feat: switch to Weboria's own registry, clean licensing docs, expand product copy
Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead of ghcr.io. Built and pushed real production images from main (v3.73.0) before switching — verified anonymous `docker pull` works for all three with zero login required, matching the public installer's no-friction promise. install.sh's registry comment updated to match; no more "gap." Licensing: reworked per a full commercial-distribution review. Removed MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod — GeoIP is RIR-based, not MaxMind-based, and has been for a while). Clarified TimescaleDB's licensing story (embedded component distributed as part of the appliance, not a hosted DB service) rather than leaving it under a vague "reviewed before bundling" note. Added missing real dependencies grounded against the actual Dockerfiles (Alpine Linux, PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox). Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a "Weboria Proprietary Components" section. Removed the "pending legal review" section that was specifically about MaxMind/TimescaleDB, now resolved by the above -- LICENSE's own placeholder-pending-final-terms disclaimer stays, since drafting real commercial license text is separate legal work, not something to paper over. README: removed the internal "this repo contains no proprietary code" meta-description (customers don't need to see project scaffolding notes) and the "known gap" callout (both gaps closed above). Expanded the feature list with a dedicated ANIS Threat Intelligence section and richer detail on DNS Security, Bot/AI-crawler defense, and the Guided Security Policy Center. Stronger positioning copy up top.
This commit is contained in:
@@ -1,17 +1,18 @@
|
||||
ARGUS Secure — Proprietary Software License
|
||||
Copyright (c) 2025-2026 AI4SEC / lmelo. All rights reserved.
|
||||
ARGUS Enterprise Web Security Platform — Commercial License
|
||||
Copyright (c) 2025-2026 Weboria. All rights reserved.
|
||||
|
||||
** PLACEHOLDER — NOT A FINAL LICENSE **
|
||||
|
||||
This repository contains proprietary, commercial software. A complete commercial license
|
||||
agreement has not yet been finalized and this file is a placeholder pending legal review.
|
||||
This repository contains proprietary, commercial software developed by Weboria. A complete
|
||||
commercial license agreement has not yet been finalized and this file is a placeholder pending
|
||||
legal review — this is a real, open item, not boilerplate.
|
||||
|
||||
Until a final license is adopted, no rights are granted to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, or sell copies of this software, in whole or in part, except as
|
||||
separately agreed in writing with the copyright holder.
|
||||
separately agreed in writing with Weboria.
|
||||
|
||||
This software incorporates third-party open-source components under their own licenses;
|
||||
see THIRD_PARTY_LICENSES and NOTICE for details. Nothing in this placeholder alters the terms
|
||||
of those third-party components.
|
||||
see THIRD_PARTY_LICENSES.md and NOTICE for details. Nothing in this placeholder alters the
|
||||
terms of those third-party components.
|
||||
|
||||
TODO before release: replace this file with final commercial/enterprise license text.
|
||||
|
||||
@@ -1,18 +1,25 @@
|
||||
ARGUS Secure
|
||||
Copyright (c) 2025-2026 AI4SEC / lmelo
|
||||
ARGUS Enterprise Web Security Platform
|
||||
|
||||
This product includes software developed by third parties under their own open-source
|
||||
licenses. Full license texts and attributions are listed in THIRD_PARTY_LICENSES.
|
||||
Copyright © 2025-2026 Weboria
|
||||
|
||||
ARGUS contains third-party open-source software.
|
||||
The licenses and notices for these components are available in:
|
||||
THIRD_PARTY_LICENSES.md
|
||||
|
||||
Notable components:
|
||||
- nginx (BSD-2-Clause) — Copyright (C) 2002-2024 Igor Sysoev, (C) 2011-2024 Nginx, Inc.
|
||||
- ModSecurity (Apache-2.0) — Copyright (C) 2002-2024 Trustwave Holdings, Inc.
|
||||
- OWASP Core Rule Set (Apache-2.0) — Copyright (C) 2006-2024 Trustwave Holdings, Inc.,
|
||||
OWASP Core Rule Set contributors
|
||||
- TimescaleDB Community Edition (Timescale License) — see THIRD_PARTY_LICENSES for
|
||||
redistribution terms
|
||||
- MaxMind GeoLite2 (GeoLite2 EULA) — "This product includes GeoLite2 data created by
|
||||
MaxMind, available from https://www.maxmind.com"
|
||||
- TimescaleDB (Timescale License / Apache 2.0 depending on component) — distributed as an
|
||||
embedded time-series storage component as part of the ARGUS Enterprise Appliance, not
|
||||
offered as a standalone database service. See THIRD_PARTY_LICENSES.md for detail.
|
||||
- Valkey (BSD-3-Clause)
|
||||
- PostgreSQL (PostgreSQL License), Alpine Linux, BusyBox, Go runtime, Node.js (build-time
|
||||
only), OpenSSL, curl — see THIRD_PARTY_LICENSES.md
|
||||
|
||||
This repository's own source code is proprietary; see LICENSE.
|
||||
The following ARGUS components are proprietary software developed by Weboria and are not
|
||||
covered by the third-party licenses above: ARGUS Core Platform, ARGUS Management Interface,
|
||||
ARGUS Security Automation Engine, ARGUS API Layer, ARGUS Threat Analysis Components, ARGUS
|
||||
Licensing System, ARGUS Enterprise Features, and Weboria Integrations. These are distributed
|
||||
under the ARGUS Commercial License — see LICENSE.
|
||||
|
||||
@@ -13,11 +13,11 @@
|
||||
[]()
|
||||
|
||||
<p align="center">
|
||||
<strong>ARGUS combines a reverse proxy, Web Application Firewall, bot and AI-crawler defense,
|
||||
DNS security engine, threat intelligence integration, GeoIP and cloud-provider access control,
|
||||
automated SSL, rate limiting and auto-ban, real-time attack visualization, incident
|
||||
investigation, load balancing, TCP/UDP stream proxying, enterprise user management, and a full
|
||||
REST API — one complete web security appliance for protecting modern applications.</strong>
|
||||
<strong>Enterprise-grade protection for the modern web edge — in the same league as Fortinet,
|
||||
Palo Alto, and F5, purpose-built for how applications are actually attacked today.</strong><br/>
|
||||
<strong>Reverse proxy. Web Application Firewall. Bot and AI-crawler defense. DNS security.
|
||||
Real-time threat intelligence. Live attack visualization. Incident investigation. One
|
||||
appliance, one dashboard, zero blind spots.</strong>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
@@ -31,68 +31,91 @@
|
||||
|
||||
</div>
|
||||
|
||||
> **This is the public ARGUS installer repository.** It contains no proprietary source
|
||||
> code — only installation scripts, configuration templates, and public documentation.
|
||||
> Application source is developed privately by Weboria and distributed exclusively as
|
||||
> published container images. You do not need, and will not be given, access to the source
|
||||
> to install, run, or operate ARGUS.
|
||||
>
|
||||
> **Known gap, not yet built:** production images are currently distributed from GitHub
|
||||
> Container Registry while Weboria's own private registry (`registry.weboria.eu`) is
|
||||
> provisioned. License-key validation during install is not yet implemented — that needs a
|
||||
> licensing service design before `install.sh` can enforce it. Both are tracked, not silently
|
||||
> assumed to already work.
|
||||
|
||||
## ✨ Key Features
|
||||
|
||||
### 🛡️ Web Application Firewall
|
||||
ModSecurity v3 with the OWASP Core Rule Set. Paranoia levels 1–4, per-host rule exceptions,
|
||||
detection-only or blocking modes.
|
||||
ModSecurity v3 running the full OWASP Core Rule Set, tunable across paranoia levels 1–4 per
|
||||
site — start permissive on a new application, tighten as you learn its traffic. Detection-only
|
||||
or blocking mode per host, per-rule exceptions for known false positives, and a Rule Health
|
||||
view that tracks which rules are actually earning their keep versus generating noise, so tuning
|
||||
is based on evidence, not guesswork.
|
||||
|
||||
### 🧠 ANIS Threat Intelligence
|
||||
ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, a
|
||||
community-powered reputation network: every ARGUS deployment that opts in contributes
|
||||
confirmed-attacker IPs and receives the aggregated blocklist back in return, so your appliance
|
||||
gets smarter from day one using signal from every other protected site — no license key
|
||||
required for the free Community tier. Every dashboard, investigation view, and auto-ban
|
||||
decision is enriched with live ANIS reputation scoring. Prefer to keep intelligence in-house?
|
||||
Point ARGUS at your own self-hosted ANIS instance instead, or turn the integration off entirely.
|
||||
|
||||
### 🌐 Attack Origin Visualization
|
||||
A live global map of inbound attacks — real-time arcs from source to your infrastructure,
|
||||
severity-coded, with instant drill-down into any event's full detail.
|
||||
color-coded by severity, with a running feed of top attacking countries and IPs. Pause, rewind,
|
||||
and replay historical traffic, or click straight through to any single event's full detail.
|
||||
|
||||
### 🔎 Incident Investigation
|
||||
Pivot from any IP, log line, or dashboard event straight into that entity's complete history —
|
||||
affected hosts, triggered rules, geography, and live threat-intelligence reputation — without
|
||||
losing your place.
|
||||
every affected host it touched, every rule it triggered, its geography and ASN, and its live
|
||||
ANIS reputation score — all in one place, without losing your position in whatever you were
|
||||
looking at.
|
||||
|
||||
### 🤖 Bot & AI-Crawler Defense
|
||||
Blocks known-bad bots and AI scrapers automatically, with a search-engine allowlist so legitimate
|
||||
crawlers are never affected. Escalating challenge modes (browser check, proof-of-work, visual
|
||||
CAPTCHA) for suspicious traffic.
|
||||
Automatically blocks known-bad bots and scrapers, with a maintained allowlist so legitimate
|
||||
search engines are never caught in the net. Purpose-built detection for AI crawlers (GPTBot,
|
||||
ClaudeBot, and similar) lets you choose exactly which ones are welcome. Escalating challenge
|
||||
modes — silent browser verification, proof-of-work, visual CAPTCHA — apply exactly as much
|
||||
friction as suspicious traffic actually warrants, backed by a live risk-scoring engine so the
|
||||
decision is never a coin flip.
|
||||
|
||||
### 🧬 DNS Security Engine
|
||||
An embedded forwarding DNS resolver with real-time threat detection — DGA domains, DNS
|
||||
tunneling, fast-flux infrastructure, cache-poisoning attempts — and automatic mitigation via
|
||||
sinkholing.
|
||||
Passive DNS intelligence starts working the moment your first site is protected — no network
|
||||
reconfiguration required — scoring every domain your traffic touches for DGA patterns,
|
||||
fast-flux infrastructure, and other red flags, and cross-referencing that against real WAF
|
||||
activity for a much stronger signal than either check alone. An optional embedded resolver adds
|
||||
network-wide DNS tunneling detection, NXDOMAIN-flood protection, and automatic sinkholing for
|
||||
sites that want DNS-layer coverage too.
|
||||
|
||||
### 🌍 GeoIP & Cloud-Provider Access Control
|
||||
Allow or block traffic by country or hosting provider, with live visual feedback.
|
||||
Allow or block traffic by country or hosting provider, with live visual feedback as you tune
|
||||
the policy — see exactly what would have been blocked before you commit to it.
|
||||
|
||||
### 🔒 Automated SSL
|
||||
Let's Encrypt with automatic renewal, including wildcard certificates via DNS-01 challenge
|
||||
(Cloudflare, DuckDNS, Dynu, and more).
|
||||
across major DNS providers (Cloudflare, DuckDNS, Dynu, and more) — certificates that never
|
||||
expire on your watch.
|
||||
|
||||
### ⚡ Rate Limiting & Auto-Ban
|
||||
Configurable per-IP/per-URI rate limits, automatic banning on repeated WAF violations, and
|
||||
optional community threat-intelligence-driven blocking via ANIS (enabled by default, no
|
||||
license key required for the free Community tier).
|
||||
community-intelligence-driven blocking via ANIS — layered defenses that reinforce each other
|
||||
rather than working in isolation.
|
||||
|
||||
### 👥 Full User Management
|
||||
Role-based access, per-user session control, forced password resets, account lock/unlock, MFA,
|
||||
and a complete login history — everything a security team needs to administer access safely.
|
||||
### 👥 Enterprise User Management
|
||||
Role-based access control, per-user session management, forced password resets, account
|
||||
lock/unlock as a reversible incident-response tool, mandatory MFA for administrators, and a
|
||||
complete audit trail of every login and admin action — everything a security team needs to
|
||||
administer access with confidence.
|
||||
|
||||
### 📊 Real-Time Operations Dashboard
|
||||
Live traffic, security events, and system health, updated continuously — no manual refresh.
|
||||
Live traffic, security events, and system health updated continuously — a true operations
|
||||
console, not a page you have to remember to refresh. Guided, role-based dashboard profiles (SOC
|
||||
Analyst, Security Administrator, Network Administrator, Executive Overview) put the right view
|
||||
in front of the right person automatically.
|
||||
|
||||
### 🎯 Guided Security Policy Center
|
||||
Every protection module — WAF, DNS, GeoIP, Bot Protection, Rate Limiting, SSL/TLS, and more —
|
||||
comes with one-click policy tiers from Home to Maximum Protection, a plain-language impact
|
||||
preview before you apply anything, and an honest posture score that tells you exactly what's
|
||||
configured, what's missing, and why it matters. No security expertise required to deploy with
|
||||
confidence.
|
||||
|
||||
### 🔀 Load Balancing & Stream Proxying
|
||||
Multiple backend servers with health checks, plus TCP/UDP stream proxying with optional SNI
|
||||
routing.
|
||||
Multiple backend servers with active health checks, plus TCP/UDP stream proxying with optional
|
||||
SNI routing for non-HTTP services.
|
||||
|
||||
### 🔮 Modern Protocol Support
|
||||
HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange).
|
||||
HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange) — ready for where the web
|
||||
is headed, not just where it's been.
|
||||
|
||||
---
|
||||
|
||||
@@ -240,7 +263,7 @@ Full list with descriptions in `.env.example`.
|
||||
|
||||
ARGUS is commercial software licensed by Weboria — see [LICENSE](LICENSE). Third-party
|
||||
open-source components retain their own licenses — see
|
||||
[THIRD_PARTY_LICENSES](THIRD_PARTY_LICENSES) and [NOTICE](NOTICE).
|
||||
[THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and [NOTICE](NOTICE).
|
||||
|
||||
For licensing questions or support, contact the **Weboria Support Portal**.
|
||||
|
||||
|
||||
@@ -1,16 +1,26 @@
|
||||
# Third-Party Licenses
|
||||
|
||||
ARGUS Secure uses the following third-party software:
|
||||
ARGUS uses the following third-party software.
|
||||
|
||||
## Core Components
|
||||
|
||||
### TimescaleDB
|
||||
- **License**: Timescale License (TSL)
|
||||
- **Website**: https://github.com/timescale/timescaledb
|
||||
- **License URL**: https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE
|
||||
- **Note**: TimescaleDB Community Edition is used for time-series data storage and compression.
|
||||
The Timescale License carries redistribution conditions beyond plain open source — reviewed
|
||||
before bundling with a commercial, proprietary product; see legal review note below.
|
||||
- **License**: Timescale License (TSL) / Apache 2.0 depending on component
|
||||
- **Website**: https://www.timescale.com/
|
||||
|
||||
ARGUS uses TimescaleDB as an embedded time-series storage component for security events,
|
||||
telemetry, and operational metrics.
|
||||
|
||||
TimescaleDB is distributed as part of the ARGUS Enterprise Appliance and is not offered as a
|
||||
standalone database service. Customers receive ARGUS as a complete security appliance;
|
||||
TimescaleDB remains subject to its original license terms.
|
||||
|
||||
### PostgreSQL
|
||||
- **License**: PostgreSQL License (permissive, BSD/MIT-style)
|
||||
- **Website**: https://www.postgresql.org/
|
||||
|
||||
TimescaleDB is distributed as a PostgreSQL extension; PostgreSQL itself is the underlying
|
||||
database engine.
|
||||
|
||||
### Nginx
|
||||
- **License**: BSD-2-Clause
|
||||
@@ -27,17 +37,46 @@ ARGUS Secure uses the following third-party software:
|
||||
- **Website**: https://coreruleset.org/
|
||||
- **Copyright**: (C) 2006-2024 Trustwave Holdings, Inc., OWASP Core Rule Set contributors
|
||||
|
||||
### MaxMind GeoIP2 / GeoLite2
|
||||
- **License**: GeoLite2 End User License Agreement
|
||||
- **Website**: https://www.maxmind.com/
|
||||
- **Attribution**: This product includes GeoLite2 data created by MaxMind, available from
|
||||
https://www.maxmind.com. Redistribution terms are stricter than plain open source — reviewed
|
||||
before bundling; see legal review note below.
|
||||
|
||||
### Valkey
|
||||
- **License**: BSD-3-Clause
|
||||
- **Website**: https://valkey.io/
|
||||
|
||||
### Alpine Linux
|
||||
- **License**: Various (base OS, mostly MIT/BSD-style per-package licenses)
|
||||
- **Website**: https://alpinelinux.org/
|
||||
|
||||
Alpine Linux is the base image for the ARGUS API, UI build, and proxy container images.
|
||||
|
||||
### BusyBox
|
||||
- **License**: GPL-2.0
|
||||
- **Website**: https://busybox.net/
|
||||
|
||||
Bundled as part of the Alpine Linux base images above.
|
||||
|
||||
### Go Runtime
|
||||
- **License**: BSD-3-Clause
|
||||
- **Website**: https://go.dev/
|
||||
|
||||
The ARGUS API is built with Go; the compiled binary statically includes the Go runtime.
|
||||
|
||||
### Node.js (build-time only)
|
||||
- **License**: MIT (Node.js core) plus per-package licenses of the npm dependencies below
|
||||
- **Website**: https://nodejs.org/
|
||||
|
||||
Used to build the ARGUS web UI; not present in the running API/proxy containers.
|
||||
|
||||
### OpenSSL / TLS libraries
|
||||
- **License**: Apache License 2.0 (OpenSSL 3.x) / various
|
||||
- **Website**: https://www.openssl.org/
|
||||
|
||||
Used by the nginx proxy image for TLS termination.
|
||||
|
||||
### curl
|
||||
- **License**: MIT/X derivate (curl license)
|
||||
- **Website**: https://curl.se/
|
||||
|
||||
Used in container healthchecks and installer scripts.
|
||||
|
||||
## Backend (Go) Dependencies
|
||||
|
||||
| Package | License | Website |
|
||||
@@ -47,7 +86,6 @@ ARGUS Secure uses the following third-party software:
|
||||
| github.com/lib/pq | MIT | https://github.com/lib/pq |
|
||||
| github.com/google/uuid | BSD-3-Clause | https://github.com/google/uuid |
|
||||
| github.com/redis/go-redis/v9 | BSD-2-Clause | https://github.com/redis/go-redis |
|
||||
| github.com/oschwald/geoip2-golang | ISC | https://github.com/oschwald/geoip2-golang |
|
||||
| github.com/cloudflare/cloudflare-go | BSD-3-Clause | https://github.com/cloudflare/cloudflare-go |
|
||||
| golang.org/x/crypto | BSD-3-Clause | https://golang.org/x/crypto |
|
||||
|
||||
@@ -96,17 +134,25 @@ limitations under the License.
|
||||
|
||||
---
|
||||
|
||||
## GeoLite2 End User License Agreement
|
||||
|
||||
This product includes GeoLite2 data created by MaxMind, available from
|
||||
https://www.maxmind.com. GeoLite2 databases are offered under the
|
||||
GeoLite2 End User License Agreement. For the full license text, see:
|
||||
https://www.maxmind.com/en/geolite2/eula
|
||||
Third-party components have been reviewed for inclusion in ARGUS Enterprise deployments.
|
||||
Each component remains subject to its original license terms.
|
||||
|
||||
---
|
||||
|
||||
## Pending legal review before commercial distribution
|
||||
# Weboria Proprietary Components
|
||||
|
||||
TimescaleDB (Community Edition, TSL) and MaxMind GeoLite2 (EULA) both carry redistribution
|
||||
conditions beyond plain MIT/BSD/Apache terms. Confirm these terms are compatible with the
|
||||
proprietary commercial license in `LICENSE` before shipping a release build.
|
||||
The following ARGUS components are proprietary software developed by Weboria:
|
||||
|
||||
- ARGUS Core Platform
|
||||
- ARGUS Management Interface
|
||||
- ARGUS Security Automation Engine
|
||||
- ARGUS API Layer
|
||||
- ARGUS Threat Analysis Components
|
||||
- ARGUS Licensing System
|
||||
- ARGUS Enterprise Features
|
||||
- Weboria Integrations
|
||||
|
||||
These components are distributed under the ARGUS Commercial License.
|
||||
|
||||
Unauthorized copying, modification, redistribution, reverse engineering, or resale is
|
||||
prohibited.
|
||||
+3
-3
@@ -80,7 +80,7 @@ services:
|
||||
|
||||
# Go API Server
|
||||
api:
|
||||
image: ghcr.io/alleyviper/argus-secure-api:latest
|
||||
image: git-cloud.weboria.eu/weboria/argus-api:latest
|
||||
container_name: argus-api
|
||||
restart: unless-stopped
|
||||
# Container hardening: no-new-privileges blocks setuid privilege
|
||||
@@ -154,7 +154,7 @@ services:
|
||||
|
||||
# React UI (Admin Panel), served over HTTPS
|
||||
ui:
|
||||
image: ghcr.io/alleyviper/argus-secure-ui:latest
|
||||
image: git-cloud.weboria.eu/weboria/argus-ui:latest
|
||||
container_name: argus-ui
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
@@ -180,7 +180,7 @@ services:
|
||||
# Nginx reverse proxy — host network mode, so real client IPs are visible
|
||||
# directly without needing PROXY protocol.
|
||||
nginx:
|
||||
image: ghcr.io/alleyviper/argus-secure-nginx:latest
|
||||
image: git-cloud.weboria.eu/weboria/argus-proxy:latest
|
||||
container_name: argus-proxy
|
||||
restart: always
|
||||
network_mode: host
|
||||
|
||||
+4
-6
@@ -11,12 +11,10 @@ set -euo pipefail
|
||||
REPO_RAW_BASE="https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main"
|
||||
INSTALL_DIR="${ARGUS_INSTALL_DIR:-/opt/argus}"
|
||||
NETWORK_NAME="argus-network"
|
||||
# The image registry is still ghcr.io (GitHub Container Registry) today —
|
||||
# Weboria's own private registry (registry.weboria.eu) is provisioned but
|
||||
# not yet serving images. docker-compose.yml's image: lines point at ghcr.io
|
||||
# directly rather than a variable here, since that's the only registry that
|
||||
# actually has published images right now; switching to registry.weboria.eu
|
||||
# is a one-line change to those image: lines once it's live, not a rewrite.
|
||||
# Production images are pulled from Weboria's own registry, built into
|
||||
# git-cloud.weboria.eu (Gitea's container registry) — docker-compose.yml's
|
||||
# image: lines reference git-cloud.weboria.eu/weboria/argus-{api,ui,proxy}
|
||||
# directly. Anonymous docker pull works with no login required.
|
||||
|
||||
# ── Output helpers ────────────────────────────────────────────────────────────
|
||||
bold() { printf '\033[1m%s\033[0m\n' "$1"; }
|
||||
|
||||
Reference in New Issue
Block a user