGINX CONFIGURATION
# ==============================================================================
# Detect existing NGINX server blocks that would conflict with our ingress port
# and disable the default site if necessary.
resolve_port_conflict() {
local port="$1"
log_message "INFO" "Checking for NGINX config conflicts on port $port..."
# Only relevant for default port 80 where distro default sites listen
if [ "$port" != "80" ]; then
return 0
fi
# Look for default server blocks listening on port 80
local conflicting
conflicting=$(grep -rl "listen.*80" /etc/nginx/sites-enabled/ /etc/nginx/conf.d/ 2>/dev/null | head -1 || true)
if [ -n "$conflicting" ]; then
log_message "WARNING" "Default NGINX site found: $conflicting"
echo -e "${YELLOW}The default site listens on port 80 and may conflict with the Wallarm node.${NC}"
read -r -p "$(echo -e "${YELLOW}Disable it (backup to .bak)? (Y/n): ${NC}")" -n 1
echo
if [[ ! $REPLY =~ ^[Nn]$ ]]; then
sudo mv "$conflicting" "${conflicting}.bak"
log_message "SUCCESS" "Disabled $conflicting (backup: ${conflicting}.bak)"
else
log_message "WARNING" "Keeping default site. The Wallarm node may not receive traffic on port 80."
fi
fi
}
create_nginx_config() {
NGINX_CONFIG="/etc/nginx/conf.d/wallarm-${INSTANCE_NAME}.conf"
log_message "INFO" "Creating NGINX configuration: $NGINX_CONFIG"
# Also keep a copy in the instance directory for reference/backup
sudo tee "$NGINX_CONFIG" > /dev/null <<EOF
# Wallarm filtering node: $INSTANCE_NAME
# Generated: $(date)
server {
listen $INGRESS_PORT;
server_name _;
EOF
# Add set_real_ip_from directives if trusted proxies are configured
if [[ -n "$TRUSTED_PROXIES" ]]; then
for proxy in $TRUSTED_PROXIES; do
sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF
set_real_ip_from $proxy;
EOF
done
sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF
real_ip_header X-Real-IP;
real_ip_recursive on;
EOF
fi
# Add the rest of the configuration
sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF
location / {
proxy_pass http://$UPSTREAM_IP:$UPSTREAM_PORT;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Server \$http_x_forwarded_server;
# Wallarm directives
wallarm_mode monitoring;
}
# Health check endpoint
location /health {
access_log off;
return 200 "healthy\n";
add_header Content-Type text/plain;
}
}
EOF
# Keep a reference copy in the instance directory
sudo cp "$NGINX_CONFIG" "$INSTANCE_DIR/nginx.conf"
log_message "SUCCESS" "NGINX configuration created: $NGINX_CONFIG"
if [[ -n "$TRUSTED_PROXIES" ]]; then
log_message "INFO" " Configured trusted proxies: $TRUSTED_PROXIES"
else
log_message "INFO" " No trusted proxies configured - real client IP detection may be limited"
fi
}
reload_nginx() {
log_message "INFO" "Testing and reloading NGINX..."
if ! sudo nginx -t 2>&1 | tee "$INSTANCE_DIR/nginx-test.log"; then
fail_with_remediation "NGINX configuration test failed" \
"NGINX rejected the configuration. Check the test output above.
1. Review the generated config: $NGINX_CONFIG
2. Look for port conflicts or syntax errors
3. Restore the backup if the default site was disabled
4. Manual test: sudo nginx -t"
fi
# Reload according to init system
case "${INIT_SYSTEM:-systemd}" in
"systemd")
sudo systemctl reload nginx 2>/dev/null || sudo systemctl restart nginx
;;
"openrc")
sudo rc-service nginx reload 2>/dev/null || sudo rc-service nginx restart
;;
"sysvinit")
sudo service nginx reload 2>/dev/null || sudo service nginx restart
;;
*)
sudo nginx -s reload 2>/dev/null || true
;;
esac
log_message "SUCCESS" "NGINX reloaded with Wallarm configuration"
}
# ==============================================================================
# DEPLOYMENT VERIFICATION
# ==============================================================================
verify_deployment() {
log_message "INFO" "Verifying native Wallarm deployment..."
# Test ingress port
log_message "INFO" "Testing ingress port $INGRESS_PORT..."
if ! check_port_available "$INGRESS_PORT"; then
log_message "SUCCESS" "Ingress port $INGRESS_PORT is in use (as expected)"
else
log_message "WARNING" "Ingress port $INGRESS_PORT appears available (NGINX may not be listening)"
fi
# Test health check endpoint
log_message "INFO" "Testing health check endpoint..."
local health_check_url="http://localhost:$INGRESS_PORT/health"
if curl -sf --connect-timeout 5 "$health_check_url" >/dev/null 2>&1; then
log_message "SUCCESS" "Health check endpoint responsive"
else
log_message "WARNING" "Health check endpoint not responsive (may need time to start)"
sleep 5
if curl -sf --connect-timeout 5 "$health_check_url" >/dev/null 2>&1; then
log_message "SUCCESS" "Health check endpoint now responsive"
else
log_message "WARNING" "Health check endpoint still not responsive (check nginx config)"
fi
fi
# Test handshake through filtering node
log_message "INFO" "Testing handshake through filtering node to upstream..."
local test_url="http://localhost:$INGRESS_PORT/"
if curl -sfI --connect-timeout 10 "$test_url" >/dev/null 2>&1; then
log_message "SUCCESS" "Handshake successful: filtering node can reach upstream"
else
log_message "WARNING" "Handshake failed (upstream may not be responding)"
log_message "INFO" "Checking if upstream is directly reachable..."
if timeout 5 bash -c "cat < /dev/null > /dev/tcp/$UPSTREAM_IP/$UPSTREAM_PORT" 2>/dev/null; then
log_message "ERROR" "Upstream is reachable but filtering node cannot proxy"
echo -e "${YELLOW}Possible NGINX configuration issue. Check:${NC}"
echo -e "1. NGINX error log: sudo tail -50 /var/log/nginx/error.log"
echo -e "2. NGINX config: $NGINX_CONFIG"
else
log_message "WARNING" "Upstream server is not reachable (as previously warned)"
fi
fi
# Check Wallarm module status endpoint
log_message "INFO" "Checking Wallarm module status..."
if curl -sf --connect-timeout 5 "http://127.0.0.8/wallarm-status" >/dev/null 2>&1; then
log_message "SUCCESS" "Wallarm module is active (wallarm-status responsive)"
else
log_message "WARNING" "wallarm-status not responsive (module may need more time or a restart)"
fi
# Check node registration file
if [ -f "/opt/wallarm/etc/wallarm/node.yaml" ]; then
log_message "SUCCESS" "Node is registered (node.yaml present)"
else
log_message "WARNING" "node.yaml not found - node may not be registered with the cloud"
fi
log_message "SUCCESS" "Deployment verification completed"
echo -e "\n${GREEN}${BOLD}Verification Summary:${NC}"
echo -e " ${GREEN}✓${NC} NGINX + Wallarm module installed"
echo -e " ${GREEN}✓${NC} Ingress port: $INGRESS_PORT"
echo -e " ${GREEN}✓${NC} Upstream: $UPSTREAM_IP:$UPSTREAM_PORT"
echo -e " ${GREEN}✓${NC} Cloud region: $CLOUD_REGION ($API_HOST)"
}
# ==============================================================================
# MAIN FUNCTION
# ==============================================================================
main() {
clear
echo -e "${BLUE}${BOLD}"
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ WALLARM DEPLOYMENT SCRIPT (Native) - V1.0 ║"
echo "║ Filtering Node Deployment Without Docker ║"
echo "╚══════════════════════════════════════════════════════════════╝${NC}"
echo -e "\n${YELLOW}Starting deployment at: $(date)${NC}"
# Initialize logging
local log_dir="${HOME:-.}/logs"
if [ ! -d "$log_dir" ]; then
if ! mkdir -p "$log_dir"; then
echo -e "${YELLOW}Cannot create log directory $log_dir, falling back to current directory...${NC}"
log_dir="."
fi
fi
LOG_FILE="$log_dir/wallarm-deployment-native.log"
if ! : > "$LOG_FILE"; then
echo -e "${RED}Cannot create log file at $LOG_FILE${NC}"
echo -e "${YELLOW}Falling back to current directory...${NC}"
LOG_FILE="./wallarm-deployment-native.log"
: > "$LOG_FILE" 2>/dev/null || true
fi
if ! chmod 644 "$LOG_FILE" 2>/dev/null; then
echo -e "${YELLOW}Warning: Could not set permissions on log file${NC}"
fi
log_message "INFO" "=== Wallarm Native Deployment Started ==="
if [ "$INSECURE_SSL" = "1" ]; then
log_message "WARNING" "SSL certificate validation is DISABLED (insecure). Set WALLARM_INSECURE_SSL=0 to enable validation."
fi
# Phase 1: Verify preflight check
log_message "INFO" "=== PHASE 1: PREFLIGHT CHECK VERIFICATION ==="
verify_preflight_check
# Phase 2: Configuration collection
log_message "INFO" "=== PHASE 2: CONFIGURATION COLLECTION ==="
select_cloud_region
collect_configuration
# Phase 3: Native installation (all-in-one installer)
log_message "INFO" "=== PHASE 3: WALLARM NATIVE INSTALLATION ==="
install_wallarm_native
# Phase 4: NGINX configuration
log_message "INFO" "=== PHASE 4: NGINX CONFIGURATION ==="
resolve_port_conflict "$INGRESS_PORT"
create_nginx_config
reload_nginx
# Phase 5: Verification
log_message "INFO" "=== PHASE 5: VERIFICATION ==="
verify_deployment
# Success message
log_message "SUCCESS" "=== WALLARM NATIVE DEPLOYMENT COMPLETED SUCCESSFULLY ==="
echo -e "\n${GREEN}${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}${BOLD}║ WALLARM FILTERING NODE DEPLOYMENT SUCCESSFUL ║${NC}"
echo -e "${GREEN}${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
echo -e "\n${CYAN}The Wallarm filtering node is now active and protecting your application.${NC}"
echo -e "${YELLOW}Full deployment log: $LOG_FILE${NC}"
echo -e "${YELLOW}Instance directory: $INSTANCE_DIR${NC}"
echo -e "\n${GREEN}To stop the node:${NC} sudo systemctl stop nginx"
echo -e "${GREEN}To restart:${NC} sudo systemctl restart nginx"
echo -e "${GREEN}To view logs:${NC} sudo tail -f /var/log/nginx/error.log"
echo -e "${GREEN}Node status:${NC} curl http://127.0.0.8/wallarm-status"
echo -e "\n${MAGENTA}${BOLD}Deployment completed successfully!${NC}"
echo -e "\n${YELLOW}Important next steps:${NC}"
echo -e "1. Monitor sync status in Wallarm Console"
echo -e "2. Test attack detection with safe test: curl http://localhost:$INGRESS_PORT/?wallarm_test=1"
echo -e "3. Review logs periodically: sudo tail -50 /var/log/nginx/error.log"
echo -e "4. Switch to block mode after validation: sudo ./native/wallarm-ct-reconfigure.sh"
}
# ==============================================================================
# SCRIPT EXECUTION
# ==============================================================================
# Ensure we're in bash
if [ -z "$BASH_VERSION" ]; then
echo "Error: This script must be run with bash" >&2
exit 1
fi
# Run main function
main "$@"

227
native/wallarm-ct-reconfigure.sh
View file

@ -1,227 +0,0 @@
#!/bin/bash
# ==============================================================================
# WALLARM RECONFIGURATION SCRIPT - V1.0 (Native deployment)
# ==============================================================================
# Purpose: Modify NGINX configuration of an existing native Wallarm node
# Features:
# - Update set_real_ip_from (trusted proxy IPs/CIDRs)
# - Change wallarm_mode (monitoring/block)
# - Backup current config before changes
# - NGINX test + reload instead of container restart
# - Interactive prompts with validation
# ==============================================================================
# Script location and shared library (colors, logging, validation)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh"
set -euo pipefail
trap early_error_handler ERR
# ==============================================================================
# CHECK FOR SUDO / ROOT PRIVILEGES
# ==============================================================================
if [ "$EUID" -ne 0 ]; then
echo -e "${RED}${BOLD}ERROR:${NC} This script must be run with sudo or as root."
echo -e "${YELLOW}Please run: sudo $0${NC}"
exit 1
fi
# ==============================================================================
# CONFIGURATION
# ==============================================================================
CONFIG_GLOB="/etc/nginx/conf.d/wallarm-*.conf"
CONFIG_FILE=""
INSTANCE_NAME=""
# ==============================================================================
# FUNCTIONS
# ==============================================================================
# Find the Wallarm NGINX config file(s)
find_wallarm_config() {
local configs=()
while IFS= read -r file; do
configs+=("$file")
done < <(ls $CONFIG_GLOB 2>/dev/null)
if [ ${#configs[@]} -eq 0 ]; then
echo -e "${RED}No Wallarm NGINX configuration found ($CONFIG_GLOB).${NC}"
echo -e "${YELLOW}Has the native deployment been run? Check /etc/nginx/conf.d/wallarm-*.conf${NC}"
exit 1
elif [ ${#configs[@]} -eq 1 ]; then
CONFIG_FILE="${configs[0]}"
INSTANCE_NAME=$(basename "$CONFIG_FILE" | sed 's/^wallarm-//; s/\.conf$//')
echo -e "${GREEN}Found Wallarm config: $CONFIG_FILE${NC}"
else
echo -e "${YELLOW}Multiple Wallarm NGINX configs found:${NC}"
for i in "${!configs[@]}"; do
echo "$((i+1)). ${configs[$i]}"
done
read -r -p "Select config number: " choice
if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le ${#configs[@]} ]; then
CONFIG_FILE="${configs[$((choice-1))]}"
INSTANCE_NAME=$(basename "$CONFIG_FILE" | sed 's/^wallarm-//; s/\.conf$//')
else
echo -e "${RED}Invalid selection.${NC}"
exit 1
fi
fi
}
# Parse current configuration to get existing values
parse_current_config() {
local config_file="$1"
current_mode=$(grep -oP 'wallarm_mode\s+\K\S+' "$config_file" | head -1)
current_proxies=$(grep -oP 'set_real_ip_from\s+\K\S+' "$config_file")
}
# Update configuration
update_config() {
local config_file="$1"
local backup_file="$config_file.backup.$(date +%Y%m%d_%H%M%S)"
echo -e "${YELLOW}Backing up current config to $backup_file${NC}"
cp "$config_file" "$backup_file"
echo -e "\n${CYAN}${BOLD}Current set_real_ip_from entries:${NC}"
if [ -n "$current_proxies" ]; then
while read -r proxy; do
echo " $proxy"
done <<< "$current_proxies"
else
echo " (none)"
fi
echo -e "\n${YELLOW}Do you want to change the trusted proxy IPs/CIDRs? (y/N)${NC}"
read -r change_proxy
new_proxies=()
if [[ "$change_proxy" =~ ^[Yy]$ ]]; then
echo -e "${YELLOW}Enter new trusted proxy IPs/CIDRs (space-separated, or empty to remove all):${NC}"
read -r new_proxies_input
if [[ -n "$new_proxies_input" ]]; then
IFS=' ' read -ra proxy_array <<< "$new_proxies_input"
for proxy in "${proxy_array[@]}"; do
proxy=$(echo "$proxy" | xargs)
if validate_ip_or_cidr "$proxy"; then
new_proxies+=("$proxy")
else
echo -e "${RED}Invalid format: $proxy. Skipping.${NC}"
fi
done
fi
else
# Keep existing
while read -r proxy; do
new_proxies+=("$proxy")
done <<< "$current_proxies"
fi
echo -e "\n${CYAN}${BOLD}Current wallarm_mode:${NC} ${current_mode:-not set}"
echo -e "${YELLOW}Do you want to change the wallarm_mode? (y/N)${NC}"
read -r change_mode
if [[ "$change_mode" =~ ^[Yy]$ ]]; then
echo -e "${YELLOW}Select new mode:${NC}"
echo "1. monitoring"
echo "2. block"
read -r mode_choice
case "$mode_choice" in
1) new_mode="monitoring" ;;
2) new_mode="block" ;;
*) echo -e "${RED}Invalid choice, keeping current mode.${NC}"; new_mode="$current_mode" ;;
esac
else
new_mode="$current_mode"
fi
# Rebuild the config file
temp_config=$(mktemp)
in_server_block=false
while IFS= read -r line; do
if [[ "$line" =~ ^[[:space:]]*server[[:space:]]*{ ]]; then
in_server_block=true
fi
if $in_server_block; then
if [[ "$line" =~ ^[[:space:]]*set_real_ip_from[[:space:]]+ ]]; then
continue
fi
if [[ "$line" =~ ^[[:space:]]*wallarm_mode[[:space:]]+ ]]; then
continue
fi
if [[ "$line" =~ ^[[:space:]]*real_ip_header[[:space:]]+ ]]; then
continue
fi
if [[ "$line" =~ ^[[:space:]]*real_ip_recursive[[:space:]]+ ]]; then
continue
fi
fi
echo "$line" >> "$temp_config"
if $in_server_block && [[ "$line" =~ ^[[:space:]]*}$ ]]; then
in_server_block=false
if [ ${#new_proxies[@]} -gt 0 ]; then
for proxy in "${new_proxies[@]}"; do
echo " set_real_ip_from $proxy;" >> "$temp_config"
done
echo " real_ip_header X-Real-IP;" >> "$temp_config"
echo " real_ip_recursive on;" >> "$temp_config"
fi
if [ -n "$new_mode" ]; then
echo " wallarm_mode $new_mode;" >> "$temp_config"
fi
fi
done < "$config_file"
mv "$temp_config" "$config_file"
chmod 644 "$config_file"
echo -e "${GREEN}Configuration updated.${NC}"
}
reload_nginx() {
echo -e "${YELLOW}Testing NGINX configuration...${NC}"
if ! sudo nginx -t; then
echo -e "${RED}NGINX configuration test failed. Restoring backup...${NC}"
cp "$CONFIG_FILE.backup."*. "$CONFIG_FILE" 2>/dev/null || true
exit 1
fi
echo -e "${YELLOW}Reloading NGINX to apply changes...${NC}"
sudo systemctl reload nginx 2>/dev/null || sudo nginx -s reload 2>/dev/null || {
sudo systemctl restart nginx 2>/dev/null || {
echo -e "${RED}Could not reload NGINX. Please do it manually: sudo systemctl reload nginx${NC}"
exit 1
}
}
echo -e "${GREEN}NGINX reloaded.${NC}"
}
main() {
echo -e "${BLUE}${BOLD}"
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ WALLARM RECONFIGURATION SCRIPT (Native) - V1.0 ║"
echo "║ Modify NGINX config (trusted proxies / mode) ║"
echo "╚══════════════════════════════════════════════════════════════╝${NC}"
find_wallarm_config
parse_current_config "$CONFIG_FILE"
update_config "$CONFIG_FILE"
echo -e "${YELLOW}Do you want to reload NGINX now? (Y/n)${NC}"
read -r reload_choice
if [[ ! "$reload_choice" =~ ^[Nn]$ ]]; then
reload_nginx
else
echo -e "${YELLOW}Changes will take effect after NGINX reload.${NC}"
echo -e "You can reload later with: sudo systemctl reload nginx"
fi
echo -e "\n${GREEN}${BOLD}Reconfiguration completed.${NC}"
}
main "$@"

299
native/wallarm-ct-uninstall.sh
View file

@ -1,299 +0,0 @@
#!/bin/bash
# ==============================================================================
# WALLARM UNINSTALL SCRIPT - V1.0 (Native deployment)
# ==============================================================================
# Purpose: Safely remove a native (no-Docker) Wallarm filtering node
# Features:
# - Interactive confirmation with safety checks
# - Removes Wallarm NGINX configuration (with backup)
# - Restores disabled default NGINX sites
# - Uninstalls Wallarm packages and repository definitions
# - Removes /opt/wallarm node data
# - Preserves user data and logs (with option to remove)
# - DAU-friendly warnings and confirmations
# ==============================================================================
# Script location and shared library (colors, logging, validation)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh"
# Strict error handling
set -euo pipefail
trap early_error_handler ERR
# ==============================================================================
# CONFIGURATION
# ==============================================================================
CONFIG_GLOB="/etc/nginx/conf.d/wallarm-*.conf"
DEFAULT_BACKUP_GLOB="/etc/nginx/sites-enabled/*.bak"
WALLARM_NODE_DIR="/opt/wallarm"
# ==============================================================================
# FUNCTIONS
# ==============================================================================
# Ask for confirmation
confirm() {
local prompt="$1"
local default="${2:-n}"
local options="[y/N]"
if [ "$default" = "y" ]; then
options="[Y/n]"
fi
echo -e -n "${YELLOW}${prompt} ${options}${NC} "
read -r response
case "$response" in
[yY][eE][sS]|[yY]) return 0 ;;
[nN][oO]|[nN]) return 1 ;;
"")
if [ "$default" = "y" ]; then
return 0
else
return 1
fi
;;
*) return 1 ;;
esac
}
# Detect the package manager in use
detect_package_manager() {
if command -v apt-get >/dev/null 2>&1; then
echo "apt"
elif command -v yum >/dev/null 2>&1; then
echo "yum"
elif command -v dnf >/dev/null 2>&1; then
echo "dnf"
elif command -v apk >/dev/null 2>&1; then
echo "apk"
else
echo "unknown"
fi
}
# Remove Wallarm NGINX configuration files
remove_nginx_configs() {
log_message "INFO" "Looking for Wallarm NGINX configurations..."
local configs=()
while IFS= read -r file; do
configs+=("$file")
done < <(ls $CONFIG_GLOB 2>/dev/null)
if [ ${#configs[@]} -eq 0 ]; then
log_message "INFO" "No Wallarm NGINX configurations found"
return
fi
log_message "INFO" "Found ${#configs[@]} Wallarm NGINX configuration(s)"
for file in "${configs[@]}"; do
if confirm "Remove $file? (backup created)" "y"; then
cp "$file" "$file.uninstall-$(date +%Y%m%d_%H%M%S).bak"
rm -f "$file"
log_message "SUCCESS" "Removed $file (backup created)"
else
log_message "INFO" "Skipping $file"
fi
done
}
# Restore any default NGINX sites we disabled during deployment
restore_default_sites() {
log_message "INFO" "Looking for disabled default NGINX sites..."
local restored=0
while IFS= read -r backup; do
if [ -f "$backup" ]; then
local target="${backup%.bak}"
log_message "INFO" "Restoring $target from $backup"
if confirm "Restore $target?" "y"; then
cp "$backup" "$target"
rm -f "$backup"
restored=$((restored + 1))
fi
fi
done < <(ls $DEFAULT_BACKUP_GLOB 2>/dev/null)
if [ "$restored" -gt 0 ]; then
log_message "SUCCESS" "Restored $restored default site(s)"
else
log_message "INFO" "No disabled default sites found"
fi
}
# Reload NGINX to drop the removed configurations
reload_nginx() {
log_message "INFO" "Testing and reloading NGINX..."
if sudo nginx -t 2>/dev/null; then
sudo systemctl reload nginx 2>/dev/null || sudo nginx -s reload 2>/dev/null || true
log_message "SUCCESS" "NGINX reloaded"
else
log_message "WARNING" "NGINX configuration test failed - reload skipped"
echo -e "${YELLOW}Run 'sudo nginx -t' manually to diagnose the issue.${NC}"
fi
}
# Uninstall Wallarm packages via the system package manager
remove_wallarm_packages() {
local pkg_manager
pkg_manager=$(detect_package_manager)
log_message "INFO" "Detected package manager: $pkg_manager"
if ! confirm "Uninstall Wallarm packages? (wallarm-node, wallarm modules)" "y"; then
log_message "INFO" "Skipping Wallarm package removal"
return
fi
case "$pkg_manager" in
"apt")
log_message "INFO" "Removing Wallarm packages (apt)..."
sudo apt-get purge -y "wallarm-node" "wallarm-node-nginx" "nginx-module-wallarm*" 2>/dev/null || true
sudo apt-get autoremove -y 2>/dev/null || true
;;
"yum")
log_message "INFO" "Removing Wallarm packages (yum)..."
sudo yum remove -y "wallarm-node" "nginx-module-wallarm*" 2>/dev/null || true
;;
"dnf")
log_message "INFO" "Removing Wallarm packages (dnf)..."
sudo dnf remove -y "wallarm-node" "nginx-module-wallarm*" 2>/dev/null || true
;;
"apk")
log_message "INFO" "Removing Wallarm packages (apk)..."
sudo apk del "wallarm-node" "nginx-module-wallarm" 2>/dev/null || true
;;
*)
log_message "WARNING" "Unknown package manager. Please remove Wallarm packages manually."
echo -e "${YELLOW}Relevant packages usually include: wallarm-node, nginx-module-wallarm${NC}"
return
;;
esac
log_message "SUCCESS" "Wallarm packages removed"
}
# Remove Wallarm repository definitions added by the installer
remove_wallarm_repos() {
log_message "INFO" "Removing Wallarm repository definitions..."
local removed=0
while IFS= read -r file; do
if [ -f "$file" ]; then
sudo rm -f "$file"
log_message "SUCCESS" "Removed repo file: $file"
removed=$((removed + 1))
fi
done < <(ls /etc/apt/sources.list.d/*wallarm* /etc/yum.repos.d/*wallarm* 2>/dev/null)
if [ "$removed" -eq 0 ]; then
log_message "INFO" "No Wallarm repository files found"
fi
}
# Remove Wallarm node data directory
remove_wallarm_data() {
if [ -d "$WALLARM_NODE_DIR" ]; then
log_message "WARNING" "Found Wallarm data directory: $WALLARM_NODE_DIR"
log_message "WARNING" "This contains node registration and local data."
if confirm "Remove $WALLARM_NODE_DIR? (node will need re-registration)" "n"; then
sudo rm -rf "$WALLARM_NODE_DIR"
log_message "SUCCESS" "Removed $WALLARM_NODE_DIR"
else
log_message "INFO" "Skipping removal of $WALLARM_NODE_DIR"
fi
else
log_message "INFO" "No Wallarm data directory found"
fi
}
# Remove Wallarm log files (optional)
remove_wallarm_logs() {
local log_dir="$HOME/logs"
if [ -d "$log_dir" ]; then
log_message "INFO" "Found log directory: $log_dir"
if [ -z "$(ls -A "$log_dir" 2>/dev/null)" ]; then
log_message "INFO" "Log directory is empty, removing..."
sudo rmdir "$log_dir" 2>/dev/null || true
else
log_message "INFO" "Log directory contains files, preserving..."
fi
fi
if [ -f ".env" ]; then
if confirm "Remove .env preflight file?" "n"; then
rm -f ".env"
log_message "SUCCESS" "Removed .env file"
fi
fi
}
# ==============================================================================
# MAIN
# ==============================================================================
main() {
echo -e "${CYAN}${BOLD}"
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ WALLARM UNINSTALLATION (Native) ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo -e "${NC}"
echo -e "${YELLOW}This script will remove the native Wallarm filtering node.${NC}"
echo -e "${YELLOW}You will be asked for confirmation before each destructive operation.${NC}"
echo ""
if ! confirm "Do you want to continue with the uninstallation?" "n"; then
log_message "INFO" "Uninstallation cancelled by user"
exit 0
fi
# Step 1: Remove Wallarm NGINX configurations
echo ""
echo -e "${CYAN}${BOLD}Step 1: Remove Wallarm NGINX configurations${NC}"
remove_nginx_configs
restore_default_sites
reload_nginx
# Step 2: Uninstall Wallarm packages
echo ""
echo -e "${CYAN}${BOLD}Step 2: Uninstall Wallarm packages${NC}"
remove_wallarm_packages
remove_wallarm_repos
# Step 3: Remove Wallarm data
echo ""
echo -e "${CYAN}${BOLD}Step 3: Remove Wallarm data${NC}"
remove_wallarm_data
# Step 4: Cleanup
echo ""
echo -e "${CYAN}${BOLD}Step 4: Logs and files cleanup${NC}"
if confirm "Remove Wallarm log files and .env?" "n"; then
remove_wallarm_logs
else
log_message "INFO" "Skipping log/file cleanup"
fi
# Final message
echo ""
echo -e "${GREEN}${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}${BOLD}║ UNINSTALLATION COMPLETE ║${NC}"
echo -e "${GREEN}${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
echo ""
echo -e "${GREEN}The native Wallarm filtering node has been removed.${NC}"
echo ""
echo -e "${YELLOW}Note:${NC}"
echo -e " • NGINX itself was kept installed (may be used by other applications)"
echo -e " • The Wallarm module may remain in NGINX's modules directory"
echo -e " • Wallarm repositories were removed from your package sources"
echo ""
}
# Run main function
main "$@"

14
setup.sh
View file

@ -41,10 +41,6 @@ DOCKER_SCRIPTS=(
) )
NATIVE_SCRIPTS=( NATIVE_SCRIPTS=(
"wallarm-ct-check.sh"
"wallarm-ct-deploy.sh"
"wallarm-ct-reconfigure.sh"
"wallarm-ct-uninstall.sh"
"wallarm-native.sh" "wallarm-native.sh"
) )
@ -139,11 +135,11 @@ echo -e " 3. Reconfigure existing node: ${YELLOW}./docker/wallarm-ct-reconfig
echo -e " 4. Uninstall a node: ${YELLOW}./docker/wallarm-ct-uninstall.sh${NC}" echo -e " 4. Uninstall a node: ${YELLOW}./docker/wallarm-ct-uninstall.sh${NC}"
echo echo
echo -e " Native deployment (no Docker):" echo -e " Native deployment (no Docker):"
echo -e " 1. Run the preflight check: ${YELLOW}./native/wallarm-ct-check.sh${NC}" echo -e " 1. Run the preflight check: ${YELLOW}sudo ./native/wallarm-native.sh --preflight${NC}"
echo -e " 2. Deploy a Wallarm node: ${YELLOW}./native/wallarm-ct-deploy.sh${NC}" echo -e " 2. Deploy Wallarm nodes: ${YELLOW}sudo ./native/wallarm-native.sh --install${NC}"
echo -e " 3. Unified node manager: ${YELLOW}./native/wallarm-native.sh --preflight${NC} (then --install)" echo -e " 3. Update a node's config: ${YELLOW}sudo ./native/wallarm-native.sh --config --node NAME --address IP:PORT${NC}"
echo -e " 4. Reconfigure existing node: ${YELLOW}./native/wallarm-ct-reconfigure.sh${NC}" echo -e " 4. Remove a node: ${YELLOW}sudo ./native/wallarm-native.sh --remove --node NAME${NC}"
echo -e " 5. Uninstall a node: ${YELLOW}./native/wallarm-ct-uninstall.sh${NC}" echo -e " 5. Show node status: ${YELLOW}./native/wallarm-native.sh --status${NC}"
echo echo
echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./<script>${NC}" echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./<script>${NC}"
echo -e "${YELLOW}Make sure you have the required information ready (see documentation).${NC}" echo -e "${YELLOW}Make sure you have the required information ready (see documentation).${NC}"