Post-setup steps

The deploy script generates a personalized POST-SETUP.md (with your real IPs and domain filled in). This page is the same checklist with fuller explanations.

1. DNS and TLS

Every web UI is served by one Caddy wildcard site, *.<domain>, on the metrics VM, so *.<domain> must resolve to that VM from your clients.

TLS_MODE=cloudflare (default). Caddy requests a Let’s Encrypt wildcard certificate using ACME DNS-01: it writes the _acme-challenge TXT record through the Cloudflare API (token in /opt/alethurgy/.env, scope Zone:Read + DNS:Edit), so no port has to be open to the Internet and renewals are automatic. If you answered yes to creating the DNS record, the deploy also upserted a DNS-only (grey-cloud) *.<domain> A record → metrics VM IP. Check:

ssh root@<metrics-vm> docker logs caddy 2>&1 | grep -iE 'certificate obtained|error'
curl -sSI https://grafana.<domain> | head -1        # no -k needed

If issuance failed: confirm the token’s zone + permissions, that <domain> is inside a zone on that Cloudflare account, then docker restart caddy. A public A record pointing at a private IP is fine for DNS-01 but does reveal your LAN addressing; prefer local DNS (router/Pi-hole) for the A record if that matters to you.

TLS_MODE=internal. Caddy uses its own private CA. Create the DNS records on your internal resolver and trust the root cert on clients:

ssh root@<metrics-vm> docker exec caddy cat /data/caddy/pki/authorities/local/root.crt > caddy-root.crt

Import caddy-root.crt into your OS/browser trust store (on Linux: /usr/local/share/ca-certificates/ + update-ca-certificates).

2. Per-node agents

For every Linux host you want monitored:

scp -r scripts root@<node>: && ssh root@<node> ./scripts/install-linux-agent.sh

That installs node_exporter (systemd, port 9100), optionally cAdvisor on Docker hosts, and prints the exact scrape stanza to paste into stack/prometheus/prometheus.yml on the metrics VM. Reload Prometheus after editing:

docker compose -f stack/prometheus/compose.yml exec prometheus kill -HUP 1

Windows hosts: install the windows_exporter MSI (v0.27.x), allow TCP 9182, add a windows scrape job. The preloaded “Windows Exporter Dashboard” picks it up.

Wazuh agents: in the Wazuh dashboard → Agents → Deploy new agent, pick OS, set the manager address to the SIEM VM IP, and run the generated command on each host. Agents auto-enroll.

3. Uptime Kuma

  1. Create the admin account, then an API key (Settings → API Keys).
  2. Put the key in /opt/alethurgy/.env (KUMA_API_KEY=...), uncomment the basic_auth block in the uptime-kuma job of stack/prometheus/prometheus.yml.tpl, and re-run the deploy script — Kuma metrics (monitor status, response times, cert expiry) then feed the preloaded “Uptime Kuma” dashboard.
  3. Add monitors for every service URL and DNS checks; build a status page; point notifications at your ntfy topic.

4. Network devices

  • SNMP v3: create a user on each device, add devices in LibreNMS. For the Prometheus-side SNMP dashboards, see Configuration — SNMP.
  • Syslog: point firewall/router/switch remote syslog at the logs VM, port 514 (UDP or TCP). In Graylog: System → Inputs → Syslog UDP on port 5140 (the container port that host 514 maps to).
  • NetFlow/sFlow: configure export to the metrics VM, UDP 2055. netflow2ng converts flows to ZMQ for ntopng — no nProbe license needed. Verify under Interfaces → tcp://netflow2ng:5556 in ntopng.

5. Graylog streams and correlation

Create one stream per source class (firewall, switches, wazuh-alerts) with index sets sized to your disk. In pipeline rules, normalize fields to the same labels Prometheus uses — host, site, role — so an LLM (or you) can pivot between metrics and logs on the same keys.

6. Wazuh hardening

The official wazuh-docker single-node ships default credentials. On the SIEM VM, follow /opt/wazuh-docker/single-node/README.md to rotate admin (indexer/dashboard) and the API user, then restart the stack. Bridge alerts into Graylog by enabling syslog output in the manager’s ossec.conf:

<syslog_output>
  <server>LOGS_VM_IP</server>
  <port>5140</port>
  <format>json</format>
</syslog_output>

7. UPS, notifications, automation, LLM/MCP

Covered on their own pages: Automation and LLM / MCP. Notification channel customization is in Configuration.

8. Record everything in inventory.md

Every host, agent, SNMP user, token, and topic gets a row in inventory.md — references only, never the secret value.

This site uses Just the Docs, a documentation theme for Jekyll.