Theseus

Appearance

Install on one server ​

The whole stack on one machine (role all). Plan 15 to 45 minutes, most of it image downloads and the first start of the Wazuh indexer.

Before you start ​

  • A server that meets the requirements.

  • Outbound HTTPS to the control plane (see Network and firewall).

  • Your domain decided (DNS and TLS).

  • The install command we sent you. It looks like this and works once, within 24 hours:

    bash
    curl -fsSL --proto '=https' --insecure --pinnedpubkey 'sha256//<pin>' https://<control>/i/TND-<token> | sudo bash

    --pinnedpubkey fixes the control plane's key: the download only succeeds from our server, even though its certificate is not from a public CA. Do not remove it. If our control plane uses a public certificate, the command has no --insecure --pinnedpubkey part.

1. Run the install command ​

Log in to the server as a user with sudo and paste the command as it is.

The command prints one line per step. On a self-hosted install it first asks for the console's address:

text
The console needs an address: a domain name you control (e.g. soc.example.com), or this
server's IP address.
Domain for the console [203.0.113.10]: soc.example.com
Use a Let's Encrypt certificate? [Y/n]: y
E-mail for Let's Encrypt: ops@example.com
    ok    console: https://soc.example.com/ (Let's Encrypt, ops@example.com)

2. Host checks ​

text
== Checking the host (role all, stack /opt/theseus)
    ok    OS: ubuntu 24.04
    ok    architecture: x86_64
    ok    memory: 15.6 GB (role all needs 8 GB)
    ok    disk: 120.4 GB free under /opt
    ok    time synchronised
    ok    vm.max_map_count: set to 262144 (persisted in /etc/sysctl.d/99-theseus.conf)
    ok    port 443 free
    ...

If a check fails, the command lists every failed check and stops without changing anything else. Fix them and run the same command again: it continues where it stopped, and a token not yet used is still valid. See Installation troubleshooting.

3. Docker, theseus-node, enrolment ​

The command then:

  1. installs Docker if it is missing;
  2. downloads theseus-node, checks its SHA-256, installs it to /usr/local/bin with the theseus-node systemd service;
  3. enrols the server with the control plane (this uses the token);
  4. starts theseus-node.

4. The stack install ​

theseus-node downloads the release, checks it, and runs the stack install. The command follows along and prints each step:

text
== Installing Theseus (15-30 minutes; Ctrl-C stops following, not the install)
    ..    download
    ..    extract
    ..    configure
    ..    registry login
    ..    install

Pressing Ctrl-C stops the display only. To follow again:

bash
sudo tail -f /var/lib/theseus-node/progress.log
# or
sudo journalctl -u theseus-node -f

The display stops after 45 minutes even if the install still runs; the install itself has up to 60 minutes.

5. Read the summary ​

When the install finishes, the command prints:

text
==> Theseus is installed

  Console     https://soc.example.com/
  Username    admin
  Password    Ths-...
              temporary: change it at first login
  Saved in    /opt/theseus/FIRST-LOGIN.txt (root only; delete it once you have signed in)

  DNS         create an A record:  soc.example.com  ->  203.0.113.10

  Firewall    allow inbound:
                443/tcp   console, and agent enrolment (HTTPS, /enroll)
                1514/tcp  Wazuh agents
                80/tcp    redirect to HTTPS, and Let's Encrypt validation

  TLS         Let's Encrypt: the certificate is issued automatically once soc.example.com points here
              ...

  Uninstall   sudo theseus-node uninstall [--keep-data]

The password is shown only here and kept in /opt/theseus/FIRST-LOGIN.txt (readable by root). It is never sent to us.

6. DNS and firewall ​

  1. Create the DNS record shown (skip it if you used the IP address).
  2. Open the inbound ports shown, in your host firewall and any cloud security group. See Network and firewall.
  3. With the internal CA, trust /opt/theseus/runtime/pki/ca.pem on your computers (how).

7. First sign-in ​

  1. Open the console address in a browser.

  2. Sign in with the username and temporary password from the summary.

  3. Choose a new password. It must have at least 12 characters, with an upper-case letter, a lower-case letter, a digit and a special character, and must not be your username or e-mail.

  4. Delete FIRST-LOGIN.txt:

    bash
    sudo rm /opt/theseus/FIRST-LOGIN.txt

Lost the temporary password before signing in? Make a new one:

bash
cd /opt/theseus && sudo ./theseus admin reset-password

8. Check the install ​

Follow Verify the install, then the Get started checklist in the console.

Theseus documentation