# Wallarm Node Manager

Single-binary deployment and management for Wallarm filtering nodes.
Interactive menu, multi-instance, zero runtime dependencies.

## Quick Start

```bash
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
sudo /opt/fw/deploy
```

## Commands

```
/opt/fw/deploy              Interactive menu
/opt/fw/deploy --deploy-all Deploy all nodes from fw.conf
/opt/fw/deploy --version    Show version
```

## Menu

```
─── Main Menu ───
  [1] Deploy a node
  [2] Edit a node
  [3] Show status
  [4] Remove a node
  [5] Remote tunnel
  [6] Dashboard (TUI)
  [q] Quit
```

## Configuration

Node configuration is stored in `/opt/fw/fw.conf`:

```json
{
  "nodes": {
    "srv1": {
      "token": "...",
      "cloud": "EU",
      "port": "8081",
      "upstream_ip": "10.1.0.10",
      "upstream_port": "8081",
      "labels": "group=srv1",
      "mode": "monitoring"
    }
  }
}
```

Modes: `monitoring`, `safe_blocking`, `block`, `off`.

## Architecture

```
cmd/deploy/main.go         Entry point — menu, deploy, edit, remove
internal/
  native/                  Node deployment, systemd, nginx
  preflight/               System checks (14)
  state/                   /opt/fw/state.json persistence
  tunnel/                  Reverse SSH over TLS:443
  ui/                      Bubbletea TUI (dashboard)
  shared/                  Validation, connectivity
setup.sh                   Bootstrap — clones repo, builds binary
Makefile                   Cross-compile targets
```

## Directory Layout

```
/opt/fw/
├── deploy                 Go binary
├── fw.conf                Node configuration (JSON)
├── state.json             Deployment state
├── {name}/wallarm/        Per-instance files
│   ├── nginx/             Instance NGINX
│   ├── modules/           Wallarm modules
│   ├── etc/               Wallarm config
│   └── ...
└── wallarm-aio.sh         Cached Wallarm installer
```

## Requirements

- Linux with systemd
- x86_64 or aarch64
- 2GB+ RAM, 10GB+ disk
- Outbound to api.wallarm.com (EU) or us1.api.wallarm.com (US)

## Remote Assistance

See [JUMP_SERVER.md](JUMP_SERVER.md) for jump server setup.