- Install live-boot package and rebuild initramfs with live-boot scripts
- Create squashfs filesystem (878MB) on data partition sda4
- Update boot.scr with live boot parameters (boot=live, toram)
- Fix wiki sidebar links from [[Page|Display]] to [Display](Page)
- Add Eye-Remote wiki page documentation
- Add sync-wiki.sh script for wiki repository sync
- Add patch-multiboot-efi.sh for post-build EFI patching
Partition layout:
- sda1 (512MB): EFI with kernel, initrd, dtbs, boot.scr
- sda2 (3GB): ARM64 rootfs reference
- sda3 (3GB): x86 rootfs for VirtualBox/QEMU
- sda4 (9.5GB): Data + /live/filesystem.squashfs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- docs/TOOLS.md: Complete reference of all build/generation tools
- scripts/README.md: Documentation for scripts directory
- remote-ui/README.md: Documentation for remote-ui module
Also fix build-storage-img.sh to use same slipstream logic as
build-ebin-live-usb.sh:
- Search packages in output/debs AND ~/.cache/secubox/debs
- Use dpkg -i --force-depends --force-overwrite (faster)
- Install all packages at once instead of per-package apt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 5 min timeout per package in dpkg-buildpackage calls
- Add 10-20 min timeout for QEMU chroot apt operations
- Add 45 min timeout for sub-script execution
- Add 15 min timeout with retries for wget downloads
- Fix pipe to tail pattern that swallowed exit codes
- Add progress logging for QEMU package installation
- Use writable log directory (output/logs) instead of /tmp
- Add --verbose flag to build-eye-remote-full.sh
- Export VERBOSE for sub-scripts
Fixes hangs caused by:
- dpkg-buildpackage | tail -5 buffering issues
- QEMU chroot apt-get with no timeout
- Network operations with no timeout
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- X11 setup now exits early for bare metal (VM_TYPE=none) without
creating config files - Intel/AMD/NVIDIA auto-detect perfectly
- Remove static fallback 10-modesetting.conf that caused conflicts
- Sanitize GPU_INFO in config comments to remove special chars
- Disable PrivateTmp and ProtectSystem for haproxy, metrics, threats
services - causes Python symlink namespace errors on some kernels
- Add fix-namespace-errors.sh script for quick fixes on running systems
Fixes: X11 "no screens found" on Intel HD Graphics 630
Fixes: "Failed to set up mount namespacing" for Python services
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add generate_debug_report() to secubox-kiosk-launcher
- Capture system info, virtualization, graphics hardware
- Log DRM/KMS devices, kernel modules, Xorg status
- Enhanced error reporting with dmesg and VT status
- Debug reports saved to /tmp/kiosk-debug-*.log
- Add v1.6.7.2 overlay installer scripts
- Add emoji font fixes for navbar icons
- Add screenshots for v1.6.7.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts:
- scripts/run-qemu.sh: Launch SecuBox in QEMU with port forwarding
- scripts/run-vbox.sh: Create and launch SecuBox VM in VirtualBox
Port forwarding (both scripts):
- SSH: localhost:2222 → guest:22
- HTTPS: localhost:9443 → guest:443
- HTTP: localhost:8080 → guest:80
Bug fix:
- secubox-kiosk-launcher: log() now writes to stderr
- Fixes URL corruption when log messages were captured by
command substitution in determine_url()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-all-local.sh: Discover and build ALL 93 packages dynamically
- build-live-usb.sh: Install ALL packages from cache
- List and verify all installed packages during build
- Save installed packages list to /var/lib/secubox/installed-packages.txt
- Add --no-compress option to skip gzip for local testing
- AZERTY keyboard already configured (fr layout)
- Update WebUI URL to use dummy interface (192.168.255.1:9443)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add dummy0 interface with fixed IP 192.168.255.1/24
- Always available for kiosk/local access regardless of DHCP
- Add optional: true to DHCP config to prevent boot blocking
- Add secubox-net-fallback service for link-local IP fallback
- Update kiosk URL to use dummy interface IP
- Fix build-all-local.sh arithmetic expression bug
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added crt-light.css to p2p, zkp, mesh pages
- Fixed body class to crt-light
- Removed duplicate WireGuard menu entry on VM
- Added scripts/fix-navbar.sh for automated navbar integration checks
Required navbar elements:
1. crt-light.css and sidebar-light.css links
2. body class="crt-light"
3. <nav class="sidebar" id="sidebar"></nav>
4. /shared/sidebar.js script
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New files:
- scripts/export-preseed.sh: Export config from running system
- image/preseed-apply.sh: Apply preseed on firstboot
- image/secubox-preseed.service: Systemd service for preseed
Features:
- Export SecuBox config (/etc/secubox/)
- Export network config (netplan, WireGuard)
- Export user accounts and SSH keys
- Export service configs (nginx, HAProxy, CrowdSec)
- Export SSL certificates
- Apply on firstboot with systemd service
Usage:
# On running VM, export config:
./scripts/export-preseed.sh my-config.tar.gz
# Build live USB with preseed:
sudo bash image/build-live-usb.sh --preseed my-config.tar.gz
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Generate README.md for all 45 secubox-* packages with screenshots
- Add multilingual wiki pages (EN, FR, DE, ZH) documenting 47 modules
- Add generate-docs.py tool for documentation generation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use aiohttp to login via API (bypasses browser SSL issues)
- Inject JWT token into browser localStorage
- All 45 modules now captured with proper authentication
- Portal service watchdog needed (keeps dying)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Refreshed all 45 VM module screenshots
- Updated screenshot-tool.py with better login selectors
- Wiki documentation ready in docs/wiki/
- secubox-debian-ui.md
- secubox-openwrt-ui.md
- UI-COMPARISON.md
Screenshots gallery: docs/SCREENSHOTS-VM.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New modules (35 total):
- secubox-repo v1.0.0: APT repository management
- repoctl CLI for package management
- GPG key generation and signing
- Multi-distribution support (bookworm, trixie)
- Web dashboard for repository status
- secubox-hardening v1.0.0: Kernel and system hardening
- hardeningctl CLI for security management
- Sysctl hardening (ASLR, kptr_restrict, SYN cookies)
- Module blacklist (uncommon protocols, filesystems)
- Security benchmark with 100% score on VM
CI/CD workflows:
- build-packages.yml: Dynamic matrix for all packages
- build-image.yml: 5 board images with compression
- publish-packages.yml: APT repo publishing
- release.yml: Unified release orchestration
APT repository scripts:
- export-secrets.sh: Export GPG/SSH keys for GitHub Actions
- local-publish.sh: Local test server
- install.sh: User installation script
Security (Phase 5):
- AppArmor profiles for all services
- Audit rules for SecuBox services
- build-all.sh for local builds
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added all new packages to the build script in dependency order:
- Core: portal, system
- Security: waf
- Network: haproxy, dns
- Publishing: droplet, streamlit, streamforge, metablogizer, publish
- Email: mail, mail-lxc, webmail, webmail-lxc, users
All 30 packages build and deploy successfully.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Includes all package APIs with public dashboard endpoints:
- secubox-system: System Hub with /info, /resources, /security
- secubox-crowdsec: CrowdSec dashboard with /status, /hub, /metrics, actions
- secubox-wireguard: WireGuard VPN with /interfaces, /peers, start/stop
- secubox-netdata: Monitoring with /stats, /processes, /alerts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
