Home › Docs ›Operations › Two-Host Deployment

Two-Host Deployment

Run the edge stack and the SIEM stack on separate hosts

The two-host shape is the intended production layout. The edge host is internet-facing and holds the only components that see client requests. The SIEM host stores and visualises telemetry, and it never initiates a connection into the edge network.

Internet-facing Edge Reverse proxy, production shop, honeypot pools, Redis, Suricata and a local Vector shipper. Request path

Internal SIEM Vector aggregator, Elasticsearch and Kibana. Receives logs over mTLS and serves dashboards to analysts. Storage + views

Outbound only Channel The edge opens the connection. No inbound path from the SIEM into the edge is required for logging. mTLS

Two-Host Topology

Edge Host: Runs the reverse proxy, honeypot backend, and dashboard/monitoring components. The Nginx Lua pipeline (pattern_analyzer, router, pool_router) runs here.
SIEM Host: Runs Kibana/Elasticsearch and consumes logs from the edge host via Vector over mTLS. All six Kibana dashboards live here.

Security events (SECURITY_EVENT: JSON in Nginx error log) are shipped by Vector to the SIEM host's Elasticsearch. Suricata on the edge host writes eve.json alerts, ingested by init_worker.lua into the threat_intel shared dict.

Setting up the mTLS channel

On the SIEM host, run siem/certs/root-ca/gen_elk_certs.sh to create the CA and sign certificates for es01, kibana, vector and vector-agent.
Copy the generated vector-agent client certificate (siem/vector/certs/vector-agent/) to the edge host's ids/vector/certs/ before starting the edge shipper.
Point the edge shipper at the SIEM with VECTOR_HOST (a raw IP in production). The vector server certificate's Subject Alternative Name list covers connecting by IP as well as by hostname.

Details of the index naming and the VRL parse step are on the SIEM & Log Pipeline page.

Host Responsibilities

Capability	Edge host	SIEM host
Client-facing TLS	Yes	No
Request scoring and routing	Yes	No
WordPress production + pools	Yes	No
Session state (Redis)	Yes	No
Suricata capture	Yes	No
Log aggregation	Local Vector shipper	Vector aggregator
Indexing and dashboards	No	Yes

Verify the Split

Confirm the edge can start with the SIEM offline; requests must still be scored and routed.
Confirm events appear in Kibana after the SIEM returns, including events buffered during the outage.
Confirm the SIEM cannot reach the edge's private services; only the outbound log channel is required.
Generate a known pattern from the edge and follow its decision trace into the corresponding Kibana document.