Generates output/repo/{nginx-apt.conf, DEPLOY.md, install.sh,
LICENCE-CMSD-1.0.md, LICENSE-CMSD-1.0.en.md}. No network operations
- artifacts are for the user to push out-of-band.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pins GPG_HOME=~/.gnupg/secubox (persistent), invokes existing
generate-gpg-key.sh, and writes the long fingerprint to
FINGERPRINT.txt for downstream consumption by reprepro SignWith.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Brainstormed design for adding the SPDX-CMSD-1.0 header to every
first-party source file (~2,170 across 6 languages), backed by a
reusable Python tool (scripts/license-headers.py), a CI check, and
a phased per-package rollout. Spec covers scope, header rendering
per language, placement rules, tool architecture, CI integration
with an enrollment allowlist, and verification steps.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- scripts/sync-mitmproxy-routes.sh: Auto-sync HAProxy vhosts to mitmproxy
- Runs via systemd timer every 5 minutes
- Fixed bash arithmetic for set -e compatibility
- secubox-metablogizer: Enhanced export ZIP package
- Includes nginx.conf, haproxy.cfg, certificates
- Complete README with republishing instructions
- Site health check endpoint
- secubox-users: Added REVOKE ALL sessions panic button
- Emergency endpoint to revoke all active sessions
- Double confirmation UI for safety
- secubox-publish: Added health status columns
- HTTP/HTTPS/WAF status with emoji indicators
- Aggregated health LEDs bar
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Auto-generated health check endpoints for sidebar status:
- Returns {status: "ok", module: "name"}
- Public endpoint (no auth required)
- Used by sidebar.js for LED status display
Added via scripts/add-health-endpoints.py
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- scripts/capture-screenshots.py: Auto-discovers 117 modules from packages/
- Playwright-based capture with JWT authentication
- 30-second delay per page for cache refresh
- Thumbnail generation (400x225)
- JSON manifest output
- scripts/generate-docs.py: Extended to 105 modules
- Multilingual descriptions (EN, FR, DE, ZH)
- --include-screenshots flag for wiki integration
- Category index pages (CATEGORIES-XX.md)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Sidebar: Replace LED dots with dice icons (⚀-⚅) based on metric values
- Sidebar: Dice update dynamically with CPU/mem/disk/load/temp/net
- SOC: Add scribe trace histogram for firewall packet stats
- SOC: Remove category tag listings (keep donut metrics)
- SOC: Fix API paths for hub endpoints
- WAF: Fix JavaScript syntax errors (orphan returns, extra braces)
- WAF: Fix getSiteEmoji function structure
- HealthBump: Update LED pulse patterns (1/2/4 flashes per tier)
- HealthBump: Pulse from bright to dim (not dark to color)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 3 vertical RGB LEDs in sidebar header (next to SECUBOX logo)
- LEDs mirror physical MOCHAbin hardware LEDs (HW/SVC/SEC layers)
- Add double-buffer pattern for LED state management
- Add multi-layer histogram tooltip (current/average/max values)
- Add 🚀 emoji to version display
- Move Smart Strip to top menu bar with hover tooltips
- Add persistent sparkline history cache (localStorage, 60 samples, 1h TTL)
- Fix SOC and Certs health endpoints (nginx routes, service restart)
- Hardware LED health bumper script with I2C double-buffering
- CSS: vertical LED strip, histogram bars, header layout fixes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-led-heartbeat-bash: simple sysfs-based heartbeat with I2C timing delays
- Add scripts/diag-leds.sh: comprehensive LED diagnostic script
- Working heartbeat: 150ms ON, 150ms OFF, 150ms ON, 700ms pause
- Fixes I2C EIO errors by using appropriate delays between writes
Tested on MOCHAbin with IS31FL3199 LED controller.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix log messages going to stdout which corrupted JSON capture
- Redirect extraction and generation logs to stderr
- Successfully syncs 94 vhosts to mitmproxy routes and health prober
- Tested on server with full HAProxy config
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
VHost Matrix Sync (scripts/vhost-matrix-sync.sh):
- Extracts vhost→backend mappings from HAProxy config
- Syncs to mitmproxy routes.json (using 10.100.0.1 for LXC bridge)
- Syncs to health prober vhost-matrix.json
- Commands: sync, status, reload
Eye Remote Round UI fix:
- Changed METRICS_ENDPOINT from /api/v1/system/metrics
to /api/v1/eye-remote/metrics/public
- Pi Zero will now fetch MOCHAbin host metrics, not local metrics
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added service exclusion capability to migration-export.sh:
- New --exclude-services parameter accepts comma-separated list
- Skips specified /srv/* directories during export
- Useful for excluding large services (nextcloud, peertube, gitea, lxc)
Example: --exclude-services "nextcloud,peertube,gitea,lxc,photoprism"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Download latest multiboot image from GitHub releases
- SHA256 checksum verification
- Flash to USB with progress and confirmation
- Supports --list, --download, --release, --force options
- Document in scripts/README.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Install live-boot package and rebuild initramfs with live-boot scripts
- Create squashfs filesystem (878MB) on data partition sda4
- Update boot.scr with live boot parameters (boot=live, toram)
- Fix wiki sidebar links from [[Page|Display]] to [Display](Page)
- Add Eye-Remote wiki page documentation
- Add sync-wiki.sh script for wiki repository sync
- Add patch-multiboot-efi.sh for post-build EFI patching
Partition layout:
- sda1 (512MB): EFI with kernel, initrd, dtbs, boot.scr
- sda2 (3GB): ARM64 rootfs reference
- sda3 (3GB): x86 rootfs for VirtualBox/QEMU
- sda4 (9.5GB): Data + /live/filesystem.squashfs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- docs/TOOLS.md: Complete reference of all build/generation tools
- scripts/README.md: Documentation for scripts directory
- remote-ui/README.md: Documentation for remote-ui module
Also fix build-storage-img.sh to use same slipstream logic as
build-ebin-live-usb.sh:
- Search packages in output/debs AND ~/.cache/secubox/debs
- Use dpkg -i --force-depends --force-overwrite (faster)
- Install all packages at once instead of per-package apt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 5 min timeout per package in dpkg-buildpackage calls
- Add 10-20 min timeout for QEMU chroot apt operations
- Add 45 min timeout for sub-script execution
- Add 15 min timeout with retries for wget downloads
- Fix pipe to tail pattern that swallowed exit codes
- Add progress logging for QEMU package installation
- Use writable log directory (output/logs) instead of /tmp
- Add --verbose flag to build-eye-remote-full.sh
- Export VERBOSE for sub-scripts
Fixes hangs caused by:
- dpkg-buildpackage | tail -5 buffering issues
- QEMU chroot apt-get with no timeout
- Network operations with no timeout
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- X11 setup now exits early for bare metal (VM_TYPE=none) without
creating config files - Intel/AMD/NVIDIA auto-detect perfectly
- Remove static fallback 10-modesetting.conf that caused conflicts
- Sanitize GPU_INFO in config comments to remove special chars
- Disable PrivateTmp and ProtectSystem for haproxy, metrics, threats
services - causes Python symlink namespace errors on some kernels
- Add fix-namespace-errors.sh script for quick fixes on running systems
Fixes: X11 "no screens found" on Intel HD Graphics 630
Fixes: "Failed to set up mount namespacing" for Python services
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ARP-based IP collision detection for multi-device environments
- MAC-based pseudo-random IP offset to spread devices across range
- Gratuitous ARP announcement to prevent IP conflicts
- Fix EspressoBin DSA network: target wan interface, not eth0 CPU port
- Static IP fallback 192.168.255.250 when DHCP unavailable
- Sync all build scripts to version 1.7.0
- Add screenshot script with 90+ module URLs
- Add mock HTML screenshots for documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add generate_debug_report() to secubox-kiosk-launcher
- Capture system info, virtualization, graphics hardware
- Log DRM/KMS devices, kernel modules, Xorg status
- Enhanced error reporting with dmesg and VT status
- Debug reports saved to /tmp/kiosk-debug-*.log
- Add v1.6.7.2 overlay installer scripts
- Add emoji font fixes for navbar icons
- Add screenshots for v1.6.7.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts:
- scripts/run-qemu.sh: Launch SecuBox in QEMU with port forwarding
- scripts/run-vbox.sh: Create and launch SecuBox VM in VirtualBox
Port forwarding (both scripts):
- SSH: localhost:2222 → guest:22
- HTTPS: localhost:9443 → guest:443
- HTTP: localhost:8080 → guest:80
Bug fix:
- secubox-kiosk-launcher: log() now writes to stderr
- Fixes URL corruption when log messages were captured by
command substitution in determine_url()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-all-local.sh: Discover and build ALL 93 packages dynamically
- build-live-usb.sh: Install ALL packages from cache
- List and verify all installed packages during build
- Save installed packages list to /var/lib/secubox/installed-packages.txt
- Add --no-compress option to skip gzip for local testing
- AZERTY keyboard already configured (fr layout)
- Update WebUI URL to use dummy interface (192.168.255.1:9443)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add dummy0 interface with fixed IP 192.168.255.1/24
- Always available for kiosk/local access regardless of DHCP
- Add optional: true to DHCP config to prevent boot blocking
- Add secubox-net-fallback service for link-local IP fallback
- Update kiosk URL to use dummy interface IP
- Fix build-all-local.sh arithmetic expression bug
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added crt-light.css to p2p, zkp, mesh pages
- Fixed body class to crt-light
- Removed duplicate WireGuard menu entry on VM
- Added scripts/fix-navbar.sh for automated navbar integration checks
Required navbar elements:
1. crt-light.css and sidebar-light.css links
2. body class="crt-light"
3. <nav class="sidebar" id="sidebar"></nav>
4. /shared/sidebar.js script
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New files:
- scripts/export-preseed.sh: Export config from running system
- image/preseed-apply.sh: Apply preseed on firstboot
- image/secubox-preseed.service: Systemd service for preseed
Features:
- Export SecuBox config (/etc/secubox/)
- Export network config (netplan, WireGuard)
- Export user accounts and SSH keys
- Export service configs (nginx, HAProxy, CrowdSec)
- Export SSL certificates
- Apply on firstboot with systemd service
Usage:
# On running VM, export config:
./scripts/export-preseed.sh my-config.tar.gz
# Build live USB with preseed:
sudo bash image/build-live-usb.sh --preseed my-config.tar.gz
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Generate README.md for all 45 secubox-* packages with screenshots
- Add multilingual wiki pages (EN, FR, DE, ZH) documenting 47 modules
- Add generate-docs.py tool for documentation generation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use aiohttp to login via API (bypasses browser SSL issues)
- Inject JWT token into browser localStorage
- All 45 modules now captured with proper authentication
- Portal service watchdog needed (keeps dying)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Refreshed all 45 VM module screenshots
- Updated screenshot-tool.py with better login selectors
- Wiki documentation ready in docs/wiki/
- secubox-debian-ui.md
- secubox-openwrt-ui.md
- UI-COMPARISON.md
Screenshots gallery: docs/SCREENSHOTS-VM.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New modules (35 total):
- secubox-repo v1.0.0: APT repository management
- repoctl CLI for package management
- GPG key generation and signing
- Multi-distribution support (bookworm, trixie)
- Web dashboard for repository status
- secubox-hardening v1.0.0: Kernel and system hardening
- hardeningctl CLI for security management
- Sysctl hardening (ASLR, kptr_restrict, SYN cookies)
- Module blacklist (uncommon protocols, filesystems)
- Security benchmark with 100% score on VM
CI/CD workflows:
- build-packages.yml: Dynamic matrix for all packages
- build-image.yml: 5 board images with compression
- publish-packages.yml: APT repo publishing
- release.yml: Unified release orchestration
APT repository scripts:
- export-secrets.sh: Export GPG/SSH keys for GitHub Actions
- local-publish.sh: Local test server
- install.sh: User installation script
Security (Phase 5):
- AppArmor profiles for all services
- Audit rules for SecuBox services
- build-all.sh for local builds
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added all new packages to the build script in dependency order:
- Core: portal, system
- Security: waf
- Network: haproxy, dns
- Publishing: droplet, streamlit, streamforge, metablogizer, publish
- Email: mail, mail-lxc, webmail, webmail-lxc, users
All 30 packages build and deploy successfully.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
