Build Your Own SMB Security Stack with Docker — SIEM + IPS + Encrypted Backups in 5 Minutes

I run IT infrastructure for a living, and I got tired of watching small businesses either overpay for security tooling they barely use, or run nothing at all and just hope for the best. So over a few weekends I put together the setup I actually wanted — three small Docker stacks that cover the essentials without a subscription or a cloud account attached.

Everything runs on your own hardware. You keep the logs, the data, and the backups.

What's in it

SIEM Core (Wazuh) — central log collection and threat detection. It pulls logs from your servers and endpoints, flags brute-force attempts, file changes and odd behaviour, and ships with compliance mappings for PCI DSS, HIPAA, NIST 800-53 and CIS already wired up.

Threat Wall (CrowdSec + Grafana) — reads your logs and blocks attackers in real time: SSH brute force, web scanners, port sweeps. Grafana gives you a dashboard so you can actually see what's hitting you instead of guessing.

Backup Audit (restic) — encrypted, deduplicated backups on a schedule, plus a small dashboard that keeps an audit trail so you can prove a backup ran when someone asks.

How it's put together

Each stack is its own folder with a docker compose up -d and a .env file. Start with the two light ones — Threat Wall and Backup Audit run comfortably in about 1 GB of RAM — and add the Wazuh SIEM once you've got the headroom for it (it likes ~6 GB).

cd stacks/threat-wall && docker compose up -d
cd stacks/backup-audit && docker compose up -d
# add the SIEM when you're ready
cd stacks/siem-core && docker compose up -d

There's a getting-started guide, an FAQ and a deploy script in the pack. I tested these on real hardware before shipping — the Threat Wall stack was running live while I was packaging it up.

Why I bothered

Most of the SMBs I deal with can't justify a $20k/year security platform, and the free stuff is scattered across a dozen tutorials that all assume you already know Docker networking. I wanted one folder you can drop onto a box and have logging, blocking and backups running the same afternoon.

If that sounds useful, I put it up here for $15 — one-time, free updates:

symshah.gumroad.com/l/smb-security-pack

Requirements: Docker + Docker Compose on Linux, Windows (WSL2) or macOS. Happy to answer questions in the comments.