gandalf/secubox-deb
0
1
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 15:28:24 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

docs: Add ARM installation guide (U-Boot flash) 

- New ARM-Installation.md with U-Boot flash procedure
- ESPRESSObin v7/Ultra and MOCHAbin support
- Updated sidebar with ARM link

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
CyberMind-FR 2026-04-05 10:09:23 +02:00
parent df80df5610
commit 4afc176c0e
8 changed files with 284 additions and 329 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

269
ARM-Installation.md Normal file

@ -0,0 +1,269 @@
# ARM Installation via U-Boot
[Francais](ARM-Installation-FR) | [中文](ARM-Installation-ZH)
This guide covers installing SecuBox on ARM boards (Marvell Armada) using U-Boot to flash the image to eMMC from USB or SD card.
## Supported Boards
| Board | SoC | RAM | Profile |
|-------|-----|-----|---------|
| ESPRESSObin v7 | Armada 3720 | 1-2 GB | secubox-lite |
| ESPRESSObin Ultra | Armada 3720 | 1-4 GB | secubox-lite |
| MOCHAbin | Armada 7040 | 4 GB | secubox-full |
## Prerequisites
- Serial console adapter (USB-TTL)
- USB drive or SD card with the image
- Serial terminal: `screen`, `minicom`, or PuTTY
### Serial Console Settings
```
Baud rate: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
```
```bash
# Linux
screen /dev/ttyUSB0 115200
# or
minicom -D /dev/ttyUSB0 -b 115200
```
## Prepare Boot Media
### Option A: USB Drive (Recommended)
Format a USB drive with a FAT32 or ext4 partition and copy the image:
```bash
# Download the image
wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-espressobin-v7-bookworm.img.gz
# Mount USB drive (assuming /dev/sdb1)
sudo mount /dev/sdb1 /mnt
# Copy image
sudo cp secubox-espressobin-v7-bookworm.img.gz /mnt/
# Unmount
sudo umount /mnt
```
### Option B: SecuBox Live USB
If using a SecuBox Live USB, copy the image to the persistence partition (partition 4):
```bash
# The persistence partition is already ext4
sudo mount /dev/sdX4 /mnt
sudo cp secubox-espressobin-v7-bookworm.img.gz /mnt/
sudo umount /mnt
```
## U-Boot Flash Procedure
### 1. Enter U-Boot
Connect serial console and power on the board. Press any key to stop autoboot:
```
Hit any key to stop autoboot: 0
=>
```
### 2. Initialize USB
```
=> usb reset
resetting USB...
USB XHCI 1.00
scanning bus usb@58000 for devices... 2 USB Device(s) found
scanning usb for storage devices... 1 Storage Device(s) found
```
### 3. Verify Storage
```
=> usb storage
Device 0: Vendor: Kingston Rev: Prod: DataTraveler 3.0
Type: Removable Hard Disk
Capacity: 29510.4 MB = 28.8 GB
```
### 4. List Files
For FAT32 partition (partition 1):
```
=> ls usb 0:1
314543223 secubox-espressobin-v7-bookworm.img.gz
```
For ext4 partition (partition 4 on Live USB):
```
=> ls usb 0:4
314543223 secubox-espressobin-v7-bookworm.img.gz
```
### 5. Flash to eMMC
```bash
# Set load address (needs ~350MB free RAM)
=> setenv loadaddr 0x1000000
# Load image from USB
# For FAT32 (partition 1):
=> load usb 0:1 $loadaddr secubox-espressobin-v7-bookworm.img.gz
# For ext4 (partition 4):
=> load usb 0:4 $loadaddr secubox-espressobin-v7-bookworm.img.gz
# Write to eMMC with automatic decompression
=> gzwrite mmc 1 $loadaddr $filesize
```
The `gzwrite` command decompresses and writes directly to eMMC. This takes 2-5 minutes depending on image size.
### 6. Configure Boot Order
```bash
# Set eMMC as primary boot device
=> setenv boot_targets "mmc1 mmc0 usb0"
=> saveenv
Saving Environment to SPI Flash... done
# Reboot
=> reset
```
## Alternative: Flash from SD Card
If the image is on SD card instead of USB:
```bash
=> mmc dev 0 # Select SD card
=> ls mmc 0:1 # List files
=> setenv loadaddr 0x1000000
=> load mmc 0:1 $loadaddr secubox-espressobin-v7-bookworm.img.gz
=> gzwrite mmc 1 $loadaddr $filesize # Write to eMMC
```
## Boot Device Reference
| Device | U-Boot | Description |
|--------|--------|-------------|
| SD Card | `mmc 0` | microSD slot |
| eMMC | `mmc 1` | Internal eMMC (install target) |
| USB | `usb 0` | USB storage |
| SATA | `scsi 0` | SATA drive (MOCHAbin) |
## Board-Specific Notes
### ESPRESSObin v7
- **eMMC**: Optional, may need to boot from SD if not present
- **RAM**: 1GB models have limited space, use `loadaddr 0x1000000`
- **Network**: eth0=WAN, lan0/lan1=LAN (DSA switch)
### ESPRESSObin Ultra
- **eMMC**: 8GB built-in
- **RAM**: Up to 4GB
- **Network**: Same as v7
### MOCHAbin
- **eMMC**: 8GB built-in
- **RAM**: 4GB (can hold larger images)
- **Network**: Multiple 10GbE + GbE ports
- **SATA**: Can also install to SATA drive
```bash
# MOCHAbin: Flash to SATA instead of eMMC
=> scsi scan
=> gzwrite scsi 0 $loadaddr $filesize
```
## Troubleshooting
### USB Not Detected
```bash
=> usb reset
=> usb tree # Show USB device tree
=> usb info # Detailed USB info
```
### eMMC Not Detected
```bash
=> mmc list # List MMC devices
=> mmc dev 1 # Select eMMC
=> mmc info # Show eMMC info
```
### Load Fails (File Not Found)
```bash
=> ls usb 0 # List all partitions
=> ls usb 0:1 # Try partition 1
=> ls usb 0:2 # Try partition 2
```
### Out of Memory
For 1GB boards, ensure no other data is loaded:
```bash
=> setenv loadaddr 0x1000000 # Use lower address
```
### Reset Environment
```bash
=> env default -a
=> saveenv
```
### Check Current Environment
```bash
=> print # Show all variables
=> print boot_targets # Show boot order
=> print loadaddr # Show load address
```
## Post-Installation
After flashing, the board boots SecuBox automatically.
### Default Credentials
| User | Password |
|------|----------|
| root | secubox |
| secubox | secubox |
### First Steps
1. Connect via SSH: `ssh root@<IP>`
2. Change passwords: `passwd`
3. Access Web UI: `https://<IP>:8443`
### Network Interfaces
| Board | WAN | LAN |
|-------|-----|-----|
| ESPRESSObin | eth0 | lan0, lan1 |
| MOCHAbin | eth0 | eth1-eth4, sfp0-sfp1 |
## See Also
- [[Installation]] - General installation guide
- [[Live-USB]] - Try without installing
- [[Modules]] - Available modules

10
Home-FR.md

@ -1,8 +1,8 @@
# SecuBox-DEB
**Appliance de Sécurité pour Debian** | [English](Home) | [中文](Home-ZH) | **v1.5.0**
**Appliance de Sécurité pour Debian** | [English](Home) | [中文](Home-ZH) | **v1.5.1**
SecuBox est une solution d'appliance de sécurité complète portée d'OpenWrt vers Debian bookworm, conçue pour les cartes ARM64 GlobalScale (MOCHAbin, ESPRESSObin) et les systèmes x86_64. Maintenant avec **93 paquets** et plus de **2000+ points d'API**.
SecuBox est une solution d'appliance de sécurité complète portée d'OpenWrt vers Debian bookworm, conçue pour les cartes ARM64 GlobalScale (MOCHAbin, ESPRESSObin) et les systèmes x86_64. Maintenant avec **124 paquets** et plus de **2000+ points d'API**.
---
@ -14,7 +14,7 @@ Testez SecuBox instantanément dans VirtualBox - aucune clé USB requise :
```bash
# Télécharger l'image
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
gunzip secubox-live-amd64-bookworm.img.gz
# Convertir au format VDI
@ -50,7 +50,7 @@ Démarrez directement depuis USB sur du matériel physique :
```bash
# Télécharger
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
# Flasher sur clé USB (remplacer /dev/sdX)
zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
@ -118,7 +118,7 @@ Options:
| **Outils Système** | Glances, MQTT, TURN, Vault, Cloner, VM | 22 |
| **Email & DNS** | Postfix/Dovecot, Webmail, DNS Provider | 9 |
**Total : 93 paquets**
**Total : 124 paquets**
---

6
Home-ZH.md

@ -1,6 +1,6 @@
# SecuBox-DEB
**Debian 安全设备** | [English](Home) | [Français](Home-FR) | **v1.5.0**
**Debian 安全设备** | [English](Home) | [Français](Home-FR) | **v1.5.1**
SecuBox 是一个完整的安全设备解决方案，从 OpenWrt 移植到 Debian bookworm，专为 GlobalScale ARM64 开发板（MOCHAbin、ESPRESSObin）和 x86_64 系统设计。现在包含 **93 个软件包**和 **2000+ 个 API 端点**。
@ -14,7 +14,7 @@ SecuBox 是一个完整的安全设备解决方案，从 OpenWrt 移植到 Debia
```bash
# 下载镜像
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
gunzip secubox-live-amd64-bookworm.img.gz
# 转换为 VDI 格式
@ -50,7 +50,7 @@ curl -sL https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/scrip
```bash
# 下载
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
# 写入 USB 驱动器（将 /dev/sdX 替换为您的设备）
zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress

10
Home.md

@ -1,8 +1,8 @@
# SecuBox-DEB
**Security Appliance for Debian** | [Français](Home-FR) | [中文](Home-ZH) | **v1.5.0**
**Security Appliance for Debian** | [Français](Home-FR) | [中文](Home-ZH) | **v1.5.1**
SecuBox is a complete security appliance solution ported from OpenWrt to Debian bookworm, designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems. Now featuring **93 packages** with **2000+ API endpoints**.
SecuBox is a complete security appliance solution ported from OpenWrt to Debian bookworm, designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems. Now featuring **124 packages** with **2000+ API endpoints**.
---
@ -14,7 +14,7 @@ Test SecuBox instantly in VirtualBox - no USB drive needed:
```bash
# Download image
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
gunzip secubox-live-amd64-bookworm.img.gz
# Convert to VDI format
@ -50,7 +50,7 @@ Boot directly from USB on physical hardware:
```bash
# Download
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.0/secubox-live-amd64-bookworm.img.gz
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v1.5.1/secubox-live-amd64-bookworm.img.gz
# Flash to USB drive (replace /dev/sdX)
zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
@ -118,7 +118,7 @@ Options:
| **System Tools** | Glances, MQTT, TURN, Vault, Cloner, VM | 22 |
| **Email & DNS** | Postfix/Dovecot, Webmail, DNS Provider | 9 |
**Total: 93 packages**
**Total: 124 packages**
---

190
UI-COMPARISON.md

@ -1,190 +0,0 @@
# SecuBox UI Comparison: OpenWRT vs Debian
*Side-by-side comparison of the two SecuBox implementations*
## Overview
| Aspect | OpenWRT | Debian |
|--------|---------|--------|
| **Repository** | [secubox-openwrt](https://github.com/gkerma/secubox-openwrt) | [secubox-deb](https://github.com/CyberMind-FR/secubox-deb) |
| **Base OS** | OpenWRT 23.05+ | Debian Bookworm |
| **Architecture** | mipsel, arm | arm64, amd64 |
| **Target Hardware** | Routers, embedded | GlobalScale boards, VMs |
| **Module Count** | 17 | 47 |
| **Theme** | LuCI Dark | CRT P31 Phosphor |
## Visual Comparison
### Theme
| OpenWRT LuCI | Debian CRT P31 |
|--------------|----------------|
| Dark blue/gray | Phosphor green |
| Sans-serif fonts | Monospace (Courier) |
| Flat design | Glow effects |
| Standard buttons | Terminal aesthetic |
### Dashboard
| OpenWRT | Debian |
|---------|--------|
| System overview widget | Real-time metrics |
| Network status | Service status grid |
| Package info | Module health |
| Basic graphs | Animated charts |
### Navigation
| OpenWRT | Debian |
|---------|--------|
| Top menu bar | Collapsible sidebar |
| Dropdown submenus | Icon + text links |
| Category tabs | Category groups |
| Breadcrumbs | Module header |
## Technical Comparison
### Backend
| Component | OpenWRT | Debian |
|-----------|---------|--------|
| Web Framework | LuCI (Lua) | FastAPI (Python) |
| IPC | ubus + RPCD | Unix sockets |
| Config Format | UCI | TOML |
| Auth | Session cookies | JWT tokens |
| API Style | RPC | REST |
### Frontend
| Component | OpenWRT | Debian |
|-----------|---------|--------|
| Templating | Lua views | Vanilla JS |
| Styling | LESS/CSS | CSS Variables |
| JS Framework | LuCI.js | None (vanilla) |
| Real-time | Polling | WebSocket |
### Services
| Service | OpenWRT | Debian |
|---------|---------|--------|
| CrowdSec | ✅ | ✅ |
| WireGuard | ✅ | ✅ |
| nftables | ✅ | ✅ |
| HAProxy | ✅ | ✅ |
| Netdata | ✅ | ✅ |
| LXC | ❌ | ✅ |
| AppArmor | ❌ | ✅ |
| Audit | ❌ | ✅ |
| SOC | ❌ | ✅ |
## Module Mapping
### Core Modules (Ported)
| OpenWRT Package | Debian Package | Status |
|-----------------|----------------|--------|
| luci-app-secubox | secubox-hub | ✅ Complete |
| luci-app-crowdsec-dashboard | secubox-crowdsec | ✅ Complete |
| luci-app-wireguard-dashboard | secubox-wireguard | ✅ Complete |
| luci-app-auth-guardian | secubox-auth | ✅ Complete |
| luci-app-client-guardian | secubox-nac | ✅ Complete |
| luci-app-network-modes | secubox-netmodes | ✅ Complete |
| luci-app-netifyd-dashboard | secubox-dpi | ✅ Complete |
| luci-app-bandwidth-manager | secubox-qos | ✅ Complete |
| luci-app-vhost-manager | secubox-vhost | ✅ Complete |
| luci-app-cdn-cache | secubox-cdn | ✅ Complete |
| luci-app-netdata-dashboard | secubox-netdata | ✅ Complete |
| luci-app-media-flow | secubox-mediaflow | ✅ Complete |
| luci-app-system-hub | secubox-system | ✅ Complete |
| luci-app-droplet | secubox-droplet | ✅ Complete |
| luci-app-metablogizer | secubox-metablogizer | ✅ Complete |
| luci-app-streamlit | secubox-streamlit | ✅ Complete |
| luci-app-streamlit-forge | secubox-streamforge | ✅ Complete |
### New Debian-Only Modules
| Package | Description |
|---------|-------------|
| secubox-portal | Login/auth portal |
| secubox-waf | Web Application Firewall |
| secubox-hardening | System hardening |
| secubox-dns | BIND DNS server |
| secubox-mail | Postfix/Dovecot mail |
| secubox-webmail | Roundcube/SOGo |
| secubox-users | Identity management |
| secubox-publish | Unified publishing |
| secubox-gitea | Git server (LXC) |
| secubox-nextcloud | File sync (LXC) |
| secubox-c3box | Services portal |
| secubox-tor | Tor network |
| secubox-exposure | Exposure settings |
| secubox-mitmproxy | MITM inspection |
| secubox-backup | System backup |
| secubox-watchdog | Service monitor |
| secubox-traffic | Traffic shaping |
| secubox-device-intel | Asset discovery |
| secubox-vortex-dns | DNS firewall |
| secubox-vortex-firewall | Threat firewall |
| secubox-meshname | Mesh DNS |
| secubox-mesh | Mesh network |
| secubox-p2p | P2P network |
| secubox-zkp | Zero-knowledge |
| secubox-soc | Security Operations |
| secubox-roadmap | Migration tracker |
| secubox-repo | APT repository |
## Performance Comparison
| Metric | OpenWRT | Debian |
|--------|---------|--------|
| RAM Usage | ~128MB | ~512MB |
| Disk Usage | ~64MB | ~2GB |
| Boot Time | ~30s | ~45s |
| API Latency | ~50ms | ~20ms |
| Concurrent Users | ~10 | ~100 |
*Note: Debian requires more resources but provides better performance and scalability.*
## Migration Path
1. **Export OpenWRT config** - UCI settings
2. **Install Debian image** - Flash to device or VM
3. **Import settings** - Convert UCI → TOML
4. **Install packages** - `apt install secubox-full`
5. **Verify services** - Check all APIs responding
6. **Update clients** - Point to new IP if changed
## Screenshots
### To Capture
Use the screenshot tool to capture both environments:
```bash
# From the secubox-deb repository
cd /path/to/secubox-deb
# Install dependencies
pip install -r scripts/requirements-screenshot.txt
playwright install chromium
# Capture VM screenshots
python3 scripts/screenshot-tool.py --host vm
# Capture device screenshots
python3 scripts/screenshot-tool.py --host device
# Generate comparison
python3 scripts/screenshot-tool.py --compare --all
```
Screenshots will be saved to:
- `docs/screenshots/vm/` - VM screenshots
- `docs/screenshots/device/` - Device screenshots
- `docs/SCREENSHOTS-VM.md` - VM gallery
- `docs/SCREENSHOTS-DEVICE.md` - Device gallery
- `docs/UI-COMPARISON.md` - Side-by-side comparison
---
*Generated by SecuBox Documentation Tool*

3
_Sidebar.md

@ -1,9 +1,10 @@
**[Home](Home)** | [FR](Home-FR) | [中文](Home-ZH) | **v1.5.0**
**[Home](Home)** | [FR](Home-FR) | [中文](Home-ZH) | **v1.5.1**
### Getting Started
* [[Live-USB-VirtualBox|VirtualBox (2 min)]] ⭐
* [[Live-USB]] | [FR](Live-USB-FR) | [中文](Live-USB-ZH)
* [[Installation]] | [FR](Installation-FR) | [中文](Installation-ZH)
* [[ARM-Installation|ARM / U-Boot]] ⚡
### Modules
* [[MODULES-EN|Modules]] 🇬🇧

87
secubox-debian-ui.md

@ -1,87 +0,0 @@
# SecuBox Debian - UI Documentation
*This documentation shows the Debian version with CRT P31 phosphor theme.*
## About SecuBox Debian
SecuBox Debian is the next-generation security appliance running on Debian Bookworm with a modern FastAPI backend.
**Repository:** [secubox-deb](https://github.com/CyberMind-FR/secubox-deb)
## UI Theme: CRT P31 Phosphor
The Debian version features a retro CRT terminal aesthetic inspired by P31 phosphor green monitors:
```css
:root {
--p31-peak: #33ff66; /* Bright phosphor green */
--p31-hot: #66ffaa; /* Hot phosphor glow */
--p31-mid: #22cc44; /* Standard text */
--p31-dim: #0f8822; /* Dim text */
--p31-ghost: #052210; /* Ghost/borders */
--p31-decay: #ffb347; /* Decay/warnings (amber) */
--tube-black: #050803; /* CRT black */
--tube-deep: #080d05; /* Deep background */
}
```
### Theme Features
- **Phosphor glow effects** on text and borders
- **Scanline overlay** for authentic CRT look
- **Monospace fonts** (Courier Prime)
- **Amber warnings** for alerts and errors
- **Responsive design** with collapsible sidebar
## Architecture
### Backend Stack
- **FastAPI** - Modern async Python web framework
- **Uvicorn** - ASGI server on Unix sockets
- **Nginx** - Reverse proxy and static files
- **JWT** - Authentication tokens
- **TOML** - Configuration format
### Frontend Stack
- **Vanilla JS** - No framework dependencies
- **CSS Variables** - Themeable design system
- **WebSocket** - Real-time updates (SOC module)
- **Shared Components** - sidebar.js, crt-system.css
## Module Count
| Category | Count |
|----------|-------|
| Dashboard | 3 |
| Security | 5 |
| Network | 6 |
| DNS | 3 |
| VPN/Privacy | 6 |
| Monitoring | 5 |
| Access Control | 4 |
| Services | 3 |
| Email | 2 |
| Publishing | 3 |
| Apps | 3 |
| System | 2 |
| **Total** | **47** |
## Module Screenshots
See the [Module Gallery](Module-Gallery) for screenshots of each module.
## API Documentation
Each module exposes a REST API at `/api/v1/<module>/`:
```bash
# Example: Get SOC status
curl -H "Authorization: Bearer $TOKEN" https://secubox/api/v1/soc/status
# Example: List CrowdSec decisions
curl -H "Authorization: Bearer $TOKEN" https://secubox/api/v1/crowdsec/decisions
```
---
*Generated by SecuBox Screenshot Tool*

38
secubox-openwrt-ui.md

@ -1,38 +0,0 @@
# SecuBox OpenWRT - UI Documentation
*This documentation shows the original OpenWRT LuCI interface.*
## About SecuBox OpenWRT
SecuBox OpenWRT is the original security appliance firmware based on OpenWRT with LuCI web interface.
**Repository:** [secubox-openwrt](https://github.com/gkerma/secubox-openwrt)
## UI Theme
The OpenWRT version uses the standard LuCI theme with SecuBox customizations:
- Dark theme with blue accents
- Responsive sidebar navigation
- Module-based organization
## Module Screenshots
See the [Module Gallery](Module-Gallery) for screenshots of each module.
## Migration to Debian
SecuBox is being migrated from OpenWRT to Debian. See [secubox-deb](https://github.com/CyberMind-FR/secubox-deb) for the Debian version.
### Key Differences
| Aspect | OpenWRT | Debian |
|--------|---------|--------|
| Base OS | OpenWRT | Debian Bookworm |
| Web Framework | LuCI (Lua) | FastAPI (Python) |
| Theme | LuCI Dark | CRT P31 Phosphor |
| Config | UCI | TOML |
| Init System | procd | systemd |
---
*Generated by SecuBox Screenshot Tool*