secubox-net-detect.service runs on first boot (gated by
!/var/lib/secubox/.net-configured) and REWRITES /etc/netplan/00-secubox.yaml
based on the detected board layout. The "no LAN interfaces" branch
in generate_netplan() was emitting an empty br-lan bridge with a
static 192.168.1.1/24 address. On single-NIC live USB hardware that
made systemd-networkd happily honour the phantom bridge while the
real WAN NIC fell off the DHCP path — the operator saw a working
br-lan in `ip a` but no upstream IP and no internet.
Same shape of bug as the v2.12.7 build-live-usb.sh static-in-DHCP
regression (commit a88c1773): a useless static IP on a non-routing
interface confused networkd into "I'm done, no DHCP needed". Fix:
when there are no LAN interfaces, emit NO bridges block at all.
Operators wire br-lan later via secubox-net-* tools once they've
decided the box is a router vs an endpoint.
Live USB v2.12.4 boot showed `secubox-kiosk-setup enable --x11` running
for 5+ minutes while the kiosk.service stayed `inactive (dead)`. The
synchronous `systemctl start secubox-kiosk.service` at the end of
enable_kiosk was hanging.
Root cause: secubox-kiosk.service declares
Conflicts=getty@tty7.service
TTYPath=/dev/tty7
systemd waits for tty7 to be released and for the conflicting unit's
JobsToStart to clear before kiosk's ExecStart can fire. When the call
comes from a process running inside the tty1 autologin shell (which
is what firstboot.sh's `secubox-kiosk-setup enable --x11` safety net
does), systemd deadlocks itself waiting on a tty operation the caller
can't unblock. The kiosk service appears to start fine when triggered
manually from SSH (proven during debug — once the stuck setup PID was
killed, `systemctl start secubox-kiosk.service` returned in <1s and
the service activated cleanly).
Fix: pass --no-block so systemctl returns as soon as the job is
queued, regardless of the tty wait. systemd then runs the start in
the background after the parent autologin shell exits, breaking the
loop. The exit-code branch is preserved for legitimate failures.
On bare-metal x86_64 with the v2.10.0 image, chromium's zygote crashes
in a restart loop:
ERROR:content/browser/zygote_host/zygote_host_impl_linux.cc(...):
... disabled unprivileged user namespaces with AppArmor,
... you can try using --no-sandbox.
Debian 12 ships AppArmor with the `unprivileged_userns` profile that
restricts the unprivileged user namespace creation chromium's zygote
needs to set up its renderer sandbox. The kernel sysctl
`kernel.unprivileged_userns_clone` is `1`, but the AppArmor profile
whitelists only known binaries — chromium launched as the
`secubox-kiosk` user doesn't match.
`secubox-kiosk-launcher:443-451` only passed `--no-sandbox` for VM
targets (`systemd-detect-virt` non-`none`). On bare metal it omitted
the flag, so the zygote died on every launch → systemd restart loop
until MAX_FAILURES=3 disabled the kiosk and left X11 stranded on VT7.
Drop `--no-sandbox` from both branches. The SecuBox kiosk runs as a
dedicated unprivileged user on a single VT, AppArmor still enforces
its per-process chromium profile, and the appliance sits behind its
own WAF — chromium's internal sandbox provides marginal additional
security here while breaking the kiosk entirely.
Validated path: VBox kiosk continues to work; bare-metal x86_64 will
reach the SecuBox login form after this fix.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
VMs with multiple interfaces (NAT + host-only) now correctly configure
all interfaces with DHCP instead of creating a br-lan bridge that
conflicts with VBox's host-only DHCP server.
Changes:
- Add dedicated x64-vm case in get_interface_config()
- Set profile="vm" for VMs to trigger single mode (no bridge)
- In generate_netplan(), detect x64-vm board and configure ALL
physical interfaces with DHCP instead of WAN-only
- VM profile forces mode="single" in main() to skip bridge creation
This fixes host-only network access for VirtualBox VMs while
preserving router/bridge functionality for baremetal deployments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix vm_type variable sanitization in kiosk launcher
- Enhance network detection for AMD64 hardware
- Improve build-live-usb service configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Problem: IP assignment failures on bare metal AMD64 due to broken
netplan wildcard syntax - using wan0: with match: name: "e*" but
no set-name: directive caused conflicts on multi-interface systems.
Solution:
- Split single e* pattern into separate en* and eth* matches
- Different route metrics (100/200) for deterministic routing
- Added br-lan bridge pre-definition for router mode
- Enhanced secubox-net-detect with better logging and patterns
- New secubox-net-reset utility for forcing re-detection
Changes:
- board/x64-live/netplan/00-secubox.yaml: Fixed bootstrap config
- image/build-live-usb.sh: Updated embedded netplan with same fix
- image/sbin/secubox-net-detect: Enhanced interface detection
- image/sbin/secubox-net-reset: New utility script
- CLAUDE.md: Added Debian shell scripting guidelines
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Eye Remote Interactive UI enhancements:
- TTY mode: Serial terminal display from /dev/ttyGS0
- Flash mode: Progress bar with speed/ETA for USB transfers
- Auth mode: QR code generation for backup authentication
- Mode detection via /etc/secubox/gadget-mode
Hub service VM compatibility fix:
- Changed from Unix socket to TCP port 8001
- Updated nginx configs for TCP proxy
- Fixes 502 errors in VirtualBox VMs
Also includes:
- FAQ/Troubleshooting wiki page with GitHub issue links
- Kiosk launcher --no-sandbox fix for VMs
- Profile Generator GUI mockup
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Complete Remote UI implementation for SecuBox status display:
- Python/PIL dashboard with direct framebuffer rendering (no Chromium)
- KMS overlay support (vc4-kms-dpi-hyperpixel2r) - tested working
- USB OTG composite gadget (CDC-ECM + CDC-ACM) for host connection
- 6 concentric rings showing CPU, MEM, DISK, LOAD, TEMP, WiFi metrics
- Auto-start systemd service (secubox-dashboard.service)
- install_zerow.sh for SD card preparation with all fixes
Key fixes discovered during debugging:
- Use KMS overlay, not non-KMS (GPIO conflicts on Bookworm)
- Framebuffer is RGB565 (16-bit), not BGRA
- RPi OS Bookworm requires userconf file for SSH credentials
- NetworkManager ignores ifupdown; use direct IP config
Files:
- secubox_dashboard.py: PIL-based live metrics dashboard
- install_zerow.sh: SD card flasher with KMS overlay
- secubox-dashboard.service: Auto-start systemd unit
- 24 module icons (AUTH/WALL/BOOT/MIND/ROOT/MESH)
Tested on: RPi Zero W + HyperPixel 2.1 Round 480x480
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Same fix as build-live-usb.sh X11 setup - the kiosk launcher was also
creating X11 config files that corrupted on bare metal.
- Skip config creation entirely for bare metal (vm_type=none)
- Intel/AMD/NVIDIA auto-detection works perfectly without configs
- Sanitize gpu_info for VMs (remove special chars)
- Only create explicit driver configs for VMs that need them
Fixes: "M2G_" parse error in /etc/X11/xorg.conf.d/10-kiosk.conf
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create secubox-x11-setup.service for boot-time VM/driver detection
- VirtualBox VMSVGA controller requires vmware X11 driver (not modesetting)
- Add driver selection: VBox+VMSVGA→vmware, VBox+VBoxVGA→modesetting
- Update secubox-kiosk.service to depend on x11-setup service
- Update secubox-kiosk-launcher v3.3 to defer to setup service
- Change SLIPSTREAM_DEBS default to 1 (126 packages by default)
- Fix EspressoBin live USB boot partition sizing for embedded images
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Dashboard footer: version, boot mode, auth mode, uptime
- Login page: auth mode badge + version display
- Plymouth splash: version v1.7.0 + boot mode indicator
- GRUB menu: descriptive echo messages for each boot option
- New API endpoints: /boot_mode, /auth_mode, /public/info
- Version bump to 1.7.0 across all components
Phase 11 tasks completed: P11-01 through P11-04, P11-07 through P11-09
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Problem: VirtualBox with VMSVGA shows as "VMware SVGA" in lspci,
causing wrong driver selection and X11 failure.
Fix: Use systemd-detect-virt as primary VM detection:
- "oracle" → VirtualBox → vboxvideo driver
- "vmware" → VMware → vmware driver
- "kvm"/"qemu" → KVM/QEMU → modesetting driver
- Fall back to lspci for bare metal
Also loads vboxsf module for shared folders support.
Addresses #27
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fixes:
- Add fallback EFI bootloader at /EFI/BOOT/BOOTX64.EFI for Lenovo/HP/Dell
- Add --slipstream flag to build-live-usb.sh (CI fix)
- Fix banner alignment in secubox-flash-disk
- Update kiosk launcher to v1.6.7.12
Wiki:
- Use generic /releases/latest/download/ URLs (no more hardcoded versions)
- Fix script paths (scripts/ → image/)
- Update all languages (EN, FR, DE, ZH)
Tested: Lenovo hardware install - PASSED
Closes#26
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Root cause: GRUB Kiosk entry used systemd.unit=graphical.target
but no display manager was installed. systemd waited forever
for graphical.target → getty never started → no keyboard input.
Fixes:
- Remove systemd.unit=graphical.target from Kiosk GRUB entry
- Revert getty Type=idle to simple service (v1.6.7.3)
- Enable backup TTYs (tty2-6) for emergency access
Closes#24
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add generate_debug_report() to secubox-kiosk-launcher
- Capture system info, virtualization, graphics hardware
- Log DRM/KMS devices, kernel modules, Xorg status
- Enhanced error reporting with dmesg and VT status
- Debug reports saved to /tmp/kiosk-debug-*.log
- Add v1.6.7.2 overlay installer scripts
- Add emoji font fixes for navbar icons
- Add screenshots for v1.6.7.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove prefix="/auth" from secubox_core/auth.py router definition
- Add prefix="/auth" when including auth_router in hub main.py
- Fixes login endpoint from /auth/auth/login to /auth/login
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create /etc/secubox/users.json with admin user on firstboot
- Default password: secubox (instead of random)
- SHA256 hash password same as portal expects
- Hide Chromium --ignore-certificate-errors warning with --test-type
Credentials: admin / secubox
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Start Xorg as root directly (required for VT allocation)
- Add proper Xauthority setup with magic cookie
- Explicit chvt 7 to switch to graphical VT
- Wait for X11 socket before launching session
- Run session as kiosk user with correct environment
- Add extensive debug logging
Tested in QEMU: Xorg starts, Chromium runs fullscreen
Version: v1.6.6
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove --no-sandbox from Chromium to eliminate warning banner
- Add --disable-infobars to hide any remaining info bars
- Add X11 InputClass sections for libinput keyboard/pointer/touchpad
- Set AutoAddDevices=true, AllowEmptyInput=false in ServerFlags
- Restore 'splash' to kernel cmdline for Plymouth boot splash
- Update version strings to 1.6.5
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Plymouth:
- New secubox-3d theme with nested cubes + triple lemniscate
- 3 cubes (outer/middle/inner) with desync rotation
- AUTH/MIND/MESH colored lemniscates with glowing heads
- SecuBox color palette integration
Kiosk:
- Fix session script: use --start-fullscreen (not --kiosk)
- Allows Ctrl+Alt+Fn VT switching
- Clean exec chromium (no background process issues)
- Consistent session between build script and launcher
Build:
- Version bump to 1.6.3
- Plymouth theme set to secubox-3d
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
secubox-flash-disk:
- Add efibootmgr verification after GRUB EFI install
- Show manual fix instructions if EFI entry not created
- Mount /dev/pts for chroot compatibility
- Pass target device to grub-install
- Better error handling and summary
netplan (x64-live):
- Remove invalid routes (via: 0.0.0.0)
- Add dhcp4-overrides for proper DNS/routes
- Rename wan to wan0 to avoid conflicts
Fixes Error 1962 on Lenovo ThinkCentre M710q
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Plymouth: Integrate secubox-cube theme with 3D rotating module icons
- Auth: Create users.json for portal login (admin/secubox)
- flash-disk: Fix 'local' outside function error on line 236
- netplan: Add br-lan/wan structure for x64-live mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create secubox-flash-disk tool for flashing to internal storage
- Smart device detection (NVMe, SATA, eMMC, VirtIO)
- Safety checks to prevent flashing boot device
- Interactive device selection with disk info
- Progress display with pv or dd status
- Optional root partition resize to fill disk
- Checksum verification support
- Update secubox-console-tui with x64 flash support
- Add is_live_x64() detection function
- Add flash_disk() function calling secubox-flash-disk
- Show 'd' key option when running x64 live
- Update build-live-usb.sh with --embed-image option
- Bundle target image in /secubox/ for disk installation
- Auto-generate checksum if not present
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New components for bootable live USB with eMMC flashing capability:
- image/build-ebin-live-usb.sh: Build script for ARM64 live USB
- SquashFS-based live filesystem
- Cross-compilation support via QEMU
- Optional embedded eMMC image for flashing
- Distroboot configuration for U-Boot
- image/sbin/secubox-flash-emmc: Interactive eMMC flasher
- Safety checks (won't flash if running from eMMC)
- Progress display and checksum verification
- Auto mode for unattended installation
- Dry-run option for testing
- board/espressobin-v7/boot-live-usb.cmd: U-Boot boot script
- USB boot priority configuration
- Live-boot kernel parameters
- board/espressobin-v7/extlinux/extlinux.conf: Distroboot menu
- Live, To-RAM, Flash, and Rescue boot options
- Updated secubox-console-tui with "Flash to eMMC" menu option
Usage:
# Build eMMC image first
sudo bash image/build-image.sh --board espressobin-v7
# Build live USB with embedded image
sudo bash image/build-ebin-live-usb.sh \
--embed-image output/secubox-espressobin-v7-bookworm.img.gz
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change kiosk URL from 192.168.255.1:9443 to https://localhost/
- Kiosk now works without network (localhost always available)
- Remove port 9443 (nginx listens on 443 internally)
- Update URL priority: localhost first, then 127.0.0.1
Fixes kiosk white screen on real hardware (Lenovo) where
dummy0 interface may not be configured.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts:
- scripts/run-qemu.sh: Launch SecuBox in QEMU with port forwarding
- scripts/run-vbox.sh: Create and launch SecuBox VM in VirtualBox
Port forwarding (both scripts):
- SSH: localhost:2222 → guest:22
- HTTPS: localhost:9443 → guest:443
- HTTP: localhost:8080 → guest:80
Bug fix:
- secubox-kiosk-launcher: log() now writes to stderr
- Fixes URL corruption when log messages were captured by
command substitution in determine_url()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- cmdline-handler: Use systemctl mask to prevent kiosk startup
- cmdline-handler: Kill X11/Chromium if already running
- cmdline-handler: Create generator drop-in for correct target
- kiosk.service: Wait for cmdline handler before starting
- tui.service: Wait for cmdline handler before starting
Fixes: TUI boot menu option was loading Kiosk GUI instead
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Boot Banner Improvements:
- /etc/issue: Gold ASCII art pre-login banner with credentials
- /etc/motd: Colorful LIVE USB banner with access info
- secubox-status: New command showing system overview with CRT colors
- secubox-help: Quick reference for all secubox commands
- secubox-logs: Live security log viewer shortcut
- profile.d: Login status display with mode/service/IP indicators
Mode Switching:
- cmdline-handler: Fixed TUI mode to start (not just enable) service
- secubox-mode: Updated with CRT colors and emoji status indicators
GRUB Menu:
- Kiosk GUI is now default when --kiosk flag used
- All entries have emoji indicators (⚡🖼️📟🌉🛡️💾🚀🔧🚨🐛)
- CRT-style menu colors (cyan on black, yellow highlights)
CI Workflows:
- build-live-usb.yml: Updated boot options and credentials in release notes
- release.yml: Updated to 93 packages, new boot options, correct credentials
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-install script for interactive disk installation
- Add "Install SecuBox to Disk" GRUB menu entry
- Add secubox.install=1 kernel parameter support
- Auto-launch installer when booted with install option
The installer:
- Lists available disks with size and model
- Asks for confirmation before wiping
- Creates GPT partitions (ESP + root + data)
- Copies live filesystem to disk
- Installs GRUB bootloader (UEFI + BIOS)
- Generates proper fstab
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Change AutoAddDevices and AutoEnableDevices to true so that
VirtualBox mouse integration and USB tablet are properly detected
by libinput.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add HTTP server block in nginx for localhost/127.0.0.1/192.168.255.1
- Change kiosk default URL from https:// to http:// (avoids SSL issues)
- Add fallback index.html creation in build script
- Ensures nginx has content to serve even if packages fail to install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-mode script to switch between kiosk/tui/console
- Add secubox.mode= kernel parameter support (tui, console)
- Add "SecuBox Live (Console TUI)" GRUB menu entry
- TUI mode is secondary, kiosk mode is default
Boot parameter examples:
secubox.mode=tui - Start with console TUI
secubox.mode=console - Drop to login shell
(default) - Kiosk GUI mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix SSL cert generation: run openssl on host, not in chroot
(chroot lacks /dev/urandom access)
- Add secubox-console-tui for text-based dashboard
- Add TUI mode to kiosk-launcher (x11, wayland, tui)
- Add secubox-console-tui.service
- Copy TUI script in build process
Fixes nginx "localhost refused to connect" in kiosk mode.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Changed default KIOSK_URL from https://192.168.255.1:9443/ to https://localhost/
- nginx listens on localhost, so this is more reliable
- Fallback URL updated to https://127.0.0.1:9443/
- Applies to both kiosk-launcher script and build-live-usb.sh template
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Detect VirtualBox VMSVGA graphics adapter and use vmware X11 driver
- Add HTTP URL fallbacks when HTTPS is not available
- Remove problematic fbdev fallback config in VMs (causes conflicts)
- Improve VM graphics detection (vmsvga vs vboxvga)
Tested with VirtualBox 7.x + VMSVGA + Chromium kiosk mode.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace non-existent SecuBoxHeader with BoardHeader in SOC screens.
Remove unused get_board_colors import.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- X server requires 'allowed_users=anybody' when started from systemd
- Without this, error: "Only console users are allowed to run the X server"
- Added to both secubox-kiosk-setup and build-live-usb.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Cage/Wayland fails on VirtualBox/VMware with "Basic output test failed"
- X11/startx mode works reliably on VMs and most hardware
- secubox-kiosk-setup now supports --x11 (default) and --wayland flags
- Added secubox-kiosk-wayland.service for native Wayland users
- Updated build-live-usb.sh to use X11 kiosk with .xinitrc
- Mode saved in /var/lib/secubox/.kiosk-mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Systemd evaluates ConditionPathExists before the cmdline handler
creates .kiosk-enabled, causing service to fail. Now explicitly
starts the service after setup.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 10s timeout to secubox-cmdline.service
- Add 5s timeout to netplan apply
- Remove pipefail to allow graceful failures
- Scripts now continue on non-critical errors
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add dummy0 interface with fixed IP 192.168.255.1/24
- Always available for kiosk/local access regardless of DHCP
- Add optional: true to DHCP config to prevent boot blocking
- Add secubox-net-fallback service for link-local IP fallback
- Update kiosk URL to use dummy interface IP
- Fix build-all-local.sh arithmetic expression bug
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Chromium now runs in native Wayland mode instead of Xwayland,
reducing dependencies and improving performance.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
