# ARGUS Enterprise Web Security Platform ### A real-time security operations platform for the modern web edge [![License](https://img.shields.io/badge/License-Commercial-lightgrey?style=for-the-badge)](LICENSE) [![Platform](https://img.shields.io/badge/Platform-Docker-2496ED?style=for-the-badge&logo=docker&logoColor=white)]() [![Nginx](https://img.shields.io/badge/Nginx-1.30-009639?style=for-the-badge&logo=nginx&logoColor=white)](https://nginx.org/) [![ModSecurity](https://img.shields.io/badge/ModSecurity-v3-red?style=for-the-badge)](https://modsecurity.org/) [![OWASP CRS](https://img.shields.io/badge/OWASP_CRS-v4.26-orange?style=for-the-badge)](https://coreruleset.org/) [![HTTP/3](https://img.shields.io/badge/HTTP/3-QUIC-blue?style=for-the-badge)]()

ARGUS combines a reverse proxy, Web Application Firewall, bot and AI-crawler defense, DNS security engine, threat intelligence integration, GeoIP and cloud-provider access control, automated SSL, rate limiting and auto-ban, real-time attack visualization, incident investigation, load balancing, TCP/UDP stream proxying, enterprise user management, and a full REST API — one complete web security appliance for protecting modern applications.

✨ Features • 🚀 Installation • 🛠 Operations • 📄 Licensing & Support

---
> **This is the public ARGUS installer repository.** It contains no proprietary source > code — only installation scripts, configuration templates, and public documentation. > Application source is developed privately by Weboria and distributed exclusively as > published container images. You do not need, and will not be given, access to the source > to install, run, or operate ARGUS. > > **Known gap, not yet built:** production images are currently distributed from GitHub > Container Registry while Weboria's own private registry (`registry.weboria.eu`) is > provisioned. License-key validation during install is not yet implemented — that needs a > licensing service design before `install.sh` can enforce it. Both are tracked, not silently > assumed to already work. ## ✨ Key Features ### 🛡️ Web Application Firewall ModSecurity v3 with the OWASP Core Rule Set. Paranoia levels 1–4, per-host rule exceptions, detection-only or blocking modes. ### 🌐 Attack Origin Visualization A live global map of inbound attacks — real-time arcs from source to your infrastructure, severity-coded, with instant drill-down into any event's full detail. ### 🔎 Incident Investigation Pivot from any IP, log line, or dashboard event straight into that entity's complete history — affected hosts, triggered rules, geography, and live threat-intelligence reputation — without losing your place. ### 🤖 Bot & AI-Crawler Defense Blocks known-bad bots and AI scrapers automatically, with a search-engine allowlist so legitimate crawlers are never affected. Escalating challenge modes (browser check, proof-of-work, visual CAPTCHA) for suspicious traffic. ### 🧬 DNS Security Engine An embedded forwarding DNS resolver with real-time threat detection — DGA domains, DNS tunneling, fast-flux infrastructure, cache-poisoning attempts — and automatic mitigation via sinkholing. ### 🌍 GeoIP & Cloud-Provider Access Control Allow or block traffic by country or hosting provider, with live visual feedback. ### 🔒 Automated SSL Let's Encrypt with automatic renewal, including wildcard certificates via DNS-01 challenge (Cloudflare, DuckDNS, Dynu, and more). ### ⚡ Rate Limiting & Auto-Ban Configurable per-IP/per-URI rate limits, automatic banning on repeated WAF violations, and optional community threat-intelligence-driven blocking via ANIS (enabled by default, no license key required for the free Community tier). ### 👥 Full User Management Role-based access, per-user session control, forced password resets, account lock/unlock, MFA, and a complete login history — everything a security team needs to administer access safely. ### 📊 Real-Time Operations Dashboard Live traffic, security events, and system health, updated continuously — no manual refresh. ### 🔀 Load Balancing & Stream Proxying Multiple backend servers with health checks, plus TCP/UDP stream proxying with optional SNI routing. ### 🔮 Modern Protocol Support HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange). --- ## 🚀 Installation ### Requirements - A Linux host with Docker Engine 24.0+ and the Docker Compose plugin (`docker compose`) - 2 vCPU / 4 GB RAM minimum for evaluation; see production sizing guidance in `docs/` for real traffic volumes - Ports 80/443 available for the reverse proxy, and 81 for the admin panel (all configurable) ### One-line install ```bash curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/install.sh | bash ``` This downloads the deployment files, generates secure database/application secrets, creates the required Docker network, pulls the production images, starts ARGUS, and prints your admin login at the end. Installs to `/opt/argus` by default — set `ARGUS_INSTALL_DIR` first to change that. ### Manual install If you'd rather see every step: ```bash mkdir -p /opt/argus/docker-socket-proxy && cd /opt/argus curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-compose.yml -o docker-compose.yml curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/.env.example -o .env curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-socket-proxy/haproxy.cfg.template -o docker-socket-proxy/haproxy.cfg.template # Generate a secure database password sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$(openssl rand -base64 24)/" .env # ARGUS expects this network to already exist docker network create argus-network docker compose pull docker compose up -d ``` Then log in at `https://:81` with `admin` / `admin` and change the password immediately — the one-line installer does this rotation for you automatically. **Do not expose the admin panel (port 81) to the internet.** Keep it on your LAN/VPN, or put it behind its own proxy host with access lists and 2FA enabled. ### Next steps after install 1. Open the administration panel at the access URL printed at the end of install. 2. Complete the first-run setup wizard — regional settings and a guided review of every protection module. 3. Confirm your administrator password was rotated (the installer does this automatically). 4. Configure domains and reverse proxy hosts under **Proxy Hosts**. 5. Review the ANIS threat intelligence connection under **Threat Intel** — on by default against the public Community Edition hub. 6. Review security policies in the **Security Policy Center**. --- ## 🛠 Operations All lifecycle management is Docker-based — five scripts cover day-to-day operation, downloaded once alongside `docker-compose.yml` (the one-line installer already does this for you), then run from `/opt/argus` (or wherever you installed): | Script | Purpose | |--------|---------| | `./update.sh` | Pull the latest images and restart, with a before/after version check | | `./healthcheck.sh` | Report the status of every component and the admin panel | | `./backup.sh [dir]` | Back up the database and application data into one archive | | `./restore.sh ` | Restore a backup onto a fresh installation | | `./uninstall.sh [--remove-data]` | Stop ARGUS; data is kept unless you explicitly opt in to removing it | You never manually download application files or modify containers directly — every update is delivered as a new published image version. ### Upgrading ```bash cd /opt/argus docker compose pull docker compose up -d ``` (`./update.sh` wraps the same two commands with a before/after version check.) This is the only supported upgrade path; there is no separate migration step to run. ### Backups ```bash cd /opt/argus ./backup.sh # writes argus-backup-.tar.gz to the current directory ./restore.sh # onto a fresh installation only — see the script's own header ``` ### Resetting the admin password ```bash docker compose exec api ./server reset-password ``` Add `--username ` to target a specific account, or `--password '...'` to set a known value instead of generating one. See `docker compose exec api ./server reset-password --help` for the rest of the options (clearing 2FA, etc.). ### Threat intelligence integration ARGUS connects to **ANIS**, Weboria's threat-intelligence hub, to share confirmed attacker IPs and receive a community blocklist in return. Enabled by default against the public Community Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in `.env.example` for the full set of options. --- ## 📚 API ARGUS exposes a full REST API for automation. Authenticate with a JWT (`POST /api/v1/auth/login`) for interactive use, or an API token (`Authorization: Bearer ng_`, created from the admin panel) for CI/CD and scripted access. Interactive API documentation is served at `https://:81/api/docs` once ARGUS is running. --- ## ⚙️ Environment Variables | Variable | Description | Default | |----------|-------------|---------| | `DB_PASSWORD` | Database password | *(generated by the installer)* | | `TZ` | Timezone | `UTC` | | `UI_PORT` | Admin panel port | `81` | | `NGINX_HTTP_PORT` / `NGINX_HTTPS_PORT` | Reverse-proxy listen ports | `80` / `443` | | `API_HOST_PORT` | Internal API port exposed to the host | `9080` | | `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` | | `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` | Full list with descriptions in `.env.example`. --- ## 📄 Licensing & Support ARGUS is commercial software licensed by Weboria — see [LICENSE](LICENSE). Third-party open-source components retain their own licenses — see [THIRD_PARTY_LICENSES](THIRD_PARTY_LICENSES) and [NOTICE](NOTICE). For licensing questions or support, contact the **Weboria Support Portal**. ---
© 2025-2026 Weboria. ARGUS Enterprise Web Security Platform.