Companion to argus-appliance issue #88. update.sh no longer trusts the
version manifest alone -- before pulling or restarting any service, it
independently resolves each image's live registry digest and verifies it
matches what the release pipeline recorded, then cosign-verifies the
signature against the committed public key. Aborts (installation
untouched) on any mismatch, missing tool, or ambiguity.
:latest is three independently-mutable registry tags with no cross-image
transaction -- update.sh pulling it directly could observe a torn set
mid-promotion (api already retagged, ui/proxy not yet). latest-version.json
is a single, atomically-committed pointer that argus-appliance's release
pipeline only ever writes AFTER every image it names has finished
promoting, so resolving it first cannot observe a partial release: by the
time it names a version, that version is already guaranteed complete.
docker-compose.yml: image tags now ${ARGUS_VERSION:-latest} -- default
unchanged for manual/non-update.sh use (plain `docker compose pull` with
no env var set behaves exactly as before).
update.sh: resolves latest-version.json first (fails loud and untouched if
unreachable/malformed, never falls back to :latest), exports ARGUS_VERSION
for its own docker compose calls only (not written to .env), and -- new --
verifies every service's actual running image tag matches the target
version before declaring success, not just that the API container itself
reports healthy. A torn pull (network hiccup, disk full on one image) is
now a loud failure instead of a silently-reported success.
README rewritten with the "ARGUS Enterprise Web Security Platform" positioning
and full feature list. install.sh/update.sh now fetch deployment files from
this Gitea repo (git-cloud.weboria.eu) instead of raw.githubusercontent.com,
default install directory changed to /opt/argus, next-steps messaging aligned
with the full onboarding journey (first-run wizard, proxy hosts, ANIS, policy
center). Support link changed from GitHub Issues to the Weboria Support
Portal.
Deliberately NOT changed: docker-compose.yml's image: lines still pull from
ghcr.io — Weboria's own private registry (registry.weboria.eu) resolves in
DNS but has no registry service listening yet (confirmed via direct check),
so switching now would break every real install. Both README and install.sh
document this as a known, tracked gap rather than silently pointing at
infrastructure that doesn't work. Same treatment for license-key validation
during install — not implemented, since there's no licensing service to
validate against yet.
Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.
install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.
update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).
Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.
Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).
root
tech