wazuh-stack
Production-proven docker compose for a single-node Wazuh stack
(manager + indexer + dashboard + wazuh-wui), wired into an agentic SOC: the realtime ingest service,
the SOC gateway token check, and the agentic-soc-send integratord plugin that ships
alert payloads to a reports mailbox.
Source repo → · part of the agentic SOC build alongside laya-control and stig-baselines
What it does
- One compose, four services: manager, indexer, dashboard, wazuh-wui — with the
env wiring for the ingest and mail paths. The pristine upstream compose is kept beside it
(
docker-compose-official.yml) so the customizations stay diffable. - Cert tooling: Wazuh's official cert generator is committed
(
wazuh-certs-tool.sh+ the node map inconfig.yml, all loopback); generated certs are laid out underconfig/wazuh_indexer_ssl_certs/at deploy time — never committed. - Secrets are env-injected and fail fast:
.env.examplelists every credential the stack expects;./secrets/is gitignored; nothing secret is ever committed. - Agentic-SOC wiring: the
integrations/directory carries theagentic-soc-sendintegratord wrapper + implementation (alert payloads → reports mailbox), the realtime ingest path, and the SOC gateway token check. - Agent intake: agents connect to the manager's LAN/Tailscale address over
1514; the extra ossec.conf entries merge via a volume mount (JSON logging included). - This stack is the one the agentic SOC itself runs on — the compose here is not a lab toy; it is the deployed configuration, simplified for single-node reuse.
What it does NOT do
A fresh clone is not yet turn-key. Known gap: the compose bind-mounts a handful of
files (config/wazuh_indexer/*.yml, config/wazuh_dashboard/{opensearch_dashboards,wazuh}.yml,
the ssl-certs layout) that the repo has not committed example copies of yet — on a truly fresh clone
those mounts fail into docker-created directories and need the operator's equivalents first. Follow the
repo for the packaging fix; until then this is a production-config port, not a one-command demo.
Not HA, not multi-node: one node by design. No cluster key setup, no shared storage, no failover story.
No sample data: alerts arrive from YOUR agents; there is no bundled dataset and the public demo uses a separate throwaway instance, never anyone's live stack.
Password rotation is not done by the compose: the compose values are bootstrap
only — use the Wazuh indexer credential-rotation flow (regenerate + securityadmin reload)
rather than editing values in place.
Quickstart
git clone https://github.com/dmrobbi/wazuh-stack.git && cd wazuh-stack
./wazuh-certs-tool.sh --config-file config.yml # generate node certs
# lay out config/ as compose volumes expect (certs under config/wazuh_indexer_ssl_certs/)
cp .env.example .env && $EDITOR .env # fill passwords + token
docker-compose up -d # certs first: indexer -> manager -> dashboardAgents connect to the manager's LAN/Tailscale address on port 1514. Create your own
./secrets/reports-mailbox.env with the SMTP values the send integration reads at runtime.
Methodology (dated)
- Release: v0.1.0, tagged 2026-10-19, with a dated CHANGELOG.
- Provenance: extracted from a production single-node deployment (the agentic
SOC host itself): the compose = the live stack minus host-specific values; the official upstream
compose kept as
docker-compose-official.ymlfor diffing. JSON logging + the ingest/mail wiring = the real production deltas. - Secrets posture: fail-fast env injection; the repo contains zero plaintext credentials; certs are generated at deploy time by Wazuh's own tool.