The indexer entrypoint is now only our CA-import block followed by exec of the image's own /entrypoint.sh, mounted at /infinito-entrypoint.sh with an explicit command. The certs entrypoint is our own script: it downloads the cert tool only from packages.wazuh.com and fails if that download fails, so there is no silent fallback to the dev bucket. The manager node name is passed in as WAZUH_MANAGER_NODE for both compose and swarm.
Tor: use the shared tor block (bond 0.5, enabled when svc-net-tor is in the node's groups, tor pinned on in both variants) so a node serves one network, onion on a Tor node and clearnet otherwise.
SPOT and sizing: WAZUH_INDEXER_URL replaces four hand-built copies of the indexer URL, and the indexer heap is half of mem_limit instead of a hardcoded 1g (unchanged for the current 2g limit).
Fixes: bcrypt_hash rejects secrets over 72 bytes; the Keycloak group-removal helper uses the same resolver as the add helper and checks every response (the realm is no longer URL-encoded, matching the add helper), and a failed cleanup fails an otherwise passing test; the swarm certs generator removes a stale container before each attempt; vm.max_map_count is set before the early handler flush; securityadmin failed_when now needs rc 0 and the success marker.
The regenerated role README also picks up generator drift (mailu to stalwart).
docker stack deploy ignores depends_on, so manager, indexer and dashboard were scheduled together with certs_generator and rejected with 'bind source path does not exist' for the cert files. stack_ready.sh treats a Rejected newest task as fatal, so the converge failed on its first poll whenever certs_generator had not finished first.
In swarm, the certs_generator service is no longer rendered. Instead the stack host pulls the generator image and runs it once with the same entrypoint, env and mounts, before the stack deploys. The run is checked against a completion marker (sha256 of certs.yml plus tool version) and all eight cert files. Compose mode renders the same output as before.
Existing swarm hosts: a host whose Wazuh stack is already running has no marker yet, so the next deploy stops with an explicit error rather than rotating the CA under the live services. Either run 'docker stack rm wazuh' and redeploy, or write the expected marker value given in the error to <instance>/certs.complete, then redeploy. Compose hosts are not affected.
Prageeth Panicker