Wazuh Architecture¶
Compose 🐳¶
flowchart LR
subgraph role [web-app-wazuh]
svc_certs_generator["certs_generator<br>wazuh/wazuh-certs-generator:0.0.5"]
svc_manager["manager<br>wazuh/wazuh-manager:4.14.10<br>agent_events 1514 · agent_registration 1515 · api 55000"]
svc_indexer["indexer<br>wazuh/wazuh-indexer:4.14.10<br>http 9200"]
svc_dashboard["dashboard<br>built here"]
end
Swarm 🐝¶
flowchart LR
svc_certs_generator["certs_generator"]
svc_certs_generator --> rep_certs_generator["replicas: from the host group"]
svc_certs_generator --> plc_certs_generator["node.role == manager"]:::pinned
svc_manager["manager"]
svc_manager --> rep_manager["replicas: from the host group"]
svc_manager --> plc_manager["node.role == manager"]:::pinned
svc_indexer["indexer"]
svc_indexer --> rep_indexer["replicas: from the host group"]
svc_indexer --> plc_indexer["node.role == manager"]:::pinned
svc_dashboard["dashboard"]
svc_dashboard --> rep_dashboard["replicas: from the host group"]
svc_dashboard --> plc_dashboard["node.role == manager"]:::pinned
classDef pinned fill:#fef7e0,stroke:#b06000,color:#3d2600;
Volumes¶
flowchart LR
vol_manager_api_configuration["wazuh_manager_api_configuration"]
vol_manager_api_configuration -->|"role is manager-pinned"| local_manager_api_configuration["node-local on the manager"]:::local
vol_manager_etc["wazuh_manager_etc"]
vol_manager_etc -->|"role is manager-pinned"| local_manager_etc["node-local on the manager"]:::local
vol_manager_logs["wazuh_manager_logs"]
vol_manager_logs -->|"role is manager-pinned"| local_manager_logs["node-local on the manager"]:::local
vol_manager_queue["wazuh_manager_queue"]
vol_manager_queue -->|"role is manager-pinned"| local_manager_queue["node-local on the manager"]:::local
vol_manager_vd["wazuh_manager_vd"]
vol_manager_vd -->|"role is manager-pinned"| local_manager_vd["node-local on the manager"]:::local
vol_manager_var_multigroups["wazuh_manager_var_multigroups"]
vol_manager_var_multigroups -->|"role is manager-pinned"| local_manager_var_multigroups["node-local on the manager"]:::local
vol_manager_integrations["wazuh_manager_integrations"]
vol_manager_integrations -->|"role is manager-pinned"| local_manager_integrations["node-local on the manager"]:::local
vol_manager_active_response["wazuh_manager_active_response"]
vol_manager_active_response -->|"role is manager-pinned"| local_manager_active_response["node-local on the manager"]:::local
vol_manager_agentless["wazuh_manager_agentless"]
vol_manager_agentless -->|"role is manager-pinned"| local_manager_agentless["node-local on the manager"]:::local
vol_manager_wodles["wazuh_manager_wodles"]
vol_manager_wodles -->|"role is manager-pinned"| local_manager_wodles["node-local on the manager"]:::local
vol_manager_filebeat_etc["wazuh_manager_filebeat_etc"]
vol_manager_filebeat_etc -->|"role is manager-pinned"| local_manager_filebeat_etc["node-local on the manager"]:::local
vol_manager_filebeat_var["wazuh_manager_filebeat_var"]
vol_manager_filebeat_var -->|"role is manager-pinned"| local_manager_filebeat_var["node-local on the manager"]:::local
vol_indexer_data["wazuh_indexer_data"]
vol_indexer_data -->|"role is manager-pinned"| local_indexer_data["node-local on the manager"]:::local
vol_dashboard_config["wazuh_dashboard_config"]
vol_dashboard_config -->|"role is manager-pinned"| local_dashboard_config["node-local on the manager"]:::local
vol_dashboard_custom["wazuh_dashboard_custom"]
vol_dashboard_custom -->|"role is manager-pinned"| local_dashboard_custom["node-local on the manager"]:::local
classDef shared fill:#e6f4ea,stroke:#137333,color:#0b2e13;
classDef local fill:#fef7e0,stroke:#b06000,color:#3d2600;
Condition |
Effect |
|---|---|
swarm, |
shared over NFS |
any one of those missing |
node-local |
All four conditions must hold, so pinning a role takes every one of its volumes node-local. Only the role’s primary entry counts as pinned here: a placement on any other service pins that service alone and leaves the backing of every volume unchanged. The chain is drawn rather than its result, because that coupling is what makes a placement change move data without saying so.
Dependencies¶
flowchart LR
subgraph deps [Dependencies]
dep_svc_bkp_volume_2_local["svc-bkp-volume-2-local 💻"]
dep_svc_db_openldap["svc-db-openldap 🐳🐝"]
dep_svc_net_tor["svc-net-tor 🐳🐝"]
dep_web_app_dashboard["web-app-dashboard 🐳🐝"]
dep_web_app_docs["web-app-docs 🐳🐝"]
dep_web_app_keycloak["web-app-keycloak 🐳🐝"]
dep_web_app_matomo["web-app-matomo 🐳🐝"]
dep_web_app_prometheus["web-app-prometheus 🐳🐝"]
dep_web_app_stalwart["web-app-stalwart 🐳🐝"]
dep_web_svc_design["web-svc-design 💻"]
dep_web_svc_logout["web-svc-logout 🐳🐝"]
end
subgraph role [web-app-wazuh 🐳🐝]
svc_email["email ❌"]
svc_sso["sso"]
svc_ldap["ldap"]
svc_logout["logout"]
svc_dashboard["dashboard"]
svc_matomo["matomo"]
svc_prometheus["prometheus"]
svc_design["design"]
svc_container_backup["container_backup"]
svc_wazuh["wazuh"]
svc_certs_generator["certs_generator"]
svc_manager["manager"]
svc_indexer["indexer"]
svc_console["console"]
svc_tor["tor"]
svc_docs["docs"]
end
dep_svc_bkp_volume_2_local -. "0..1" .-> svc_container_backup
dep_svc_db_openldap -. "0..1" .-> svc_ldap
dep_svc_net_tor -. "0..1" .-> svc_tor
dep_web_app_dashboard -. "0..1" .-> svc_dashboard
dep_web_app_docs -. "0..1" .-> svc_docs
dep_web_app_keycloak -. "0..1" .-> svc_sso
dep_web_app_matomo -. "0..1" .-> svc_matomo
dep_web_app_prometheus -. "0..1" .-> svc_prometheus
dep_web_app_stalwart -- "0..0" --> svc_email
dep_web_svc_design -. "0..1" .-> svc_design
dep_web_svc_logout -. "0..1" .-> svc_logout
linkStyle 8 stroke:red;
Symbol |
Meaning |
|---|---|
|
fixed relationship |
|
conditional, enabled only in matching deployments |
|
declared but turned off in this role |
💻 |
deploys to the host |
🐳 |
deploys under compose |
🐝 |
deploys under swarm |
❌ |
service explicitly turned off |
⚙️ |
Ansible role dependency from |
Every dependency and dependent is listed; the graph is not truncated.