Issues docker compose multi node possible solutions

[recomblacksmith]

Here is what i did to make the multi-node stack run:

Solutions — Wazuh Multi-Node Deployment Issues

Problem

The Wazuh multi-node stack (docker compose) failed to start due to several issues.

Issues Found and Fixes Applied

1. Missing SSL Certificates

Symptom: Containers fail to start because certificate files referenced in docker-compose.yml do not exist under multi-node/config/wazuh_indexer_ssl_certs/.

Fix: Generate certificates using the provided cert generator container:

cd multi-node
docker compose -f generate-indexer-certs.yml run --rm generator

This reads config/certs.yml and produces all required .pem and -key.pem files for the indexer nodes, Wazuh manager/worker, and dashboard.

---

2. Invalid Wazuh Cluster Key

Symptom: Wazuh manager and worker containers fail to form a cluster because the shared <key> in their config files contains non-hexadecimal characters.

Files affected:

• multi-node/config/wazuh_cluster/wazuh_manager.conf (line 295)
• multi-node/config/wazuh_cluster/wazuh_worker.conf (line 295)

Original (invalid): c98b6ha9b6169zc5f67rae55ae4z5647 — contains h, z, r which are not hex chars.

Fix: Replaced with a valid 32-character hexadecimal key:

<key>c98b6a9b6169c5f67ae55ae45670a1b2</key>

The cluster key must be exactly 32 hex characters (0-9, a-f) and identical on all cluster nodes.

---

3. Incorrectly Quoted Environment Variables

Symptom: Filebeat on the Wazuh manager and the dashboard fail to parse the indexer URL due to extra surrounding quotes in docker-compose.yml.

File affected: multi-node/docker-compose.yml

Original:

- INDEXER_URL="https://wazuh1.indexer:9200","https://wazuh2.indexer:9200","https://wazuh3.indexer:9200"
- OPENSEARCH_HOSTS="https://wazuh1.indexer:9200"

Fix: Remove the double quotes so Docker compose passes the values correctly:

- INDEXER_URL=https://wazuh1.indexer:9200,https://wazuh2.indexer:9200,https://wazuh3.indexer:9200
- OPENSEARCH_HOSTS=https://wazuh1.indexer:9200

---

4. vm.max_map_count Too Low

Symptom: OpenSearch (Wazuh Indexer) containers crash on startup with:

ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

Fix: Set the kernel parameter on the Docker host:

sudo sysctl -w vm.max_map_count=262144

Make persistent across reboots:

echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

After applying, restart the stack:

cd multi-node
docker compose -f docker-compose.yml restart

---

Deployment Steps (from scratch)

# 1. Generate SSL certificates
cd multi-node
docker compose -f generate-indexer-certs.yml run --rm generator

# 2. Set vm.max_map_count
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

# 3. Start the stack
docker compose -f docker-compose.yml up -d

# 4. Verify cluster health
curl -sk https://admin:SecretPassword@localhost:9200/_cluster/health?pretty

# 5. Verify Wazuh cluster
docker exec multi-node-wazuh.master-1 /var/ossec/bin/cluster_control -l