mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
docs: update WIP/HISTORY/TODO for Phase 11 A+B + gk2 system triage + v2.13.14
Some checks are pending
License Headers / check (push) Waiting to run
Some checks are pending
License Headers / check (push) Waiting to run
- Phase 11 social mapping A (#506/2.6.0) + B (#507/2.6.1) deployed live;
C (#508) checkpointed at 55626e51.
- gk2 triage: CrowdSec bouncer tables, /var/log/secubox traversal,
WAF double-buffer cache (#509/1.2.2), PeerTube/PhotoPrism restart.
- CI: espressobin disable (#504), WAF perf (#510) merged, v2.13.14 tagged.
- Carried: Round Eye link, toolbox tab decision, var/log postinst patch.
This commit is contained in:
parent
a6f44807c6
commit
8263bc7681
|
|
@ -3,6 +3,79 @@
|
|||
|
||||
---
|
||||
|
||||
## 2026-06-10 — Phase 11 social mapping (A+B) + system triage + v2.13.14 (ref #502-#509)
|
||||
|
||||
### Package bumps
|
||||
|
||||
| Package | from → to |
|
||||
|---|---|
|
||||
| secubox-toolbox | 2.5.2 → **2.6.0** (#505 Phase 11.A backend) |
|
||||
| secubox-toolbox | 2.6.0 → **2.6.1** (#507 Phase 11.B frontend) |
|
||||
| secubox-waf | 1.2.1 → **1.2.2** (#509 double-buffer cache) |
|
||||
| Release tag | **v2.13.14** |
|
||||
|
||||
### Phase 11 — Social mapping per device (#502)
|
||||
|
||||
**11.A backend** (`secubox-toolbox 2.6.0`, PR #506) — `social.py`
|
||||
correlation engine + 3 SQLite tables (`social_edges` / `social_nodes`
|
||||
/ `social_links`), `social_graph.py` mitm addon (cookie_id_hash =
|
||||
sha256, never persists raw values), `/social/graph/{token}` +
|
||||
`/social/wipe/{token}` (RGPD art. 17) + `/admin/social-aggregate`
|
||||
endpoints, fold + purge background tasks.
|
||||
|
||||
**11.B frontend** (`secubox-toolbox 2.6.1`, #507) — d3 force-directed
|
||||
graph view at `/social/{token}`, FR/EN i18n, server-side favicon proxy
|
||||
(7d cache), wipe modal with 3s countdown, full-viewport layout with
|
||||
pan/pinch-zoom + pre-warm + autoFit. Splash menu link `/social/me`
|
||||
(🕸️ Ma carto) resolving R3 peers via X-R3-Peer sentinel.
|
||||
|
||||
**Live result** : graph renders real cross-site tracking on gk2 — the
|
||||
ad-tech relay `35.214.136.108` bridging 360yield + seedtag +
|
||||
smartadserver + smilewanted publishers, surfacing exactly the
|
||||
fingerprint reuse Phase 11 targets.
|
||||
|
||||
**Critical live-deploy fixes** : addon relative-import never resolved
|
||||
(mitmproxy loads addons top-level) → inlined; **PYTHONPATH missing in
|
||||
mitm-wg launcher** silently degraded every addon's `secubox_toolbox`
|
||||
imports → fixed globally (also un-degraded inject_banner's host
|
||||
classification + GeoIP); i18n moved to `<script>` block (FR
|
||||
apostrophes broke JSON.parse); StaticFiles mount + chmod 0755 www
|
||||
(kbin HAProxy path bypasses nginx).
|
||||
|
||||
**11.C** (#508) — WIP checkpoint `55626e51` : schema (consent_state +
|
||||
GeoIP columns), EU/EEA whitelist, GeoIP fold enrichment, evidence()
|
||||
helper. PDF generator + consent-probe addon + frontend wire pending.
|
||||
|
||||
### System triage on gk2
|
||||
|
||||
- **CrowdSec firewall** — bouncer ran healthy but had no nft tables
|
||||
(external flush). Restart recreated `ip crowdsec` + `ip6 crowdsec6`,
|
||||
100 live decisions.
|
||||
- **WAF + SOC empty cards** — `/var/log/secubox` was 0750
|
||||
secubox-toolbox, blocking the aggregator (user `secubox`) from
|
||||
traversing to read `waf-threats.log`. chmod 0755 live.
|
||||
- **WAF /stats 30s+ timeout** — `_get_threat_stats()` re-parsed the full
|
||||
110 MB / 332k-entry JSONL on every request (89% aggregator CPU).
|
||||
Fixed via #509 double-buffered cache : disk-persisted counters +
|
||||
byte-position incremental tail reading. `/waf/stats` now 30-37 ms.
|
||||
- **PeerTube + PhotoPrism 502** — LXCs were STOPPED; `lxc-start` → live.
|
||||
|
||||
### CI + release
|
||||
|
||||
- #503/PR #504 — drop espressobin-v7 + ultra from the scheduled
|
||||
build-image matrix (cause of the v2.13.9-12 release failures).
|
||||
- #509/PR #510 — double-buffer WAF cache.
|
||||
- Merged both to master (`3ebb4477`, `a6f44807`), tagged **v2.13.14**.
|
||||
|
||||
### Carried forward
|
||||
|
||||
- Round Eye gadget remote-link to gk2 (shows local metrics only) —
|
||||
needs Pi-side investigation.
|
||||
- admin.gk2/toolbox/ tab surfacing decision (proxy/iframe/sub-tab).
|
||||
- `/var/log/secubox` 0755 source-side postinst patch (live-only for now).
|
||||
|
||||
---
|
||||
|
||||
## 2026-06-09 — Phase 10 banner injection perf quick wins + postinst regression fix (ref #501)
|
||||
|
||||
### Package bumps
|
||||
|
|
|
|||
|
|
@ -1,10 +1,40 @@
|
|||
# TODO — SecuBox-DEB Backlog
|
||||
*Mis à jour : 2026-06-09*
|
||||
*Mis à jour : 2026-06-10*
|
||||
|
||||
---
|
||||
|
||||
## 🔥 P0 — Immediate (in flight)
|
||||
|
||||
### Phase 11 — Social mapping per device (#502)
|
||||
|
||||
- [x] **11.A backend** (#505 / PR #506, `secubox-toolbox 2.6.0`) — correlation
|
||||
engine + SQLite + API. Déployé live gk2.
|
||||
- [x] **11.B frontend** (#507, `2.6.1`) — d3 graph + i18n FR/EN + favicon
|
||||
proxy + wipe modal + full-viewport pan/zoom. Live `/social/me`.
|
||||
- [ ] **11.C evidence + PDF** (#508) — reprendre depuis checkpoint
|
||||
`55626e51` : consent-probe addon (OneTrust/Didomi/Quantcast/Sourcepoint)
|
||||
+ extra-EU flag + PDF bilingue FR/EN + wire frontend (remplacer le
|
||||
placeholder "Rapport PDF arrive en Phase 11.C").
|
||||
- [ ] **Merger PR #506** (11.A backend) → master quand prêt.
|
||||
- [ ] **11.D opérateur** (futur) — dashboard agrégat `/admin/social/` HTML
|
||||
(l'endpoint JSON `/admin/social-aggregate` existe déjà depuis 2.6.0).
|
||||
|
||||
### Système — bugs gk2 (2026-06-10)
|
||||
|
||||
- [x] **CrowdSec firewall** — restart bouncer → tables nft recréées.
|
||||
- [x] **WAF /var/log/secubox traversal** — chmod 0755 live.
|
||||
- [x] **WAF /stats perf** (#509 / PR #510, `secubox-waf 1.2.2`) — double-buffer
|
||||
cache. Mergé + `v2.13.14`.
|
||||
- [x] **PeerTube + PhotoPrism** — LXC redémarrés.
|
||||
- [ ] **Round Eye gadget** — ne voit plus gk2, métriques locales only.
|
||||
Investigation Pi Zero (dashboard `localhost:8000` proxie vers gk2 via OTG).
|
||||
- [ ] **admin.gk2/toolbox/ tab** — toolbox déjà wiré (`/toolbox/` alias +
|
||||
sidebar). User veut surfacer l'UI kbin/admin dedans — décision en
|
||||
attente : proxy_pass `10.99.0.1:8088/admin/` (cleanest) / iframe (CSP) /
|
||||
sous-tab frontend-only.
|
||||
- [ ] **Postinst `/var/log/secubox` 0755** — porter le fix live en source
|
||||
(même pattern que `/etc/secubox` parent + `/usr/share/secubox/www`).
|
||||
|
||||
### Phase 10 — Banner injection perf (#501) — ✅ shipped 2026-06-09
|
||||
|
||||
- [x] **Banner perf quick wins** (`secubox-toolbox` 2.5.1, commit `ce059d0f`)
|
||||
|
|
|
|||
|
|
@ -1,5 +1,73 @@
|
|||
# WIP — Work In Progress
|
||||
*Mis à jour : 2026-06-09*
|
||||
*Mis à jour : 2026-06-10*
|
||||
|
||||
---
|
||||
|
||||
## 🔄 2026-06-10 : Phase 11 social mapping (A+B) + system triage round (ref #502-#509)
|
||||
|
||||
Grosse journée : Phase 11 social mapping shippé jusqu'au frontend live,
|
||||
puis une cascade de fixes système découverts par l'utilisateur en
|
||||
production sur gk2.
|
||||
|
||||
### ✅ Done — Phase 11 social mapping (#502 parent)
|
||||
|
||||
| Issue | Phase | État |
|
||||
|---|---|---|
|
||||
| #505 / PR #506 | **11.A backend** : correlation engine + SQLite + API | ✅ mergeable, déployé live `secubox-toolbox 2.6.0` |
|
||||
| #507 | **11.B frontend** : d3 graph + i18n FR/EN + favicon proxy + wipe modal | ✅ déployé live `2.6.1`, branche poussée |
|
||||
| #508 | **11.C evidence + PDF** | 🔄 WIP checkpoint `55626e51` (schema + GeoIP fold + evidence helper) |
|
||||
|
||||
**Design** : 2 rounds de design lock sur #502 (Gemini + GPT mockups),
|
||||
edge-thickness + animated-pulse + tracker bottom-sheet + 3s wipe
|
||||
countdown verrouillés.
|
||||
|
||||
**Live URL** : `https://kbin.gk2.secubox.in/social/me` (splash → 🕸️ Ma carto).
|
||||
Le graphe montre les trackers cross-site réels (relais ad-tech
|
||||
`35.214.136.108` reliant 360yield + seedtag + smartadserver + smilewanted).
|
||||
|
||||
**Fixes live-deploy critiques découverts** :
|
||||
- `social_graph.py` : `from . import local_store` ne résolvait jamais
|
||||
(mitmproxy charge les addons en top-level) → inliné le WG peer hash.
|
||||
- **PYTHONPATH manquant dans le launcher mitm-wg** : TOUS les addons
|
||||
(`inject_banner` dpi/geo/store, `social_graph`) avaient leurs
|
||||
`from secubox_toolbox import …` silencieusement dégradés. Fix global.
|
||||
- i18n déplacé de `data-*` attr vers `<script>` (apostrophes FR
|
||||
cassaient `JSON.parse`).
|
||||
- StaticFiles mount + chmod 0755 `/usr/share/secubox/www` (kbin passe
|
||||
par HAProxy direct uvicorn, bypass nginx).
|
||||
- d3 : full-viewport + pan/pinch-zoom + pre-warm 300 ticks + autoFit
|
||||
data-based (146 nodes spread off-screen avant).
|
||||
|
||||
### ✅ Done — triage système gk2 (2026-06-10)
|
||||
|
||||
| Bug | Cause racine | Fix |
|
||||
|---|---|---|
|
||||
| CrowdSec firewall status faux | bouncer tournait mais sans tables nft (flush externe) | restart bouncer → `ip crowdsec` + `ip6 crowdsec6` recréées, 100 décisions live |
|
||||
| WAF /threats + tracked attackers vides | `/var/log/secubox` 0750 secubox-toolbox bloquait traversal aggregator (user `secubox`) | chmod 0755 live |
|
||||
| WAF /stats timeout 30s+ | `_get_threat_stats()` re-parsait 110 MB / 332k JSONL à CHAQUE requête (CPU 89%) | **#509 double-buffer cache** (disk + byte-position incrémental) `secubox-waf 1.2.2` |
|
||||
| SOC /soc/ status WAF+firewall faux | consommait les mêmes endpoints WAF cassés | résolu en cascade par le fix WAF |
|
||||
| PeerTube + PhotoPrism 502 | LXC STOPPED | `lxc-start` → 200 / 307 |
|
||||
|
||||
### ✅ Done — CI + release
|
||||
|
||||
- **#503 / PR #504** : drop espressobin-v7 + ultra du matrix build-image
|
||||
scheduled (faisaient échouer le pipeline release v2.13.9-12).
|
||||
- **#509 / PR #510** : double-buffer WAF cache.
|
||||
- **Merge #504 + #510 → master** (`3ebb4477`, `a6f44807`).
|
||||
- **Tag `v2.13.14`** poussé.
|
||||
|
||||
### ⬜ Next up
|
||||
|
||||
- **Round Eye gadget** : ne voit plus le lien gk2, montre ses métriques
|
||||
locales. iface `eye-remote` UP côté gk2, route `/api/v1/eye-remote/*`
|
||||
renvoie page erreur. Investigation côté Pi Zero nécessaire.
|
||||
- **admin.gk2/toolbox/ tab** : le toolbox est DÉJÀ wiré (`/toolbox/`
|
||||
alias + sidebar). User veut surfacer l'UI kbin/admin dedans —
|
||||
décision en attente : proxy_pass / iframe / sous-tab.
|
||||
- **Phase 11.C** : reprendre depuis `55626e51` (consent probe addon +
|
||||
extra-EU flag + PDF bilingue + wire frontend).
|
||||
- **Postinst patch** : `/var/log/secubox` 0755 en source (pour l'instant
|
||||
fix live uniquement) — même pattern que `/etc/secubox` + `www`.
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user