Root cause of a real production failure on the first live install
(wap-proxy, 2026-07-25): DB_PASSWORD was generated with
`openssl rand -base64 24`, which can produce '/', '+', or '=' --
docker-compose.yml then naively interpolated the raw password into
postgres://postgres:${DB_PASSWORD}@db:5432/..., and a generated
password containing '/' broke the connection string outright. The API
never became healthy; log ingestion failed completely.
- install.sh now generates with `openssl rand -hex 32` (always
[0-9a-f], can't produce this class of character). Same fix applied
everywhere else openssl-rand-base64-24 was referenced.
- docker-compose.yml no longer builds DATABASE_URL by string
interpolation -- DB_PASSWORD is passed as its own var and the API
assembles the connection string safely internally using
net/url.UserPassword (proper percent-encoding), a second,
independent layer so the installer doesn't rely on the password
generator alone. See the matching argus-appliance commit for the
Go-side change and its regression test.
- backup.sh/healthcheck.sh/restore.sh/uninstall.sh still defaulted
ARGUS_INSTALL_DIR to $HOME/argus, inconsistent with install.sh/
update.sh's own /opt/argus default (changed in an earlier commit
this session) -- confirmed live on the same install: healthcheck.sh
and uninstall.sh reported "no installation found" when run from the
real, correct directory. All five scripts now agree on /opt/argus.
Corresponding argus-appliance fix (config.go's buildDatabaseURL, v3.73.1)
already built and pushed to git-cloud.weboria.eu/weboria/argus-api.
Three corrections, driven by explicit product decisions plus code
verification:
- There is no self-hosted-ANIS deployment model going forward. ANIS_URL
is now hardcoded to https://anis.weboria.eu in docker-compose.yml, not
a customer-configurable env var -- removed from env.example and the
README entirely.
- The ANIS license key is dashboard-only (Threat Intel -> ANIS
Connection, write-only there per the earlier security fix) -- never
set via .env. ANIS_LICENSE_KEY hardcoded to an empty string in
docker-compose.yml (community tier by default) rather than left as a
pass-through env var with no real path to ever being set.
- Removed ANIS_SHARE_ATTACKERS -- confirmed dead via grep, zero
references anywhere in the Go source. This was incorrectly kept as
"real" in the previous env.example cleanup pass; ROADMAP.md in the
appliance repo already documented this exact variable as dead.
ANIS_ENABLED remains the one real customer-facing ANIS toggle.
Full review of what belongs in the public installer vs. what customers
should never need to see, per an explicit audit request:
- Removed DB_USER/DB_NAME as customer-configurable env vars entirely --
nothing outside this compose stack ever connects to Postgres directly,
so there was no real reason a customer would ever change these.
Hardcoded to postgres/argus in docker-compose.yml and the two scripts
that referenced them (backup.sh, restore.sh); DB_PASSWORD remains the
one real secret, still auto-generated by install.sh.
- Removed ANIS_ADMIN_KEY entirely -- confirmed dead in a prior session's
audit: it's ANIS's own admin-dashboard credential, unrelated to the
ARGUS<->ANIS intelligence protocol, which ARGUS never sends. Carried
over into this file by copy-paste from ANIS's own env template, not
because ARGUS ever uses it.
- Reordered/re-commented env.example around what a customer actually
might touch (timezone, ANIS bootstrap trio, network ports for
conflict resolution, DOCKER_API_VERSION for NAS platforms) versus
what's fully automated (DB_PASSWORD) -- with an explicit note that
ongoing product configuration (WAF, DNS, users, policies) happens in
the dashboard, not this file.
- ANIS_ENABLED/ANIS_URL defaults aligned with the Community Edition
auto-provisioning decision (true / https://anis.weboria.eu) --
previously still showed the pre-decision false/empty defaults since
this repo's initial population predated that change landing.
- Flagged CHANGELOG.md as stale (last entry v3.29.0, well behind the
current shipped version) with an honest note rather than silently
leaving a misleading "GitHub Releases page" pointer or backfilling
invented descriptions of past releases.
No file needed to move to the private repo -- everything here (install/
update/backup/restore/healthcheck/uninstall scripts, the compose
manifest, license/notice docs) is either required for the customer to
install and operate ARGUS or a legal-transparency requirement. None of
it is build logic, dev configuration, or reproducible source.
Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from
git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead
of ghcr.io. Built and pushed real production images from main (v3.73.0)
before switching — verified anonymous `docker pull` works for all three
with zero login required, matching the public installer's no-friction
promise. install.sh's registry comment updated to match; no more "gap."
Licensing: reworked per a full commercial-distribution review. Removed
MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod —
GeoIP is RIR-based, not MaxMind-based, and has been for a while).
Clarified TimescaleDB's licensing story (embedded component distributed
as part of the appliance, not a hosted DB service) rather than leaving it
under a vague "reviewed before bundling" note. Added missing real
dependencies grounded against the actual Dockerfiles (Alpine Linux,
PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox).
Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a
"Weboria Proprietary Components" section. Removed the "pending legal
review" section that was specifically about MaxMind/TimescaleDB, now
resolved by the above -- LICENSE's own placeholder-pending-final-terms
disclaimer stays, since drafting real commercial license text is separate
legal work, not something to paper over.
README: removed the internal "this repo contains no proprietary code"
meta-description (customers don't need to see project scaffolding notes)
and the "known gap" callout (both gaps closed above). Expanded the
feature list with a dedicated ANIS Threat Intelligence section and richer
detail on DNS Security, Bot/AI-crawler defense, and the Guided Security
Policy Center. Stronger positioning copy up top.
Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.
install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.
update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).
Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.
Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).
tech
