feat(mitmproxy): package self-healing WAF inspector watchdog (closes #624)

secubox-waf-watchdog timer checks inspector :8080 every 60s and auto-recovers
the mitmproxy LXC after 3 consecutive failures (rate-limited once/10min) — an
inspector crash becomes a ~3min auto-recovery instead of a multi-hour 503.
Shipped in secubox-mitmproxy; enabled in postinst, disabled in prerm. Makes the
live hotfix from the #624 incident durable across reflash.

packages/secubox-mitmproxy/bin/secubox-waf-watchdog.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+# Source-Disclosed License — All rights reserved except as expressly granted.
+# See LICENCE-CMSD-1.0.md for terms.
+
+# SecuBox-Deb :: WAF inspector watchdog (#624)
+# Auto-recover the mitmproxy LXC if its inspector port is down for MAXFAIL
+# consecutive checks. Rate-limited by COOLDOWN to avoid restart flap. The whole
+# point: an inspector crash becomes a ~3-minute auto-recovery instead of a
+# multi-hour board-wide 503.
+set -uo pipefail
+
+readonly HOST="${SECUBOX_WAF_HOST:-10.100.0.60}"
+readonly PORT="${SECUBOX_WAF_PORT:-8080}"
+readonly CTN="${SECUBOX_WAF_CTN:-mitmproxy}"
+readonly STATE="/run/secubox-waf-watchdog.state"
+readonly MAXFAIL="${SECUBOX_WAF_MAXFAIL:-3}"
+readonly COOLDOWN="${SECUBOX_WAF_COOLDOWN:-600}"
+
+now="$(date +%s)"
+fails=0
+last=0
+if [ -f "$STATE" ]; then
+    read -r fails last < "$STATE" 2>/dev/null || true
+fi
+[[ "$fails" =~ ^[0-9]+$ ]] || fails=0
+[[ "$last"  =~ ^[0-9]+$ ]] || last=0
+
+# Healthy → reset the failure counter and exit.
+if timeout 4 bash -c "echo >/dev/tcp/$HOST/$PORT" 2>/dev/null; then
+    echo "0 $last" > "$STATE"
+    exit 0
+fi
+
+fails=$((fails + 1))
+logger -t secubox-waf-watchdog "inspector $HOST:$PORT DOWN (fail $fails/$MAXFAIL)"
+
+if [ "$fails" -ge "$MAXFAIL" ] && [ $((now - last)) -ge "$COOLDOWN" ]; then
+    logger -t secubox-waf-watchdog "auto-recovering container $CTN"
+    timeout 45 lxc-stop -n "$CTN" -k 2>/dev/null || true
+    timeout 45 lxc-start -n "$CTN" -d 2>/dev/null || true
+    echo "0 $now" > "$STATE"
+else
+    echo "$fails $last" > "$STATE"
+fi

packages/secubox-mitmproxy/debian/changelog

@@ -1,3 +1,14 @@
+secubox-mitmproxy (1.0.9-1~bookworm1) bookworm; urgency=medium
+
+  * feat(robustness): self-healing WAF inspector watchdog (closes #624).
+      - secubox-waf-watchdog.{sh,service,timer}: every 60s check inspector
+        :8080; after 3 consecutive failures auto-recover the mitmproxy LXC
+        (lxc-stop -k / lxc-start), rate-limited once/10min. Turns an inspector
+        crash from a multi-hour board-wide 503 into a ~3-minute auto-recovery.
+      - Enabled in postinst, stopped/disabled in prerm.
+
+ -- Gerald Kerma <devel@cybermind.fr>  Tue, 17 Jun 2026 08:00:00 +0200
+
 secubox-mitmproxy (1.0.8-1~bookworm1) bookworm; urgency=medium
 
   * fix(waf): live-reload haproxy-routes.json on change (#609). The addon now

packages/secubox-mitmproxy/debian/postinst

@@ -111,6 +111,10 @@ EOF
     systemctl enable secubox-mitmproxy.service
     systemctl start secubox-mitmproxy.service || true
 
+    # WAF inspector self-healing watchdog (#624)
+    systemctl enable secubox-waf-watchdog.timer 2>/dev/null || true
+    systemctl start secubox-waf-watchdog.timer 2>/dev/null || true
+
     # Reload nginx if installed
     systemctl reload nginx 2>/dev/null || true
     ;;

packages/secubox-mitmproxy/debian/prerm

@@ -5,6 +5,8 @@ case "$1" in
   remove|purge)
     systemctl stop secubox-mitmproxy.service || true
     systemctl disable secubox-mitmproxy.service || true
+    systemctl stop secubox-waf-watchdog.timer 2>/dev/null || true
+    systemctl disable secubox-waf-watchdog.timer 2>/dev/null || true
     ;;
 esac
 #DEBHELPER#

packages/secubox-mitmproxy/debian/rules

@@ -19,6 +19,10 @@ override_dh_auto_install:
 	install -m 644 debian/mitmproxy.toml $(CURDIR)/debian/secubox-mitmproxy/etc/secubox/
 	install -d $(CURDIR)/debian/secubox-mitmproxy/usr/lib/systemd/system
 	install -m 644 debian/secubox-mitmproxy.service $(CURDIR)/debian/secubox-mitmproxy/usr/lib/systemd/system/
+	# WAF inspector watchdog (#624) — auto-recover the mitmproxy LXC if :8080 dies
+	install -m 755 bin/secubox-waf-watchdog.sh $(CURDIR)/debian/secubox-mitmproxy/usr/sbin/
+	install -m 644 debian/secubox-waf-watchdog.service $(CURDIR)/debian/secubox-mitmproxy/usr/lib/systemd/system/
+	install -m 644 debian/secubox-waf-watchdog.timer $(CURDIR)/debian/secubox-mitmproxy/usr/lib/systemd/system/
 	install -d $(CURDIR)/debian/secubox-mitmproxy/etc/nginx/secubox.d
 	install -m 644 nginx/mitmproxy.conf $(CURDIR)/debian/secubox-mitmproxy/etc/nginx/secubox.d/
 	# Cookie audit (issue #156) hardening — AppArmor abstraction + logrotate (issue #170)

packages/secubox-mitmproxy/debian/secubox-waf-watchdog.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=SecuBox WAF inspector watchdog (auto-recover mitmproxy LXC)
+Documentation=https://github.com/CyberMind-FR/secubox-deb
+ConditionPathExists=/usr/sbin/secubox-waf-watchdog.sh
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/secubox-waf-watchdog.sh
+Nice=10

packages/secubox-mitmproxy/debian/secubox-waf-watchdog.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run the SecuBox WAF inspector watchdog every minute
+
+[Timer]
+OnBootSec=120
+OnUnitActiveSec=60
+AccuracySec=10s
+
+[Install]
+WantedBy=timers.target