A full audit of the installer and first-run experience found the mandatory
first-run wizard (is_initial_setup gate + InitialSetup.tsx) already works
correctly end-to-end — the real gap was discoverability and drift between
the installer and current app, not the wizard itself:
- nginx's static welcome page (served on the default HTTP/HTTPS ports, the
first place any new admin looks) never mentioned the admin panel lives on
a separate port, still shipped a Korean-language switcher despite Korean
being fully removed from the product, and linked to the retired
"Argus-appliance" identity. Now surfaces a live, dynamically-derived
admin panel link and drops the dead i18n/branding.
- users.language defaulted to 'ko' at the schema level (both the column
DEFAULT and the seed admin row) — a leftover from before Korean removal,
silently affecting every new user, not just the seed account.
- Three independently-drifting install paths existed (public distribution
installer, private-repo SSH-ship installer, and a fully manual README/docs
flow). README/docs now lead with the public alleyviper/argus installer
(verified to actually exist and mirror distribution/); the manual path is
kept only as an explicit private/pre-release fallback.
- Both scripted installers auto-rotated admin/admin via the API as their
last step, silently warning (not failing) if it didn't work — inconsistent
with the manual path and capable of leaving defaults active undetected.
Removed; every install path now consistently lands on admin/admin + the
in-app wizard.
- ANIS_ADMIN_KEY was documented as required ("ARGUS fails closed without
it") but is never read anywhere in src/api — confirmed dead, not just
vestigial. Retired from env templates, compose files, and docs; ROADMAP's
existing "wire it up or retire it" item resolved for this variable.
- Proxy host creation returned an opaque 500 when given an unresolvable
forward_host (e.g. a Docker container name typed into the free-text
field — ARGUS's nginx runs in host-network mode with no embedded DNS).
nginx -t's real "host not found in upstream" failure now surfaces as an
actionable 400 instead of a generic internal error; placeholder text
fixed to stop inviting the failure. Live-verified both the failure path
(with NGINX_SKIP_TEST temporarily disabled in the sandbox to exercise the
real validation) and the no-regression path (valid IP still succeeds).
- LOG_COLLECTION silently disables the entire access-log/analytics/live-event
pipeline when set to anything but the exact string "true", with zero log
output anywhere. Added a boot-time WARN matching the existing
IsInitialSetupRequired nudge pattern.
Every fix live-verified against a genuinely fresh sandbox install
(docker/docker-compose.local-sandbox.yml, zero pre-existing volumes),
not just read from source.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.
install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.
update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).
Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.
Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).
