fix(wireguard): sudo-route wgctl/wg (root needed for wg show dump) so webui lists interfaces+peers; fix(mochabin): clean netplan — WAN=eth2 DHCP metric100, drop stray lan3 IP (boot-wedge)

board/mochabin/netplan/00-secubox.yaml

@@ -1,46 +1,26 @@
-# /etc/netplan/00-secubox.yaml — MOCHAbin — Mode Router (défaut)
-# Généré par build-image.sh · Modifié par secubox-netmodes lors du changement de mode
-# Marvell Armada 7040 : mvpp2 (SFP+) + mvneta (GbE) + DSA (switch 88E6341)
+# SecuBox MOCHAbin base network (router mode).
+# WAN = eth2 (DHCP from upstream, e.g. Freebox), reliably the default route.
+# lan0-3 = DSA switch ports (optional so a link-down port never wedges boot).
+# br-lxc = LXC container bridge.
 network:
   version: 2
   renderer: networkd
-
   ethernets:
-    # WAN candidate (SFP+, eth0) — connecté à l'opérateur via fibre/module SFP.
-    eth0:
-      dhcp4: true
-      dhcp6: false
-      optional: true
-
-    # LAN — port GbE switch (DSA 88E6341)
     eth1:
       optional: true
-    # WAN candidate (RJ45 cuivre, eth2 = mvpp2-2). Sur MOCHAbin le seul RJ45
-    # direct ; sert d'uplink quand l'opérateur arrive en cuivre. Le port WAN
-    # câblé (eth0 SFP+ OU eth2 cuivre) obtient le bail DHCP ; l'autre reste idle.
     eth2:
       dhcp4: true
       dhcp6: false
       optional: true
-    eth3:
-      optional: true
-    eth4:
-      optional: true
-
-    # SFP+ 10GbE
-    eth5:
-      optional: true
-    eth6:
-      optional: true
-
+      dhcp4-overrides:
+        use-routes: true
+        route-metric: 100
+    lan0: {optional: true}
+    lan1: {optional: true}
+    lan2: {optional: true}
+    lan3: {optional: true}
   bridges:
-    # Bridge LAN
-    br-lan:
-      interfaces: [eth1, eth3, eth4]
-      addresses: [192.168.10.1/24]
-      dhcp4: false
-      parameters:
-        stp: false
-        forward-delay: 0
-
-  # DHCP server sur br-lan géré par dnsmasq (secubox-nac)
+    br-lxc:
+      interfaces: []
+      addresses: [10.100.0.1/24]
+      optional: true

packages/secubox-wireguard/api/main.py

@@ -154,7 +154,7 @@ def _parse_wg_show() -> Dict[str, Any]:
     result = {"interfaces": {}}
     try:
         proc = subprocess.run(
-            ["wg", "show", "all", "dump"],
+            ["sudo", "-n", "wg", "show", "all", "dump"],
             capture_output=True, text=True, timeout=5
         )
         if proc.returncode != 0:
@@ -329,7 +329,7 @@ async def shutdown_event():
 # === Helper: run wgctl ===
 async def _run_ctl(*args, timeout: int = 30) -> dict:
     """Run wgctl and return JSON output."""
-    cmd = ["/usr/sbin/wgctl"] + list(args)
+    cmd = ["sudo", "-n", "/usr/sbin/wgctl"] + list(args)
     try:
         proc = await asyncio.create_subprocess_exec(
             *cmd,
@@ -487,7 +487,7 @@ async def migrate(req: MigrateRequest, user=Depends(require_jwt)):
 def health():
     """Health check endpoint."""
     try:
-        result = subprocess.run(["wg", "show", "interfaces"], capture_output=True, timeout=2)
+        result = subprocess.run(["sudo", "-n", "wg", "show", "interfaces"], capture_output=True, timeout=2)
         interfaces = result.stdout.decode().strip().split() if result.returncode == 0 else []
         return {
             "status": "ok",

packages/secubox-wireguard/debian/postinst

@@ -10,6 +10,14 @@ case "$1" in
         mkdir -p /var/lib/secubox/wireguard/peers
         chown -R secubox:secubox /var/lib/secubox/wireguard
         
+        # Validate the sudoers drop-in (remove on invalid, never abort).
+        if [ -f /etc/sudoers.d/secubox-wireguard ]; then
+            visudo -cf /etc/sudoers.d/secubox-wireguard >/dev/null || {
+                echo "secubox-wireguard: invalid sudoers, removing" >&2
+                rm -f /etc/sudoers.d/secubox-wireguard
+            }
+        fi
+
         # Enable and start service
         systemctl daemon-reload
         systemctl enable secubox-wireguard.service

packages/secubox-wireguard/debian/rules

@@ -15,5 +15,7 @@ override_dh_auto_install:
 	# Install control scripts
 	install -d debian/secubox-wireguard/usr/sbin
 	[ -d sbin ] && install -m 755 sbin/* debian/secubox-wireguard/usr/sbin/ || true
+	install -d debian/secubox-wireguard/etc/sudoers.d
+	install -m 440 debian/secubox-wireguard.sudoers debian/secubox-wireguard/etc/sudoers.d/secubox-wireguard
 	# Create data directories
 	install -d debian/secubox-wireguard/var/lib/secubox/wireguard/peers

packages/secubox-wireguard/debian/secubox-wireguard.sudoers

@@ -0,0 +1,4 @@
+# The aggregator (user secubox) reads/controls WireGuard via wgctl, which needs
+# root for `wg show <iface>` (private-key access) + `wg set` peer/interface ops.
+secubox ALL=(root) NOPASSWD: /usr/sbin/wgctl
+secubox ALL=(root) NOPASSWD: /usr/bin/wg show *