secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

feat(openclaw): packaging — sudoers+visudo, install openclawctl+toml, deps debootstrap/lxc/jq

Browse Source
This commit is contained in:
CyberMind-FR 2026-07-09 06:35:11 +02:00
parent f4468484f1
commit cc61eb9c42
5 changed files with 38 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
packages/secubox-openclaw/conf/openclaw.toml.example Normal file
View File

@ -0,0 +1,12 @@
# /etc/secubox/openclaw.toml — cp from this example.
enabled = true
container_name = "openclaw"
lxc_ip = "10.100.0.41"
# Active nmap scans are auto-allowed for RFC1918/LAN + these owned suffixes;
# any other external active target needs an explicit authorized=true per scan.
owned_domains = ["gk2.secubox.in"]
# Optional OSINT integrations (leave blank to disable). Put real keys in
# /etc/secubox/secrets/ (chmod 600) if you prefer them off the TOML.
# shodan_api_key = ""
# censys_api_id = ""
# virustotal_api_key = ""

2
packages/secubox-openclaw/debian/control
View File

@ -7,7 +7,7 @@ Standards-Version: 4.6.2
Package: secubox-openclaw
Architecture: all
Depends: ${misc:Depends}, secubox-core (>= 1.0.0), dnsutils, whois, curl
Depends: ${misc:Depends}, secubox-core (>= 1.0.0), debootstrap, lxc, jq
Recommends: nmap
Description: SecuBox OpenClaw OSINT Module
Open Source Intelligence (OSINT) tool for reconnaissance and

12
packages/secubox-openclaw/debian/postinst
View File

@ -1,6 +1,13 @@
#!/bin/sh
set -e
if [ "$1" = "configure" ]; then
if [ -f /etc/sudoers.d/secubox-openclaw ]; then
visudo -cf /etc/sudoers.d/secubox-openclaw >/dev/null || {
echo "secubox-openclaw: invalid sudoers, removing" >&2
rm -f /etc/sudoers.d/secubox-openclaw
}
fi
# Create data directories. The openclaw FastAPI imports a module that
# touches /var/lib/secubox/openclaw/scans at import time, so the user
# that loads it MUST be able to traverse the parent dir. Under
@ -14,10 +21,9 @@ if [ "$1" = "configure" ]; then
chmod 0755 /var/lib/secubox/openclaw
chmod 0750 /var/lib/secubox/openclaw/scans
# Enable and start service
# The aggregator serves this module in-process (imports api/main.py as
# user secubox) — do NOT enable the dedicated secubox-openclaw.service.
systemctl daemon-reload
systemctl enable secubox-openclaw.service || true
systemctl start secubox-openclaw.service || true
# Reload nginx if available
if systemctl is-active --quiet nginx; then

13
packages/secubox-openclaw/debian/rules
View File

@ -13,3 +13,16 @@ override_dh_auto_install:
[ -d nginx ] && cp -r nginx/. debian/secubox-openclaw/etc/nginx/secubox.d/ || true
install -d debian/secubox-openclaw/lib/systemd/system
[ -d systemd ] && cp systemd/*.service debian/secubox-openclaw/lib/systemd/system/ || true
install -d debian/secubox-openclaw/usr/sbin
install -m 755 sbin/openclawctl debian/secubox-openclaw/usr/sbin/openclawctl
# Sudoers drop-in: lets the aggregator (user secubox) drive openclawctl
# as root without a password — the ONLY privileged surface for the module.
install -d debian/secubox-openclaw/etc/sudoers.d
install -m 440 debian/secubox-openclaw.sudoers debian/secubox-openclaw/etc/sudoers.d/secubox-openclaw
# Operator config example. Shipped to /etc/secubox/ so operators can
# `cp openclaw.toml.example openclaw.toml` without hunting for keys.
install -d debian/secubox-openclaw/etc/secubox
install -m 644 conf/openclaw.toml.example debian/secubox-openclaw/etc/secubox/openclaw.toml.example

3
packages/secubox-openclaw/debian/secubox-openclaw.sudoers Normal file
View File

@ -0,0 +1,3 @@
# The aggregator (user secubox) drives the OpenClaw LXC through openclawctl.
# This is the ONLY privileged surface for the module.
secubox ALL=(root) NOPASSWD: /usr/sbin/openclawctl