secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 22:07:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs(dpi): clarify role vs secubox-netifyd; drop aspirational dual-stream framing (closes #382)

Browse Source 
secubox-dpi and secubox-netifyd both ship a dashboard backed by the
netifyd daemon — that overlap had readers thinking one was redundant.
On closer inspection, they're a clean two-layer split:

  - secubox-netifyd manages the daemon lifecycle (start/stop/config/
    alerts/restart/interfaces) and is what an operator installs to
    control netifyd itself.
  - secubox-dpi is the analytics layer on top: top apps, top
    protocols, bandwidth-by-app, bandwidth-by-device, talkers, risks,
    plus the tc mirred ifb0 setup endpoint.

Update secubox-dpi's metadata to make that split explicit:

  - Description headline: "netifyd Dashboard" → "Analytics —
    netifyd-backed app/protocol classification" so the apt-cache
    description no longer collides with secubox-netifyd.
  - Description body: explicitly point at secubox-netifyd (and
    secubox-ndpid for the different-engine case) so operators know
    what to install for what.
  - Recommends: secubox-netifyd, in addition to the existing netifyd
    daemon recommendation. Layered model: control + analytics
    together is the intended setup.
  - Drop the "dual-stream netifyd/nDPId" framing from the
    Description. The code is netifyd-only; nDPId analysis is owned
    by secubox-ndpid (separate package, separate backend daemon).
    The aspirational framing was making the cluster look more
    consolidated than it actually is.
  - README rewritten to match.

Bump to 1.0.5-1~bookworm1 so the description change ships in apt
metadata.

No code, endpoints, nginx routes, menu entries, or services changed.
secubox-netifyd, secubox-ndpid, secubox-mediaflow not touched.

Decided no cluster merge — the dpi/netifyd/ndpid/mediaflow split is
the right architecture; the only bug was the misleading description.
See [docs/superpowers/plans/2026-05-27-secubox-consolidation-audit.md].
This commit is contained in:
CyberMind-FR 2026-05-27 08:12:13 +02:00
parent ad0550a461
commit c761c97d0a
3 changed files with 34 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
packages/secubox-dpi/README.md
View File

@ -1,6 +1,11 @@
# 🔬 Deep Packet Inspection
# 🔬 SecuBox DPI Analytics
DPI with netifyd/nDPId
Netifyd-backed analytics layer: top apps, top protocols, bandwidth
breakdown, talkers, risks. Sets up `tc mirred` to `ifb0` for inline
inspection. Complements `secubox-netifyd` (daemon lifecycle).
For nDPId-engine analysis with TLS fingerprinting (JA3/JA4), see
`secubox-ndpid` instead.
**Category:** Monitoring

13
packages/secubox-dpi/debian/changelog
View File

@ -1,3 +1,16 @@
secubox-dpi (1.0.5-1~bookworm1) bookworm; urgency=low
* Clarify Description: this is the netifyd-backed analytics layer
that complements secubox-netifyd (daemon lifecycle), not a
duplicate of it (closes #382)
* Recommend secubox-netifyd so operators get the full daemon-control
+ analytics experience together
* Drop the "dual-stream netifyd/nDPId" framing — the code is
netifyd-only; nDPId-engine analysis lives in secubox-ndpid
* README rewritten to match
-- Gerald KERMA <devel@cybermind.fr> Wed, 27 May 2026 11:00:00 +0000
secubox-dpi (1.0.4-1~bookworm1) bookworm; urgency=medium
* Add dynamic menu system with menu.d JSON definitions

18
packages/secubox-dpi/debian/control
View File

@ -10,8 +10,18 @@ Rules-Requires-Root: no
Package: secubox-dpi
Architecture: all
Depends: ${misc:Depends}, secubox-core (>= 1.0), iproute2
Recommends: netifyd
Description: SecuBox DPI — netifyd Dashboard
Deep Packet Inspection dual-stream : netifyd/nDPId, tc mirred ifb0, classification applicative.
Recommends: netifyd, secubox-netifyd
Description: SecuBox DPI Analytics — netifyd-backed app/protocol classification
Analytics layer on top of netifyd: top applications, top protocols,
bandwidth-by-app, bandwidth-by-device, talkers, and risk visualization.
Configures tc mirred to ifb0 for inline inspection.
.
Port Debian bookworm de luci-app-netifyd-dashboard (SecuBox OpenWrt / CyberMind.fr).
Complements secubox-netifyd, which manages the netifyd daemon
lifecycle (start/stop/config/alerts). Install both for the full
daemon-control + analytics experience. For TLS fingerprinting and
nDPId-engine analysis, install secubox-ndpid instead — it covers a
different DPI engine and is not provided by this package despite
historical "dual-stream" framing.
.
Port Debian bookworm de luci-app-netifyd-dashboard (SecuBox OpenWrt
/ CyberMind.fr).