30s was too short for slow module operations behind the reverse proxy — a
podcaster audiobook upload (server-side ZIP extraction of ~120MB) exceeded it,
so nginx returned 502 on an upload that actually succeeded. 300s matches the
per-vhost timeouts already used elsewhere (lyrion, yacy). Applies to every
module served through secubox.d.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
#65's symptom (new modules' /api/v1/<m>/ return 404 because their nginx routes
aren't loaded) is already solved in the deployed webui.conf via
'include /etc/nginx/secubox-routes.d/*.conf' — every module package drops a
location-only snippet there at install. The repo template common/nginx/webui.conf
was stale (hardcoded core blocks only, no include), which is misleading. Add the
active include so the template matches production; keep the hardcoded
crowdsec/waf/system blocks (those core packages ship only the legacy secubox.d/
snippet, so no duplicate-location).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(metrics): Make sibling imports work under uvicorn (api.main:app)
The aggregator imports `from visitor_origin import VisitorOriginAggregator`
worked in pytest (conftest puts api/ on sys.path) but crashed at module load
under `uvicorn api.main:app` with ModuleNotFoundError. The service entered
a restart loop; the new live-panel endpoints were unreachable.
Fix: insert os.path.dirname(__file__) at the top of sys.path before the
sibling imports, mirroring the test conftest.
Verified live on gk2: secubox-metrics now starts cleanly, all three new
endpoints (visitor-origin / live-hosts / cert-status) respond 200 with the
documented disabled payload.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(nginx): Strip upstream CORS headers in /api/v1/* snippet (ref #92)
Several FastAPI services in this repo (including secubox-metrics, with the
new live-panel endpoints from #98) ship their own CORSMiddleware emitting
Access-Control-Allow-Origin: *. The nginx snippet for /api/v1/* also adds
the same header. Browsers receiving both fold them into
"Access-Control-Allow-Origin: *, *" and reject all cross-origin requests,
which broke health-banner.js v1.3.0 when injected on any vhost other than
admin.<host>.secubox.in.
Fix: declare nginx as the sole CORS authority by stripping the upstream
copies with proxy_hide_header before nginx's own add_header fires. The
project standard already had nginx own CORS at the edge; this just plugs
the leak introduced when individual services started emitting their own.
Verified live on gk2: single Access-Control-Allow-Origin: * header now
returned by /api/v1/metrics/* through HAProxy + mitmproxy + nginx.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- WAF API: Replace ipapi.co HTTP calls with local GeoLite2-Country.mmdb
- CrowdSec frontend: Use backend /api/v1/waf/geoip/ instead of ipapi.co
- nginx: Add routes for /system/ and /api/v1/system/
- Avoids CORS issues and rate limiting from remote GeoIP services
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Eye Remote Interactive UI enhancements:
- TTY mode: Serial terminal display from /dev/ttyGS0
- Flash mode: Progress bar with speed/ETA for USB transfers
- Auth mode: QR code generation for backup authentication
- Mode detection via /etc/secubox/gadget-mode
Hub service VM compatibility fix:
- Changed from Unix socket to TCP port 8001
- Updated nginx configs for TCP proxy
- Fixes 502 errors in VirtualBox VMs
Also includes:
- FAQ/Troubleshooting wiki page with GitHub issue links
- Kiosk launcher --no-sandbox fix for VMs
- Profile Generator GUI mockup
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add CORS headers to nginx secubox-proxy.conf for cross-origin API requests
- Fix login.html endpoints: /auth/login -> /login
- Upgrade Python deps in build scripts: pydantic>=2.0, fastapi>=0.100, uvicorn>=0.25
- Add pip upgrade in secubox-core postinst for Debian bookworm compatibility
- Fix display/__init__.py to import existing modules only
Fixes authentication and API issues in VBox and ebin builds.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add HTTP server block in nginx for localhost/127.0.0.1/192.168.255.1
- Change kiosk default URL from https:// to http:// (avoids SSL issues)
- Add fallback index.html creation in build script
- Ensures nginx has content to serve even if packages fail to install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Includes all package APIs with public dashboard endpoints:
- secubox-system: System Hub with /info, /resources, /security
- secubox-crowdsec: CrowdSec dashboard with /status, /hub, /metrics, actions
- secubox-wireguard: WireGuard VPN with /interfaces, /peers, start/stop
- secubox-netdata: Monitoring with /stats, /processes, /alerts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
