Two failures surfaced by the strict apt-get pass that --kiosk runs in the
rpi chroot (the lenient `dpkg -i --force-depends || true` had been swallowing
the first one on every build):
1. secubox-mediaflow postinst had `#DEBHELPER#` inside a comment. dh_installsystemd
substitutes that token textually wherever it appears, so it expanded the
systemd block mid-comment and orphaned "; kick one refresh" onto its own
line → `syntax error near ';'` → configure fails on EVERY install. Reword
the comment (real token stays alone on line 22). Bump to ~bookworm3.
2. The kiosk apt-get relied on DEBIAN_FRONTEND=noninteractive, which governs
debconf, not dpkg's conffile prompt — a pre-existing /etc/secubox/mesh.toml
triggered an interactive prompt that EOFs on the closed chroot stdin and
aborted the build. Pass --force-confdef/--force-confold (as the main
dpkg --configure pass already does) to auto-keep existing conffiles.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
secubox-auth/users crash at import on the rpi400 image because it is built
with `dpkg -i --force-depends` + debootstrap --include, so their declared
Depends (python3-argon2, python3-pyotp, python3-qrcode) are never pulled —
unlike normal apt installs on mochabin. The engine does `from argon2 import
...` / `import pyotp` / `import qrcode`, so the daemon dies at startup →
nginx 502 → no login. Add pyotp+qrcode (pure-Python) to INCLUDE_PKGS and
argon2 via the QEMU-proven pip step (mirroring the cryptography exclusion).
Also expose the kiosk GUI through CI: a `kiosk` workflow_dispatch boolean
→ build-image.sh --kiosk → forwarded to build-rpi-usb.sh, so a rebuilt
rpi400 image can ship the chromium fullscreen dashboard.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
uvicorn/uvloop refuses to rebind an existing UDS ('Address already in use') →
crash-loop on restart. ExecStartPre=+/bin/rm -f the socket (root, clears any
owner in the sticky /run/secubox) before ExecStart.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Deploy found a crash-loop: the shipped default config has [shared_grid] set, but
the opt-in mosquitto is not running, so Bridge.start()/the paho adapter's
synchronous connect() raised ConnectionRefusedError and killed the daemon.
Bridge.start() now skips an unreachable broker (log + continue); the paho adapter
uses connect_async + loop_start (non-blocking, auto-reconnect). +regression test.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Reconcile the three pieces the webui→ctl delegation needs to actually work:
NoNewPrivileges=yes on the daemon unit neutralized sudo, and sudoers.d
granted to the wrong user (secubox instead of secubox-meshtastic, the
daemon's actual User=). Verified _ctl_cb's systemd-run argv matches the
sudoers command lines for set-mode/set-grid token-for-token.
Also demote mosquitto from Depends to Recommends (module never installs/
runs it; README already documents opt-in setup) and add sudo to Depends
for the ctl delegation. Minor cleanups: unused `field` import in model.py,
dead gridpolicy re-export in daemon.py, and a malformed broker port
(e.g. host:abc) no longer crashes Bridge.start() at daemon startup.
Deferred: append a note to the multigrid design spec about the
gridpolicy/bridge default broker-port mismatch (8883 vs 1883) and the
nft hostname-resolved-once caveat for future on-grid containment work.
Finalizes the secubox-meshtastic package for install: debian/install
(api -> usr/lib/secubox/meshtastic/api, sbin -> usr/sbin, www, nginx
route, menu entry, config example, mosquitto broker reference conf),
debian/postinst (secubox-meshtastic system user in dialout, restricted
leaf dirs under 0755 shared parents per #511/#474, config seed-if-absent,
enable+start the daemon which runs fine with radio: absent), debian/prerm,
debian/rules (0440 sudoers drop-in + dh_installsystemd --name=), and
debian/control deps (fastapi/uvicorn/pydantic/paho-mqtt/mosquitto,
secubox-core). Adds README documenting the API, the three grids, passive
mode, and the meshtastic pip (non-Debian) dependency note.
Clean dpkg-buildpackage build verified (secubox-meshtastic_0.1.0-1~bookworm1_all.deb),
60/60 tests pass, SPDX headers clean.
- systemd/secubox-meshtasticd.service (+ debian/ copy): dedicated
secubox-meshtastic user/group, dialout for serial, ProtectSystem=strict
hardening, DeviceAllow for ttyUSB/ttyACM. No RuntimeDirectory=secubox
(ref #896 landmine) — daemon binds its socket directly into the shared
1777 /run/secubox.
- nginx/meshtastic.conf: static panel + dedicated-socket API proxy,
mirrors secubox-profiles' prefix-preserving proxy_pass convention.
- menu.d/71-meshtastic.json: panel entry under the mesh category.
- conf/mosquitto-secubox-meshtastic.conf: private shared_grid broker
listener bound to the MirrorNet IP (10.10.0.1), anonymous access
disabled, creds/ACL left to the operator.
Add www/meshtastic/index.html — cyan hybrid-dark panel (Courier Prime w/
monospace fallback, no external CDN/fonts/tiles) with 5 tabs: Nodes (list +
offline canvas map plotting positioned nodes, ringed/colored by SNR), Messages
(per-channel view + send via POST /send), Channels (per-channel grid
off/shared/on toggle via POST /grid), Sniffer (census table + channel-activity
bars from /packets), and Grid (radio present/absent banner + mode selector via
POST /mode). Reads localStorage.sbx_token, shows a persistent auth-required
banner on 401, and a radio-absent banner throughout.
create_app(cache, send_cb, ctl_cb) exposes GET status/nodes/messages/packets
over the injected StateCache, and POST send/mode/grid — mode and grid are
validated against config.MODES/GRIDS (422) BEFORE delegating to ctl_cb,
mirroring secubox-profiles' validate-before-delegate pattern. All routes
require the real secubox_core.auth.require_jwt.
Root-only webui->ctl CLI for /etc/secubox/meshtastic.toml, mirroring
secubox-profiles' cli.py/actuate_paths.py conventions: set-mode/set-region/
set-role/set-grid/set-psk edit the config via a small TOML dump/validate/
atomic-swap (double-buffer/4R), apply-egress renders gridpolicy's nft rules
into an nftables drop-in (empty rule list keeps DEFAULT DROP). Each verb
requires root and appends a JSON audit line. Scoped systemd-run-wrapped
sudoers grants let the panel (User=secubox) invoke each verb without a
broader sudo surface.
Carried fix from Task 4 review: the single lambda used for all three pubsub
topics forwarded `packet` for every event, but meshtastic publishes `node=`
on meshtastic.node.updated (no `packet` kwarg) and neither on
meshtastic.connection.established. Deliver the correct kwarg per topic
(packet/node/interface). Untested (no real device), no new test required
per task brief.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implement Task 8: Engine class wiring radio → state → cache/passive/bridge
on packet receive, plus main() building real objects (config.load, open_serial,
paho-mqtt-backed Bridge factory imported lazily, PassiveCapture, StateCache).
Radio-absent and api.web-absent (Task 10 not yet done) paths degrade gracefully
instead of crashing. sbin/secubox-meshtasticd launches `python3 -m api.daemon`.
Tests drive Engine with MockRadio + FakeMqtt, no real device/broker. 33/33 tests
pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implement Bridge class for serial↔MQTT bridging with grid-policy-driven
publishing. Tests verify correct broker connection and topic filtering per
channel grid configuration. All 30 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implement Task 6: PassiveCapture with packet recording (JSON lines),
node census tracking, and per-channel statistics. Payload withheld
when decrypted=False; included when decrypted=True.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Implement targets_for(channel, cfg) to return grid membership subset
- Implement nft_egress_rules(cfg) to generate allow-rules for enabled on-grid brokers
- TDD: 5 test cases all passing (offgrid, shared+on, on-disabled, empty rules, broker rules)
- Full test suite: 23 passed
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implements Task 4: RadioInterface protocol with MockRadio test double and
SerialRadio wrapper. Lazy meshtastic import in open_serial() ensures test
suite never requires the library. Returns None when device absent (radio: absent
path). All tests pass; full suite clean (18/18).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Use copy.deepcopy in StateCache.get() and update() to prevent nested-mutable sharing
- Move _write_atomic() call inside lock in update() for atomicity
- Add copyright line to tests/test_cache.py header
- Add test_get_returns_deep_copy_not_live_reference() to verify isolation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
TDD implementation: Packet dataclass with parse_packet() parser,
Node dataclass for mesh participants, MeshState with apply_packet()
and apply_nodeinfo() to build census and channel message logs.
Parser consumes meshtastic pubsub dict format.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Task 1 complete:
- Package scaffold with proper directory structure
- Config loader using tomllib with dataclass-based interface
- Comprehensive test coverage (4 tests, all passing)
- Example TOML configuration with sensible defaults
- Debian packaging (control, compat=13, changelog, rules)
- Full SPDX header compliance
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sync-all.yml's release job does `uses: ./.github/workflows/release.yml`, but
release.yml only declared push/workflow_dispatch triggers — a reusable-workflow
reference to a workflow without `on: workflow_call:` makes the CALLER fail at
startup ('workflow file issue'), which is why every sync-all run was red at 0s.
Add a bare workflow_call trigger (tag-push + dispatch paths unchanged; the
release job is tags-guarded and sync-all runs on branch pushes, so the callable
path is not exercised — this only restores a valid reference).
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
The board ran a hand-created unhardened ROOT sbxwaf on :8085 while the package
shipped only a worker@ fan-out that crash-looped (panic on the root-only
cookie-audit log) and, as secubox-waf + RuntimeDirectory=secubox, re-chowned the
shared /run/secubox on every crash-restart — breaking every secubox-user socket
bind (profiles 502s). Ship ONE hardened unit (secubox-waf-ng.service, :8085,
User=secubox-waf, full sandbox, NO RuntimeDirectory — sbxwaf only connects to
waker.sock). postinst asserts the perms a non-root sbxwaf needs
(haproxy-routes.json 0644, cookie-audit ledger writable by secubox-waf),
disables leftover worker@ units, drops the /etc override. Validated live on gk2:
264 routes, real routing, admin/gitea/billets/yacy 200; a WAF restart no longer
touches /run/secubox and profiles stays up.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
The postinst enabled+started the sleeper, which stops idle sleepable modules —
and health-sync currently lists crowdsec among sleepable. Ship it disabled
(--no-enable --no-start; postinst try-restart only, never enable). Operator
opts in after auditing the sleepable set. Waker stays enabled (never stops).
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Sleep-when-idle + wake-on-access for public on-demand services, per-module
lifecycle policy, durable route restoration, awake-level panel setter, and a
two-phase terminal wake splash (waker + nginx error_page) generalized to all
on-demand vhosts. Includes #893 profiles-actuation robustness.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Repurpose the (dead, Task-7) nginx-sync into a transactional injector that wires
the phase-2 splash into EVERY on-demand vhost, not just yacy:
- nginx/secubox-waking.conf is now fully self-contained at server level
(proxy_intercept_errors + proxy_connect_timeout 3s + error_page → splash), so
per-vhost wiring collapses to a single `include snippets/secubox-waking.conf;`.
- nginxgen.py rewritten: find_config (by server_name), wire/unwire (idempotent,
marker-based, insert after the domain's server_name line — right block in
multi-server files), and sync_and_reload (wire every on-demand vhost via
wafsync.ondemand_vhosts, nginx -t, rollback from in-memory originals on
failure, reload on success — NO .bak in the nginx dir).
- `secubox-wakectl nginx-sync` (root) runs it; `set-lifecycle` runs it after the
waf/health resync (best-effort — opting a service on-demand auto-wires its
splash); postinst runs it so every install/upgrade re-asserts the wiring.
Live on gk2: one nginx-sync wired 5 on-demand vhosts (yacy/gitea/nextcloud/
podcaster/billets), reported streamlit as having no nginx config, idempotent on
re-run; yacy down → nginx serves the 503 splash in 3.0s. 286 tests pass.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Two-phase graceful wake UX, one shared splash page:
- templates/waking.html reworked into a pseudo-terminal "virtual screen": a CRT
panel with scanlines, an auto-executing boot log, blinking cursor, elapsed
counter, and a "taking longer / repair" panel after ~90s. Fully self-contained,
JS-driven (service name from the vhost hostname, elapsed from sessionStorage),
auto-refreshing — so it needs no server-side substitution and works verbatim
for BOTH phases.
- waker (phase 1, container down / route absent): serves the page verbatim.
- nginx (phase 2, container up but app still booting → backend 502/503/504):
new nginx/secubox-waking.conf snippet intercepts the gateway error and serves
the same splash (503 + Retry-After) instead of a raw 502. Wire per on-demand
vhost with `include snippets/secubox-waking.conf;` + `proxy_intercept_errors on;`
+ `proxy_connect_timeout 3s;` (fail fast so the splash beats HAProxy/sbxwaf).
- debian/install ships the page to /usr/share/secubox/www/waking/ and the snippet
to /etc/nginx/snippets/.
Proven live on yacy: full path (HAProxy→sbxwaf→nginx) serves the terminal splash
during the down/boot window, then the real app once it answers. 279 tests pass.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Review follow-ups for the awake-level setter:
- reject a protected module server-side (web 409) and in the ctl (refused,
reason=protected) — it is forced always-on anyway, so the write is spurious
and would dirty a core manifest; mirrors set_pin's protected refusal.
- fsync manifest_edit's atomic write before rename (the manifest is source of
truth, not a regenerable derived file) — parity with web._atomic_write.
- tests: protected refusal (web + cli), duplicate-same-key collapse, manifest
with no trailing newline.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
The scale-to-zero policy (lifecycle always-on/eager/on-demand/manual +
wake_class normal/urgent) was manifest-only. Add a per-module selector to the
/profiles/ panel that writes the manifest and resyncs the derived files, via the
webui->ctl pattern:
- api/manifest_edit.py: targeted line-edit of a manifest's lifecycle/wake_class,
preserving everything else (comments, inline portal table, …); refuses a
sectioned manifest; atomic write.
- api/cli.py: `secubox-profilectl set-lifecycle <mod> --lifecycle X --wake-class Y`
(root) — edits the manifest then re-runs waf-sync + health-sync so the change
takes effect; resync paths derive from --root (test-isolated). argparse choices=
hard-gate the enums; refuses an unknown module.
- api/web.py: POST /api/v1/profiles/lifecycle — validates enum (422) + known
module (404) BEFORE any sudo, then delegates to the root ctl via systemd-run.
- sudoers.d: one scoped grant (three bounded wildcards, panel pre-validates +
ctl re-validates — execve, no shell).
- www/profiles/index.html: two compact <select>s per module (protected → 🔒),
POSTing /lifecycle and refreshing.
16 new tests (manifest_edit, cli set-lifecycle, web route); 275 pass, no
live-state leakage, sudoers + JS validated.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
The scale-to-zero pilot proved the wake-trigger chain but found the round-trip
broken: a woken portal module started (container up, backend serving) yet stayed
unreachable via its vhost because its sbxwaf route was never re-added. wake.py
passed routes={} to apply_plan, and by wake time the route is long gone from the
live haproxy-routes.json (removed at sleep) and out of the rotated 4R snapshot.
Fix — a durable per-domain route memory (portal_routes.remember/recall,
/var/lib/secubox/profiles/portal-routes.json): the actuator persists the live
route value just before removing it on STOP; wake recalls it and passes it as the
routes map, so the existing snapshot->START->_portal_add path restores it. No
change to snapshot/apply/_portal_add semantics. Best-effort memory (a failed
write never breaks a STOP). remember_path_for(root) mirrors snap_root_for for
test isolation.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
On a 184-module fleet, DEFAULT_LIFECYCLE="eager" made every module with
no manifest opinion idle-sleep-eligible, including core services (admin,
gitea, nextcloud) that never opted into scale-to-zero. Flip the default
to always-on: sleep is now a strict opt-in via lifecycle="eager" or
"on-demand" declared explicitly in the manifest. scan()-derived
manifests already relied on this same default (no code change needed
there), so they inherit the safer behavior too.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Three findings from the pre-pilot review:
- waf-sync/health-sync _write_atomic left the produced file 0600 root-owned
(tempfile.mkstemp default) with no chmod before the rename. sbxwaf (user
secubox-waf) and secubox-hub (user secubox) could never read their own
public on-demand-vhosts.json / sleepable-modules.json — the wake trigger
and health-distinction were silently inert on install. Chmod 0644 before
os.replace in both helpers.
- The two sbxwaf workers (@1, @2) each hold independent in-memory
Begin/End vhost state but flushed to the SAME --vhost-signals path,
last-writer-wins clobbering each other every ~5s — a service kept fresh
by one worker could be read as stale by the sleeper and wrongly STOPped.
Unit now passes a per-instance path (vhost-signals.@%i.json, no Go
change needed); sleeper_daemon._signal_reader globs and merges per-vhost
(max last_request_ts, sum active_conns) across workers, falling back to
the legacy plain path when no per-worker files exist yet.
- manifest.load_manifest stored portal_domain verbatim; the rest of the
front pipeline (waker exact-match, sleeper keys, wafsync output) is
lowercase, so a hand-edited mixed-case domain would silently never wake
nor sleep. Lowercase at load time.
Full profiles suite: 251 passed. mypy --strict api/: unchanged 102
pre-existing errors (diffed against HEAD, only reordering, zero new).
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
secubox-sleeper.service actuates in-process as root (no sudo/systemd-run,
unlike the panel/waker which escape their own sandbox before touching
systemd/LXC). ProtectSystem=strict made everything under /run read-only
outside the listed ReadWritePaths, but lxc-start/lxc-stop write
LXC-internal runtime/lock/cgroup paths (/run/lxc/, /run/lock/lxc/, mount-
namespace setup) that are not part of this codebase's stable contract to
enumerate. api/actuate.py::_issue only hard-fails on rc is None, so the
resulting EROFS would have been silent: auto-sleep for every LXC-backed
on-demand module would quietly stop working.
Drop ProtectSystem=strict and ReadWritePaths=; keep ProtectHome=true,
PrivateTmp=true, NoNewPrivileges=true, and RuntimeDirectory=secubox. A
root daemon driving LXC in-process without ProtectSystem is at this
codebase's normal floor, not a regression.
debian/postinst: keep pre-creating /var/log/secubox and
/var/lib/secubox/profiles/rollback (still needed by the actuator
regardless of sandboxing), reword the comment to drop the
ProtectSystem=strict framing.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Wires the scale-to-zero services into debian/ packaging: secubox-wakectl
entry point (/usr/sbin), templates/waking.html now ships, secubox-waker
and secubox-sleeper systemd units registered via dh_installsystemd
--name=, enabled/restarted (try-restart, preserving runtime state) in
postinst alongside secubox-profiles.service. postinst now also runs
secubox-wakectl waf-sync/health-sync so sbxwaf and the health monitor
have their lists from first install (nginx-sync stays unwired per the
2026-07-20 pivot).
Hardens secubox-sleeper.service with ProtectSystem=strict and an
explicit ReadWritePaths covering the actuator's real write set, traced
through api/actuate.py/snapshot.py/audit.py: /run/secubox,
/var/lib/secubox/profiles/rollback, /var/log/secubox, /data/lxc, and
/etc/secubox/waf (haproxy-routes.json, written on a routed module's
STOP — missed by a naive reading of the write set).
Documents the lifecycle/wake_class policy, the waker/sleeper mechanism
and a pilot procedure in README.md, wiki/Architecture.md and
.claude/MODULE-COMPLIANCE.md. Bumps changelog to 0.8.0.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
boot_should_start(m) is the pure boot policy (always-on/eager start
immediately, on-demand/manual wait for a real wake) and
watchdog_should_manage(m) documents/tests that no sleepable module is ever
force-revived by secubox-watchdog.
Investigation found: HEAD's secubox-watchdog has no auto-revive logic at
all today (monitor_loop only logs up/down, restarts are manual-only); the
unmerged feat/watchdog-auto-revive branch adds one gated purely on
lxc.start.auto, which actuate.py::runtime_stop already clears before
lxc-stop specifically to avoid this race — the same flag streamlit sleepers
rely on for exclusion today. No separate exclusion file exists to reuse, so
none was invented; once that branch merges it is already #896-safe with
zero further wiring.
The real, closeable gap was secubox-hub's own sidebar health-batch, which
reported a sleeping on-demand module's inactive systemd unit as "warn".
Added a profiles-side export (secubox-wakectl health-sync ->
sleepable-modules.json, mirrors waf-sync/nginx-sync) and wired it into
secubox-hub so a sleepable module shows "Asleep (on-demand)" instead of an
alarm; a failed unit still alarms regardless. The full admin /health/ page
reads module_prober.py/prober.py, which aren't sourced in this repo yet
(TODO #393) -- documented as a precise cross-package follow-up.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
Status payload now surfaces effective lifecycle, wake_class and a derived
sleep_state (up/asleep/n-a) + wake budget per module. Adds POST /wake and
POST /sleep, webui->ctl (JWT + _apply_lock + fixed sudo argv), refusing
unknown/non-sleepable modules locally before any sudo call. Two new bounded
sudoers grants: synchronous wakectl wake (distinct from the waker's
fire-and-forget grant) and profilectl apply --only. Panel gains a
sleep-state pill + manual Sleep/Wake buttons per module row.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
The Begin/End hook was placed before the WAF-inspection block, so a
request the WAF blocks (403 warning/ban) still refreshed last_request_ts —
scanner/bot traffic against public on-demand vhosts (near-constant
internet-wide scanning) kept the signal "fresh" forever, so
should_sleep()'s idle-age check never passed. Defeated auto-sleep for the
feature's primary deployment (public on-demand vhosts).
Move the Begin/defer End bracket to right after the WAF-inspection block's
403/warning/ban early-returns, immediately before the media-cache-hit
check. One placement still covers three real-response exit paths via the
single defer: the media-cache hit (counts — genuine content served),
media-cache-miss proxy, and the plain proxy. Blocked, banned, waker, and
421 requests never reach this line.
Adds TestVhostSignalsExcludedForWAFBlock (verified RED against the old
placement, GREEN after the move).
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
