The webui/API runs unprivileged (secubox); operations touching root-owned config
or driving systemd/LXC/apps MUST delegate to the root helper secubox-<module>ctl
via scoped exact-command sudoers (shipped by the package), which acts as root and
audits each change. Documented in MODULE-COMPLIANCE (authoritative), MODULE-GUIDELINES
§7 (CTL), WEBUI-PANEL-GUIDELINES, and wiki/Architecture. Ref: secubox-cvectl fix.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
19 piped wiki-links (navbar Modules, Home pages, Architecture, Live-USB, etc.)
were written MediaWiki-style (target first) so they resolved to absent pages
(e.g. Modules link → /wiki/Modules 'absent' instead of /wiki/MODULES-EN).
Reversed all to Gollum order [[display|target]].
Anchor the pattern that secubox-lyrion v1.1.0 demonstrated (admin
static page on the canonical hub vhost + real app served at the root
of its own dedicated vhost) as a REQUIRED rule across the docs:
- docs/MODULE-GUIDELINES.md §4 — new "REQUIRED: dual-vhost pattern"
subsection with the URL table, the JS pattern for reading the
public URL from /access, and the explicit forbidden anti-pattern
(`proxy_pass /<module>/ → app LXC`).
- docs/MODULE-GUIDELINES.md §5 — nginx template updated: `/<module>/`
is `alias` (static), the dedicated vhost is a separate file. The
previous "Iframe pattern for LXC web UIs" + "LXC daemon iframe
target" sections are flagged deprecated.
- .claude/PATTERNS.md Pattern 12 — same rule reproduced for the
Claude-facing pattern catalog with the source-of-truth JS snippet.
- .claude/HISTORY.md + .claude/WIP.md — entry for today's three-
module alignment (lyrion 1.1.0 + zigbee + authelia).
- wiki/Architecture.md — short reference + pointer back to
MODULE-GUIDELINES.
- packages/secubox-lyrion/README.md — adds the URLs table at the top.
- packages/secubox-zigbee/README.md — was a verbatim copy of the
lyrion README, rewritten as a proper zigbee README with the new
URLs table + API surface + ports + files.
- packages/secubox-authelia/README.md — Quickstart points at
sso.gk2.secubox.in (was auth.maegia.tv); URLs table added.
The forbidden anti-pattern catches LMS Material, Nextcloud,
Grafana, z2m and any future module whose UI uses absolute asset
URLs — incident on gk2 2026-05-24, see secubox-lyrion 1.1.0
changelog.
