feat(#662 Phase 5-prep B): debian packaging for sbxmitm (DISABLED, dark)

New packages/secubox-toolbox-ng/debian/ producing the secubox-toolbox-ng
binary package (Architecture: arm64):
  - control: Maintainer Gerald KERMA; B-D golang-go; Depends
    only (static CGO_ENABLED=0 binary → no shlib deps). Compat 13 via
    debhelper-compat build-dep (debhelper rejects compat both ways).
  - changelog: 0.1.0-1~bookworm1.
  - rules: dh; GOOS=linux GOARCH=arm64 CGO_ENABLED=0 GOPROXY=off go build
    (pure stdlib, offline). dh_installsystemd --no-enable --no-start so the
    unit is shipped but NEVER enabled/started.
  - secubox-toolbox-ng-worker@.service: systemd template mirroring the Python
    mitm-wg worker@ but running sbxmitm on 127.0.0.1:809%i (distinct from the
    Python 808%i so both fleets coexist during cutover). Reads the ca-wg CA.
    DISABLED BY DESIGN — header documents Phase-6-cutover-only enablement.
  - postinst: daemon-reload only; explicitly NO enable/start; NO nft.

Built locally for arm64: dpkg-deb verified — ships /usr/sbin/sbxmitm (arm64
static ELF) + the disabled template; postinst contains ZERO deb-systemd-helper
enable lines. .gitignore extended for in-tree build artifacts. DARK: install
changes no runtime behaviour (no service start, no DNAT, no live-R3 wiring).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/secubox-toolbox-ng/.gitignore

@@ -1,3 +1,12 @@
 /sbxmitm
 *.test
 cmd/sbxmitm/sbxmitm
+# Debian build artifacts (rules builds the binary + go caches in-tree)
+/_gocache/
+/_gopath/
+/debian/.debhelper/
+/debian/files
+/debian/*.substvars
+/debian/secubox-toolbox-ng/
+/debian/debhelper-build-stamp
+/debian/*.debhelper.log

packages/secubox-toolbox-ng/debian/changelog

@@ -0,0 +1,9 @@
+secubox-toolbox-ng (0.1.0-1~bookworm1) bookworm; urgency=medium
+
+  * Initial packaging of the Go MITM engine migration target (#662 Phase 5-prep).
+    Ships /usr/sbin/sbxmitm + a DISABLED systemd template unit
+    (secubox-toolbox-ng-worker@.service). DARK by design: the unit is not
+    enabled or started, no nft DNAT, no live-R3 wiring — enabled only at the
+    Phase 6 cutover.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Wed, 18 Jun 2026 22:00:00 +0200

packages/secubox-toolbox-ng/debian/control

@@ -0,0 +1,22 @@
+Source: secubox-toolbox-ng
+Section: net
+Priority: optional
+Maintainer: Gerald KERMA <devel@cybermind.fr>
+Build-Depends: debhelper-compat (= 13), golang-go (>= 2:1.22~)
+Standards-Version: 4.6.2
+Homepage: https://cybermind.fr/secubox
+Rules-Requires-Root: no
+
+Package: secubox-toolbox-ng
+Architecture: arm64
+Depends: ${misc:Depends}
+Description: SecuBox-Deb — Go MITM engine (migration target, DARK)
+ Multi-core Go re-implementation of the R3 toolbox MITM engine (#662),
+ ported off the GIL-bound Python mitmproxy worker fleet. Ships the
+ standalone sbxmitm binary plus a DISABLED systemd template unit.
+ .
+ This package is the Phase-6-cutover migration target. The unit is NOT
+ enabled or started by the maintainer scripts — the live R3 tunnel keeps
+ running on the Python workers until the cutover is performed manually.
+ Installing this package changes NO runtime behaviour (no service start,
+ no nft DNAT).

packages/secubox-toolbox-ng/debian/postinst

@@ -0,0 +1,27 @@
+#!/bin/sh
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# SecuBox-Deb :: toolbox-ng — postinst
+#
+# DARK by design (#662 Phase 5-prep):
+#   - DO reload the systemd unit catalogue so the template is known.
+#   - DO NOT enable or start secubox-toolbox-ng-worker@.service — this is the
+#     Phase-6 cutover target; the live R3 tunnel keeps running on the Python
+#     workers until the operator performs the cutover manually.
+#   - DO NOT touch nftables (no DNAT, no live-R3 rewiring).
+set -e
+
+case "$1" in
+  configure)
+    if [ -d /run/systemd/system ]; then
+      systemctl daemon-reload >/dev/null 2>&1 || true
+    fi
+    # Intentionally NO `systemctl enable --now`. See the unit header and
+    # debian/changelog: enabled only at the Phase 6 cutover.
+    ;;
+  abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

packages/secubox-toolbox-ng/debian/rules

@@ -0,0 +1,44 @@
+#!/usr/bin/make -f
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# SecuBox-Deb :: toolbox-ng — Go MITM engine (migration target, DARK)
+#
+# The binary is pure-stdlib (no go.sum, no external modules), so it
+# cross-compiles offline with GOPROXY=off. CI cross-builds for arm64;
+# this rules file does the same with `GOOS=linux GOARCH=arm64 go build`.
+
+export DH_VERBOSE = 1
+
+# Build the static arm64 binary offline (stdlib only — no network, no go.sum).
+export GOOS = linux
+export GOARCH = arm64
+export CGO_ENABLED = 0
+export GOFLAGS = -mod=mod
+export GOPROXY = off
+# Keep the Go build/module cache inside the build tree (sandbox-friendly).
+export GOCACHE = $(CURDIR)/_gocache
+export GOPATH  = $(CURDIR)/_gopath
+
+%:
+	dh $@
+
+override_dh_auto_build:
+	go build -trimpath -ldflags=-s -o sbxmitm ./cmd/sbxmitm
+
+# No Go unit tests at package-build time (run in CI on the host arch; the
+# arm64 cross-binary cannot execute its tests here).
+override_dh_auto_test:
+
+override_dh_auto_install:
+	install -d debian/secubox-toolbox-ng/usr/sbin
+	install -m 0755 sbxmitm debian/secubox-toolbox-ng/usr/sbin/sbxmitm
+
+override_dh_auto_clean:
+	rm -f sbxmitm
+	rm -rf _gocache _gopath
+
+# DARK: install the unit file into the catalogue but DO NOT enable or start it.
+# This is the Phase-6 cutover target; the live R3 tunnel stays on the Python
+# workers until the operator enables it manually. The postinst still reloads the
+# unit catalogue so `systemctl` knows the template exists.
+override_dh_installsystemd:
+	dh_installsystemd --no-enable --no-start --name=secubox-toolbox-ng-worker@

packages/secubox-toolbox-ng/debian/secubox-toolbox-ng-worker@.service

@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# SecuBox-Deb :: toolbox-ng — Go MITM engine worker template (#662)
+#
+# ── DISABLED BY DESIGN (DARK) ────────────────────────────────────────────────
+# This is the Phase-6 CUTOVER MIGRATION TARGET. It is NOT enabled or started by
+# the package (postinst does not `systemctl enable --now`). The live R3 tunnel
+# keeps running on the Python mitmproxy workers
+# (secubox-toolbox-mitm-wg-worker@{1..4}, ports 8081-8084) until the cutover is
+# performed manually.
+#
+# Mirrors the Python worker@ fanout: each %i ∈ {1..4} listens on 127.0.0.1:809%i
+# (distinct from the Python 808%i ports so both fleets can coexist during a
+# side-by-side cutover validation). Enable ONLY at Phase 6:
+#
+#   systemctl enable --now secubox-toolbox-ng-worker@{1,2,3,4}.service
+#   # then re-point the nft DNAT at 809%i and retire the Python workers
+#
+# Rollback: disable these, re-point DNAT at the Python 808%i workers.
+
+[Unit]
+Description=SecuBox ToolBoX-NG Go MITM worker %i (migration target, port 809%i)
+Documentation=https://github.com/CyberMind-FR/secubox-deb/issues/662
+After=network.target
+
+[Service]
+Type=simple
+User=secubox-toolbox
+Group=secubox-toolbox
+
+# Reuse the EXISTING ca-wg CA (R3 clients already trust it — no re-enroll).
+# The anti-track jar key is best-effort: absent → poison stays off.
+ExecStart=/usr/sbin/sbxmitm \
+  --listen 127.0.0.1:809%i \
+  --ca-cert /etc/secubox/toolbox/ca-wg/ca.pem \
+  --ca-key /etc/secubox/toolbox/ca-wg/key.pem \
+  --jar-key /etc/secubox/secrets/privacy-jar.key
+
+Restart=on-failure
+RestartSec=5
+
+# Hardening (mirrors the Python worker envelope).
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadOnlyPaths=/etc/secubox
+MemoryHigh=100M
+MemoryMax=128M
+TasksMax=128
+
+[Install]
+WantedBy=multi-user.target

packages/secubox-toolbox-ng/debian/source/format

@@ -0,0 +1 @@
+3.0 (native)