Commit Graph

5 Commits

Author SHA1 Message Date
CyberMind
64f89ebf43
fix(secubox-soc-web): remove duplicate /soc/ location from nginx snippet (closes #163) (#166)
The snippet at `debian/secubox-soc-web.nginx.conf` (installed to
`/etc/nginx/secubox.d/soc-web.conf`) declared `location /soc/` —
duplicating the same location that already exists inline in
`secubox-hub`'s `sites-enabled/webui.conf`. Combined with a third orphan
file `/etc/nginx/secubox.d/soc.conf` (from a now-removed package — no
source in the repo), this triple-defined `/soc/` in a single server
block, making every `nginx -t` fail with:

  [emerg] duplicate location "/soc/" in /etc/nginx/secubox.d/soc.conf:3

That failure silently no-op'd every `systemctl reload nginx` for days,
until a full `systemctl restart nginx` finally surfaced it (during the
#156 deploy — 4-min outage cascade with #162).

Fix:
  - The `/soc/` static-serving block is removed from this package's
    snippet. The block in webui.conf (owned by secubox-hub) is the
    canonical static serving location.
  - The unique `/api/v1/soc-gateway/` proxy is preserved here — that's
    legitimately specific to soc-web.

Operator note: any orphan `/etc/nginx/secubox.d/soc.conf` on existing
boards must be cleaned manually (no package owns it).

Changelog bumped to 1.1.1-1.

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 07:53:00 +02:00
bd7dda0c6f feat(secubox): complete meta-script generator Tasks 14-17
Task 14: Arch Profiles
- Add profiles/arch/arm64.yaml and profiles/arch/amd64.yaml
- Add ResolveWithArch() to merger for base → arch → tier chain
- Add tests for arch profile resolution

Task 15: Package secubox.yaml for All Packages
- Add scripts/generate-secubox-yaml.py generator script
- Generate 131 debian/secubox.yaml files with:
  - Category detection (security, network, system, etc.)
  - Tier assignment (all, lite, standard, pro)
  - API socket and UI path detection

Task 16: APT Repository Setup
- Add apt/conf/ reprepro configuration (multi-arch arm64/amd64)
- Add apt/hooks/lintian-check pre-publish validation
- Add scripts/apt-publish.sh and scripts/apt-sync.sh
- Add apt/README.md documentation

Task 17: CI Integration
- Add .github/workflows/build-secubox-cli.yml
- Build for linux-amd64 and linux-arm64
- Version injection via ldflags
- GitHub releases on tag push

Code Quality Fixes (Tasks 10-13):
- Add atomic writes for OTA boot control files (0600 perms)
- Fix NVME device extraction (nvme0n1p2 → nvme0n1)
- Add scanner.Err() checks in hardware detection
- Fix URL injection validation in fetch command
- Add proper cleanup on checksum failures

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-05-11 05:32:29 +02:00
8abe743c40 fix(ci): Build Go c3box binary and pre-build soc-web in CI
- Add c3box binary build alongside secuboxd and secuboxctl
- Pre-build React app for soc-web before dpkg-buildpackage
- Update soc-web debian/rules to skip npm if dist/ pre-built
- Remove nodejs/npm Build-Depends (now pre-built in CI)

Fixes build failures for secubox-daemon and secubox-soc-web packages.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-04 07:56:45 +02:00
9115d9cbf2 fix(nginx): Move location configs to secubox.d directory
- secubox-repo: /etc/nginx/snippets/ → /etc/nginx/secubox.d/repo.conf
- secubox-soc-web: /etc/nginx/sites-available/ → /etc/nginx/secubox.d/soc-web.conf
- Remove symlink creation/removal in soc-web postinst/prerm

Location blocks must be inside a server block. The secubox.d/ directory
is included via `include /etc/nginx/secubox.d/*.conf;` in the main
server block, not at http context level like conf.d/.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-03 04:34:02 +02:00
f5b114590c feat(soc): Add hierarchical SOC system with multi-tier deployment
Implements complete Security Operations Center architecture with:

Phase 1-4: Base SOC packages
- secubox-soc-agent: Edge node metrics collector with HMAC-signed push
- secubox-soc-gateway: Central aggregation hub with node registry
- secubox-console: TUI dashboard with SOC screens (fleet/alerts/node)
- secubox-soc-web: React web dashboard with cyberpunk theme

Phase 5: Hierarchical Mode
- Mode configuration (edge/regional/central)
- Regional SOC enrollment with token-based auth
- Regional-to-central aggregation with signed push
- Cross-region threat correlation
- Global view for central SOC with regional breakdown

New packages: secubox-soc-agent, secubox-soc-gateway, secubox-soc-web
Updated: secubox-console v1.1.0

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-01 07:08:08 +02:00