tech
4dbb7613d9
Three corrections, driven by explicit product decisions plus code verification: - There is no self-hosted-ANIS deployment model going forward. ANIS_URL is now hardcoded to https://anis.weboria.eu in docker-compose.yml, not a customer-configurable env var -- removed from env.example and the README entirely. - The ANIS license key is dashboard-only (Threat Intel -> ANIS Connection, write-only there per the earlier security fix) -- never set via .env. ANIS_LICENSE_KEY hardcoded to an empty string in docker-compose.yml (community tier by default) rather than left as a pass-through env var with no real path to ever being set. - Removed ANIS_SHARE_ATTACKERS -- confirmed dead via grep, zero references anywhere in the Go source. This was incorrectly kept as "real" in the previous env.example cleanup pass; ROADMAP.md in the appliance repo already documented this exact variable as dead. ANIS_ENABLED remains the one real customer-facing ANIS toggle.
65 lines
2.7 KiB
Plaintext
65 lines
2.7 KiB
Plaintext
# ARGUS Enterprise Web Security Platform — Installation Configuration
|
|
#
|
|
# install.sh generates this file for you automatically, including a secure
|
|
# database password. Most installs need nothing beyond the defaults below.
|
|
#
|
|
# Everything else — WAF policy, DNS security, threat intelligence tuning,
|
|
# proxy hosts, users, security policies — is configured from the ARGUS
|
|
# dashboard after your first login, not from this file.
|
|
|
|
# ===========================================
|
|
# Database (do not edit)
|
|
# ===========================================
|
|
# install.sh replaces this with a securely generated value on first install
|
|
# and never touches it again. There's nothing to fill in here yourself.
|
|
DB_PASSWORD=change-me-in-production
|
|
|
|
# ===========================================
|
|
# Timezone
|
|
# ===========================================
|
|
# Should match the timezone you select in the dashboard's first-run setup
|
|
# wizard (Regional Settings) — the wizard checks for a mismatch and will
|
|
# warn you if this file and your dashboard selection disagree.
|
|
TZ=UTC
|
|
|
|
# ===========================================
|
|
# Threat Intelligence (ANIS)
|
|
# ===========================================
|
|
# ARGUS connects to ANIS, Weboria's threat-intelligence network, by default
|
|
# — no license key needed for the free Community tier. There is no
|
|
# self-hosted-ANIS deployment model, so there's no URL to configure here.
|
|
# A license key upgrades the tier, but is only ever set from
|
|
# Threat Intel -> ANIS Connection in the dashboard — never from this file.
|
|
ANIS_ENABLED=true
|
|
|
|
# ===========================================
|
|
# Network Ports
|
|
# ===========================================
|
|
# Only change these if the defaults conflict with something else already
|
|
# running on this host.
|
|
|
|
# Admin panel port (default: 81)
|
|
# UI_PORT=81
|
|
|
|
# Reverse-proxy listen ports — change if 80/443 are already in use
|
|
# NGINX_HTTP_PORT=8080
|
|
# NGINX_HTTPS_PORT=8443
|
|
|
|
# Internal port used for nginx<->API communication.
|
|
# MUST NOT conflict with NGINX_HTTP_PORT.
|
|
# API_HOST_PORT=9080
|
|
|
|
# DNS Security Engine listen address — host-only (127.0.0.1) by default.
|
|
# Set to an internal interface IP only if you intend to route real client
|
|
# DNS traffic through ARGUS. Never 0.0.0.0 unless this host is on a fully
|
|
# trusted network — an open forwarding resolver is exactly the profile
|
|
# abused for DNS amplification attacks against third parties.
|
|
# DNS_LISTEN_HOST=127.0.0.1
|
|
|
|
# ===========================================
|
|
# Advanced / Troubleshooting
|
|
# ===========================================
|
|
# Only needed on some NAS platforms (e.g. Synology DSM) where Docker's API
|
|
# version needs to be pinned manually. Leave commented out otherwise.
|
|
# DOCKER_API_VERSION=1.41
|