XCloak / docs

Deployment

XCloak ships three deployment paths from the same repository: Docker Compose, Kubernetes via Helm, and bare Go binaries.

Docker Compose

The root docker-compose.yml brings up the full stack — Postgres, Redis, Kafka + ZooKeeper, Prometheus, Grafana, MinIO — each with health checks and memory limits configured. This is the recommended path for evaluation and small production deployments.

docker compose up -d --build

Kubernetes / Helm

helm dependency update charts/xcloak
helm install xcloak charts/xcloak \
  --namespace xcloak --create-namespace \
  --set global.ingress.host=xcloak.yourdomain.com \
  --set backend.env.JWT_SECRET=$(openssl rand -hex 32) \
  --set backend.env.METRICS_TOKEN=$(openssl rand -hex 32)

Minimal values.yaml for production

global:
  ingress:
    host: xcloak.yourdomain.com

backend:
  replicaCount: 2
  env:
    JWT_SECRET: "your-secret-here"
    METRICS_TOKEN: "your-metrics-token"
    DB_HOST: "your-postgres-host"
    DB_USER: "xcloak"
    DB_PASSWORD: "your-db-password"
    DB_NAME: "ngfw"
    APP_DB_USER: "xcloak_app"
    APP_DB_PASSWORD: "your-app-user-password"
    REDIS_ADDR: "your-redis:6379"
    CORS_ALLOWED_ORIGINS: "https://xcloak.yourdomain.com"
    APP_BASE_URL: "https://xcloak.yourdomain.com"

postgresql:
  enabled: false  # Use external PostgreSQL

redis:
  enabled: false  # Use external Redis

Bundled PostgreSQL and Redis (evaluation only)

postgresql:
  enabled: true
  auth:
    database: ngfw
    username: xcloak
    password: change_me

redis:
  enabled: true
  auth:
    enabled: false
Kafka and MinIO are not bundled in the Helm chart — use external services or bring your own. Both degrade gracefully when unavailable.

TLS

Set TLS_CERT_FILE and TLS_KEY_FILE in the backend's .env to serve the API over HTTPS directly, or terminate TLS at your ingress/load balancer in front of the plain HTTP backend. For Postgres, set DB_SSLMODE=require (or verify-full) in production rather than the default disable.

Agentless log ingestion

Two ways to send logs without installing the agent:

Syslog

UDP/TCP on port 5140. CEF, LEEF, JSON, NDJSON, and plain syslog are auto-detected — point your firewall or switch's syslog forwarding here.

HTTP

Create a log source from the dashboard (Log Sources → Add → HTTP) to get a per-source API key, then:

curl -X POST http://localhost:8080/api/ingest/http/<source-id> \
  -H "Authorization: Bearer <api-key>" \
  -H "Content-Type: application/json" \
  -d '{"timestamp":"2026-06-29T12:00:00Z","src_ip":"10.0.0.1","event":"login_failed","user":"admin"}'

Backups

# Manual backup (reads DB_* from xcloak-platform/backend/.env)
./scripts/backup_db.sh

# Restore — DESTRUCTIVE, drops and recreates every table first
./scripts/restore_db.sh backups/ngfw_20260619_213343.sql.gz

For automated daily backups:

0 2 * * * /path/to/xcloak/scripts/backup_db.sh >> /var/log/xcloak-backup.log 2>&1

Backups land in backups/ (gitignored) and are pruned after RETENTION_DAYS (default 14).

← Detection EngineConfiguration →