- ARGUS combines a reverse proxy, Web Application Firewall, bot and AI-crawler defense,
- DNS security engine, threat intelligence integration, GeoIP and cloud-provider access control,
- automated SSL, rate limiting and auto-ban, real-time attack visualization, incident
- investigation, load balancing, TCP/UDP stream proxying, enterprise user management, and a full
- REST API — one complete web security appliance for protecting modern applications.
+ Enterprise-grade protection for the modern web edge — in the same league as Fortinet,
+ Palo Alto, and F5, purpose-built for how applications are actually attacked today.
+ Reverse proxy. Web Application Firewall. Bot and AI-crawler defense. DNS security.
+ Real-time threat intelligence. Live attack visualization. Incident investigation. One
+ appliance, one dashboard, zero blind spots.
@@ -31,68 +31,91 @@ -> **This is the public ARGUS installer repository.** It contains no proprietary source -> code — only installation scripts, configuration templates, and public documentation. -> Application source is developed privately by Weboria and distributed exclusively as -> published container images. You do not need, and will not be given, access to the source -> to install, run, or operate ARGUS. -> -> **Known gap, not yet built:** production images are currently distributed from GitHub -> Container Registry while Weboria's own private registry (`registry.weboria.eu`) is -> provisioned. License-key validation during install is not yet implemented — that needs a -> licensing service design before `install.sh` can enforce it. Both are tracked, not silently -> assumed to already work. - ## ✨ Key Features ### 🛡️ Web Application Firewall -ModSecurity v3 with the OWASP Core Rule Set. Paranoia levels 1–4, per-host rule exceptions, -detection-only or blocking modes. +ModSecurity v3 running the full OWASP Core Rule Set, tunable across paranoia levels 1–4 per +site — start permissive on a new application, tighten as you learn its traffic. Detection-only +or blocking mode per host, per-rule exceptions for known false positives, and a Rule Health +view that tracks which rules are actually earning their keep versus generating noise, so tuning +is based on evidence, not guesswork. + +### 🧠 ANIS Threat Intelligence +ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, a +community-powered reputation network: every ARGUS deployment that opts in contributes +confirmed-attacker IPs and receives the aggregated blocklist back in return, so your appliance +gets smarter from day one using signal from every other protected site — no license key +required for the free Community tier. Every dashboard, investigation view, and auto-ban +decision is enriched with live ANIS reputation scoring. Prefer to keep intelligence in-house? +Point ARGUS at your own self-hosted ANIS instance instead, or turn the integration off entirely. ### 🌐 Attack Origin Visualization A live global map of inbound attacks — real-time arcs from source to your infrastructure, -severity-coded, with instant drill-down into any event's full detail. +color-coded by severity, with a running feed of top attacking countries and IPs. Pause, rewind, +and replay historical traffic, or click straight through to any single event's full detail. ### 🔎 Incident Investigation Pivot from any IP, log line, or dashboard event straight into that entity's complete history — -affected hosts, triggered rules, geography, and live threat-intelligence reputation — without -losing your place. +every affected host it touched, every rule it triggered, its geography and ASN, and its live +ANIS reputation score — all in one place, without losing your position in whatever you were +looking at. ### 🤖 Bot & AI-Crawler Defense -Blocks known-bad bots and AI scrapers automatically, with a search-engine allowlist so legitimate -crawlers are never affected. Escalating challenge modes (browser check, proof-of-work, visual -CAPTCHA) for suspicious traffic. +Automatically blocks known-bad bots and scrapers, with a maintained allowlist so legitimate +search engines are never caught in the net. Purpose-built detection for AI crawlers (GPTBot, +ClaudeBot, and similar) lets you choose exactly which ones are welcome. Escalating challenge +modes — silent browser verification, proof-of-work, visual CAPTCHA — apply exactly as much +friction as suspicious traffic actually warrants, backed by a live risk-scoring engine so the +decision is never a coin flip. ### 🧬 DNS Security Engine -An embedded forwarding DNS resolver with real-time threat detection — DGA domains, DNS -tunneling, fast-flux infrastructure, cache-poisoning attempts — and automatic mitigation via -sinkholing. +Passive DNS intelligence starts working the moment your first site is protected — no network +reconfiguration required — scoring every domain your traffic touches for DGA patterns, +fast-flux infrastructure, and other red flags, and cross-referencing that against real WAF +activity for a much stronger signal than either check alone. An optional embedded resolver adds +network-wide DNS tunneling detection, NXDOMAIN-flood protection, and automatic sinkholing for +sites that want DNS-layer coverage too. ### 🌍 GeoIP & Cloud-Provider Access Control -Allow or block traffic by country or hosting provider, with live visual feedback. +Allow or block traffic by country or hosting provider, with live visual feedback as you tune +the policy — see exactly what would have been blocked before you commit to it. ### 🔒 Automated SSL Let's Encrypt with automatic renewal, including wildcard certificates via DNS-01 challenge -(Cloudflare, DuckDNS, Dynu, and more). +across major DNS providers (Cloudflare, DuckDNS, Dynu, and more) — certificates that never +expire on your watch. ### ⚡ Rate Limiting & Auto-Ban Configurable per-IP/per-URI rate limits, automatic banning on repeated WAF violations, and -optional community threat-intelligence-driven blocking via ANIS (enabled by default, no -license key required for the free Community tier). +community-intelligence-driven blocking via ANIS — layered defenses that reinforce each other +rather than working in isolation. -### 👥 Full User Management -Role-based access, per-user session control, forced password resets, account lock/unlock, MFA, -and a complete login history — everything a security team needs to administer access safely. +### 👥 Enterprise User Management +Role-based access control, per-user session management, forced password resets, account +lock/unlock as a reversible incident-response tool, mandatory MFA for administrators, and a +complete audit trail of every login and admin action — everything a security team needs to +administer access with confidence. ### 📊 Real-Time Operations Dashboard -Live traffic, security events, and system health, updated continuously — no manual refresh. +Live traffic, security events, and system health updated continuously — a true operations +console, not a page you have to remember to refresh. Guided, role-based dashboard profiles (SOC +Analyst, Security Administrator, Network Administrator, Executive Overview) put the right view +in front of the right person automatically. + +### 🎯 Guided Security Policy Center +Every protection module — WAF, DNS, GeoIP, Bot Protection, Rate Limiting, SSL/TLS, and more — +comes with one-click policy tiers from Home to Maximum Protection, a plain-language impact +preview before you apply anything, and an honest posture score that tells you exactly what's +configured, what's missing, and why it matters. No security expertise required to deploy with +confidence. ### 🔀 Load Balancing & Stream Proxying -Multiple backend servers with health checks, plus TCP/UDP stream proxying with optional SNI -routing. +Multiple backend servers with active health checks, plus TCP/UDP stream proxying with optional +SNI routing for non-HTTP services. ### 🔮 Modern Protocol Support -HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange). +HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange) — ready for where the web +is headed, not just where it's been. --- @@ -240,7 +263,7 @@ Full list with descriptions in `.env.example`. ARGUS is commercial software licensed by Weboria — see [LICENSE](LICENSE). Third-party open-source components retain their own licenses — see -[THIRD_PARTY_LICENSES](THIRD_PARTY_LICENSES) and [NOTICE](NOTICE). +[THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and [NOTICE](NOTICE). For licensing questions or support, contact the **Weboria Support Portal**. diff --git a/THIRD_PARTY_LICENSES b/THIRD_PARTY_LICENSES.md similarity index 54% rename from THIRD_PARTY_LICENSES rename to THIRD_PARTY_LICENSES.md index 586c83c..30023d3 100644 --- a/THIRD_PARTY_LICENSES +++ b/THIRD_PARTY_LICENSES.md @@ -1,16 +1,26 @@ # Third-Party Licenses -ARGUS Secure uses the following third-party software: +ARGUS uses the following third-party software. ## Core Components ### TimescaleDB -- **License**: Timescale License (TSL) -- **Website**: https://github.com/timescale/timescaledb -- **License URL**: https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE -- **Note**: TimescaleDB Community Edition is used for time-series data storage and compression. - The Timescale License carries redistribution conditions beyond plain open source — reviewed - before bundling with a commercial, proprietary product; see legal review note below. +- **License**: Timescale License (TSL) / Apache 2.0 depending on component +- **Website**: https://www.timescale.com/ + +ARGUS uses TimescaleDB as an embedded time-series storage component for security events, +telemetry, and operational metrics. + +TimescaleDB is distributed as part of the ARGUS Enterprise Appliance and is not offered as a +standalone database service. Customers receive ARGUS as a complete security appliance; +TimescaleDB remains subject to its original license terms. + +### PostgreSQL +- **License**: PostgreSQL License (permissive, BSD/MIT-style) +- **Website**: https://www.postgresql.org/ + +TimescaleDB is distributed as a PostgreSQL extension; PostgreSQL itself is the underlying +database engine. ### Nginx - **License**: BSD-2-Clause @@ -27,17 +37,46 @@ ARGUS Secure uses the following third-party software: - **Website**: https://coreruleset.org/ - **Copyright**: (C) 2006-2024 Trustwave Holdings, Inc., OWASP Core Rule Set contributors -### MaxMind GeoIP2 / GeoLite2 -- **License**: GeoLite2 End User License Agreement -- **Website**: https://www.maxmind.com/ -- **Attribution**: This product includes GeoLite2 data created by MaxMind, available from - https://www.maxmind.com. Redistribution terms are stricter than plain open source — reviewed - before bundling; see legal review note below. - ### Valkey - **License**: BSD-3-Clause - **Website**: https://valkey.io/ +### Alpine Linux +- **License**: Various (base OS, mostly MIT/BSD-style per-package licenses) +- **Website**: https://alpinelinux.org/ + +Alpine Linux is the base image for the ARGUS API, UI build, and proxy container images. + +### BusyBox +- **License**: GPL-2.0 +- **Website**: https://busybox.net/ + +Bundled as part of the Alpine Linux base images above. + +### Go Runtime +- **License**: BSD-3-Clause +- **Website**: https://go.dev/ + +The ARGUS API is built with Go; the compiled binary statically includes the Go runtime. + +### Node.js (build-time only) +- **License**: MIT (Node.js core) plus per-package licenses of the npm dependencies below +- **Website**: https://nodejs.org/ + +Used to build the ARGUS web UI; not present in the running API/proxy containers. + +### OpenSSL / TLS libraries +- **License**: Apache License 2.0 (OpenSSL 3.x) / various +- **Website**: https://www.openssl.org/ + +Used by the nginx proxy image for TLS termination. + +### curl +- **License**: MIT/X derivate (curl license) +- **Website**: https://curl.se/ + +Used in container healthchecks and installer scripts. + ## Backend (Go) Dependencies | Package | License | Website | @@ -47,7 +86,6 @@ ARGUS Secure uses the following third-party software: | github.com/lib/pq | MIT | https://github.com/lib/pq | | github.com/google/uuid | BSD-3-Clause | https://github.com/google/uuid | | github.com/redis/go-redis/v9 | BSD-2-Clause | https://github.com/redis/go-redis | -| github.com/oschwald/geoip2-golang | ISC | https://github.com/oschwald/geoip2-golang | | github.com/cloudflare/cloudflare-go | BSD-3-Clause | https://github.com/cloudflare/cloudflare-go | | golang.org/x/crypto | BSD-3-Clause | https://golang.org/x/crypto | @@ -96,17 +134,25 @@ limitations under the License. --- -## GeoLite2 End User License Agreement - -This product includes GeoLite2 data created by MaxMind, available from -https://www.maxmind.com. GeoLite2 databases are offered under the -GeoLite2 End User License Agreement. For the full license text, see: -https://www.maxmind.com/en/geolite2/eula +Third-party components have been reviewed for inclusion in ARGUS Enterprise deployments. +Each component remains subject to its original license terms. --- -## Pending legal review before commercial distribution +# Weboria Proprietary Components -TimescaleDB (Community Edition, TSL) and MaxMind GeoLite2 (EULA) both carry redistribution -conditions beyond plain MIT/BSD/Apache terms. Confirm these terms are compatible with the -proprietary commercial license in `LICENSE` before shipping a release build. +The following ARGUS components are proprietary software developed by Weboria: + +- ARGUS Core Platform +- ARGUS Management Interface +- ARGUS Security Automation Engine +- ARGUS API Layer +- ARGUS Threat Analysis Components +- ARGUS Licensing System +- ARGUS Enterprise Features +- Weboria Integrations + +These components are distributed under the ARGUS Commercial License. + +Unauthorized copying, modification, redistribution, reverse engineering, or resale is +prohibited. diff --git a/docker-compose.yml b/docker-compose.yml index a70abd6..aa8d6e1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -80,7 +80,7 @@ services: # Go API Server api: - image: ghcr.io/alleyviper/argus-secure-api:latest + image: git-cloud.weboria.eu/weboria/argus-api:latest container_name: argus-api restart: unless-stopped # Container hardening: no-new-privileges blocks setuid privilege @@ -154,7 +154,7 @@ services: # React UI (Admin Panel), served over HTTPS ui: - image: ghcr.io/alleyviper/argus-secure-ui:latest + image: git-cloud.weboria.eu/weboria/argus-ui:latest container_name: argus-ui restart: unless-stopped security_opt: @@ -180,7 +180,7 @@ services: # Nginx reverse proxy — host network mode, so real client IPs are visible # directly without needing PROXY protocol. nginx: - image: ghcr.io/alleyviper/argus-secure-nginx:latest + image: git-cloud.weboria.eu/weboria/argus-proxy:latest container_name: argus-proxy restart: always network_mode: host diff --git a/install.sh b/install.sh index aeee2bb..d703980 100755 --- a/install.sh +++ b/install.sh @@ -11,12 +11,10 @@ set -euo pipefail REPO_RAW_BASE="https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main" INSTALL_DIR="${ARGUS_INSTALL_DIR:-/opt/argus}" NETWORK_NAME="argus-network" -# The image registry is still ghcr.io (GitHub Container Registry) today — -# Weboria's own private registry (registry.weboria.eu) is provisioned but -# not yet serving images. docker-compose.yml's image: lines point at ghcr.io -# directly rather than a variable here, since that's the only registry that -# actually has published images right now; switching to registry.weboria.eu -# is a one-line change to those image: lines once it's live, not a rewrite. +# Production images are pulled from Weboria's own registry, built into +# git-cloud.weboria.eu (Gitea's container registry) — docker-compose.yml's +# image: lines reference git-cloud.weboria.eu/weboria/argus-{api,ui,proxy} +# directly. Anonymous docker pull works with no login required. # ── Output helpers ──────────────────────────────────────────────────────────── bold() { printf '\033[1m%s\033[0m\n' "$1"; }