secubox-core.service is a Type=oneshot (mkdir+chown) that RemainAfterExit=yes. A hard
Requires= on ~108 units cascade-stops them all if core is restarted/fails (e.g. a
secubox-core package upgrade) — a thundering-herd outage. After= keeps the ordering;
Wants= keeps the soft dependency without the cascade. Prereq for mass native apply
(Phase 3). Scaffolds (new-module.sh/new-package.sh) updated so future units use Wants=.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Hub + portal stayed `inactive (dead)` on real-hardware boot. The
journal error was `Failed to set up mount namespacing: /run/systemd/
unit-root/run/secubox: No such file or directory` at the NAMESPACE
step. Root cause: 96 services declare `RuntimeDirectory=secubox`
without the matching `RuntimeDirectoryPreserve=yes`. When any of them
stops (including any of the LXC-backed services that fail their
health probe and Restart=on-failure for a few cycles), systemd
removes /run/secubox on the way out. The next service with the same
RuntimeDirectory= that tries to namespace its inputs hits the gap
and falls into 226/NAMESPACE failure — Restart hammers a few times,
then the unit goes failed-permanent.
Earlier fmrelay + sentinelle units got the fix individually
(v2.12.0/v2.12.3 era). Now applied to all 96 remaining units in a
single sweep via:
sed -i '/^RuntimeDirectory=secubox/a RuntimeDirectoryPreserve=yes' "$f"
No version bumps in changelog — `dpkg -i --force-depends` in the
live-USB slipstream picks up the new .deb regardless of version
number.
- Add LogsDirectory=secubox to systemd services for proper logging
- Fix systemd service security sandboxing (remove PrivateTmp issues)
- Replace text icons with emojis in menu.d JSON files
- Fixes navbar display issues (overlapping text from icon names)
Services updated:
- secubox-system, secubox-hub, secubox-portal, secubox-watchdog
- ~70 other services with LogsDirectory directive
Menu icons fixed:
- ipblock, interceptor, cookies, dns-provider, homeassistant, etc.
- Changed from text strings to emojis for proper sidebar display
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add RuntimeDirectory=secubox to all services using ProtectSystem
- Change ProtectSystem=strict to ProtectSystem=full for compatibility
- Add systemd overrides in build script for cached packages
- Create tmpfiles.d entry for /run/secubox
This fixes the namespace issue where services couldn't create sockets
in /run/secubox due to ProtectSystem=strict mount namespacing.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New FastAPI modules migrated from OpenWrt:
- secubox-ad-guard: Adware/tracker detection with device-type stats
- secubox-ndpid: nDPId DPI with JA3/JA4 fingerprinting
- secubox-ai-gateway: OpenAI-compatible local AI API
- secubox-localrecall: Local RAG with Qdrant/Ollama
- secubox-master-link: Node mesh management
- secubox-threat-analyst: AI-powered threat analysis
- secubox-cve-triage: NVD/EPSS CVE triage workflow
- secubox-network-anomaly: IQR-based anomaly detection
- secubox-dns-guard: DNS filtering with RPZ
- secubox-iot-guard: IoT device security & quarantine
- secubox-config-advisor: ANSSI CSPN compliance checks
- secubox-mcp-server: MCP protocol for Claude integration
- secubox-identity: User/role management
- secubox-system-hub: System health & remote support
C library:
- zkp-hamiltonian: Zero-Knowledge Proof library (Blum 1986)
VM configuration:
- MOCHAbin-like 7-NIC topology for libvirt testing
Dev environment:
- VSCode tasks and extensions for SecuBox development
- Claude Code CLAUDE.md project instructions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
