secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(profiles): secubox-sleeper ships DISABLED (pilot; never auto-sleep crowdsec) (ref #896)

Browse Source 
The postinst enabled+started the sleeper, which stops idle sleepable modules —
and health-sync currently lists crowdsec among sleepable. Ship it disabled
(--no-enable --no-start; postinst try-restart only, never enable). Operator
opts in after auditing the sleepable set. Waker stays enabled (never stops).

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
This commit is contained in:
CyberMind-FR 2026-07-21 07:06:53 +02:00
parent e91f2aa252
commit 7b8fd5f1e3
3 changed files with 33 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/secubox-profiles/debian/changelog
View File

@ -1,3 +1,14 @@
secubox-profiles (0.10.1-1~bookworm1) bookworm; urgency=medium
* secubox-sleeper ships DISABLED by default (--no-enable + postinst no longer
enables it). It STOPS idle sleepable modules; until a deployment's lifecycle
assignments are audited (a security service like crowdsec must be always-on,
never on-demand) auto-enabling it fleet-wide could sleep something that must
stay up. The operator enables it deliberately once verified. secubox-waker
stays enabled (it only serves the splash + fires wakes, never stops anything).
-- Gerald KERMA <devel@cybermind.fr> Tue, 21 Jul 2026 09:15:00 +0200
secubox-profiles (0.10.0-1~bookworm1) bookworm; urgency=medium
* Terminal wake splash + two-phase UX (ref #896): pseudo-terminal "virtual

25
packages/secubox-profiles/debian/postinst
View File

@ -45,14 +45,23 @@ case "$1" in
systemctl enable secubox-profiles.service 2>/dev/null || true
systemctl restart secubox-profiles.service 2>/dev/null || true
# secubox-waker + secubox-sleeper (ref #896, scale-to-zero): `enable
# --now` is safe/idempotent (no-op if already enabled+running — the
# first-install case starts them), `try-restart` afterwards is a
# no-op if inactive and gracefully restarts (not a hard kill) an
# ALREADY-running instance so an upgrade picks up new code without
# forcibly disrupting an in-flight wake/sleep decision.
systemctl enable --now secubox-waker.service secubox-sleeper.service 2>/dev/null || true
systemctl try-restart secubox-waker.service secubox-sleeper.service 2>/dev/null || true
# secubox-waker (ref #896, scale-to-zero): safe to enable+run — it only
# serves the wake splash and fires a single wake per vhost; it never
# stops anything. `enable --now` is idempotent; `try-restart` is a no-op
# if inactive and gracefully restarts (not a hard kill) a running
# instance so an upgrade picks up new code.
systemctl enable --now secubox-waker.service 2>/dev/null || true
systemctl try-restart secubox-waker.service 2>/dev/null || true
# secubox-sleeper ships DISABLED (pilot): it STOPS idle sleepable
# modules, and until each deployment's lifecycle assignments are audited
# (a security service like crowdsec must be always-on, NEVER on-demand),
# auto-enabling it fleet-wide could sleep something that must stay up.
# The operator enables it deliberately, once the sleepable set is
# verified: `systemctl enable --now secubox-sleeper.service`. We only
# try-restart it here so an UPGRADE refreshes an operator who ALREADY
# opted in (no-op when it is inactive/disabled — never starts it).
systemctl try-restart secubox-sleeper.service 2>/dev/null || true
# Config sync for the sbxwaf-side wake trigger + the health monitor
# (ref #896 — supersedes the nginx-sync path of Task 7, PIVOT

6
packages/secubox-profiles/debian/rules
View File

@ -19,4 +19,8 @@ override_dh_auto_install:
override_dh_installsystemd:
dh_installsystemd --name=secubox-profiles
dh_installsystemd --name=secubox-waker
dh_installsystemd --name=secubox-sleeper
# secubox-sleeper ships DISABLED (--no-enable --no-start): it stops idle
# sleepable modules, so it must be enabled deliberately by the operator only
# after the deployment's lifecycle assignments are audited (a security
# service like crowdsec must never be on-demand). See debian/postinst.
dh_installsystemd --no-enable --no-start --name=secubox-sleeper