- Install live-boot package and rebuild initramfs with live-boot scripts
- Create squashfs filesystem (878MB) on data partition sda4
- Update boot.scr with live boot parameters (boot=live, toram)
- Fix wiki sidebar links from [[Page|Display]] to [Display](Page)
- Add Eye-Remote wiki page documentation
- Add sync-wiki.sh script for wiki repository sync
- Add patch-multiboot-efi.sh for post-build EFI patching
Partition layout:
- sda1 (512MB): EFI with kernel, initrd, dtbs, boot.scr
- sda2 (3GB): ARM64 rootfs reference
- sda3 (3GB): x86 rootfs for VirtualBox/QEMU
- sda4 (9.5GB): Data + /live/filesystem.squashfs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add test-menu-system job for pytest validation
- Update VERSION to 2.2.0
- Add create_release manual trigger option
- Update release notes with radial menu features
- Change tag pattern to eye-remote-v* for clarity
- Add PR trigger for CI on changes
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Eye-Remote-Hardware.md: GPIO pinout, USB OTG, DPI timings, gadget modes
- Update CI workflow to v2.0.0
- Fix build script: add DNS for chroot network access
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Complete rewrite of build-eye-remote-image.sh for pure offline boot:
- Use QEMU ARM chroot to pre-install all packages at build time
- Expand image by 1GB for pre-installed packages (~500MB)
- Pre-installed: chromium, nginx, lightdm, openbox, python3-pil
- Configure lightdm autologin, openbox autostart, nginx in chroot
- Create secubox user with all groups during build
- No rc.local/firstrun needed - boots directly into kiosk
Build requirements: qemu-user-static, binfmt-support
Boot time comparison:
- v1.8.x: ~10 min (package download required)
- v1.9.0: ~60 sec (ready immediately, no internet)
Closes#30
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Downloads RPi OS Lite automatically
- Builds complete Eye Remote SD card image
- Compresses with xz and generates checksums
- Uploads to releases on version tags
- Supports manual trigger with WiFi/hostname options
- Part of Eye Remote v1.8.0
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-all-live-usb.yml: Check for .img.gz first since build-image.sh
already compresses and removes the .img file
- build-rpi-usb.sh: Handle multiple kernel/initrd files by selecting
the latest version instead of globbing which breaks cp
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
GitHub Actions doesn't allow matrix.* in job-level 'if' conditions.
Moved platform filtering to step-level with skip output variable.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add build-all-live-usb.yml with matrix for x64, EspressoBin V7, and RPi 400
- Update release.yml to include live USB builds in release pipeline
- Add RPi 400 netplan configuration for Ethernet and WiFi
- Deprecate build-live-usb.yml (now wrapper to unified workflow)
Platforms supported:
- x64 (amd64) - GRUB UEFI/BIOS boot
- EspressoBin V7 (arm64) - U-Boot distroboot with embedded eMMC image
- Raspberry Pi 400 (arm64) - Native Pi firmware boot
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Skip signing and deploy steps when secrets are not configured
instead of failing the entire workflow.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add create-qemu-arm64-vm.sh script for ARM64 emulation on x86 hosts
- Add wiki/QEMU-ARM64.md documentation
- Update CI workflows to include RPi 400 and VM scripts in releases
- Update release notes to document all platforms
Platforms now supported:
- MOCHAbin (Armada 7040)
- ESPRESSObin v7/Ultra (Armada 3720)
- Raspberry Pi 400 / Pi 4
- VirtualBox x64
- QEMU ARM64 emulation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add rpi400 to default CI builds in build-image.yml
- Create board/rpi400/config.mk with Pi 400 settings
- Add build-image.sh redirect to build-rpi-usb.sh for RPi boards
- Add boot menu system to build-rpi-usb.sh:
- Normal, Kiosk, Console, Bridge, Minimal modes
- VT100/DEC PDP-style menu interface
- Persistent mode selection across reboots
- systemd integration for early boot
- Fix slipstream in build-rpi-usb.sh:
- Use dpkg --force-depends (pip provides Python deps)
- Skip failing apt-get -f install
- Add more Python dependencies to pip install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-image.yml: Download packages from build-packages workflow
and pass --slipstream flag to include them in images
- build-live-usb.yml: Remove redundant cache copy, improve logging
- release.yml: Update package count from 93 to 124
- build-image.yml: Update package count from 33 to 124
All 124 SecuBox packages will now be slipstreamed into live USB
and system images when built via CI.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Boot Banner Improvements:
- /etc/issue: Gold ASCII art pre-login banner with credentials
- /etc/motd: Colorful LIVE USB banner with access info
- secubox-status: New command showing system overview with CRT colors
- secubox-help: Quick reference for all secubox commands
- secubox-logs: Live security log viewer shortcut
- profile.d: Login status display with mode/service/IP indicators
Mode Switching:
- cmdline-handler: Fixed TUI mode to start (not just enable) service
- secubox-mode: Updated with CRT colors and emoji status indicators
GRUB Menu:
- Kiosk GUI is now default when --kiosk flag used
- All entries have emoji indicators (⚡🖼️📟🌉🛡️💾🚀🔧🚨🐛)
- CRT-style menu colors (cyan on black, yellow highlights)
CI Workflows:
- build-live-usb.yml: Updated boot options and credentials in release notes
- release.yml: Updated to 93 packages, new boot options, correct credentials
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-packages.yml: Add workflow_call with secrets
- build-image.yml: Add workflow_call with inputs, fix matrix for all event types
- publish-packages.yml: Add workflow_call with inputs and secrets
This fixes the release.yml workflow which was failing because it tried
to call these workflows as reusable workflows without the workflow_call
trigger defined.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add c3box binary build alongside secuboxd and secuboxctl
- Pre-build React app for soc-web before dpkg-buildpackage
- Update soc-web debian/rules to skip npm if dist/ pre-built
- Remove nodejs/npm Build-Depends (now pre-built in CI)
Fixes build failures for secubox-daemon and secubox-soc-web packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Node.js 20 setup for secubox-soc-web (requires nodejs >= 18)
- Add Go 1.22 setup for secubox-daemon
- Build Go binaries in CI before dpkg-buildpackage
Fixes CI failures for secubox-daemon and secubox-soc-web.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add kiosk input option to build-live-usb workflow
- Add DEBIAN_FRONTEND=noninteractive to prevent interactive prompts
- Copy debs to .cache/debs for slipstream consistency
- Increase timeout to 90 minutes for kiosk builds
- Use sudo -E to preserve environment
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
fix(live-usb): Improve UEFI boot compatibility
Jitsi module:
- LXC-based Jitsi Meet server
- Prosody + Jicofo + JVB stack
- Authentication support
- Let's Encrypt SSL
- Recording with Jibri
Live USB UEFI fixes:
- Add fallback to pre-built signed EFI
- Copy grubx64.efi for compatibility
- Copy grub.cfg to EFI/BOOT
- Add grub-efi-amd64-signed and shim-signed to CI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-installer-iso.yml: New workflow for hybrid live/installer ISO
- Builds ISO and IMG files
- Slipstreams SecuBox packages
- French AZERTY keyboard support
- DHCP networking on live boot
- Generates wiki documentation
- Creates GitHub release with artifacts
- Triggered on: tag push (v*), workflow_dispatch, after package build
- Publishes: compressed ISO/IMG, SHA256SUMS, GPG signatures
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add chown after sudo build to fix file ownership
- Ensures checksum step can write SHA256SUMS
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove duplicate compression (build-image.sh already creates .gz)
- Fix checksum generation to only look for .img.gz files
- Update artifact upload and release to match
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Skip arm64 builds for Architecture: all packages (redundant)
- Remove QEMU cross-compilation setup (not needed for arch-all)
- Fix missing /esp/live directory in build-live-usb.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add arm64 architecture and install python3-all:arm64
- Detect Architecture: all packages (Python/noarch)
- Use -d flag to skip cross-build deps for arch-all packages
- Fixes secubox-core, secubox-hardening, secubox-repo arm64 builds
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New workflow: .github/workflows/build-live-usb.yml
- Triggers on: workflow_dispatch, tag push, after build-packages success
- Downloads .deb artifacts from build-packages workflow
- Slipstreams all SecuBox packages into live image
- Creates GitHub Release with live USB on tag
Script changes:
- Slipstream enabled by default (all local .deb included)
- Added --no-slipstream option to disable
- All 47+ SecuBox modules included in live USB
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Single-line fromJson expression to avoid YAML parsing issues
- Handle push events (tags) separately from workflow_dispatch
- Build all boards on tag push, selected board on manual dispatch
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-metrics package ported from luci-app-metrics-dashboard
- FastAPI backend with cached system metrics
- Real-time dashboard with live updates
- Overview stats, WAF metrics, connection counts
- Service status monitoring
- Fix CI workflow: add build-essential to apt dependencies
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New modules (35 total):
- secubox-repo v1.0.0: APT repository management
- repoctl CLI for package management
- GPG key generation and signing
- Multi-distribution support (bookworm, trixie)
- Web dashboard for repository status
- secubox-hardening v1.0.0: Kernel and system hardening
- hardeningctl CLI for security management
- Sysctl hardening (ASLR, kptr_restrict, SYN cookies)
- Module blacklist (uncommon protocols, filesystems)
- Security benchmark with 100% score on VM
CI/CD workflows:
- build-packages.yml: Dynamic matrix for all packages
- build-image.yml: 5 board images with compression
- publish-packages.yml: APT repo publishing
- release.yml: Unified release orchestration
APT repository scripts:
- export-secrets.sh: Export GPG/SSH keys for GitHub Actions
- local-publish.sh: Local test server
- install.sh: User installation script
Security (Phase 5):
- AppArmor profiles for all services
- Audit rules for SecuBox services
- build-all.sh for local builds
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Includes all package APIs with public dashboard endpoints:
- secubox-system: System Hub with /info, /resources, /security
- secubox-crowdsec: CrowdSec dashboard with /status, /hub, /metrics, actions
- secubox-wireguard: WireGuard VPN with /interfaces, /peers, start/stop
- secubox-netdata: Monitoring with /stats, /processes, /alerts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
