- README.md: Quick start, architecture, configuration, troubleshooting
- Eye-Remote-Implementation.md: Full wiki with timeline, components,
build system, display config, API reference, lessons learned
Documents the complete Eye Remote v2.0.0 framework implementation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add complete Debian packaging for the Eye Remote management module:
- debian/control: Package metadata and dependencies
- debian/rules: Build script for installing api/core/models/www
- debian/postinst: Service enablement and directory creation
- debian/prerm: Clean service shutdown
- debian/changelog: Initial v2.0.0 release
- debian/secubox-eye-remote.service: Systemd unit with uvicorn
- nginx/eye-remote.conf: Reverse proxy with WebSocket support
- menu.d/50-eye-remote.json: SecuBox dashboard menu entry
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- pairing.py: Remove unused 'secrets' import, use timedelta for safe arithmetic,
make port configurable via SECUBOX_EYE_REMOTE_PORT env var
- devices.py: Add UnpairResponse model for proper OpenAPI documentation
- build-eye-remote-image.sh: Fix glob quoting, add file validation, use symlink
pattern for service enablement, secure config permissions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add FastAPI routers for Eye Remote module:
- devices.py: CRUD operations for paired devices with JWT auth
- pairing.py: QR code generation, discovery, and device pairing
- metrics.py: System metrics endpoint with device token validation
Update main.py to include routers at /api/v1/eye-remote prefix.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements DeviceRegistry class for managing paired Eye Remote devices:
- CRUD operations (add, get, remove, list)
- Thread-safe access via Lock
- JSON file persistence at /var/lib/secubox/eye-remote/devices.json
- Token validation and last_seen timestamp updates
- Singleton pattern for global access
Includes test suite with 8 passing tests covering all operations.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Generate secure device tokens using secrets.token_hex
- Hash tokens with SHA256 (never store plain tokens)
- Verify tokens with constant-time comparison
- Generate 6-char pairing codes
- Create QR code URLs for pairing
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Create the SecuBox-side secubox-eye-remote module structure:
- api/main.py: FastAPI application with health check
- models/device.py: Pydantic models for device management
- Directory structure for routers, core, tests, debian, nginx, www
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 5 USB gadget modes: Normal, Flash, Debug, TTY, Auth
- Add HID keyboard emulation for U-Boot automation
- Add FIDO2/U2F security key mode (Eye Remote)
- Add x64/amd64 live boot support
- Update README.md with Eye Remote documentation
- Update WIKI.md with mode mockups and technical details
- Add INFOGRAPHIC-PROMPT.md for Claude.ai image generation
- Bump version from 1.7.0 to 1.8.0
New files:
- secubox-hid-keyboard.sh: Virtual HID keyboard driver
- INFOGRAPHIC-PROMPT.md: 7 prompts for publicity infographics
Eye Remote transforms the Round UI from a status display
into a full remote control device with debugging, flashing,
and authentication capabilities.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add LogsDirectory=secubox to systemd services for proper logging
- Fix systemd service security sandboxing (remove PrivateTmp issues)
- Replace text icons with emojis in menu.d JSON files
- Fixes navbar display issues (overlapping text from icon names)
Services updated:
- secubox-system, secubox-hub, secubox-portal, secubox-watchdog
- ~70 other services with LogsDirectory directive
Menu icons fixed:
- ipblock, interceptor, cookies, dns-provider, homeassistant, etc.
- Changed from text strings to emojis for proper sidebar display
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Module discovery: Use systemctl list-units instead of list-unit-files
to show only active/loaded modules, not all installed
- Auth router: Remove duplicate /auth prefix (secubox_core.auth already has it)
- Package versions: Cache batch queries to avoid blocking on slow ARM devices
- API paths (api.js): Fix frontend paths to match FastAPI routes
- getStatus -> status
- getModules -> modules
- get_dashboard_data -> dashboard
- etc.
Deployed and verified on EspressoBin V7.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Complete Remote UI implementation for SecuBox status display:
- Python/PIL dashboard with direct framebuffer rendering (no Chromium)
- KMS overlay support (vc4-kms-dpi-hyperpixel2r) - tested working
- USB OTG composite gadget (CDC-ECM + CDC-ACM) for host connection
- 6 concentric rings showing CPU, MEM, DISK, LOAD, TEMP, WiFi metrics
- Auto-start systemd service (secubox-dashboard.service)
- install_zerow.sh for SD card preparation with all fixes
Key fixes discovered during debugging:
- Use KMS overlay, not non-KMS (GPIO conflicts on Bookworm)
- Framebuffer is RGB565 (16-bit), not BGRA
- RPi OS Bookworm requires userconf file for SSH credentials
- NetworkManager ignores ifupdown; use direct IP config
Files:
- secubox_dashboard.py: PIL-based live metrics dashboard
- install_zerow.sh: SD card flasher with KMS overlay
- secubox-dashboard.service: Auto-start systemd unit
- 24 module icons (AUTH/WALL/BOOT/MIND/ROOT/MESH)
Tested on: RPi Zero W + HyperPixel 2.1 Round 480x480
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Dark theme with cyan/teal country highlighting by threat density
- Clickable countries with sidebar showing threat details
- Stats bar: total threats, countries, regions, critical
- Color legend: 1-3, 4-9, 10-19, 20+ threats
- Zoom controls (+/-)
- Continent/country filtering via dropdowns and URL params
- Country flags emoji in sidebar
- Enhanced /map/threats API with filtering support
- SVG map with 30+ countries across 6 continents
Inspired by privacynex.org/map interactive style.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- X11 setup now exits early for bare metal (VM_TYPE=none) without
creating config files - Intel/AMD/NVIDIA auto-detect perfectly
- Remove static fallback 10-modesetting.conf that caused conflicts
- Sanitize GPU_INFO in config comments to remove special chars
- Disable PrivateTmp and ProtectSystem for haproxy, metrics, threats
services - causes Python symlink namespace errors on some kernels
- Add fix-namespace-errors.sh script for quick fixes on running systems
Fixes: X11 "no screens found" on Intel HD Graphics 630
Fixes: "Failed to set up mount namespacing" for Python services
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add IP address discovery to network_summary API endpoint
- Add _get_package_version() helper for fetching installed versions
- Update _svc() to include package versions in status data
- Fix loadNetwork() to use API data instead of hardcoded IPs
- Add loadMemory() and loadDisk() functions for actual used/total values
- Update modules table to display real versions from dpkg
- Make EspressoBin build consistent with AMD64 slipstream (check cache too)
Fixes dashboard showing placeholder values (Memory: -/-, Storage: -/-, etc.)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Noto Color Emoji font-family to all icon elements
- Separate category icon into .cat-icon element with emoji font
- Put 'Noto Color Emoji' first in font stack (installed on live USB)
- Add explicit emoji font installation in build script
- Update both light and dark sidebar themes
Fixes emoji/icon boxes showing as empty squares on real hardware.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Dashboard footer: version, boot mode, auth mode, uptime
- Login page: auth mode badge + version display
- Plymouth splash: version v1.7.0 + boot mode indicator
- GRUB menu: descriptive echo messages for each boot option
- New API endpoints: /boot_mode, /auth_mode, /public/info
- Version bump to 1.7.0 across all components
Phase 11 tasks completed: P11-01 through P11-04, P11-07 through P11-09
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add generate_debug_report() to secubox-kiosk-launcher
- Capture system info, virtualization, graphics hardware
- Log DRM/KMS devices, kernel modules, Xorg status
- Enhanced error reporting with dmesg and VT status
- Debug reports saved to /tmp/kiosk-debug-*.log
- Add v1.6.7.2 overlay installer scripts
- Add emoji font fixes for navbar icons
- Add screenshots for v1.6.7.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove prefix="/auth" from secubox_core/auth.py router definition
- Add prefix="/auth" when including auth_router in hub main.py
- Fixes login endpoint from /auth/auth/login to /auth/login
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create secubox user explicitly in build script before package install
- Configure tmpfiles.d for /run/secubox at boot time
- Add ExecStartPre with + prefix to hub service for root permissions
- Ensure hub.conf created in nginx secubox.d
- Fix service dependency chain (Wants instead of Requires)
- Change UMask to 0002 for proper socket permissions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The auth_router already has prefix="/auth" defined in secubox_core.auth,
so adding prefix="/auth" again when including it caused double path
/api/v1/hub/auth/auth/login instead of /api/v1/hub/auth/login.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add /portal/login.html with CRT-styled login form
- Create default auth.toml in build script for demo credentials
- Credentials: admin / secubox (same as SSH)
- Login page uses existing /api/v1/hub/auth/login endpoint
- Stores JWT in localStorage as sbx_token
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add --nicbootprio1 0 and --nicbootprio2 0 to prevent VirtualBox
from attempting network boot when hard disk boot fails.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Provides common commands:
- secubox status - system and services overview
- secubox services - list all SecuBox services
- secubox logs [svc] - view service logs
- secubox restart/start/stop <svc> - manage services
- secubox info - system information
- secubox network - network configuration
- secubox version - version info
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1. Fix slipstream path: Look for packages in output/ not just output/debs/
- build-image.sh and build-live-usb.sh now check both locations
- 73 packages now properly detected and installed
2. Add ConditionPathExists to 22 optional services:
- Services only start if /etc/secubox/<module>/enabled exists
- Prevents boot failures when backend apps aren't installed
- Affected: ollama, jellyfin, zigbee, lyrion, localai, hexo,
peertube, newsbin, webradio, gotosocial, torrent, domoticz,
simplex, photoprism, homeassistant, matrix, jitsi, voip,
magicmirror, mmpm, jabber, redroid
3. Add explicit parted/fdisk install in live USB build
- Ensures disk tools available for secubox-install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
With set -euo pipefail, find on non-existent directories causes script
failure even with stderr redirected. Add directory existence checks
before running find commands to prevent CI failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Go binaries are cross-compiled (arm64 on x86_64 runner) and already
stripped with -ldflags "-s -w". The native strip tool can't recognize
the ARM64 binary format, causing build failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add tmpfiles.d/secubox.conf with mode 1777 (sticky + world-writable)
- Update postinst to create /run/secubox with correct permissions
- Run systemd-tmpfiles --create on package install
This fixes permission denied errors when services try to create
Unix sockets in /run/secubox directory.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add require_jwt dependency to all public endpoints:
- /dashboard
- /alerts
- /network_summary
- /system_health
- /network_mode (GET)
- /menu
- /board_summary
Only /health remains public for monitoring.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add checkAuth() function to verify token on page load
- Redirect to login if no token present
- Clear invalid tokens on 401 response
- Block page content until auth verified
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New Phase 9 System Tools modules:
- secubox-rtty: Remote terminal access via web interface
- secubox-smtp-relay: SMTP relay status and queue monitoring
- secubox-routes: Routing table viewer with IPv4/IPv6 support
- secubox-reporter: System report generation and scheduling
All modules include:
- FastAPI backend with JWT auth
- P31 Phosphor CRT-style web interface
- Auth verification and auto-refresh
- Nginx reverse proxy configuration
- Systemd service and menu integration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add c3box binary build alongside secuboxd and secuboxctl
- Pre-build React app for soc-web before dpkg-buildpackage
- Update soc-web debian/rules to skip npm if dist/ pre-built
- Remove nodejs/npm Build-Depends (now pre-built in CI)
Fixes build failures for secubox-daemon and secubox-soc-web packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add checkAuth() function to redirect to login if no token
- Check auth before page initialization
- Improve auto-refresh intervals (10-30 seconds)
- Fix token retrieval to check both sbx_token and secubox_token
Fixes auth not requested and auto-refresh issues.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
