tech
db132c9f92
Full review of what belongs in the public installer vs. what customers should never need to see, per an explicit audit request: - Removed DB_USER/DB_NAME as customer-configurable env vars entirely -- nothing outside this compose stack ever connects to Postgres directly, so there was no real reason a customer would ever change these. Hardcoded to postgres/argus in docker-compose.yml and the two scripts that referenced them (backup.sh, restore.sh); DB_PASSWORD remains the one real secret, still auto-generated by install.sh. - Removed ANIS_ADMIN_KEY entirely -- confirmed dead in a prior session's audit: it's ANIS's own admin-dashboard credential, unrelated to the ARGUS<->ANIS intelligence protocol, which ARGUS never sends. Carried over into this file by copy-paste from ANIS's own env template, not because ARGUS ever uses it. - Reordered/re-commented env.example around what a customer actually might touch (timezone, ANIS bootstrap trio, network ports for conflict resolution, DOCKER_API_VERSION for NAS platforms) versus what's fully automated (DB_PASSWORD) -- with an explicit note that ongoing product configuration (WAF, DNS, users, policies) happens in the dashboard, not this file. - ANIS_ENABLED/ANIS_URL defaults aligned with the Community Edition auto-provisioning decision (true / https://anis.weboria.eu) -- previously still showed the pre-decision false/empty defaults since this repo's initial population predated that change landing. - Flagged CHANGELOG.md as stale (last entry v3.29.0, well behind the current shipped version) with an honest note rather than silently leaving a misleading "GitHub Releases page" pointer or backfilling invented descriptions of past releases. No file needed to move to the private repo -- everything here (install/ update/backup/restore/healthcheck/uninstall scripts, the compose manifest, license/notice docs) is either required for the customer to install and operate ARGUS or a legal-transparency requirement. None of it is build logic, dev configuration, or reproducible source.
69 lines
2.7 KiB
Plaintext
69 lines
2.7 KiB
Plaintext
# ARGUS Enterprise Web Security Platform — Installation Configuration
|
|
#
|
|
# install.sh generates this file for you automatically, including a secure
|
|
# database password. Most installs need nothing beyond the defaults below.
|
|
#
|
|
# Everything else — WAF policy, DNS security, threat intelligence tuning,
|
|
# proxy hosts, users, security policies — is configured from the ARGUS
|
|
# dashboard after your first login, not from this file.
|
|
|
|
# ===========================================
|
|
# Database (do not edit)
|
|
# ===========================================
|
|
# install.sh replaces this with a securely generated value on first install
|
|
# and never touches it again. There's nothing to fill in here yourself.
|
|
DB_PASSWORD=change-me-in-production
|
|
|
|
# ===========================================
|
|
# Timezone
|
|
# ===========================================
|
|
# Should match the timezone you select in the dashboard's first-run setup
|
|
# wizard (Regional Settings) — the wizard checks for a mismatch and will
|
|
# warn you if this file and your dashboard selection disagree.
|
|
TZ=UTC
|
|
|
|
# ===========================================
|
|
# Threat Intelligence (ANIS)
|
|
# ===========================================
|
|
# ARGUS connects to ANIS, Weboria's threat-intelligence network, by default
|
|
# — no license key needed for the free Community tier. These three values
|
|
# only matter on first boot; manage the connection afterward from
|
|
# Threat Intel -> ANIS Connection in the dashboard.
|
|
ANIS_ENABLED=true
|
|
ANIS_URL=https://anis.weboria.eu
|
|
ANIS_LICENSE_KEY=
|
|
|
|
# Share this instance's confirmed attacker IPs back to the community feed?
|
|
ANIS_SHARE_ATTACKERS=false
|
|
|
|
# ===========================================
|
|
# Network Ports
|
|
# ===========================================
|
|
# Only change these if the defaults conflict with something else already
|
|
# running on this host.
|
|
|
|
# Admin panel port (default: 81)
|
|
# UI_PORT=81
|
|
|
|
# Reverse-proxy listen ports — change if 80/443 are already in use
|
|
# NGINX_HTTP_PORT=8080
|
|
# NGINX_HTTPS_PORT=8443
|
|
|
|
# Internal port used for nginx<->API communication.
|
|
# MUST NOT conflict with NGINX_HTTP_PORT.
|
|
# API_HOST_PORT=9080
|
|
|
|
# DNS Security Engine listen address — host-only (127.0.0.1) by default.
|
|
# Set to an internal interface IP only if you intend to route real client
|
|
# DNS traffic through ARGUS. Never 0.0.0.0 unless this host is on a fully
|
|
# trusted network — an open forwarding resolver is exactly the profile
|
|
# abused for DNS amplification attacks against third parties.
|
|
# DNS_LISTEN_HOST=127.0.0.1
|
|
|
|
# ===========================================
|
|
# Advanced / Troubleshooting
|
|
# ===========================================
|
|
# Only needed on some NAS platforms (e.g. Synology DSM) where Docker's API
|
|
# version needs to be pinned manually. Leave commented out otherwise.
|
|
# DOCKER_API_VERSION=1.41
|