WMC is the Web Management Interface for attacks, analytics, the Nginx settings of Filter the WAF settings of the cluster. It reads and writes those settings through API. The package is mikiri-waf-wmc.
The WMC is not the Filter. Its Nginx listens on port 8080 and proxies to the WMC backend on 127.0.0.1:8000. The Filter has its own Nginx and its own virtual hosts.
Changed in the WMC, for the CID selected in the header:
The same settings can be changed with the API. A value saved in the WMC is the value the API stores for that CID.
Left as files, because the WMC does not edit them:
/etc/nginx/mikiri-waf/filter/global/waf.conf on the Filter;/etc/mikiri-waf-mlc/mlc.conf on MLC;/var/www/mikiri-waf-api/settings.py;/var/www/mikiri-waf-wmc/.env on this server;stream block that publishes RabbitMQ to MLC.Install WMC on the server that runs API, after PostgreSQL has a database for it. The database commands are in PostgreSQL.
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb https://s.mikiri.ai/repo/stable/debian trixie mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-wmc
The package script builds /var/www/mikiri-waf-wmc/venv with python3.13.
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb [arch=amd64] https://s.mikiri.ai/repo/stable/ubuntu resolute mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-wmc
The package script builds /var/www/mikiri-waf-wmc/venv with python3.14.
/etc/yum.repos.d/mikiri-waf.repo look like:[MikiriWAF]
name=Mikiri WAF Packages for RHEL
baseurl=https://s.mikiri.ai/repo/stable/rhel/$releasever/$basearch/
gpgkey=https://s.mikiri.ai/repo/gpg.key
enabled=1
gpgcheck=1
dnf install epel-release
dnf update
dnf install mikiri-waf-wmc
The package script builds /var/www/mikiri-waf-wmc/venv with python3.12.
The package depends on Nginx, Memcached and OpenSSL. During installation it disables the default Nginx site (/etc/nginx/conf.d/default.conf is renamed to default.conf.disabled /etc/nginx/sites-enabled/default is removed when that file exists).
Deployment as a container is in Deploying WMC Docker container.
cp /var/www/mikiri-waf-wmc/.env.example /var/www/mikiri-waf-wmc/.env
Set the API address and the database. Leave HOST and PORT as 127.0.0.1 and 8000: Nginx proxies to the backend on that port. Keep the JWT_SECRET that the package wrote into the example.
API_URL="http://api.example.com:8080"
DB_HOST=127.0.0.1
DB_PORT=5432
DB_NAME=wmc
DB_USER=wmc
DB_PASS=YOUR_PASSWORD
HOST and PORT are also the address used in links inside notifications. A commented API_FALLBACK_URL is the read-only standby API, used while API_URL is unreachable.
Apply the database schema. The package runs this only when .env already exists at install time, so on a first install run it yourself:
cd /var/www/mikiri-waf-wmc
/var/www/mikiri-waf-wmc/venv/bin/alembic -c alembic.ini upgrade head
The server block is installed disabled, as /etc/nginx/conf.d/mikiri-waf-wmc.conf.disabled. It listens on 8080 and proxies to http://127.0.0.1:8000.
mv /etc/nginx/conf.d/mikiri-waf-wmc.conf.disabled /etc/nginx/conf.d/mikiri-waf-wmc.conf
nginx -t && service nginx reload
After changing .env, run the script that corrects the permissions:
/bin/bash /var/www/mikiri-waf-wmc/venv/set_permissions.sh
Restart the services:
systemctl restart mikiri-waf-wmc mikiri-waf-wmc-aux memcached nginx
| Service | Role | Log |
|---|---|---|
mikiri-waf-wmc |
The WMC backend | /var/log/mikiri-waf/wmc/wmc.log |
mikiri-waf-wmc-aux |
Signature descriptions, unsent email and chat alerts, and cleanup of old notifications | /var/log/mikiri-waf/wmc/aux.log |
mikiri-waf-wmc-aux runs three jobs. signatures and notifications use AUX_INTERVAL (30 seconds unless .env sets another value). notifications sends attack alerts that have not gone out yet, by email and by Slack or Telegram. cleanup runs hourly and drops resolved unblock requests and read notifications older than AUX_STORAGE_PERIOD days (31 by default). A failing job is logged and does not stop the others. After a backend code update the worker loads the new files on its next run, so that service does not need a separate restart. .env is still read only when the process starts.
From /var/www/mikiri-waf-wmc:
cd /var/www/mikiri-waf-wmc
/var/www/mikiri-waf-wmc/venv/bin/python3 -m backend createadmin <email> <password>
A non-administrator account is createuser with the same arguments. Open the WMC at http://<this server>:8080. The first page is Attacks.
Signing in, the header each section of the console: