Change configuration

Who owns the configuration

When your stack is connected to the Theseus control plane (installed with an install command), we manage its settings: we keep each change as a numbered revision with who made it, and apply it to your server through theseus-node. Integrations are yours: set them up in the console under Admin → Integrations (Integrations), and each saved change is recorded with us as a revision too. To change another setting or a module, ask us.

Settings we manage are replaced on your server each time we apply a revision. A local edit to one of them does not last. Settings we do not manage (see Configuration settings) stay as you set them.

Modules

cd /opt/theseus
sudo ./theseus modules list
sudo ./theseus modules enable patch ai
sudo ./theseus modules disable reporting

Modules: patch, scanner, ai, jira, reporting, cloudflare, defender, intune, sophos. A vendor connector cannot be enabled before it is set up in Admin → Integrations (on a stack without the console: ./theseus connectors enable <name>).

Edit theseus.env by hand

For a stack you manage yourself:

1. Show the current settings, with secrets masked:

   sudo ./theseus config show

2. Either edit theseus.env directly, or put the changes in a file and merge it. A merge file has KEY=VALUE lines to set and -KEY lines to remove:

   printf '%s\n' INDEXER_HEAP=4g 'ALERT_EMAIL=soc@example.com' > /tmp/change.env
   sudo ./theseus config merge /tmp/change.env

   config merge refuses generated secrets, derived settings, COMPOSE_PROFILES, and values with $, quotes, control characters, leading or trailing spaces or #.

3. Apply:

   sudo ./theseus config apply

   This re-renders the generated files in runtime/, starts or recreates what changed, and recreates the gateway and the Wazuh services.

Do not change generated secrets this way.

Settings that need more than config apply

Change	Why
THESEUS_HOST, TLS_MODE, GATEWAY	Enrolled endpoints keep the address and certificate pin they enrolled with
THESEUS_ROLE, CORE_HOST, CORE_BIND	Topology is fixed at install time
Generated secrets	Each lives in its own store as well (indexer, manager, databases)

Plan these with us.