mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
docs(history,wip,todo): 2026-05-27 session — consolidation audit + 2 merges + 5 sweeps + gk2 deploy
HISTORY.md: 2026-05-27 entry capturing the full session — Phase 1 audit (141 packages → audit-doc + script), meta-finding on naming- affinity vs real redundancy, 2 real merges (#381 mmpm+magicmirror, #384 master-link+p2p), 5 Description-clarity sweeps (#382, #383, #385, #386, #387), 1 packaging bug fix (#378), 1 build-tooling fix (dynamic discovery in scripts/build-packages.sh), and the gk2 deploy result. WIP.md: bumped to 2026-05-27 with current done-state + carry-over list (filed in TODO.md). TODO.md: three new P0 follow-ups — - secubox-daemon arm64 cross-build so #378 lands on gk2 - secubox-ndpid blocked by missing ndpid apt source on gk2 - Mail transitional postinsts should rm orphan nginx snippets (dpkg's .list didn't auto-clean leftovers from pre-2.2 installs)
This commit is contained in:
parent
561007fe74
commit
d20aacf8cf
|
|
@ -1,6 +1,70 @@
|
|||
# HISTORY — SecuBox-DEB Migration Log
|
||||
*Tracking completed milestones with dates*
|
||||
|
||||
---
|
||||
## 2026-05-27
|
||||
|
||||
### Consolidation pass — full per-cluster audit + 2 real merges + 5 naming sweeps + gk2 deploy
|
||||
|
||||
Phase 1 audit of all 141 `secubox-*` packages
|
||||
(`docs/superpowers/plans/2026-05-27-secubox-consolidation-audit.md`,
|
||||
generated by re-runnable `scripts/audit-packages.py`). Key meta-finding:
|
||||
the audit's projected reduction (~100 packages, 28%) was based on
|
||||
naming-affinity intuition that didn't survive per-package code
|
||||
inspection. Realistic floor revised to ~135-137 (4-5% reduction).
|
||||
|
||||
Where consolidation actually paid off:
|
||||
|
||||
* **#378** (Tier 0) — `secubox-c3box` binary-package-name collision:
|
||||
Python dashboard + Go daemon both built a `.deb` named
|
||||
`secubox-c3box`. Renamed the Go variant to `secubox-daemon-c3box`
|
||||
with `Conflicts:` for clean upgrade. **Not yet on gk2** —
|
||||
Arch:any, needs arm64 cross-compile (`secubox-daemon` not
|
||||
currently installed on the board, so non-acute).
|
||||
* **#380** (Tier 1) — pruned 2634 LOC of dead source from the three
|
||||
already-transitional mail packages (`secubox-mail-lxc`,
|
||||
`secubox-webmail`, `secubox-webmail-lxc`): `api/`, `nginx/`, `www/`,
|
||||
`menu.d/`, dead `.service` files, misleading README. Each now
|
||||
ships only `debian/`.
|
||||
* **#381** (Tier 2, real merge) — folded `secubox-mmpm` into
|
||||
`secubox-magicmirror`: 334-line FastAPI app → `APIRouter` mounted
|
||||
at `/mmpm`. Frontend URL: `/mmpm/` → `/magicmirror/mmpm/`. Old
|
||||
package becomes transitional. **-1 effective package.**
|
||||
* **#384** (Tier 3, real merge) — folded `secubox-master-link` into
|
||||
`secubox-p2p`: surprising finding that master-link's 851-LOC API
|
||||
was effectively dead on production (no nginx config → unreachable
|
||||
via web; the visible `/master-link/` UI was being served by p2p
|
||||
all along). Operator-scoping calls made and documented in the
|
||||
commit. **-1 effective package, -1284 LOC dead code.**
|
||||
* **#382 / #383 / #385 / #386 / #387** — five thematic
|
||||
Description-clarity sweeps. After these land, NO `secubox-*`
|
||||
package on master ships an "X Module" placeholder headline
|
||||
anymore. 24 Descriptions clarified, 9 maintainer placeholders
|
||||
corrected from `SecuBox <dev@secubox.local>` → Gerald.
|
||||
|
||||
Where consolidation did NOT pay off (decisions recorded in audit
|
||||
doc): streamlit/forge (distinct workflows, lxc-dep cost), dpi
|
||||
cluster (4 packages = clean two-layer + two-engine + consumer
|
||||
split), dns cluster (5 distinct DNS subsystems, no config overlap),
|
||||
threats cluster (7 distinct security capabilities with different
|
||||
backends).
|
||||
|
||||
**Build tooling fix:** `scripts/build-packages.sh` had a hardcoded
|
||||
30-package allowlist that silently skipped the other 110 of 141
|
||||
packages. Replaced with dynamic glob over `packages/secubox-*/` with
|
||||
`debian/control` — core first, metapackages last. Surfaced today
|
||||
when 18 of 31 touched packages had to be built manually.
|
||||
|
||||
**Deploy:** 30 of 31 .debs apt-installed on gk2 (root@192.168.1.200).
|
||||
`secubox-ndpid` dropped from batch (depends on `ndpid | ndpi-reader`,
|
||||
not in board's apt sources). All transitional Breaks/Replaces fired
|
||||
cleanly (mmpm + master-link old payloads removed). 24/24 expected-
|
||||
active services running post-deploy; `secubox-magicmirror.service`
|
||||
inactive is correct (`ConditionPathExists=/etc/secubox/magicmirror/
|
||||
enabled` opt-in unit). 3 orphan nginx snippets manually removed —
|
||||
pre-#380 leftovers that dpkg's `.list` tracked but new .debs didn't
|
||||
ship; recommend follow-up to add `rm -f` in transitional postinsts.
|
||||
|
||||
---
|
||||
## 2026-05-26
|
||||
|
||||
|
|
|
|||
|
|
@ -5,6 +5,46 @@
|
|||
|
||||
## 🔥 P0 — Immediate (in flight)
|
||||
|
||||
### Session 2026-05-27 follow-ups (consolidation pass)
|
||||
|
||||
- [ ] **`secubox-daemon` arm64 cross-build + deploy** so the
|
||||
c3box binary-package rename (#378, in master at `4cd5f343`)
|
||||
lands on gk2 and other arm64 boards. Either:
|
||||
(a) on a Marvell-arm64 host: `cd daemon && make build-arm64`,
|
||||
rename `secuboxd-arm64` → `secuboxd` (etc.) in `daemon/build/`,
|
||||
then `cd packages/secubox-daemon && dpkg-buildpackage -us -uc -b`;
|
||||
(b) patch `packages/secubox-daemon/debian/rules` to detect target
|
||||
arch and use the `-arm64`-suffixed binaries when cross-building
|
||||
from amd64 (cleaner, lets the dev box build everything).
|
||||
Non-acute: secubox-daemon not currently installed on gk2.
|
||||
|
||||
- [ ] **`secubox-ndpid 1.0.1` blocked from gk2** by missing
|
||||
`ndpid | ndpi-reader` apt source. Options:
|
||||
(a) add an apt source that provides `ndpid` for bookworm/arm64;
|
||||
(b) package `ndpid` ourselves under `packages/ndpid/`;
|
||||
(c) relax `secubox-ndpid` `Depends:` → `Recommends:` and add a
|
||||
runtime check that surfaces "ndpid daemon unavailable" in the
|
||||
dashboard instead of refusing to install.
|
||||
Recommend (c) for shortest path — operators who want the
|
||||
fingerprinting dashboard install ndpid themselves.
|
||||
|
||||
- [ ] **Mail transitional postinsts** (#380) should rm orphan nginx
|
||||
snippets on upgrade. On gk2 today, dpkg's `.list` for
|
||||
`secubox-mail-lxc 2.2.1`, `secubox-webmail 2.2.0`, `secubox-
|
||||
webmail-lxc 2.2.0` claimed to own `/etc/nginx/secubox.d/
|
||||
{mail-lxc,webmail,webmail-lxc}.conf` but the new (empty) .debs
|
||||
don't ship them — leftovers from a pre-2.2 install that dpkg
|
||||
didn't auto-clean. Patch each transitional postinst to add:
|
||||
|
||||
```sh
|
||||
rm -f /etc/nginx/secubox.d/<name>.conf
|
||||
systemctl reload nginx 2>/dev/null || true
|
||||
```
|
||||
|
||||
(Mirror the mmpm pattern from #381's transitional postinst.)
|
||||
Bump versions, rebuild, mass-redeploy. Without this fix, other
|
||||
boards upgrading from <2.2 will inherit the same orphan files.
|
||||
|
||||
### Session 2026-05-26 follow-ups
|
||||
|
||||
- [ ] **Finir Preserve fix sur 2 services restants** : `secubox-torrent` et
|
||||
|
|
|
|||
|
|
@ -1,5 +1,60 @@
|
|||
# WIP — Work In Progress
|
||||
*Mis à jour : 2026-05-26*
|
||||
*Mis à jour : 2026-05-27*
|
||||
|
||||
---
|
||||
|
||||
## 🔄 2026-05-27: Consolidation pass — audit + 2 real merges + 5 naming sweeps + gk2 deploy
|
||||
|
||||
### ✅ Done (this session)
|
||||
|
||||
- **Phase 1 audit** (`docs/superpowers/plans/2026-05-27-secubox-consolidation-audit.md`):
|
||||
re-runnable `scripts/audit-packages.py` inventories all 141
|
||||
packages with cluster + dep + service + route + has-payload data.
|
||||
Meta-finding: audit's projected ~100-package floor was naming-
|
||||
affinity intuition, real floor is ~135-137 (4-5% reduction).
|
||||
|
||||
- **2 real package merges** (-2 effective packages):
|
||||
- **#381** mmpm → magicmirror: APIRouter fold, frontend moves
|
||||
`/mmpm/` → `/magicmirror/mmpm/`. Old becomes oldlibs.
|
||||
- **#384** master-link → p2p: master-link's 851 LOC was dead
|
||||
(no nginx config → unreachable). Operator-scoping calls
|
||||
documented in commit.
|
||||
|
||||
- **1 packaging bug** (#378): secubox-c3box binary collision —
|
||||
Go variant renamed to `secubox-daemon-c3box`. **Not yet on gk2**
|
||||
(Arch:any, needs arm64 rebuild — daemon not currently installed
|
||||
on board so non-acute).
|
||||
|
||||
- **1 cleanup** (#380): 2634 LOC of dead source pruned from the
|
||||
three already-transitional mail packages.
|
||||
|
||||
- **5 Description-clarity sweeps** (#382, #383, #385, #386, #387):
|
||||
24 Descriptions clarified, 9 maintainer placeholders corrected.
|
||||
After these land, no `secubox-*` package on master ships an
|
||||
"X Module" placeholder headline anymore.
|
||||
|
||||
- **Build tooling fix** (`561007fe`): `scripts/build-packages.sh`
|
||||
switched from hardcoded 30-package allowlist to dynamic glob
|
||||
over `packages/secubox-*/` with `debian/control`. Was silently
|
||||
skipping 110 of 141 packages.
|
||||
|
||||
- **gk2 deploy**: 30 .debs apt-installed and verified.
|
||||
Transitional Breaks/Replaces fired cleanly. 24/24 expected
|
||||
services active post-deploy.
|
||||
|
||||
- **GitHub housekeeping**: 9 issues (#378, #380-#387) closed; 9
|
||||
merged remote branches deleted; 9 local worktrees cleaned.
|
||||
|
||||
### 📋 Carry-overs (filed in TODO.md)
|
||||
|
||||
- `secubox-daemon` arm64 rebuild on a Marvell-arm64 host so the
|
||||
c3box binary rename (#378) lands on gk2.
|
||||
- `secubox-ndpid 1.0.1` blocked from gk2 by missing `ndpid` apt
|
||||
source — needs either package upload or `Recommends:` relax.
|
||||
- Orphan nginx snippets (`mail-lxc.conf`, `webmail.conf`,
|
||||
`webmail-lxc.conf`) on gk2 manually removed; mail transitional
|
||||
postinsts should be patched to do this on other boards.
|
||||
- Smart-strip packaging (#379, deferred to hardware track).
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user