Wallarm Docker Node Manager

Single-command Docker-based deployment for Wallarm filtering nodes. Multiple nodes on one host, no conflicts, zero native dependencies.

Quick Start

curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
sudo /opt/fw/deploy.sh

Setup installs Python + Docker, downloads deploy script. Menu handles everything.

Menu

[1] Deploy all     Deploy all nodes from fw.conf
[2] Add a node     Interactive config + deploy
[3] Status         Show running containers
[4] Remove a node  Stop + delete container
[5] Edit a node    Update port, upstream, mode in fw.conf

Configuration

/opt/fw/app/fw.conf — JSON with node configs:

{
  "srv1": {
    "token": "your-wallarm-token",
    "cloud": "EU",
    "port": "8081",
    "upstream_ip": "10.1.0.10",
    "upstream_port": "8081",
    "mode": "monitoring"
  }
}

Architecture

deploy.py                 Single Python file, ~200 lines
  ├── Docker image: wallarm/node:6.13.0
  ├── Named volumes for persistence
  └── Unique ports per node

/opt/fw/
├── deploy.sh             Entry wrapper
├── app/
│   ├── main.py           Deploy script
│   ├── fw.conf           Node config
│   └── state.json        Deployment state
└── wallarm-aio.sh        Cached installer (native fallback)

Requirements

• Linux with systemd
• Docker (auto-installed by setup.sh)
• Python 3.10+ (auto-installed by setup.sh)
• Outbound to api.wallarm.com (EU) or us1.api.wallarm.com (US)

Remote Assistance

See JUMP_SERVER.md for jump server setup.

Agent Rules (for AI assistants working on this project)

CRITICAL — These override all other considerations:

1. NEVER change code without explicit user approval. Discuss ideas first. Ask before implementing.
2. Production defaults must be explicit. Never rely on Docker image defaults — nginx config, headers, client_max_body_size, upload limits must be set explicitly in our code. Defaults cause production outages.
3. Header forwarding is not default. proxy_set_header X-Real-IP, X-Forwarded-For, X-Forwarded-Proto must be explicitly configured.
4. client_max_body_size must be set high enough for production (e.g., 1024m) — default 1m blocks legitimate uploads.
5. The user owns this project. You are assisting, not leading. Propose, don't impose.