From 27be26f5f244f02622ac3f415f3d756443bf0ae8 Mon Sep 17 00:00:00 2001
From: Weboria Migration <tech@weboria.eu>
Date: Sat, 25 Jul 2026 16:38:58 +0000
Subject: [PATCH] fix(installer): rename .env.example -> env.example, WAF
 blocks .env* paths

Found live during a real install dry-run: fetching .env.example via the
Gitea raw URL returned a 403 with an ARGUS-branded WAF block page --
Weboria's own front-line WAF blocks any request path matching .env* as a
standard credential-harvesting-probe rule, and it caught this legitimate
static file served from Gitea too. Confirmed docker-compose.yml and other
non-.env-named files fetch fine; only the .env.example path was affected.

Renamed to env.example (no leading dot) rather than requesting a WAF
exception -- sidesteps the false positive without depending on
infrastructure access this session doesn't have. Still saved locally as
.env either way; only the remote filename changed.
---
 README.md                   | 6 +++---
 .env.example => env.example | 0
 install.sh                  | 7 ++++++-
 3 files changed, 9 insertions(+), 4 deletions(-)
 rename .env.example => env.example (100%)

diff --git a/README.md b/README.md
index 0f9676c..5cce0fb 100644
--- a/README.md
+++ b/README.md
@@ -146,7 +146,7 @@ If you'd rather see every step:
 ```bash
 mkdir -p /opt/argus/docker-socket-proxy && cd /opt/argus
 curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-compose.yml -o docker-compose.yml
-curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/.env.example -o .env
+curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/env.example -o .env
 curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-socket-proxy/haproxy.cfg.template -o docker-socket-proxy/haproxy.cfg.template
 
 # Generate a secure database password
@@ -230,7 +230,7 @@ ARGUS connects to **ANIS**, Weboria's threat-intelligence hub, to share confirme
 and receive a community blocklist in return. Enabled by default against the public Community
 Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if
 you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in
-`.env.example` for the full set of options.
+`env.example` for the full set of options.
 
 ---
 
@@ -255,7 +255,7 @@ served at `https://<your-server-address>:81/api/docs` once ARGUS is running.
 | `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` |
 | `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` |
 
-Full list with descriptions in `.env.example`.
+Full list with descriptions in `env.example`.
 
 ---
 
diff --git a/.env.example b/env.example
similarity index 100%
rename from .env.example
rename to env.example
diff --git a/install.sh b/install.sh
index d703980..7dfdf63 100755
--- a/install.sh
+++ b/install.sh
@@ -54,8 +54,13 @@ for script in update.sh uninstall.sh healthcheck.sh backup.sh restore.sh; do
   fetch "$script" "$script"
   chmod +x "$script"
 done
+# The repo stores this as env.example (no leading dot) rather than .env.example
+# -- Weboria's own WAF blocks any request path matching .env* as a standard
+# credential-harvesting-probe rule, which also caught this legitimate static
+# file when served from Gitea. Renaming sidesteps it without needing a WAF
+# exception. Saved locally as .env either way.
 if [ ! -f .env ]; then
-  fetch ".env.example" ".env"
+  fetch "env.example" ".env"
   ok "Fetched deployment files into $INSTALL_DIR"
 else
   ok "Fetched compose file (kept your existing .env)"