Weboria/argus-installer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(installer): rename .env.example -> env.example, WAF blocks .env* paths

Browse Source 
Found live during a real install dry-run: fetching .env.example via the
Gitea raw URL returned a 403 with an ARGUS-branded WAF block page --
Weboria's own front-line WAF blocks any request path matching .env* as a
standard credential-harvesting-probe rule, and it caught this legitimate
static file served from Gitea too. Confirmed docker-compose.yml and other
non-.env-named files fetch fine; only the .env.example path was affected.

Renamed to env.example (no leading dot) rather than requesting a WAF
exception -- sidesteps the false positive without depending on
infrastructure access this session doesn't have. Still saved locally as
.env either way; only the remote filename changed.
This commit is contained in:
tech
2026-07-25 16:38:58 +00:00
parent abab6775d6
commit 27be26f5f2
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -3
View File
@@ -146,7 +146,7 @@ If you'd rather see every step:
```bash ```bash
mkdir -p /opt/argus/docker-socket-proxy && cd /opt/argus mkdir -p /opt/argus/docker-socket-proxy && cd /opt/argus
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-compose.yml -o docker-compose.yml curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-compose.yml -o docker-compose.yml
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/.env.example -o .env curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/env.example -o .env
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-socket-proxy/haproxy.cfg.template -o docker-socket-proxy/haproxy.cfg.template curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-socket-proxy/haproxy.cfg.template -o docker-socket-proxy/haproxy.cfg.template
# Generate a secure database password # Generate a secure database password
@@ -230,7 +230,7 @@ ARGUS connects to **ANIS**, Weboria's threat-intelligence hub, to share confirme
and receive a community blocklist in return. Enabled by default against the public Community and receive a community blocklist in return. Enabled by default against the public Community
Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if
you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in
`.env.example` for the full set of options. `env.example` for the full set of options.
--- ---
@@ -255,7 +255,7 @@ served at `https://<your-server-address>:81/api/docs` once ARGUS is running.
| `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` | | `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` |
| `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` | | `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` |
Full list with descriptions in `.env.example`. Full list with descriptions in `env.example`.
--- ---
.env.example → env.example
View File
install.sh
+6 -1
View File
@@ -54,8 +54,13 @@ for script in update.sh uninstall.sh healthcheck.sh backup.sh restore.sh; do
fetch "$script" "$script" fetch "$script" "$script"
chmod +x "$script" chmod +x "$script"
done done
# The repo stores this as env.example (no leading dot) rather than .env.example
# -- Weboria's own WAF blocks any request path matching .env* as a standard
# credential-harvesting-probe rule, which also caught this legitimate static
# file when served from Gitea. Renaming sidesteps it without needing a WAF
# exception. Saved locally as .env either way.
if [ ! -f .env ]; then if [ ! -f .env ]; then
fetch ".env.example" ".env" fetch "env.example" ".env"
ok "Fetched deployment files into $INSTALL_DIR" ok "Fetched deployment files into $INSTALL_DIR"
else else
ok "Fetched compose file (kept your existing .env)" ok "Fetched compose file (kept your existing .env)"