Deploying on Google Cloud Platform (GCP)
To deploy Wallarm Node on Google Cloud Platform:
- Log in to your Google Cloud Platform account.
- Launch a Wallarm Node instance
- Connect to the Wallarm Node instance console for the further configuration
- Register Wallarm Node in Wallarm Cloud
- Set up filtering and proxying rules
1. Log in to your Google Cloud Platform account
Sign in at console.cloud.google.com.
2. Launch a Wallarm Node instance
Launch your Wallarm Node instance using this link and click LAUNCH ON COMPUTER ENGINE.
The GCP instance launches with a pre-installed Wallarm Node.
3. Connect to the Wallarm Node instance console for the further configuration
See Google Cloud Platform: Connecting to Instances for more details.
4. Register Wallarm Node in Wallarm Cloud
The filter node interacts with the Wallarm cloud located on a remote server.
The addnode
script connects the filter node to the Wallarm cloud.
Run the script
addnode
:You have to pick which script to run depending on the Cloud you are using.
- If you are using https://my.wallarm.com/, run the script from the «EU Cloud» tab below.
- If you are using https://us1.my.wallarm.com/, run the script from the «US Cloud» tab below.
EU CloudUS Cloudsudo /usr/share/wallarm-common/addnode
sudo /usr/share/wallarm-common/addnode -H us1.api.wallarm.com
Enter the login and password. This is the same login and password that you use to access Wallarm console at https://my.wallarm.com or https://us1.my.wallarm.com/. The profile must have the Administrator role and 2FA should be disabled. If the profile has the Analyst role or has 2FA enabled, the script will error out.
API Access
The API choice for your filter node depends on the Cloud you are using. Please, select the API accordingly:
- If you are using https://my.wallarm.com/, your node requires access to https://api.wallarm.com:444.
- If you are using https://us1.my.wallarm.com/, your node requires access to https://us1.api.wallarm.com:444.
Ensure the access is not blocked by a firewall.
5. Set up filtering and proxying rules
Uncomment the wallarm_mode
string in the file
/etc/nginx-wallarm/conf.d/wallarm.conf
.
To uncomment, remove the #
character at the beginning of the string.
By default, the directive is set to off
– wallarm_mode off
.
Set it to monitoring
.
File contents example:
#
# Wallarm module specific parameters
#
wallarm_mode monitoring;
# wallarm_mode_allow_override on;
Additional step. Allocate more memory for the Wallarm Node
Wallarm Node uses Tarantool, open-source in-memory database, to calculate traffic metrics required for automated adjusting of security rules.
By default, the amount of RAM allocated to Tarantool is 75% of the total instance memory.
You can change the amount of RAM allocated to in-memory database:
Open the Tarantool configuration file:
vi /etc/default/wallarm-tarantool
Set the amount of allocated RAM (in GB) using the
SLAB_ALLOC_ARENA
variable. For example, to set 24 GB:SLAB_ALLOC_ARENA=24
To apply changes, restart the Tarantool daemon:
systemctl restart wallarm-tarantool
The installation is complete
Check that the filter node runs and filters the traffic. See Check the filter node operation.