tech
27be26f5f2
Found live during a real install dry-run: fetching .env.example via the Gitea raw URL returned a 403 with an ARGUS-branded WAF block page -- Weboria's own front-line WAF blocks any request path matching .env* as a standard credential-harvesting-probe rule, and it caught this legitimate static file served from Gitea too. Confirmed docker-compose.yml and other non-.env-named files fetch fine; only the .env.example path was affected. Renamed to env.example (no leading dot) rather than requesting a WAF exception -- sidesteps the false positive without depending on infrastructure access this session doesn't have. Still saved locally as .env either way; only the remote filename changed.
66 lines
2.2 KiB
Plaintext
66 lines
2.2 KiB
Plaintext
# ARGUS — Environment Configuration
|
|
# Copy this file to .env and modify as needed. install.sh does this for you
|
|
# automatically, including generating a secure DB_PASSWORD.
|
|
|
|
# ===========================================
|
|
# Required Settings
|
|
# ===========================================
|
|
|
|
# Database password — install.sh generates this for you.
|
|
# Manual value: openssl rand -base64 24
|
|
DB_PASSWORD=change-me-in-production
|
|
|
|
# ===========================================
|
|
# Optional Settings
|
|
# ===========================================
|
|
|
|
TZ=UTC
|
|
DB_USER=postgres
|
|
DB_NAME=argus
|
|
|
|
# ===========================================
|
|
# ANIS — Threat Intelligence Integration
|
|
# ===========================================
|
|
# ANIS is a separate product, deployed independently (self-hosted or via a
|
|
# community instance). These vars configure how THIS ARGUS instance talks to
|
|
# an already-running ANIS service — they do not start one.
|
|
#
|
|
# Set ANIS_ENABLED=true and ANIS_URL to turn on reporting WAF auto-bans to
|
|
# ANIS and pulling its community threat-intelligence feed.
|
|
|
|
ANIS_ENABLED=false
|
|
# ANIS_URL=https://anis.example.com:8090
|
|
ANIS_LICENSE_KEY=
|
|
# Must match the ANIS instance's own ANIS_ADMIN_KEY. Generate: openssl rand -hex 32
|
|
ANIS_ADMIN_KEY=
|
|
ANIS_SHARE_ATTACKERS=false
|
|
|
|
# ===========================================
|
|
# Docker Compatibility (Synology DSM, etc.)
|
|
# ===========================================
|
|
|
|
# Leave empty for auto-detection. Only set if auto-detection fails.
|
|
# Synology DSM typically needs: 1.41 or 1.43
|
|
# DOCKER_API_VERSION=1.41
|
|
|
|
# ===========================================
|
|
# Network & Port Settings
|
|
# ===========================================
|
|
|
|
# Admin panel port (default: 81)
|
|
# UI_PORT=81
|
|
|
|
# Nginx listen ports — change if 80/443 are already in use
|
|
# (e.g. Synology Web Station)
|
|
# NGINX_HTTP_PORT=8080
|
|
# NGINX_HTTPS_PORT=8443
|
|
|
|
# API host port — exposed for nginx-to-API communication.
|
|
# MUST NOT conflict with NGINX_HTTP_PORT.
|
|
# API_HOST_PORT=9080
|
|
|
|
# DNS Security Engine listen address — host-only (127.0.0.1) by default.
|
|
# Set to an internal interface IP to route real client DNS traffic through
|
|
# it. Never 0.0.0.0 unless this host is on a fully trusted network.
|
|
# DNS_LISTEN_HOST=127.0.0.1
|