Deploy a cluster of independent Cyberwatch nodes with Swarm (Recommended)

This page purpose is to give the procedure to install Cyberwatch in satellite mode without using swarm for communication between the nodes.

To ensure proper communication between the master and the satellite, both Cyberwatch instances must have the same version.

Requirements

Network prerequisites and flows matrix

Required flows to set up a satellite node:

Source	Destination	Protocol	Port	Description
satellite node	master node	TCP	3306	Connection to the SQL database
satellite node	master node	TCP	6379	Connection to the Redis cache database
satellite node	`download.docker.com`	TCP	443	Docker installation and updates
satellite node	`harbor.cyberwatch.fr`	TCP	443	Cyberwatch Docker images registry
satellite node	`dl.cyberwatch.com`	TCP	443	Cyberwatch package repository

flowchart LR
  SAT["Satellite node"]
  SAT -- "TCP 3306 · SQL database" --> MASTER["Master node"]
  SAT -- "TCP 6379 · Redis cache" --> MASTER
  SAT -- "TCP 443 · Docker" --> DOCKER["download.docker.com"]
  SAT -- "TCP 443 · images" --> HARBOR["harbor.cyberwatch.fr"]
  SAT -- "TCP 443 · packages" --> DL["dl.cyberwatch.com"]

Hardware prerequisites

2 vCPU
RAM 8 GB
32 GB of disk space in /var/lib/docker (12GB) and /var/lib/containerd (20GB)

It is recommended to assign all disk space to the root partition /. The breakdown above is provided for information purposes.

You can check the hardware prerequisites with these commands:

vCPU:
```
lscpu | grep "CPU(s):"
```
RAM:
```
free -m
```
Disk space in /var/lib/docker/:
```
df /var/lib/docker/
```

Master node installation

Follow the standard deployment procedure and stop before configuring Cyberwatch
Configure Cyberwatch:
- Configure Cyberwatch for a master node embedding the database:
```
 sudo cyberwatch configure --master
```
- Configure Cyberwatch for a master node with an external database:
```
 sudo cyberwatch configure --master --no-db
```

Satellite node installation

The secrets and the root certificate of the master node are copied to the satellite node before it is configured:

sequenceDiagram
  participant M as Master node
  participant A as Administrator
  participant S as Satellite node
  Note over M,S: Same Cyberwatch version on both nodes
  A->>S: Standard procedure, stop before configuration
  A->>M: cyberwatch show-secrets
  M-->>A: secrets
  A->>S: /etc/cyberwatch/secrets.env
  A->>M: cyberwatch show-root-cert
  M-->>A: root certificate
  A->>S: /etc/cyberwatch/certs/cbw-root-ca-cert.pem
  A->>S: cyberwatch configure --satellite
  S->>M: SQL (3306) and Redis (6379) connection

Follow the standard deployment procedure and stop before configuring Cyberwatch
Execute the following command on master node:
```
sudo cyberwatch show-secrets
```
Write the output of the previous command to file /etc/cyberwatch/secrets.env of the satellite node:
```
sudo vim /etc/cyberwatch/secrets.env
sudo chmod 600 /etc/cyberwatch/secrets.env
```
Execute the following command on master node:
```
sudo cyberwatch show-root-cert
```
Write the output of the previous command to file /etc/cyberwatch/certs/cbw-root-ca-cert.pem of the satellite node:
```
sudo mkdir -p /etc/cyberwatch/certs
sudo vim /etc/cyberwatch/certs/cbw-root-ca-cert.pem
```
Configure Cyberwatch:
```
sudo cyberwatch configure --satellite
```
Verify that the satellite node is able to reach the master node:
```
sudo cyberwatch logs sidekiq
```