ARGUS Enterprise Web Security Platform

A real-time security operations platform for the modern web edge

ARGUS combines a reverse proxy, Web Application Firewall, bot and AI-crawler defense, DNS security engine, threat intelligence integration, GeoIP and cloud-provider access control, automated SSL, rate limiting and auto-ban, real-time attack visualization, incident investigation, load balancing, TCP/UDP stream proxying, enterprise user management, and a full REST API — one complete web security appliance for protecting modern applications.

✨ Features • 🚀 Installation • 🛠 Operations • 📄 Licensing & Support

---

This is the public ARGUS installer repository. It contains no proprietary source code — only installation scripts, configuration templates, and public documentation. Application source is developed privately by Weboria and distributed exclusively as published container images. You do not need, and will not be given, access to the source to install, run, or operate ARGUS.

Known gap, not yet built: production images are currently distributed from GitHub Container Registry while Weboria's own private registry (registry.weboria.eu) is provisioned. License-key validation during install is not yet implemented — that needs a licensing service design before install.sh can enforce it. Both are tracked, not silently assumed to already work.

✨ Key Features

🛡️ Web Application Firewall

ModSecurity v3 with the OWASP Core Rule Set. Paranoia levels 1–4, per-host rule exceptions, detection-only or blocking modes.

🌐 Attack Origin Visualization

A live global map of inbound attacks — real-time arcs from source to your infrastructure, severity-coded, with instant drill-down into any event's full detail.

🔎 Incident Investigation

Pivot from any IP, log line, or dashboard event straight into that entity's complete history — affected hosts, triggered rules, geography, and live threat-intelligence reputation — without losing your place.

🤖 Bot & AI-Crawler Defense

Blocks known-bad bots and AI scrapers automatically, with a search-engine allowlist so legitimate crawlers are never affected. Escalating challenge modes (browser check, proof-of-work, visual CAPTCHA) for suspicious traffic.

🧬 DNS Security Engine

An embedded forwarding DNS resolver with real-time threat detection — DGA domains, DNS tunneling, fast-flux infrastructure, cache-poisoning attempts — and automatic mitigation via sinkholing.

🌍 GeoIP & Cloud-Provider Access Control

Allow or block traffic by country or hosting provider, with live visual feedback.

🔒 Automated SSL

Let's Encrypt with automatic renewal, including wildcard certificates via DNS-01 challenge (Cloudflare, DuckDNS, Dynu, and more).

⚡ Rate Limiting & Auto-Ban

Configurable per-IP/per-URI rate limits, automatic banning on repeated WAF violations, and optional community threat-intelligence-driven blocking via ANIS (enabled by default, no license key required for the free Community tier).

👥 Full User Management

Role-based access, per-user session control, forced password resets, account lock/unlock, MFA, and a complete login history — everything a security team needs to administer access safely.

📊 Real-Time Operations Dashboard

Live traffic, security events, and system health, updated continuously — no manual refresh.

🔀 Load Balancing & Stream Proxying

Multiple backend servers with health checks, plus TCP/UDP stream proxying with optional SNI routing.

🔮 Modern Protocol Support

HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange).

---

🚀 Installation

Requirements

• A Linux host with Docker Engine 24.0+ and the Docker Compose plugin (docker compose)
• 2 vCPU / 4 GB RAM minimum for evaluation; see production sizing guidance in docs/ for real traffic volumes
• Ports 80/443 available for the reverse proxy, and 81 for the admin panel (all configurable)

One-line install

curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/install.sh | bash

This downloads the deployment files, generates secure database/application secrets, creates the required Docker network, pulls the production images, starts ARGUS, and prints your admin login at the end. Installs to /opt/argus by default — set ARGUS_INSTALL_DIR first to change that.

Manual install

If you'd rather see every step:

mkdir -p /opt/argus/docker-socket-proxy && cd /opt/argus
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-compose.yml -o docker-compose.yml
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/.env.example -o .env
curl -fsSL https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main/docker-socket-proxy/haproxy.cfg.template -o docker-socket-proxy/haproxy.cfg.template

# Generate a secure database password
sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$(openssl rand -base64 24)/" .env

# ARGUS expects this network to already exist
docker network create argus-network

docker compose pull
docker compose up -d

Then log in at https://<your-server-address>:81 with admin / admin and change the password immediately — the one-line installer does this rotation for you automatically.

Do not expose the admin panel (port 81) to the internet. Keep it on your LAN/VPN, or put it behind its own proxy host with access lists and 2FA enabled.

Next steps after install

1. Open the administration panel at the access URL printed at the end of install.
2. Complete the first-run setup wizard — regional settings and a guided review of every protection module.
3. Confirm your administrator password was rotated (the installer does this automatically).
4. Configure domains and reverse proxy hosts under Proxy Hosts.
5. Review the ANIS threat intelligence connection under Threat Intel — on by default against the public Community Edition hub.
6. Review security policies in the Security Policy Center.

---

🛠 Operations

All lifecycle management is Docker-based — five scripts cover day-to-day operation, downloaded once alongside docker-compose.yml (the one-line installer already does this for you), then run from /opt/argus (or wherever you installed):

Script	Purpose
./update.sh	Pull the latest images and restart, with a before/after version check
./healthcheck.sh	Report the status of every component and the admin panel
./backup.sh [dir]	Back up the database and application data into one archive
./restore.sh <archive>	Restore a backup onto a fresh installation
./uninstall.sh [--remove-data]	Stop ARGUS; data is kept unless you explicitly opt in to removing it

You never manually download application files or modify containers directly — every update is delivered as a new published image version.

Upgrading

cd /opt/argus
docker compose pull
docker compose up -d

(./update.sh wraps the same two commands with a before/after version check.) This is the only supported upgrade path; there is no separate migration step to run.

Backups

cd /opt/argus
./backup.sh                 # writes argus-backup-<timestamp>.tar.gz to the current directory
./restore.sh <archive>      # onto a fresh installation only — see the script's own header

Resetting the admin password

docker compose exec api ./server reset-password

Add --username <name> to target a specific account, or --password '...' to set a known value instead of generating one. See docker compose exec api ./server reset-password --help for the rest of the options (clearing 2FA, etc.).

Threat intelligence integration

ARGUS connects to ANIS, Weboria's threat-intelligence hub, to share confirmed attacker IPs and receive a community blocklist in return. Enabled by default against the public Community Edition hub — no license key required. Point ANIS_URL at your own self-hosted ANIS instead if you run one, or set ANIS_ENABLED=false to turn this off entirely. See the comments in .env.example for the full set of options.

---

📚 API

ARGUS exposes a full REST API for automation. Authenticate with a JWT (POST /api/v1/auth/login) for interactive use, or an API token (Authorization: Bearer ng_<token>, created from the admin panel) for CI/CD and scripted access. Interactive API documentation is served at https://<your-server-address>:81/api/docs once ARGUS is running.

---

⚙️ Environment Variables

Variable	Description	Default
DB_PASSWORD	Database password	(generated by the installer)
TZ	Timezone	UTC
UI_PORT	Admin panel port	81
NGINX_HTTP_PORT / NGINX_HTTPS_PORT	Reverse-proxy listen ports	80 / 443
API_HOST_PORT	Internal API port exposed to the host	9080
DNS_LISTEN_HOST	DNS Security Engine bind address	127.0.0.1
ANIS_ENABLED / ANIS_URL	Threat-intel hub integration	true / https://anis.weboria.eu

Full list with descriptions in .env.example.

---

📄 Licensing & Support

ARGUS is commercial software licensed by Weboria — see LICENSE. Third-party open-source components retain their own licenses — see THIRD_PARTY_LICENSES and NOTICE.

For licensing questions or support, contact the Weboria Support Portal.

---

_{© 2025-2026 Weboria. ARGUS Enterprise Web Security Platform.}