Multi-Node & Docker Compose Deployment

This guide provides battle-tested deployment recipes for running a central Routewarden security dashboard and distributed edge shippers using Docker Compose, systemd, and Kubernetes.

---

1. Central Dashboard Server

On your central monitoring host (e.g. dashboard.internal or an internal security VM), deploy the Routewarden dashboard.

Docker Compose Recipe

docker-compose.yml (Central Dashboard)yaml

services:  routewarden-dashboard:    # Dedicated SOC dashboard image (~11MB) or full toolkit ghcr.io/routewarden/cli:latest    image: ghcr.io/routewarden/dashboard:latest    container_name: routewarden-dashboard    restart: unless-stopped    ports:      - "7890:7890"    volumes:      # Persistent storage for master keypair, API keys, and SQLite database      - routewarden_data:/root/.routewarden/dashboard      # Optional: access Docker daemon to monitor local containers as well      - /var/run/docker.sock:/var/run/docker.sock:ro    command: ["up", "--no-open", "--port", "7890"]volumes:  routewarden_data:

●READONLY│UTF-8│YAML

Initial Central Setup

Central Server Commandsbash

# 1. Start the central dashboarddocker compose up -d# 2. Generate an enrollment token for your remote nodedocker exec -it routewarden-dashboard rwarden keys create edge-node-01

●READONLY│UTF-8│BASH

---

2. Remote Edge Nodes (Docker Companion Pattern)

On your remote edge nodes running Traefik, Caddy, or NGINX, run rwarden push as a lightweight companion service alongside your gateway.

Initial Remote Enrollment

Run the registration command once on the remote host to create ~/.routewarden/agent.json:

Remote Registrationbash

# Run one-time registration on the remote hostrwarden register --url http://<central-ip>:7890 --key rw_sec_8f9a2b4c1e0d3f7a...

●READONLY│UTF-8│BASH

Docker Compose Companion Recipe

docker-compose.yml (Edge Companion)yaml

services:  traefik:    image: traefik:v3.1    container_name: edge-traefik    restart: unless-stopped    ports:      - "80:80"      - "443:443"    labels:      # Mark container for Routewarden auto-discovery      - "routewarden=true"    volumes:      - /var/run/docker.sock:/var/run/docker.sock:ro      - ./traefik.yml:/etc/traefik/traefik.yml:ro  # Ultra-lightweight Routewarden Shipper Companion (~6.2MB binary)  routewarden-shipper:    image: ghcr.io/routewarden/shipper:latest    container_name: routewarden-shipper    restart: unless-stopped    environment:      - RW_DASHBOARD_URL=http://198.51.100.10:7890      - RW_AGENT_KEY=rw_sec_a8f9c2d1e4b7...      - TZ=Asia/Kolkata    volumes:      # Read container logs via Docker socket      - /var/run/docker.sock:/var/run/docker.sock:ro    # Or mount registered profile if preferred:    # volumes:    #   - /var/run/docker.sock:/var/run/docker.sock:ro    #   - ~/.routewarden:/root/.routewarden:ro    command: ["--docker"]

●READONLY│UTF-8│YAML

Launch the edge stack:

Start Companion Stackbash

docker compose up -d

●READONLY│UTF-8│BASH

The companion container starts, loads your registered credentials, attaches to edge-traefik, and begins streaming encrypted batches immediately.

---

3. Remote Edge Nodes (Native Systemd Service)

For bare-metal servers or VMs running native NGINX or Caddy without Docker:

[Unit]Description=Routewarden Remote Log ShipperAfter=network.target nginx.service[Service]Type=simpleUser=rootExecStart=/usr/local/bin/rwarden push \  --config /etc/routewarden/agent.json \  --file /var/log/nginx/access.log \  --batch-size 100 \  --flush-interval 1sRestart=alwaysRestartSec=5s# HardeningProtectSystem=fullNoNewPrivileges=true[Install]WantedBy=multi-user.target

●READONLY│UTF-8│INI

---

4. Kubernetes Sidecar Pattern

For Kubernetes clusters, deploy rwarden as a sidecar container sharing an emptyDir volume with your ingress controller:

k8s-sidecar-deployment.yamlyaml

apiVersion: apps/v1kind: Deploymentmetadata:  name: ingress-gatewayspec:  template:    spec:      volumes:        - name: shared-logs          emptyDir: {}        - name: agent-config          secret:            secretName: routewarden-agent-secret      containers:        - name: gateway          image: nginx:alpine          volumeMounts:            - name: shared-logs              mountPath: /var/log/nginx        - name: routewarden-shipper          image: ghcr.io/routewarden/cli:latest          command:            - rwarden            - push            - --file=/var/log/nginx/access.log            - --config=/etc/routewarden/agent.json          volumeMounts:            - name: shared-logs              mountPath: /var/log/nginx:ro            - name: agent-config              mountPath: /etc/routewarden:ro          resources:            limits:              cpu: 50m              memory: 32Mi            requests:              cpu: 10m              memory: 16Mi

●READONLY│UTF-8│YAML

---

5. Network & Firewall Requirements

Port	Protocol	Direction	Source	Destination	Purpose
7890	TCP / HTTP	Inbound	Remote Edge Shippers	Central Dashboard	Encrypted Ingest (/api/v1/events), Heartbeats, & Web UI

TIP

The central dashboard port (7890) can be placed behind an internal WireGuard/Tailscale mesh VPN or reverse proxy with TLS if you prefer not to expose port 7890 directly to the public Internet.