secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

docs(tor-plan): Task 9 must-fix — package secubox-exposure-tor-reconcile sbin+unit (Task 5 persist-on-boot)

Browse Source
This commit is contained in:
CyberMind-FR 2026-07-09 08:35:43 +02:00
parent 217628ce71
commit 691a5cbad1
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/superpowers/plans/2026-07-09-tor-enhancement-phase1.md
View File

@ -472,6 +472,7 @@ In `disarm()`: `rm -f "$BRIDGES_DROPIN"`.
**Files:** none (integration). Packaging note: bump changelogs + build the three debs; deploy; restore prior Tor-egress state at the end.
- [ ] **Step 1: Build + deploy** the three debs (`secubox-toolbox`, `secubox-exposure`, `secubox-tor`) to gk2; install; restart the aggregator once (for the in-process modules).
- **MUST-FIX before build:** wire `packages/secubox-exposure/debian/rules` to install the new `sbin/secubox-exposure-tor-reconcile` (0755, `/usr/sbin/`) + `systemd/secubox-exposure-tor-reconcile.service`, and enable the unit in `debian/postinst` (`systemctl enable secubox-exposure-tor-reconcile.service`) — Task 5's persist-on-boot is inert until this ships. Also confirm the toolbox `obfs4proxy` dep + new confs (Task 1/8) install.
- [ ] **Step 2: Arm egress + verify DNSPort move** — set `tor_mode` on (or `secubox-toolbox-tor-reconcile arm`); confirm `ss -lunp | grep 9053` (tor DNSPort, not avahi), `nft list table inet toolbox_tor` shows `prerouting_vpn` + `tor_vpn_src`, and `/etc/unbound/unbound.conf.d/48-secubox-onion.conf` present + `unbound-checkconf` clean.
- [ ] **Step 3: Exit-country** — write `DE` to `tor-exit-country.txt`, reconcile, confirm `11-secubox-exit-country.conf` has `ExitNodes {de} StrictNodes 1`; check a Tor circuit exits via DE (`tor_control` GETINFO / a curl through the transport geolocating to DE). If DE has no exit, confirm the fail-closed state is visible.
- [ ] **Step 4: Tor-VPN client** — add a throwaway test client IP to `tor-vpn-clients.txt`, reconcile, confirm that source is in `tor_vpn_src` and its 80/443 redirects (a non-listed client stays direct). Remove it after.