Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 alleyviperandroot
|
5bdfd99c4d | ||
|
|
913615903b |
+8
-6
@@ -25,14 +25,16 @@ DB_NAME=argus
|
||||
# community instance). These vars configure how THIS ARGUS instance talks to
|
||||
# an already-running ANIS service — they do not start one.
|
||||
#
|
||||
# Set ANIS_ENABLED=true and ANIS_URL to turn on reporting WAF auto-bans to
|
||||
# ANIS and pulling its community threat-intelligence feed.
|
||||
# On by default against the public Community Edition hub — an empty license
|
||||
# key already grants the community (free) tier, no signup required. Point
|
||||
# ANIS_URL at your own self-hosted ANIS instead if you run one, or set
|
||||
# ANIS_ENABLED=false to turn this off entirely.
|
||||
|
||||
ANIS_ENABLED=false
|
||||
# ANIS_URL=https://anis.example.com:8090
|
||||
ANIS_ENABLED=true
|
||||
ANIS_URL=https://anis.weboria.eu
|
||||
# License key from ANIS dashboard -> Licenses -> Create License.
|
||||
# Leave blank to use the community (free) tier.
|
||||
ANIS_LICENSE_KEY=
|
||||
# Must match the ANIS instance's own ANIS_ADMIN_KEY. Generate: openssl rand -hex 32
|
||||
ANIS_ADMIN_KEY=
|
||||
ANIS_SHARE_ATTACKERS=false
|
||||
|
||||
# ===========================================
|
||||
|
||||
+7
-5
@@ -118,12 +118,13 @@ services:
|
||||
NGINX_HTTPS_PORT: ${NGINX_HTTPS_PORT:-}
|
||||
API_HOST_PORT: ${API_HOST_PORT:-9080}
|
||||
API_HOST: ${API_HOST:-}
|
||||
# ANIS community intelligence — optional, off by default. Set these to
|
||||
# connect this instance to an already-running ANIS hub.
|
||||
ANIS_ENABLED: ${ANIS_ENABLED:-false}
|
||||
ANIS_URL: ${ANIS_URL:-}
|
||||
# ANIS community intelligence — on by default against the public
|
||||
# Community Edition hub (empty license key = community tier, no signup
|
||||
# required). Set ANIS_URL to your own self-hosted ANIS instead if you
|
||||
# run one, or ANIS_ENABLED=false to turn this off entirely.
|
||||
ANIS_ENABLED: ${ANIS_ENABLED:-true}
|
||||
ANIS_URL: ${ANIS_URL:-https://anis.weboria.eu}
|
||||
ANIS_LICENSE_KEY: ${ANIS_LICENSE_KEY:-}
|
||||
ANIS_ADMIN_KEY: ${ANIS_ADMIN_KEY:-}
|
||||
ANIS_SHARE_ATTACKERS: ${ANIS_SHARE_ATTACKERS:-false}
|
||||
DNS_SECURITY_LISTEN_ADDR: ":53"
|
||||
ports:
|
||||
@@ -196,6 +197,7 @@ services:
|
||||
max-file: "5"
|
||||
environment:
|
||||
TZ: ${TZ:-UTC}
|
||||
UI_PORT: ${UI_PORT:-81}
|
||||
ulimits:
|
||||
nofile:
|
||||
soft: 65535
|
||||
|
||||
+9
-33
@@ -97,32 +97,13 @@ if [ "$READY" != "true" ]; then
|
||||
fi
|
||||
ok "ARGUS is up"
|
||||
|
||||
# ── 8. Rotate the default admin credentials ───────────────────────────────────
|
||||
ADMIN_USER="admin"
|
||||
ADMIN_PASSWORD="Ax9!$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 20)"
|
||||
API_BASE="http://127.0.0.1:${API_HOST_PORT}/api/v1"
|
||||
|
||||
LOGIN_RESP="$(curl -fsS -X POST "${API_BASE}/auth/login" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"username":"admin","password":"admin"}' 2>/dev/null || true)"
|
||||
TOKEN="$(printf '%s' "${LOGIN_RESP}" | grep -oP '"token"\s*:\s*"\K[^"]+' || true)"
|
||||
|
||||
CREDS_ROTATED=false
|
||||
if [ -n "$TOKEN" ]; then
|
||||
CHANGE_RESP="$(curl -fsS -o /dev/null -w '%{http_code}' -X POST "${API_BASE}/auth/change-credentials" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-d "{\"current_password\":\"admin\",\"new_username\":\"${ADMIN_USER}\",\"new_password\":\"${ADMIN_PASSWORD}\",\"new_password_confirm\":\"${ADMIN_PASSWORD}\"}" 2>/dev/null || echo "000")"
|
||||
if [ "$CHANGE_RESP" = "200" ]; then
|
||||
CREDS_ROTATED=true
|
||||
ok "Rotated the default admin password"
|
||||
fi
|
||||
fi
|
||||
if [ "$CREDS_ROTATED" != "true" ]; then
|
||||
warn "Could not auto-rotate admin credentials (already changed on a prior run?). Log in with your existing credentials, or admin/admin on a genuinely fresh install."
|
||||
fi
|
||||
|
||||
# ── 9. Summary ─────────────────────────────────────────────────────────────────
|
||||
# ── 8. Summary ─────────────────────────────────────────────────────────────────
|
||||
# Credentials are no longer auto-rotated here — a fresh install always lands
|
||||
# on admin/admin, and ARGUS itself forces a mandatory First-Run Setup Wizard
|
||||
# on that first login (credential change, regional settings, guided feature
|
||||
# configuration, installation validation) before the dashboard is reachable.
|
||||
# Pre-rotating here just made that flow inconsistent across install paths and
|
||||
# risked silently leaving defaults active if the rotation call failed.
|
||||
UI_PORT="$(grep -oP '^UI_PORT=\K.*' .env 2>/dev/null || true)"
|
||||
UI_PORT="${UI_PORT:-81}"
|
||||
|
||||
@@ -130,13 +111,8 @@ echo
|
||||
bold "ARGUS is installed and running."
|
||||
echo
|
||||
info "Admin Panel: https://localhost:${UI_PORT} (accept the self-signed certificate)"
|
||||
if [ "$CREDS_ROTATED" = "true" ]; then
|
||||
info "Username: ${ADMIN_USER}"
|
||||
info "Password: ${ADMIN_PASSWORD}"
|
||||
warn "Save this password now — it is not stored anywhere and cannot be recovered."
|
||||
else
|
||||
info "Log in with your existing admin credentials."
|
||||
fi
|
||||
info "Default Login: admin / admin"
|
||||
warn "You will be required to set a real username/password and complete the First-Run Setup Wizard on first login."
|
||||
echo
|
||||
info "Configuration: ${INSTALL_DIR}/.env and ${INSTALL_DIR}/docker-compose.yml"
|
||||
info "Upgrade: cd ${INSTALL_DIR} && docker compose pull && docker compose up -d"
|
||||
|
||||
Reference in New Issue
Block a user