fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units

Hub + portal stayed `inactive (dead)` on real-hardware boot. The journal error was `Failed to set up mount namespacing: /run/systemd/ unit-root/run/secubox: No such file or directory` at the NAMESPACE step. Root cause: 96 services declare `RuntimeDirectory=secubox` without the matching `RuntimeDirectoryPreserve=yes`. When any of them stops (including any of the LXC-backed services that fail their health probe and Restart=on-failure for a few cycles), systemd removes /run/secubox on the way out. The next service with the same RuntimeDirectory= that tries to namespace its inputs hits the gap and falls into 226/NAMESPACE failure — Restart hammers a few times, then the unit goes failed-permanent. Earlier fmrelay + sentinelle units got the fix individually (v2.12.0/v2.12.3 era). Now applied to all 96 remaining units in a single sweep via: sed -i '/^RuntimeDirectory=secubox/a RuntimeDirectoryPreserve=yes' "$f" No version bumps in changelog — `dpkg -i --force-depends` in the live-USB slipstream picks up the new .deb regardless of version number.
2026-07-28 21:17:36 +00:00 · 2026-05-26 09:50:22 +02:00 · 2026-05-26 09:50:22 +02:00 · 24000d67ea
commit 24000d67ea
parent 1f51d1818d
87 changed files with 87 additions and 0 deletions
--- a/packages/secubox-ad-guard/debian/secubox-ad-guard.service
+++ b/packages/secubox-ad-guard/debian/secubox-ad-guard.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-admin/debian/secubox-admin.service
+++ b/packages/secubox-admin/debian/secubox-admin.service
@ -16,6 +16,7 @@ Restart=on-failure
 RestartSec=5
 PrivateTmp=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 [Install]
--- a/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service
+++ b/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-ai-insights/systemd/secubox-ai-insights.service
+++ b/packages/secubox-ai-insights/systemd/secubox-ai-insights.service
@ -17,6 +17,7 @@ RestartSec=5
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox
--- a/packages/secubox-auth/debian/secubox-auth.service
+++ b/packages/secubox-auth/debian/secubox-auth.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-avatar/debian/secubox-avatar.service
+++ b/packages/secubox-avatar/debian/secubox-avatar.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-backup/debian/secubox-backup.service
+++ b/packages/secubox-backup/debian/secubox-backup.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-c3box/debian/secubox-c3box.service
+++ b/packages/secubox-c3box/debian/secubox-c3box.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-cdn/debian/secubox-cdn.service
+++ b/packages/secubox-cdn/debian/secubox-cdn.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-config-advisor/debian/secubox-config-advisor.service
+++ b/packages/secubox-config-advisor/debian/secubox-config-advisor.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-crowdsec/debian/secubox-crowdsec.service
+++ b/packages/secubox-crowdsec/debian/secubox-crowdsec.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-cve-triage/debian/secubox-cve-triage.service
+++ b/packages/secubox-cve-triage/debian/secubox-cve-triage.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service
+++ b/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-device-intel/debian/secubox-device-intel.service
+++ b/packages/secubox-device-intel/debian/secubox-device-intel.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-dns-guard/debian/secubox-dns-guard.service
+++ b/packages/secubox-dns-guard/debian/secubox-dns-guard.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-dns-provider/debian/secubox-dns-provider.service
+++ b/packages/secubox-dns-provider/debian/secubox-dns-provider.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-dns-provider/systemd/secubox-dns-provider.service
+++ b/packages/secubox-dns-provider/systemd/secubox-dns-provider.service
@ -15,6 +15,7 @@ UMask=0000
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox
--- a/packages/secubox-dns/debian/secubox-dns.service
+++ b/packages/secubox-dns/debian/secubox-dns.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-droplet/debian/secubox-droplet.service
+++ b/packages/secubox-droplet/debian/secubox-droplet.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/droplet
--- a/packages/secubox-eye-remote/debian/secubox-eye-remote.service
+++ b/packages/secubox-eye-remote/debian/secubox-eye-remote.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-gitea/debian/secubox-gitea.service
+++ b/packages/secubox-gitea/debian/secubox-gitea.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-glances/debian/secubox-glances.service
+++ b/packages/secubox-glances/debian/secubox-glances.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-haproxy/debian/secubox-haproxy.service
+++ b/packages/secubox-haproxy/debian/secubox-haproxy.service
@ -23,6 +23,7 @@ StartLimitBurst=5
 # ProtectSystem=full
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 # ReadWritePaths removed - causes NAMESPACE errors when haproxy not installed
 # (haproxy is Recommends, not Depends - /etc/haproxy may not exist)
--- a/packages/secubox-hardening/debian/secubox-hardening.service
+++ b/packages/secubox-hardening/debian/secubox-hardening.service
@ -16,6 +16,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /etc/sysctl.d /etc/modprobe.d
--- a/packages/secubox-hub/debian/secubox-hub.service
+++ b/packages/secubox-hub/debian/secubox-hub.service
@ -23,6 +23,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 LogsDirectory=secubox
 LogsDirectoryMode=0755
--- a/packages/secubox-identity/debian/secubox-identity.service
+++ b/packages/secubox-identity/debian/secubox-identity.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-interceptor/systemd/secubox-interceptor.service
+++ b/packages/secubox-interceptor/systemd/secubox-interceptor.service
@ -13,6 +13,7 @@ Restart=on-failure
 RestartSec=5
 PrivateTmp=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes

 [Install]
 WantedBy=multi-user.target
--- a/packages/secubox-iot-guard/debian/secubox-iot-guard.service
+++ b/packages/secubox-iot-guard/debian/secubox-iot-guard.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-ipblock/debian/secubox-ipblock.service
+++ b/packages/secubox-ipblock/debian/secubox-ipblock.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/nftables.d
--- a/packages/secubox-ipblock/systemd/secubox-ipblock.service
+++ b/packages/secubox-ipblock/systemd/secubox-ipblock.service
@ -15,6 +15,7 @@ UMask=0000
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/nftables.d
--- a/packages/secubox-jitsi/systemd/secubox-jitsi.service
+++ b/packages/secubox-jitsi/systemd/secubox-jitsi.service
@ -19,6 +19,7 @@ Restart=on-failure
 RestartSec=5
 PrivateTmp=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 [Install]
--- a/packages/secubox-ksm/debian/secubox-ksm.service
+++ b/packages/secubox-ksm/debian/secubox-ksm.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=false
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /sys/kernel/mm/ksm
--- a/packages/secubox-localrecall/debian/secubox-localrecall.service
+++ b/packages/secubox-localrecall/debian/secubox-localrecall.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-mac-guard/systemd/secubox-mac-guard.service
+++ b/packages/secubox-mac-guard/systemd/secubox-mac-guard.service
@ -17,6 +17,7 @@ RestartSec=5
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox
--- a/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service
+++ b/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-master-link/debian/secubox-master-link.service
+++ b/packages/secubox-master-link/debian/secubox-master-link.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-matrix/debian/secubox-matrix.service
+++ b/packages/secubox-matrix/debian/secubox-matrix.service
@ -19,6 +19,7 @@ RestartSec=5

 NoNewPrivileges=false
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/lib/lxc
--- a/packages/secubox-matrix/systemd/secubox-matrix.service
+++ b/packages/secubox-matrix/systemd/secubox-matrix.service
@ -19,6 +19,7 @@ RestartSec=5
 PrivateTmp=true
 NoNewPrivileges=false
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /var/lib/lxc
--- a/packages/secubox-mcp-server/debian/secubox-mcp-server.service
+++ b/packages/secubox-mcp-server/debian/secubox-mcp-server.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-mediaflow/debian/secubox-mediaflow.service
+++ b/packages/secubox-mediaflow/debian/secubox-mediaflow.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-mesh/debian/secubox-mesh.service
+++ b/packages/secubox-mesh/debian/secubox-mesh.service
@ -8,6 +8,7 @@ Type=simple
 User=secubox
 Group=secubox
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 WorkingDirectory=/usr/lib/secubox/mesh
 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/mesh.sock --workers 1
 Restart=always
--- a/packages/secubox-meshname/debian/secubox-meshname.service
+++ b/packages/secubox-meshname/debian/secubox-meshname.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-metabolizer/debian/secubox-metabolizer.service
+++ b/packages/secubox-metabolizer/debian/secubox-metabolizer.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox
--- a/packages/secubox-metacatalog/debian/secubox-metacatalog.service
+++ b/packages/secubox-metacatalog/debian/secubox-metacatalog.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox
--- a/packages/secubox-metoblizer/debian/secubox-metoblizer.service
+++ b/packages/secubox-metoblizer/debian/secubox-metoblizer.service
@ -11,6 +11,7 @@ ExecStart=/usr/bin/uvicorn api.main:app --uds /run/secubox/metoblizer.sock --wor
 Restart=on-failure
 RestartSec=5
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 StateDirectory=secubox/metoblizer

 [Install]
--- a/packages/secubox-mirror/debian/secubox-mirror.service
+++ b/packages/secubox-mirror/debian/secubox-mirror.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox-mirror /etc/secubox /etc/nginx/secubox-mirror.d
--- a/packages/secubox-modem/debian/secubox-modem.service
+++ b/packages/secubox-modem/debian/secubox-modem.service
@ -19,6 +19,7 @@ RestartSec=5
 # Security
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 # Allow access to serial ports and modem devices
--- a/packages/secubox-modem/systemd/secubox-modem.service
+++ b/packages/secubox-modem/systemd/secubox-modem.service
@ -19,6 +19,7 @@ RestartSec=5
 # Security
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 # Allow access to serial ports and modem devices
--- a/packages/secubox-nac/debian/secubox-nac.service
+++ b/packages/secubox-nac/debian/secubox-nac.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-ndpid/debian/secubox-ndpid.service
+++ b/packages/secubox-ndpid/debian/secubox-ndpid.service
@ -16,6 +16,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /run/ndpid
--- a/packages/secubox-netdata/debian/secubox-netdata.service
+++ b/packages/secubox-netdata/debian/secubox-netdata.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-netdiag/debian/secubox-netdiag.service
+++ b/packages/secubox-netdiag/debian/secubox-netdiag.service
@ -16,6 +16,7 @@ Restart=on-failure
 RestartSec=5

 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox
--- a/packages/secubox-nettweak/debian/secubox-nettweak.service
+++ b/packages/secubox-nettweak/debian/secubox-nettweak.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=false
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/sysctl.d /proc/sys
--- a/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service
+++ b/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-nextcloud/debian/secubox-nextcloud.service
+++ b/packages/secubox-nextcloud/debian/secubox-nextcloud.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-p2p/debian/secubox-p2p.service
+++ b/packages/secubox-p2p/debian/secubox-p2p.service
@ -8,6 +8,7 @@ Type=simple
 User=secubox
 Group=secubox
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/p2p.sock --workers 1
 WorkingDirectory=/usr/lib/secubox/p2p
 Restart=on-failure
--- a/packages/secubox-publish/debian/secubox-publish.service
+++ b/packages/secubox-publish/debian/secubox-publish.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-repo/debian/secubox-repo.service
+++ b/packages/secubox-repo/debian/secubox-repo.service
@ -18,6 +18,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox-repo /var/www/apt.secubox.in /tmp
--- a/packages/secubox-reporter/debian/secubox-reporter.service
+++ b/packages/secubox-reporter/debian/secubox-reporter.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox
--- a/packages/secubox-roadmap/debian/secubox-roadmap.service
+++ b/packages/secubox-roadmap/debian/secubox-roadmap.service
@ -8,6 +8,7 @@ Type=simple
 User=secubox
 Group=secubox
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 WorkingDirectory=/usr/lib/secubox/roadmap
 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/roadmap.sock --workers 1
 Restart=always
--- a/packages/secubox-routes/debian/secubox-routes.service
+++ b/packages/secubox-routes/debian/secubox-routes.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-rtty/debian/secubox-rtty.service
+++ b/packages/secubox-rtty/debian/secubox-rtty.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/rtty /var/log/rtty /var/log/secubox
--- a/packages/secubox-saas-relay/debian/secubox-saas-relay.service
+++ b/packages/secubox-saas-relay/debian/secubox-saas-relay.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/cache/secubox
--- a/packages/secubox-simplex/debian/secubox-simplex.service
+++ b/packages/secubox-simplex/debian/secubox-simplex.service
@ -13,6 +13,7 @@ Group=root
 WorkingDirectory=/usr/lib/secubox/simplex
 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/simplex.sock --log-level warning
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0755
 UMask=0117
 Restart=on-failure
--- a/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service
+++ b/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/postfix /var/log/mail.log
--- a/packages/secubox-soc-agent/debian/secubox-soc-agent.service
+++ b/packages/secubox-soc-agent/debian/secubox-soc-agent.service
@ -13,6 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
 RestartSec=5
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0755

 # Security hardening
--- a/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service
+++ b/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service
@ -13,6 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
 RestartSec=5
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0755

 # Security hardening
--- a/packages/secubox-soc/debian/secubox-soc.service
+++ b/packages/secubox-soc/debian/secubox-soc.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-streamforge/debian/secubox-streamforge.service
+++ b/packages/secubox-streamforge/debian/secubox-streamforge.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/streamlit
--- a/packages/secubox-streamlit/debian/secubox-streamlit.service
+++ b/packages/secubox-streamlit/debian/secubox-streamlit.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/streamlit
--- a/packages/secubox-system/debian/secubox-system.service
+++ b/packages/secubox-system/debian/secubox-system.service
@ -18,6 +18,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 LogsDirectory=secubox
 LogsDirectoryMode=0755
--- a/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service
+++ b/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-threats/systemd/secubox-threats.service
+++ b/packages/secubox-threats/systemd/secubox-threats.service
@ -17,6 +17,7 @@ UMask=0000
 # ProtectSystem=full
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/suricata /var/log/secubox

--- a/packages/secubox-tor/debian/secubox-tor.service
+++ b/packages/secubox-tor/debian/secubox-tor.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-torrent/systemd/secubox-torrent.service
+++ b/packages/secubox-torrent/systemd/secubox-torrent.service
@ -19,6 +19,7 @@ RestartSec=5
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox /srv/torrent
--- a/packages/secubox-turn/debian/secubox-turn.service
+++ b/packages/secubox-turn/debian/secubox-turn.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/turnserver.conf /var/log/turnserver /var/log/secubox
--- a/packages/secubox-users/debian/secubox-users.service
+++ b/packages/secubox-users/debian/secubox-users.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-vhost/debian/secubox-vhost.service
+++ b/packages/secubox-vhost/debian/secubox-vhost.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-voip/systemd/secubox-voip.service
+++ b/packages/secubox-voip/systemd/secubox-voip.service
@ -19,6 +19,7 @@ RestartSec=5
 PrivateTmp=true
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox /srv/voip
--- a/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service
+++ b/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service
+++ b/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-waf/debian/secubox-waf.service
+++ b/packages/secubox-waf/debian/secubox-waf.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-watchdog/debian/secubox-watchdog.service
+++ b/packages/secubox-watchdog/debian/secubox-watchdog.service
@ -14,6 +14,7 @@ RestartSec=5
 UMask=0000
 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775
 LogsDirectory=secubox
 LogsDirectoryMode=0755
--- a/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service
+++ b/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-webmail/debian/secubox-webmail.service
+++ b/packages/secubox-webmail/debian/secubox-webmail.service
@ -15,6 +15,7 @@ UMask=0000

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox
--- a/packages/secubox-wireguard/debian/secubox-wireguard.service
+++ b/packages/secubox-wireguard/debian/secubox-wireguard.service
@ -17,6 +17,7 @@ RestartSec=5

 NoNewPrivileges=true
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0775

 ReadWritePaths=/run/secubox /var/lib/secubox /etc/wireguard /var/log/secubox
--- a/packages/secubox-zkp/debian/secubox-zkp.service
+++ b/packages/secubox-zkp/debian/secubox-zkp.service
@ -9,6 +9,7 @@ User=secubox
 Group=secubox
 WorkingDirectory=/usr/lib/secubox/zkp
 RuntimeDirectory=secubox
+RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode=0755
 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/zkp.sock
 Restart=always