tech
abab6775d6
Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead of ghcr.io. Built and pushed real production images from main (v3.73.0) before switching — verified anonymous `docker pull` works for all three with zero login required, matching the public installer's no-friction promise. install.sh's registry comment updated to match; no more "gap." Licensing: reworked per a full commercial-distribution review. Removed MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod — GeoIP is RIR-based, not MaxMind-based, and has been for a while). Clarified TimescaleDB's licensing story (embedded component distributed as part of the appliance, not a hosted DB service) rather than leaving it under a vague "reviewed before bundling" note. Added missing real dependencies grounded against the actual Dockerfiles (Alpine Linux, PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox). Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a "Weboria Proprietary Components" section. Removed the "pending legal review" section that was specifically about MaxMind/TimescaleDB, now resolved by the above -- LICENSE's own placeholder-pending-final-terms disclaimer stays, since drafting real commercial license text is separate legal work, not something to paper over. README: removed the internal "this repo contains no proprietary code" meta-description (customers don't need to see project scaffolding notes) and the "known gap" callout (both gaps closed above). Expanded the feature list with a dedicated ANIS Threat Intelligence section and richer detail on DNS Security, Bot/AI-crawler defense, and the Guided Security Policy Center. Stronger positioning copy up top.
5.3 KiB
Third-Party Licenses
ARGUS uses the following third-party software.
Core Components
TimescaleDB
- License: Timescale License (TSL) / Apache 2.0 depending on component
- Website: https://www.timescale.com/
ARGUS uses TimescaleDB as an embedded time-series storage component for security events, telemetry, and operational metrics.
TimescaleDB is distributed as part of the ARGUS Enterprise Appliance and is not offered as a standalone database service. Customers receive ARGUS as a complete security appliance; TimescaleDB remains subject to its original license terms.
PostgreSQL
- License: PostgreSQL License (permissive, BSD/MIT-style)
- Website: https://www.postgresql.org/
TimescaleDB is distributed as a PostgreSQL extension; PostgreSQL itself is the underlying database engine.
Nginx
- License: BSD-2-Clause
- Website: https://nginx.org/
- Copyright: (C) 2002-2024 Igor Sysoev, (C) 2011-2024 Nginx, Inc.
ModSecurity
- License: Apache License 2.0
- Website: https://github.com/owasp-modsecurity/ModSecurity
- Copyright: (C) 2002-2024 Trustwave Holdings, Inc.
OWASP Core Rule Set (CRS)
- License: Apache License 2.0
- Website: https://coreruleset.org/
- Copyright: (C) 2006-2024 Trustwave Holdings, Inc., OWASP Core Rule Set contributors
Valkey
- License: BSD-3-Clause
- Website: https://valkey.io/
Alpine Linux
- License: Various (base OS, mostly MIT/BSD-style per-package licenses)
- Website: https://alpinelinux.org/
Alpine Linux is the base image for the ARGUS API, UI build, and proxy container images.
BusyBox
- License: GPL-2.0
- Website: https://busybox.net/
Bundled as part of the Alpine Linux base images above.
Go Runtime
- License: BSD-3-Clause
- Website: https://go.dev/
The ARGUS API is built with Go; the compiled binary statically includes the Go runtime.
Node.js (build-time only)
- License: MIT (Node.js core) plus per-package licenses of the npm dependencies below
- Website: https://nodejs.org/
Used to build the ARGUS web UI; not present in the running API/proxy containers.
OpenSSL / TLS libraries
- License: Apache License 2.0 (OpenSSL 3.x) / various
- Website: https://www.openssl.org/
Used by the nginx proxy image for TLS termination.
curl
- License: MIT/X derivate (curl license)
- Website: https://curl.se/
Used in container healthchecks and installer scripts.
Backend (Go) Dependencies
| Package | License | Website |
|---|---|---|
| github.com/labstack/echo/v4 | MIT | https://echo.labstack.com/ |
| github.com/go-acme/lego/v4 | MIT | https://go-acme.github.io/lego/ |
| github.com/lib/pq | MIT | https://github.com/lib/pq |
| github.com/google/uuid | BSD-3-Clause | https://github.com/google/uuid |
| github.com/redis/go-redis/v9 | BSD-2-Clause | https://github.com/redis/go-redis |
| github.com/cloudflare/cloudflare-go | BSD-3-Clause | https://github.com/cloudflare/cloudflare-go |
| golang.org/x/crypto | BSD-3-Clause | https://golang.org/x/crypto |
Frontend (React) Dependencies
| Package | License | Website |
|---|---|---|
| React | MIT | https://react.dev/ |
| @tanstack/react-query | MIT | https://tanstack.com/query |
| react-router-dom | MIT | https://reactrouter.com/ |
| recharts | MIT | https://recharts.org/ |
| i18next | MIT | https://www.i18next.com/ |
| Tailwind CSS | MIT | https://tailwindcss.com/ |
| Vite | MIT | https://vitejs.dev/ |
Nginx Modules
| Module | License | Website |
|---|---|---|
| ModSecurity-nginx | Apache 2.0 | https://github.com/owasp-modsecurity/ModSecurity-nginx |
| ngx_brotli | BSD-2-Clause | https://github.com/google/ngx_brotli |
| headers-more-nginx-module | BSD-2-Clause | https://github.com/openresty/headers-more-nginx-module |
| ngx_http_geoip2_module | BSD-2-Clause | https://github.com/leev/ngx_http_geoip2_module |
Apache License 2.0 Notice
The following components are licensed under the Apache License 2.0:
- ModSecurity (Copyright 2002-2024 Trustwave Holdings, Inc.)
- OWASP Core Rule Set (Copyright 2006-2024 Trustwave Holdings, Inc.)
- ModSecurity-nginx (Copyright 2015-2024 Trustwave Holdings, Inc.)
Licensed under the Apache License, Version 2.0 (the "License"); you may not use these files except in compliance with the License. You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Third-party components have been reviewed for inclusion in ARGUS Enterprise deployments. Each component remains subject to its original license terms.
Weboria Proprietary Components
The following ARGUS components are proprietary software developed by Weboria:
- ARGUS Core Platform
- ARGUS Management Interface
- ARGUS Security Automation Engine
- ARGUS API Layer
- ARGUS Threat Analysis Components
- ARGUS Licensing System
- ARGUS Enterprise Features
- Weboria Integrations
These components are distributed under the ARGUS Commercial License.
Unauthorized copying, modification, redistribution, reverse engineering, or resale is prohibited.