# Wallarm Docker Node Manager

Single-command Docker-based deployment for Wallarm filtering nodes.
Multiple nodes on one host, no conflicts, zero native dependencies.

## Quick Start

```bash
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
sudo /opt/fw/deploy.sh
```

Setup installs Python + Docker, downloads deploy script. Menu handles everything.

## Menu

```
[1] Deploy all     Deploy all nodes from fw.conf
[2] Add a node     Interactive config + deploy
[3] Status         Show running containers
[4] Remove a node  Stop + delete container
[5] Edit a node    Update port, upstream, mode in fw.conf
```

## Configuration

`/opt/fw/app/fw.conf` — JSON with node configs:

```json
{
  "srv1": {
    "token": "your-wallarm-token",
    "cloud": "EU",
    "port": "8081",
    "upstream_ip": "10.1.0.10",
    "upstream_port": "8081",
    "mode": "monitoring"
  }
}
```

## Architecture

```
deploy.py                 Single Python file, ~200 lines
  ├── Docker image: wallarm/node:6.13.0
  ├── Named volumes for persistence
  └── Unique ports per node

/opt/fw/
├── deploy.sh             Entry wrapper
├── app/
│   ├── main.py           Deploy script
│   ├── fw.conf           Node config
│   └── state.json        Deployment state
└── wallarm-aio.sh        Cached installer (native fallback)
```

## Requirements

- Linux with systemd
- Docker (auto-installed by setup.sh)
- Python 3.10+ (auto-installed by setup.sh)
- Outbound to api.wallarm.com (EU) or us1.api.wallarm.com (US)

## Remote Assistance

See [JUMP_SERVER.md](JUMP_SERVER.md) for jump server setup.

## Agent Rules (for AI assistants working on this project)

**CRITICAL — These override all other considerations:**

1. **NEVER change code without explicit user approval.** Discuss ideas first. Ask before implementing.
2. **Production defaults must be explicit.** Never rely on Docker image defaults — nginx config, headers, client_max_body_size, upload limits must be set explicitly in our code. Defaults cause production outages.
3. **Header forwarding is not default.** `proxy_set_header X-Real-IP`, `X-Forwarded-For`, `X-Forwarded-Proto` must be explicitly configured.
4. **client_max_body_size** must be set high enough for production (e.g., `1024m`) — default 1m blocks legitimate uploads.
5. **The user owns this project.** You are assisting, not leading. Propose, don't impose.