NuajLens · Deployment
NuajLens is a free, self-hosted vulnerability scanner for the assets you register. One package holds all of it — the web console, datastore, scheduler, report engine and the nuclei scan engine — so there is nothing to provision and nothing fetched while it installs. It runs as its own service account, keeps its state in one directory, and serves its console over HTTPS from the first start.
Requirements
| Operating system | Linux with systemd — Debian, Ubuntu, RHEL, Fedora, Rocky, Alma and openSUSE |
|---|---|
| Architectures | x86_64 and aarch64 |
| Packaging | deb and rpm, installed and upgraded by name through your own package manager |
| Memory | 2 GB |
| Database | None to provision — the datastore is part of the package |
| Web server | None to configure — the service serves its own console over HTTPS on port 8443. Your own certificate or a reverse proxy in front are both supported |
| Network at install | Nothing is fetched. An air-gapped host installs identically |
| Scan engine | The open-source nuclei engine, bundled in the package and read-only to the service |
| State | One directory, /opt/nuajlens |
| Service account | Created by the package. The systemd unit is hardened and does not run as root |
| Multi-customer | One install serves a book of clients — assets, schedules and reports are kept per customer |
| Price | Free of charge, commercial use included. No licence key, no seat count, no trial timer |
The package
No chain of downloads to trust at install time. Your own package manager installs one file, and that file is complete.
What it installs
One binary with the web console, datastore, scheduler and report engine, and a matching nuclei binary beside it, owned by dpkg or rpm.
What it configures
The service account, a hardened systemd unit and a self-signed TLS certificate, generated before the service starts, so the console is never served in plaintext during setup.
What it does not do
At install it reaches no network, adds no repository and runs no scan. The only port it opens is the console you are about to log into.
State
/opt/nuajlens/ ├── bin/ nuajlens + scan engine ├── nuajlens.conf configuration └── data/ db, scan logs, templates, cert
Copy that directory and you have copied the install: the asset inventory, schedules, scan history, your team’s triage decisions and the console’s certificate. Move it to another host with the same package and the console comes up where you left it.
Removing the package leaves the directory, so a reinstall finds your scan history again. Purging takes everything.
Air-gapped hosts
Scanners often live where downloads are not welcome: a management network, a segment behind a jump host, a site with no route out. Every part of NuajLens, the scan engine and its templates included, is inside the package. Such a host installs like any other, and the first scan can run before the machine has ever reached the internet.
What an isolated host gives up is updates arriving on their own. Templates change daily and the engine every few weeks; on a disconnected host both advance when the package does. engine-updates = off makes that explicit: it pins the install to the bundled binary and makes the API refuse version changes, so every executable the service can run stays read-only to it.
Engine updates
On a connected host the scan engine can update between package releases. Before a fetched build becomes the active engine, it must:
Only then does the active pointer move, by atomic rename — a scan starting mid-swap sees one version or the other, never a broken link. Any failure discards the download and leaves the running engine untouched. The bundled engine is never pruned and the service cannot write to it, so a rollback target exists even on a host offline since install. Version changes are refused while a scan is in flight, and every scan records the engine that produced it.
Access
No licence key, no seat count, no trial timer. Builds come from download.nuaj.com, opened to each organisation on request.
The End User Licence Agreement is the whole agreement. NuajLens is supplied free of charge and without warranty, and you must hold authorisation to test every asset you register.
One email with your organisation, distribution and architecture. Access is usually granted the same business day.
The reply carries the repository setup: one keyring and one source line, added once per host. Then apt install nuajlens or dnf install nuajlens, and your package manager verifies every install and upgrade against that key.
Questions