78 lines
2.4 KiB
Markdown
78 lines
2.4 KiB
Markdown
# Wallarm Docker Node Manager
|
|
|
|
Single-command Docker-based deployment for Wallarm filtering nodes.
|
|
Multiple nodes on one host, no conflicts, zero native dependencies.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
|
|
sudo /opt/fw/deploy.sh
|
|
```
|
|
|
|
Setup installs Python + Docker, downloads deploy script. Menu handles everything.
|
|
|
|
## Menu
|
|
|
|
```
|
|
[1] Deploy all Deploy all nodes from fw.conf
|
|
[2] Add a node Interactive config + deploy
|
|
[3] Status Show running containers
|
|
[4] Remove a node Stop + delete container
|
|
[5] Edit a node Update port, upstream, mode in fw.conf
|
|
```
|
|
|
|
## Configuration
|
|
|
|
`/opt/fw/app/fw.conf` — JSON with node configs:
|
|
|
|
```json
|
|
{
|
|
"srv1": {
|
|
"token": "your-wallarm-token",
|
|
"cloud": "EU",
|
|
"port": "8081",
|
|
"upstream_ip": "10.1.0.10",
|
|
"upstream_port": "8081",
|
|
"mode": "monitoring"
|
|
}
|
|
}
|
|
```
|
|
|
|
## Architecture
|
|
|
|
```
|
|
deploy.py Single Python file, ~200 lines
|
|
├── Docker image: wallarm/node:6.13.0
|
|
├── Named volumes for persistence
|
|
└── Unique ports per node
|
|
|
|
/opt/fw/
|
|
├── deploy.sh Entry wrapper
|
|
├── app/
|
|
│ ├── main.py Deploy script
|
|
│ ├── fw.conf Node config
|
|
│ └── state.json Deployment state
|
|
└── wallarm-aio.sh Cached installer (native fallback)
|
|
```
|
|
|
|
## Requirements
|
|
|
|
- Linux with systemd
|
|
- Docker (auto-installed by setup.sh)
|
|
- Python 3.10+ (auto-installed by setup.sh)
|
|
- Outbound to api.wallarm.com (EU) or us1.api.wallarm.com (US)
|
|
|
|
## Remote Assistance
|
|
|
|
See [JUMP_SERVER.md](JUMP_SERVER.md) for jump server setup.
|
|
|
|
## Agent Rules (for AI assistants working on this project)
|
|
|
|
**CRITICAL — These override all other considerations:**
|
|
|
|
1. **NEVER change code without explicit user approval.** Discuss ideas first. Ask before implementing.
|
|
2. **Production defaults must be explicit.** Never rely on Docker image defaults — nginx config, headers, client_max_body_size, upload limits must be set explicitly in our code. Defaults cause production outages.
|
|
3. **Header forwarding is not default.** `proxy_set_header X-Real-IP`, `X-Forwarded-For`, `X-Forwarded-Proto` must be explicitly configured.
|
|
4. **client_max_body_size** must be set high enough for production (e.g., `1024m`) — default 1m blocks legitimate uploads.
|
|
5. **The user owns this project.** You are assisting, not leading. Propose, don't impose.
|