Theseus

Appearance

Install from a bundle ​

For installations without theseus-node and the control plane: an air-gapped lab, or automation of your own. You need a release bundle (theseus-<version>.tar.gz) and pull credentials for the image registry, both from us. Most customers should use the install command instead (one server, two servers).

What you give up

Without theseus-node nothing delivers configuration changes or the licence. A stack without a licence file accepts one agent; see Licence and agent limits. Ask us how to license a stack installed this way.

Requirements ​

The host checks of the install command do not run here; ./theseus install runs its own preflight (./theseus doctor). It needs:

  • Docker Engine 24 or later with the Compose plugin 2.24 or later, already installed.

  • At least 8 GB of memory available to Docker (6 GB for core, 4 GB for app); 2 GB less than that is refused.

  • vm.max_map_count of at least 262144 on Linux (except app):

    bash
    echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-theseus.conf && sudo sysctl --system

  • x86-64. On other architectures doctor only warns that the Wazuh images would run emulated; that is not supported for production.

One server ​

bash
tar -xzf theseus-0.1.0.tar.gz && cd theseus
docker login registry.example.com
printf '%s\n' THESEUS_HOST=soc.example.com THESEUS_REGISTRY_HOST=registry.example.com \
  THESEUS_ROLE=all ADMIN_EMAIL=ops@example.com COMPOSE_PROFILES=patch,scanner > theseus.env
chmod 600 theseus.env
./theseus install --non-interactive
  • Replace registry.example.com with the registry we give you, and the version with your bundle's.
  • The images are pulled, never built.
  • The first administrator's temporary password is in runtime/install-result.json (mode 0600).
  • Every other setting can go in theseus.env before the install; see Configuration settings.

Without --non-interactive, ./theseus install asks its questions in the terminal: tenant name, public host name or IP, TLS mode, gateway, ports, the first administrator, modules, an optional LLM endpoint and optional SMTP. It then prints the console address, the temporary password and the first endpoint install commands.

Two servers ​

  1. On the core: THESEUS_ROLE=core and CORE_BIND=<core's private IP> in theseus.env, then ./theseus install --non-interactive.
  2. Copy the core's generated secrets (the keys under Generated secrets in its theseus.env) and its runtime/pki/ directory to the application server, into a new bundle directory there.
  3. On the application server: THESEUS_ROLE=app and CORE_HOST=<core's private IP>, plus the copied secrets, then ./theseus install --non-interactive.

The application server needs ports 9200, 55000, 5601 and 9001 of the core.

Upgrade ​

Extract the new bundle over the directory, then:

bash
./theseus config apply

See Upgrade.

Theseus documentation