- Add sync and sleep before unmounting /dev
- Check if directory still has mounts before rm -rf
- Use force unmount with fallback to lazy unmount
- Remove duplicate trap and umount function
Prevents host /dev/null and other devices from being corrupted
during build failures or cleanup.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Mount /dev, /dev/pts, /proc, /sys into chroot before apt-get
- Unmount special filesystems before squashfs creation
- Prevents /dev/null corruption and gpgv errors during build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Simplify netplan to match all e* interfaces (eth*, en*, eno*, enp*, etc)
- Enhanced fallback script: retries DHCP, logs actions
- Supports physical interfaces starting with e (ethernet) or w (wifi)
- Skip virtual interfaces (docker, veth, br-, virbr)
- Use networkctl reconfigure for DHCP retry
Ensures network works on Lenovo, Dell, HP, and other hardware
regardless of interface naming scheme.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change kiosk URL from 192.168.255.1:9443 to https://localhost/
- Kiosk now works without network (localhost always available)
- Remove port 9443 (nginx listens on 443 internally)
- Update URL priority: localhost first, then 127.0.0.1
Fixes kiosk white screen on real hardware (Lenovo) where
dummy0 interface may not be configured.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- New wiki/Live-USB-QEMU.md with run-qemu.sh documentation
- Updated _Sidebar.md version to v1.6.0
- Added links to VM launcher scripts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts:
- scripts/run-qemu.sh: Launch SecuBox in QEMU with port forwarding
- scripts/run-vbox.sh: Create and launch SecuBox VM in VirtualBox
Port forwarding (both scripts):
- SSH: localhost:2222 → guest:22
- HTTPS: localhost:9443 → guest:443
- HTTP: localhost:8080 → guest:80
Bug fix:
- secubox-kiosk-launcher: log() now writes to stderr
- Fixes URL corruption when log messages were captured by
command substitution in determine_url()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New scripts for USB boot workflow:
- boot-usb.cmd/scr: Boot live system from USB
- flash-emmc.cmd/scr: Flash compressed image to eMMC
Usage:
1. Copy image.gz + boot.scr to FAT32 USB
2. On U-Boot: usb start && load usb 0:1 $loadaddr boot.scr && source $loadaddr
3. For eMMC flash: load usb 0:1 $loadaddr flash-emmc.scr && source $loadaddr
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add SECUBOX_VERSION and BUILD_TIMESTAMP variables
- Include version in GRUB menu entries
- Add version and build timestamp to /etc/issue banner
- Add version and build timestamp to /etc/motd
- Add EFI grub.cfg for VirtualBox/OVMF boot fix
Version: v1.5.10
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Create a small grub.cfg in the EFI System Partition that searches
for the root partition by UUID and chains to the main GRUB config.
This fixes boot issues in VirtualBox and other OVMF-based systems.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add --nicbootprio1 0 and --nicbootprio2 0 to prevent VirtualBox
from attempting network boot when hard disk boot fails.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Prefer AAVMF firmware (64MB) over QEMU_EFI (2MB) for UEFI vars
- Use jq instead of grep for reliable format extraction
- Copy AAVMF_VARS.fd template when available
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Skip signing and deploy steps when secrets are not configured
instead of failing the entire workflow.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add create-qemu-arm64-vm.sh script for ARM64 emulation on x86 hosts
- Add wiki/QEMU-ARM64.md documentation
- Update CI workflows to include RPi 400 and VM scripts in releases
- Update release notes to document all platforms
Platforms now supported:
- MOCHAbin (Armada 7040)
- ESPRESSObin v7/Ultra (Armada 3720)
- Raspberry Pi 400 / Pi 4
- VirtualBox x64
- QEMU ARM64 emulation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add nginx config cleanup to build-image.sh and build-rpi-usb.sh
- Moves location-only configs from conf.d/sites-enabled to secubox.d/
- Tests nginx configuration after package install
- Matches existing cleanup in build-live-usb.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Run nginx config cleanup after rootfs cleanup (after all apt-gets)
- Remove any secubox/repo configs from conf.d
- Verify nginx config is valid before creating squashfs
- Move location-only configs from sites-enabled to secubox.d
- Auto-detect and disable problematic nginx config files
- Retry nginx test after auto-fix
- Add explicit nginx snippet installation after package install
- Create secubox-proxy.conf if missing
- Install main secubox nginx site config if missing
- Test nginx config in chroot and show errors
- Regenerate SSL certs if missing
Package postinst scripts check nginx config which requires SSL certs.
Moving cert generation to before dpkg install prevents postinst failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The pipeline `dpkg ... | grep | head -30` fails with SIGPIPE when
dpkg continues writing after head exits. With set -o pipefail,
this causes build failure even with || true at end.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
netifaces requires compilation which fails without build-essential.
Use the Debian packaged version instead.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Provides common commands:
- secubox status - system and services overview
- secubox services - list all SecuBox services
- secubox logs [svc] - view service logs
- secubox restart/start/stop <svc> - manage services
- secubox info - system information
- secubox network - network configuration
- secubox version - version info
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add -- to parted commands to stop option parsing, otherwise -4GiB
is interpreted as -4, -G, -i, -B options instead of a size value.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add rpi400 to default CI builds in build-image.yml
- Create board/rpi400/config.mk with Pi 400 settings
- Add build-image.sh redirect to build-rpi-usb.sh for RPi boards
- Add boot menu system to build-rpi-usb.sh:
- Normal, Kiosk, Console, Bridge, Minimal modes
- VT100/DEC PDP-style menu interface
- Persistent mode selection across reboots
- systemd integration for early boot
- Fix slipstream in build-rpi-usb.sh:
- Use dpkg --force-depends (pip provides Python deps)
- Skip failing apt-get -f install
- Add more Python dependencies to pip install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
apt-get install -f fails because it tries to resolve Debian packages
(python3-jose, python3-httpx, etc.) that don't exist in repos.
These Python dependencies are installed via pip before dpkg, so
apt dependency resolution is unnecessary and causes slipstream
to report failures despite packages being properly installed.
Changes:
- Remove apt-get install -f call from both build scripts
- Keep dpkg --configure -a to complete package configuration
- Pip packages satisfy runtime dependencies without apt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create /usr/lib/systemd/system and /etc/systemd/system directories
before dpkg install (fixes "unable to open *.service.dpkg-new" errors)
- Install Python dependencies (fastapi, uvicorn, httpx, etc.) via pip
BEFORE slipstream (fixes "depends on python3-X but not installed")
- Add --force-depends and --force-overwrite flags for dpkg
- Show proper installed/total package counts
- Move pip install block before slipstream in build-image.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1. Fix slipstream path: Look for packages in output/ not just output/debs/
- build-image.sh and build-live-usb.sh now check both locations
- 73 packages now properly detected and installed
2. Add ConditionPathExists to 22 optional services:
- Services only start if /etc/secubox/<module>/enabled exists
- Prevents boot failures when backend apps aren't installed
- Affected: ollama, jellyfin, zigbee, lyrion, localai, hexo,
peertube, newsbin, webradio, gotosocial, torrent, domoticz,
simplex, photoprism, homeassistant, matrix, jitsi, voip,
magicmirror, mmpm, jabber, redroid
3. Add explicit parted/fdisk install in live USB build
- Ensures disk tools available for secubox-install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use armada-3720-espressobin-v7-emmc.dtb to enable both SDHCI controllers
- Fix root device: /dev/mmcblk1p2 (eMMC is mmc1 with dual controller DTB)
- Add modprobe.blacklist=mv88e6xxx,dsa_core to prevent DSA probe loop
- Add sdhci.debug_quirks2=0x40 to fix xenon-sdhci DDR timing issues
- Add initramfs hooks for sdhci-xenon and mv88e6xxx blacklist
- Add systemd service to load mv88e6xxx after rootfs mount
- Fix fstab tmpfs mount (remove non-existent user reference)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-image.sh: Fix boot.scr to load from boot partition (mmc 1:1)
with files at root level (Image, not /boot/Image)
- build-rpi-usb.sh: Make initramfs generation failure non-fatal
(Pi can boot without initramfs, just with reduced functionality)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Consistent with build-image.sh:
- --slipstream installs packages from output/debs/
- Falls back to cache/repo/pool if not using slipstream
- Installs secubox-core first (dependency)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Configuration.md: TOML config, modules, double-buffer system
- Troubleshooting.md: Common issues, diagnostics, recovery
- All pages translated to French and Chinese
- Sidebar updated to v1.5.3 with new sections
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- ARM-Installation-FR.md (French translation)
- ARM-Installation-ZH.md (Chinese translation)
- ESPRESSObin-ZH.md (Chinese translation)
- UI-COMPARISON.md (moved from docs/wiki/)
- Updated sidebar with all language links
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
