Found live during a real install dry-run: fetching .env.example via the
Gitea raw URL returned a 403 with an ARGUS-branded WAF block page --
Weboria's own front-line WAF blocks any request path matching .env* as a
standard credential-harvesting-probe rule, and it caught this legitimate
static file served from Gitea too. Confirmed docker-compose.yml and other
non-.env-named files fetch fine; only the .env.example path was affected.
Renamed to env.example (no leading dot) rather than requesting a WAF
exception -- sidesteps the false positive without depending on
infrastructure access this session doesn't have. Still saved locally as
.env either way; only the remote filename changed.
Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from
git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead
of ghcr.io. Built and pushed real production images from main (v3.73.0)
before switching — verified anonymous `docker pull` works for all three
with zero login required, matching the public installer's no-friction
promise. install.sh's registry comment updated to match; no more "gap."
Licensing: reworked per a full commercial-distribution review. Removed
MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod —
GeoIP is RIR-based, not MaxMind-based, and has been for a while).
Clarified TimescaleDB's licensing story (embedded component distributed
as part of the appliance, not a hosted DB service) rather than leaving it
under a vague "reviewed before bundling" note. Added missing real
dependencies grounded against the actual Dockerfiles (Alpine Linux,
PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox).
Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a
"Weboria Proprietary Components" section. Removed the "pending legal
review" section that was specifically about MaxMind/TimescaleDB, now
resolved by the above -- LICENSE's own placeholder-pending-final-terms
disclaimer stays, since drafting real commercial license text is separate
legal work, not something to paper over.
README: removed the internal "this repo contains no proprietary code"
meta-description (customers don't need to see project scaffolding notes)
and the "known gap" callout (both gaps closed above). Expanded the
feature list with a dedicated ANIS Threat Intelligence section and richer
detail on DNS Security, Bot/AI-crawler defense, and the Guided Security
Policy Center. Stronger positioning copy up top.
README rewritten with the "ARGUS Enterprise Web Security Platform" positioning
and full feature list. install.sh/update.sh now fetch deployment files from
this Gitea repo (git-cloud.weboria.eu) instead of raw.githubusercontent.com,
default install directory changed to /opt/argus, next-steps messaging aligned
with the full onboarding journey (first-run wizard, proxy hosts, ANIS, policy
center). Support link changed from GitHub Issues to the Weboria Support
Portal.
Deliberately NOT changed: docker-compose.yml's image: lines still pull from
ghcr.io — Weboria's own private registry (registry.weboria.eu) resolves in
DNS but has no registry service listening yet (confirmed via direct check),
so switching now would break every real install. Both README and install.sh
document this as a known, tracked gap rather than silently pointing at
infrastructure that doesn't work. Same treatment for license-key validation
during install — not implemented, since there's no licensing service to
validate against yet.
Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.
install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.
update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).
Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.
Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).
tech
