fix: no self-hosted ANIS model, license key is dashboard-only, remove dead ANIS_SHARE_ATTACKERS

Three corrections, driven by explicit product decisions plus code
verification:

- There is no self-hosted-ANIS deployment model going forward. ANIS_URL
  is now hardcoded to https://anis.weboria.eu in docker-compose.yml, not
  a customer-configurable env var -- removed from env.example and the
  README entirely.
- The ANIS license key is dashboard-only (Threat Intel -> ANIS
  Connection, write-only there per the earlier security fix) -- never
  set via .env. ANIS_LICENSE_KEY hardcoded to an empty string in
  docker-compose.yml (community tier by default) rather than left as a
  pass-through env var with no real path to ever being set.
- Removed ANIS_SHARE_ATTACKERS -- confirmed dead via grep, zero
  references anywhere in the Go source. This was incorrectly kept as
  "real" in the previous env.example cleanup pass; ROADMAP.md in the
  appliance repo already documented this exact variable as dead.

ANIS_ENABLED remains the one real customer-facing ANIS toggle.

README.md

@@ -41,13 +41,14 @@ view that tracks which rules are actually earning their keep versus generating n
 is based on evidence, not guesswork.
 
 ### 🧠 ANIS Threat Intelligence
-ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, a
+ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, Weboria's
 community-powered reputation network: every ARGUS deployment that opts in contributes
 confirmed-attacker IPs and receives the aggregated blocklist back in return, so your appliance
 gets smarter from day one using signal from every other protected site — no license key
 required for the free Community tier. Every dashboard, investigation view, and auto-ban
-decision is enriched with live ANIS reputation scoring. Prefer to keep intelligence in-house?
+decision is enriched with live ANIS reputation scoring. A license key upgrades the tier —
-Point ARGUS at your own self-hosted ANIS instance instead, or turn the integration off entirely.
+manage it entirely from Threat Intel → ANIS Connection in the dashboard, or turn the
+integration off entirely from the same page.
 
 ### 🌐 Attack Origin Visualization
 A live global map of inbound attacks — real-time arcs from source to your infrastructure,
@@ -228,9 +229,9 @@ for the rest of the options (clearing 2FA, etc.).
 
 ARGUS connects to **ANIS**, Weboria's threat-intelligence hub, to share confirmed attacker IPs
 and receive a community blocklist in return. Enabled by default against the public Community
-Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if
+Edition hub — no license key required. Set `ANIS_ENABLED=false` in `.env` to turn this off
-you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in
+entirely. A license key upgrades the tier — set it from Threat Intel → ANIS Connection in the
-`env.example` for the full set of options.
+dashboard, not from `.env`.
 
 ---
 
@@ -253,9 +254,10 @@ served at `https://<your-server-address>:81/api/docs` once ARGUS is running.
 | `NGINX_HTTP_PORT` / `NGINX_HTTPS_PORT` | Reverse-proxy listen ports | `80` / `443` |
 | `API_HOST_PORT` | Internal API port exposed to the host | `9080` |
 | `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` |
-| `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` |
+| `ANIS_ENABLED` | Threat-intel hub integration | `true` |
 
-Full list with descriptions in `env.example`.
+Full list with descriptions in `env.example`. ANIS's URL is fixed (`https://anis.weboria.eu`,
+not configurable) and its license key is dashboard-only — neither is an env var.
 
 ---
 

docker-compose.yml

@@ -123,16 +123,19 @@ services:
       API_HOST_PORT: ${API_HOST_PORT:-9080}
       API_HOST: ${API_HOST:-}
       # ANIS community intelligence — on by default against the public
-      # Community Edition hub (empty license key = community tier, no signup
+      # Community Edition hub (community tier, no signup required). There is
-      # required). These three only matter on first boot; manage the
+      # no self-hosted-ANIS deployment model: the URL is fixed, not
-      # connection afterward from Threat Intel -> ANIS Connection in the
+      # customer-configurable. A license key upgrades the tier, but is only
-      # dashboard. (No ANIS_ADMIN_KEY here: it's ANIS's own admin-dashboard
+      # ever set from Threat Intel -> ANIS Connection in the dashboard
-      # credential, unrelated to the ARGUS<->ANIS protocol, which ARGUS never
+      # (write-only there — never round-trips back to the client), not from
-      # sends — a prior version of this file carried it by mistake.)
+      # this file, so it's seeded empty (community tier) here.
+      # (No ANIS_ADMIN_KEY or ANIS_SHARE_ATTACKERS here: both confirmed dead
+      # via grep, zero references anywhere in internal/config.go or the ANIS
+      # client. A prior version of this file carried ANIS_ADMIN_KEY and
+      # falsely claimed ARGUS "fails closed at startup" without it.)
       ANIS_ENABLED: ${ANIS_ENABLED:-true}
-      ANIS_URL:              ${ANIS_URL:-https://anis.weboria.eu}
+      ANIS_URL: https://anis.weboria.eu
-      ANIS_LICENSE_KEY:      ${ANIS_LICENSE_KEY:-}
+      ANIS_LICENSE_KEY: ""
-      ANIS_SHARE_ATTACKERS:  ${ANIS_SHARE_ATTACKERS:-false}
       DNS_SECURITY_LISTEN_ADDR: ":53"
     ports:
       - "127.0.0.1:${API_HOST_PORT:-9080}:8080"

env.example

@@ -26,15 +26,11 @@ TZ=UTC
 # Threat Intelligence (ANIS)
 # ===========================================
 # ARGUS connects to ANIS, Weboria's threat-intelligence network, by default
-# — no license key needed for the free Community tier. These three values
+# — no license key needed for the free Community tier. There is no
-# only matter on first boot; manage the connection afterward from
+# self-hosted-ANIS deployment model, so there's no URL to configure here.
-# Threat Intel -> ANIS Connection in the dashboard.
+# A license key upgrades the tier, but is only ever set from
+# Threat Intel -> ANIS Connection in the dashboard — never from this file.
 ANIS_ENABLED=true
-ANIS_URL=https://anis.weboria.eu
-ANIS_LICENSE_KEY=
-
-# Share this instance's confirmed attacker IPs back to the community feed?
-ANIS_SHARE_ATTACKERS=false
 
 # ===========================================
 # Network Ports