secubox-core.service is a Type=oneshot (mkdir+chown) that RemainAfterExit=yes. A hard
Requires= on ~108 units cascade-stops them all if core is restarted/fails (e.g. a
secubox-core package upgrade) — a thundering-herd outage. After= keeps the ordering;
Wants= keeps the soft dependency without the cascade. Prereq for mass native apply
(Phase 3). Scaffolds (new-module.sh/new-package.sh) updated so future units use Wants=.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Lets the SecuBox Companion extension install YouTube cookies with one click.
- api/main.py: POST /import/cookies (require_jwt) — accepts the Netscape
cookies body, spools to /run/secubox/peertube-yt-cookies.txt, then escalates
via a single narrowly-scoped sudoers rule to `peertubectl set-youtube-cookies`
(installs into the LXC, enables import cookies, restarts PeerTube).
- debian/secubox-peertube.sudoers: secubox → NOPASSWD exactly
`peertubectl set-youtube-cookies /run/secubox/peertube-yt-cookies.txt`.
- service unit: drop NoNewPrivileges (would block sudo); documented why.
- rules: install sudoers 0440; control: Depends sudo.
Deployed + verified on gk2 (route 401s unauth, sudoers scoped, secubox can
spool, NoNewPrivileges=no).
Aligns the package with what's actually deployed on gk2 (validated live at
https://peertube.gk2.secubox.in/, upload confirmed) and adds yt-dlp URL import.
- lib/peertube/install-lxc.sh (NEW): idempotent native PeerTube install in a
dedicated Debian LXC (10.100.0.120 on br-lxc), mirroring grafana/yacy. Bakes
in every fix from the live bring-up: Node 22 via signed NodeSource repo (8.x
needs >=22, no curl|bash); pnpm with MSGPACKR_NATIVE_ACCELERATION_DISABLED=1
(arm64); debian.common.conf template (postgres-15 needs it); bind mounts
/data/peertube/{storage,config,postgres,redis} chown'd to LXC root UID;
production.yaml patch (listen 0.0.0.0:9000, https/hostname/443, secret, db,
admin email, import.videos.http.enabled=true); captures first-boot root
password to /etc/secubox/secrets/peertube-admin.
- sbin/peertubectl (NEW): install/status/start/stop/restart/logs/reload.
- conf/peertube.nginx.conf (folds #390, port corrected to LXC :9000 not the
stale 127.0.0.1:9001 Docker-on-host plan): public vhost :9080 -> 10.100.0.120
:9000, 8G uploads, 7d streaming timeouts, WS, ACME; WAF-bypass (gitea pattern).
- api/main.py: talk to the native instance over HTTP at <lxc_ip>:<http_port>
with Host: <public_hostname> header (PeerTube 403s on raw-IP Host) instead of
podman/docker exec; status reports real LXC state + reachability; /container/*
drive the LXC via peertubectl; NEW POST /import + GET /imports.
- www/peertube/index.html: new "Import" tab (URL + channel + privacy + recent
imports); status/labels/links corrected for native-LXC.
- debian/control + service: reframe Docker/Podman -> native-LXC; drop
Wants=podman/docker. conf/peertube.toml.example (NEW). README + changelog 1.1.0.
secubox-peertube 1.0.0 had been removed from gk2 and could not be
cleanly reinstalled: hardcoded /srv/peertube path (predates #319),
service unit blocked from starting by ConditionPathExists, broken
Requires=secubox-runtime.service, root user with ExecStartPost
chmod hacks, postinst didn't tolerate masked units, no /data
migration block.
Reworked to current SecuBox patterns (mirror gitea/wazuh):
api/main.py — default data_path /srv/peertube → /data/peertube
(5 hardcoded fallbacks updated in lockstep, Pydantic model
default updated, top-level DEFAULT_CONFIG updated).
debian/secubox-peertube.service — drop ConditionPathExists gate
so the API daemon is always reachable to serve the dashboard
(the heavy PeerTube container is still operator-deployed on
demand via the dashboard); User=root → User=secubox + Group=
secubox; replace ExecStartPost chmod/chown hacks with
RuntimeDirectory=secubox + RuntimeDirectoryPreserve=yes +
RuntimeDirectoryMode=0775 + UMask=0000 (mass-redeploy safety);
drop the broken Requires=secubox-runtime.service (no such
service); reorder Wants= to podman.service docker.service;
add ReadWritePaths covering /run/secubox /var/lib/secubox
/etc/secubox /var/log/secubox /data/peertube.
debian/postinst — add #319 /data migration block (mirror gitea
pattern from aba60ae3); wrap systemctl enable in is-enabled
!= masked check (per wazuh fix 63284497) so a deliberately
masked unit no longer fails the postinst; drop the hardcoded
/srv/peertube/{storage,config,data} mkdir (the API creates
these on first container/install so PeerTube's UID/GID can own
them); nginx reload guarded by `nginx -t`.
debian/control — Description rewritten with cross-references
to the other federated/streaming/media SecuBox packages
(matrix, jitsi, jellyfin, gotosocial, simplex); Recommends
reordered to podman first (smaller, distro-native), docker.io
second; explicit note that the API daemon is lightweight and
always reachable while the container is operator-deployed.
Verified on gk2 (root@192.168.1.200):
- apt install podman secubox-peertube_1.0.1-1~bookworm1_all.deb
succeeded.
- systemctl is-active secubox-peertube → active
- /run/secubox/peertube.sock created srw-rw-rw- secubox:secubox
(no ExecStartPost chmod hacks needed)
- curl --unix-socket /run/secubox/peertube.sock http://x/health
→ {"status":"ok","module":"deb"}
- podman 4.3.1 installed and ready for container/install when
operator triggers it via dashboard
- /data/peertube preserved (existing symlink /srv/peertube →
/data/peertube intact)
Not done in this rework (out of scope per issue):
- Actually installing the PeerTube container on gk2 (1G RAM
free, operator's call).
- peertubectl LXC controller — package is Docker/Podman-based
by design.
- Frontend rewrite (1154-LOC dashboard stays as-is).
- Adding to secubox-full/-lite metapackages.
Changed /usr/local/bin/uvicorn to /usr/bin/python3 -m uvicorn
for compatibility across different Python installation methods.
Also fixed JWT auth import in eye-remote boot_media router.
Affected: 31 service files across 30 packages
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1. Fix slipstream path: Look for packages in output/ not just output/debs/
- build-image.sh and build-live-usb.sh now check both locations
- 73 packages now properly detected and installed
2. Add ConditionPathExists to 22 optional services:
- Services only start if /etc/secubox/<module>/enabled exists
- Prevents boot failures when backend apps aren't installed
- Affected: ollama, jellyfin, zigbee, lyrion, localai, hexo,
peertube, newsbin, webradio, gotosocial, torrent, domoticz,
simplex, photoprism, homeassistant, matrix, jitsi, voip,
magicmirror, mmpm, jabber, redroid
3. Add explicit parted/fdisk install in live USB build
- Ensures disk tools available for secubox-install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add RuntimeDirectory=secubox to all services using ProtectSystem
- Change ProtectSystem=strict to ProtectSystem=full for compatibility
- Add systemd overrides in build script for cached packages
- Create tmpfiles.d entry for /run/secubox
This fixes the namespace issue where services couldn't create sockets
in /run/secubox due to ProtectSystem=strict mount namespacing.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- LXC-based PeerTube container with PostgreSQL, Redis, Node.js, ffmpeg
- FastAPI backend for install, user, video management
- Web UI with stats grid, videos/users/logs tabs
- Systemd service on Unix socket
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
