95 lines
2.2 KiB
Markdown
95 lines
2.2 KiB
Markdown
# Wallarm Node Manager
|
|
|
|
Single-binary deployment and management for Wallarm filtering nodes.
|
|
Interactive menu, multi-instance, zero runtime dependencies.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
|
|
sudo /opt/fw/deploy
|
|
```
|
|
|
|
## Commands
|
|
|
|
```
|
|
/opt/fw/deploy Interactive menu
|
|
/opt/fw/deploy --deploy-all Deploy all nodes from fw.conf
|
|
/opt/fw/deploy --version Show version
|
|
```
|
|
|
|
## Menu
|
|
|
|
```
|
|
─── Main Menu ───
|
|
[1] Deploy a node
|
|
[2] Edit a node
|
|
[3] Show status
|
|
[4] Remove a node
|
|
[5] Remote tunnel
|
|
[6] Dashboard (TUI)
|
|
[q] Quit
|
|
```
|
|
|
|
## Configuration
|
|
|
|
Node configuration is stored in `/opt/fw/fw.conf`:
|
|
|
|
```json
|
|
{
|
|
"nodes": {
|
|
"srv1": {
|
|
"token": "...",
|
|
"cloud": "EU",
|
|
"port": "8081",
|
|
"upstream_ip": "10.1.0.10",
|
|
"upstream_port": "8081",
|
|
"labels": "group=srv1",
|
|
"mode": "monitoring"
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
Modes: `monitoring`, `safe_blocking`, `block`, `off`.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
cmd/deploy/main.go Entry point — menu, deploy, edit, remove
|
|
internal/
|
|
native/ Node deployment, systemd, nginx
|
|
preflight/ System checks (14)
|
|
state/ /opt/fw/state.json persistence
|
|
tunnel/ Reverse SSH over TLS:443
|
|
ui/ Bubbletea TUI (dashboard)
|
|
shared/ Validation, connectivity
|
|
setup.sh Bootstrap — clones repo, builds binary
|
|
Makefile Cross-compile targets
|
|
```
|
|
|
|
## Directory Layout
|
|
|
|
```
|
|
/opt/fw/
|
|
├── deploy Go binary
|
|
├── fw.conf Node configuration (JSON)
|
|
├── state.json Deployment state
|
|
├── {name}/wallarm/ Per-instance files
|
|
│ ├── nginx/ Instance NGINX
|
|
│ ├── modules/ Wallarm modules
|
|
│ ├── etc/ Wallarm config
|
|
│ └── ...
|
|
└── wallarm-aio.sh Cached Wallarm installer
|
|
```
|
|
|
|
## Requirements
|
|
|
|
- Linux with systemd
|
|
- x86_64 or aarch64
|
|
- 2GB+ RAM, 10GB+ disk
|
|
- Outbound to api.wallarm.com (EU) or us1.api.wallarm.com (US)
|
|
|
|
## Remote Assistance
|
|
|
|
See [JUMP_SERVER.md](JUMP_SERVER.md) for jump server setup.
|