Image: mikirisec/mikiri-waf-wmc. Volume: /mikiri-waf-wmc. Nginx listens on port 8080.
The database is external PostgreSQL, configured in .env. Create it with Deploying the PostgreSQL Docker container before the second start. On every start that finds .env, the entrypoint runs alembic upgrade head.
mkdir -p /opt/mikiri-waf/mikiri-waf-wmc
touch /opt/mikiri-waf/mikiri-waf-wmc/first-launch
docker run -d --name mikiri-waf-wmc --network mikiri-waf \
-p 8081:8080 \
-v /opt/mikiri-waf/mikiri-waf-wmc:/mikiri-waf-wmc \
mikirisec/mikiri-waf-wmc:latest
The host port 8081 is an example. API already uses host port 8080 when both containers run on one machine. Inside the Docker network the container is still mikiri-waf-wmc:8080.
The first start copies .env from .env.example, writes a random JWT_SECRET the container exits. Do not add a restart policy to this first start.
/opt/mikiri-waf/mikiri-waf-wmc/.env, set the API address and the WMC database. Leave HOST and PORT as they are in the example (127.0.0.1 and 8000): Nginx in the image proxies to the backend on that port. Keep the generated JWT_SECRET.API_URL="http://mikiri-waf-api:8080"
DB_HOST=mikiri-waf-db
DB_PORT=5432
DB_NAME=wmc
DB_USER=wmc
DB_PASS=YOUR_PASSWORD
docker start mikiri-waf-wmc
docker update --restart unless-stopped mikiri-waf-wmc
docker exec mikiri-waf-wmc /bin/sh -c 'for i in $(seq 1 90); do test -f /tmp/on && exit 0; sleep 2; done; exit 1'
docker exec -it mikiri-waf-wmc \
/var/www/mikiri-waf-wmc/venv/bin/python3 -m backend createadmin <email> <password>
The for loop waits until /tmp/on exists. The entrypoint writes that file after linking .env, running alembic upgrade head and starting the services. createadmin before that file exists does not create the administrator: the database schema is not there yet, or .env is not linked. The same command succeeds once the file is there, without a restart of the container. The working directory is /var/www/mikiri-waf-wmc. Open WMC at http://<docker host>:8081.
Logs are written to /opt/mikiri-waf/mikiri-waf-wmc/log/mikiri-waf/ (wmc.log, aux.log).
| In the volume | In the container | Contents |
|---|---|---|
.env |
/var/www/mikiri-waf-wmc/.env |
Database, JWT and API URL |
conf.d/ |
/etc/nginx/conf.d/ |
Server and upstream configuration |
snippets/ |
/etc/nginx/snippets/ |
Custom includes |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
WMC logs |
docker pull mikirisec/mikiri-waf-wmc:latest
docker stop mikiri-waf-wmc
docker rm mikiri-waf-wmc
docker run -d --name mikiri-waf-wmc --network mikiri-waf --restart unless-stopped \
-p 8081:8080 \
-v /opt/mikiri-waf/mikiri-waf-wmc:/mikiri-waf-wmc \
mikirisec/mikiri-waf-wmc:latest
Do not create first-launch again. If the package version changed, the previous volume contents are copied to old/. The working files stay in place.