Authelia SSO is removed. nginx/authelia.conf is reduced to a permissive
no-op: /__sbx_auth_verify returns 200 for every request and
@sbx_auth_login falls back to the app root. The two named locations are
kept only because grafana/lyrion/yacy/rustdesk/fmrelay/zigbee/nextcloud
vhosts still reference them; without them nginx fails to load.
postinst now disables + masks secubox-authelia.service instead of
enabling it. No SSO portal, no session check, no Authelia socket.
Fixes the dead sso.gk2.secubox.in 302 that produced a password prompt
on LAN clients (live USB at 192.168.1.9). Apps keep their native auth;
exposure boundaries stay with HAProxy + WAF.
The live-usb nginx cleanup deleted ALL conf.d/*secubox*.conf, including
secubox-lan-geo.conf which defines 'geo $lan_client'. authelia.conf then hit
'unknown lan_client variable' -> nginx -t fails -> no web server -> blank
kiosk with a connection error. Only remove conf.d files that actually contain
a location block (misplaced); keep geo/map/limit_req_zone/upstream.
The 'final nginx cleanup' branch runs precisely when nginx -t fails, but
nginx_error=$(nginx -t|head) and missing_file=$(...grep...) then trip
set -e/pipefail and abort the whole build right after the warn. Guard both
with || true. nginx config is regenerated at first boot by secubox-net-detect,
so a build-time-invalid config is non-fatal. This was the last blocker on the
amd64 USB (kiosk + everything else already pass).
The workflow passes --kiosk (consistent with build-rpi-usb.sh); build-live-usb.sh
only had --no-kiosk and erred 'Unknown argument: --kiosk', failing the x64 USB
build. Add a --kiosk case (INCLUDE_KIOSK=1).
The live-usb kiosk stack (dbus, X11, chromium) aborted its postinst in the
init-less chroot ('Failed to connect to system message bus', invoke-rc.d
errors), failing the build. Add /usr/sbin/policy-rc.d (exit 101) before the
installs and remove it before squashfs, so packages don't try to start
services at build time but the booted system still does. Keep kiosk ON for
amd64 USB (extra_args=--kiosk). Do NOT disable kiosk.
The per-install flag didn't cover secubox-mesh's configure path; write
/etc/dpkg/dpkg.cfg.d/90-secubox-confold (force-confold/confdef) into the chroot
before any install so every dpkg op keeps conffiles and never prompts. Fixes
'end of file on stdin at conffile prompt' aborting the amd64 USB build.
secubox-mesh's mesh.toml is an auto-detected conffile that triggers an
interactive dpkg prompt (*** mesh.toml [Y/I/N/O/D/Z]) during configure,
failing the headless chroot install in build-live-usb.sh (amd64 USB build).
Install secubox-full with DEBIAN_FRONTEND=noninteractive + --force-confold/
--force-confdef + a follow-up dpkg --configure -a, in build-live-usb.sh and
build-image.sh.
dpi/toolbox-ng/waf-ng are CGO_ENABLED=0 cross-compiles; the go toolchain is
present (golang-1.22-go) but dpkg-checkbuilddeps trips on the golang-go
metapackage. Skip the dep check for just these three (-mod=vendor, self-contained).
list_peers inserted+persisted get_self_peer() into PEERS_FILE, so peer_count
and online_peers counted the node itself (showed '<host> (local)' as a phantom
peer). /status and /peers now exclude is_local/self; self info stays available
via /discover/self for announcements.
p2p shipped its UI to /var/www/secubox/p2p, but the dashboard vhost serves
modules from /usr/share/secubox/www (root + try_files). So /p2p/ fell through
to the unknown-module page. Install p2p + master-link UIs there like all other
modules; update nginx aliases to match.
The app's master-link init mkdir's master-link/ and failed EACCES when
/var/lib/secubox/p2p was root-owned (it was never created by the package),
500-ing /api/v1/p2p/status and breaking mesh-join enrollment. Create p2p/ +
master-link/ as secubox in postinst (mirroring the log-dir pattern) and chown
to repair pre-existing installs. Never touches the shared parent (#494/#511).
The discover matrix filter only compared requested_arch against amd64/arm64/
empty, so the 'both' workflow_dispatch option produced an EMPTY matrix (no
builds, collect failed). Normalize 'both' -> empty (= all arches).
secubox-dpi and secubox-toolbox-ng are CGO_ENABLED=0, GOARCH=arm64,
-mod=vendor offline cross-compiles. They failed the arm64 build only
because golang-go was never installed, so dpkg-checkbuilddeps aborted on
their `Build-Depends: golang-go (>= 1.22)`. Not a CGO cross-toolchain
gap. ubuntu-24.04 ships golang-go >= 1.22; installing it lets the pure-Go
arm64 cross-compile run on the amd64 runner.
Unblocks a complete amd64+arm64 package set for the apt repo + arm64 images.
build-image.sh / build-installer-iso.sh / validate-staged-repo.sh fetched the
ASCII-armored secubox-keyring.gpg and used it directly as
`signed-by=/usr/share/keyrings/secubox.gpg`. apt's signed-by requires a
DEARMORED (binary) keyring, so the chroot apt-get update failed with
"NO_PUBKEY 44E50F0178E8BC7E / repository not signed" even though the repo
signature and key are correct. Pipe the key through `gpg --dearmor`.
Root cause of all image-build failures since the keyring became armored;
not a key desync (repo signer == published keyring == 44E50F0178E8BC7E).
The image labelled eth0 (SFP+) as the only WAN; the single copper RJ45
(eth2/mvpp2-2) was trapped in br-lan, so an operator/uplink arriving on
copper got no lease. Make both eth0 (SFP+) and eth2 (copper) DHCP WAN
candidates (whichever is cabled gets the lease); br-lan keeps the switch
LAN ports. Verified live on the c3box reference install.
Add user=Depends(require_jwt) to netstats_summary and netstats_series,
matching the sibling pattern used throughout the same router.
Drop redundant int() casts on already-typed window/step params.
- Replace truthiness guard (max_ts_c or max_ts_i) with explicit None-check
any(t is not None ...) so a sole sample at ts=0 (boot edge) is handled by
intent, not coincidence.
- Add test_query_drops_sums_multiple_names_per_category: proves blacklist_v4
and blacklist_v6 (same category) are summed (10+5=15) in the same bucket,
not overwritten.
#757: for sw-neuter allow-listed hosts, strip If-None-Match/If-Modified-Since on
HTML document fetches so a stale-while-revalidate SW re-fetches a full 200 (banner
injected) and caches a banner'd shell without being neutered. Reviewed APPROVED.
Also removes the redundant ♥ Liveness dashboard card (version stays in the top badge).
Add requestWantsHTML (Sec-Fetch-Dest: document or Accept: text/html) and use
it in mitmPipeline to strip conditional headers before up.Do for sw-neuter
allow-listed hosts, forcing a full 200 so the injected banner is cached by a
stale-while-revalidate Service Worker.
Non-WG LAN clients never receive the cosmetic ad-hide <style> (injectHTML
gates injectCosmetic behind `if wg`), yet recordCosmetic() fired on every
successful inject — inflating pages_cleaned for banner-only flows.
Gate the call with `if wg && px.ads != nil` to match injectHTML's own gate.
PWA news sites (leparisien, cnn, 20minutes, franceinfo) serve their main HTML
from a Service-Worker cache so the navigation never reaches the MITM and the
banner can't be injected. For an operator-curated allow-list, sbxmitm answers
the SW script fetch with a passive self-unregistering SW (next navigation reaches
the MITM → banner), with an auto-learn candidate feed to /__toolbox/sw-candidate.
Targeted-strict: empty list = no-op. Final review READY TO MERGE (race-clean).
