# /etc/secubox/secubox.conf — Configuration SecuBox-DEB
# Format TOML — généré par firstboot.sh, éditable ensuite
# Recharger : systemctl restart secubox-\*

# ── Global ────────────────────────────────────────────────────────
[global]
hostname  = "secubox-01"
timezone  = "Europe/Paris"
board     = "mochabin"          # mochabin | espressobin-v7 | espressobin-ultra
debug     = false
log_level = "warning"           # debug | info | warning | error

# ── API / Auth ────────────────────────────────────────────────────
[api]
socket_dir  = "/run/secubox"    # Dossier des Unix sockets
jwt_secret  = ""                # Généré au firstboot — ne pas modifier

# Utilisateurs locaux (fallback si pas d'OAuth)
[auth]

[auth.users.admin]
password = "secubox"            # À changer impérativement !
# password_hash = "$2b$12$..."  # bcrypt recommandé (TODO Phase 5)

# ── CrowdSec ──────────────────────────────────────────────────────
[crowdsec]
lapi_url  = "http://127.0.0.1:8080"
lapi_key  = ""                  # Généré par : cscli bouncers add secubox-bouncer

# ── DPI / netifyd ─────────────────────────────────────────────────
[dpi]
mode      = "inline"            # inline | passive
engine    = "netifyd"           # netifyd | ndpid
interface = "eth0"              # Interface à surveiller (WAN)
mirror_if = "ifb0"              # Interface miroir pour DPI inline

# ── WireGuard ─────────────────────────────────────────────────────
[wireguard]
interface    = "wg0"
listen_port  = 51820

# ── NAC / DHCP ────────────────────────────────────────────────────
[nac]
dhcp_interface = "br-lan"
dhcp_range     = "192.168.1.100,192.168.1.254,12h"
dns_servers    = ["9.9.9.9", "149.112.112.112"]
# Zones : lan_allowed, iot_zone, guest_zone, quarantine
default_zone   = "quarantine"   # Nouveaux clients en quarantaine par défaut

# ── QoS / Bandwidth ───────────────────────────────────────────────
[qos]
interface    = "eth0"           # Interface WAN pour le shaping
upload_mbps  = 100
download_mbps = 200
enabled      = false

# ── CDN Cache ─────────────────────────────────────────────────────
[cdn]
engine       = "nginx"          # nginx | squid
cache_dir    = "/var/cache/secubox-cdn"
cache_size   = "5g"
listen_port  = 3128

# ── VirtualHosts ──────────────────────────────────────────────────
[vhost]
nginx_sites_dir  = "/etc/nginx/sites-available"
certbot_email    = "admin@example.com"
default_ssl_mode = "selfsigned"  # selfsigned | letsencrypt

# ── OAuth2 providers (secubox-auth) ───────────────────────────────
[oauth]
# [oauth.google]
# client_id     = ""
# client_secret = ""

# [oauth.github]
# client_id     = ""
# client_secret = ""

# ── Réseau modes ──────────────────────────────────────────────────
[netmodes]
current_mode = "router"
backup_dir   = "/var/lib/secubox/netmodes-backup"
confirm_timeout = 300           # Secondes avant rollback auto si pas confirmé

# ── Notifications ─────────────────────────────────────────────────
[notifications]
# [notifications.email]
# smtp_host = "smtp.example.com"
# smtp_port = 587
# from      = "secubox@example.com"
# to        = "admin@example.com"

# [notifications.webhook]
# url     = "https://hooks.example.com/secubox"
# secret  = ""

# ── Remote UI / HyperPixel Dashboard ─────────────────────────────
# Configuration du dashboard kiosk HyperPixel 2.1 Round (480×480 px)
# sur RPi Zero W — Affichage des métriques SecuBox en temps réel.
#
# Déploiement :
#   bash remote-ui/round/deploy.sh -h <rpi-ip> --api-url http://<secubox-ip>:8000
#
# Service systemd sur le RPi : secubox-remote-ui.service
# Ressources limitées : MemoryMax=256M, CPUQuota=80%
[remote_ui]
enabled       = true
api_base      = "/api/v1/system"     # Endpoint métriques (servi par secubox-system)
refresh_ms    = 5000                 # Intervalle de rafraîchissement (ms)
simulate      = false                # Mode simulation (données fictives)

# Seuils d'alerte — CPU (%)
[remote_ui.thresholds.cpu]
warn = 70                            # Niveau warning
crit = 85                            # Niveau critique

# Seuils d'alerte — Mémoire (%)
[remote_ui.thresholds.mem]
warn = 75
crit = 90

# Seuils d'alerte — Disque (%)
[remote_ui.thresholds.disk]
warn = 80
crit = 95

# Seuils d'alerte — Température CPU (°C)
[remote_ui.thresholds.temp]
warn = 65
crit = 75

# Seuils d'alerte — WiFi RSSI (dBm, valeurs négatives)
[remote_ui.thresholds.wifi]
warn = -70                           # Signal faible
crit = -80                           # Signal critique

# Mapping services SecuBox vers les anneaux du dashboard
# Ordre : centre vers extérieur = AUTH → WALL → BOOT → MIND → ROOT → MESH
[remote_ui.modules]
AUTH = "secubox-auth"                # Authentification / SSO
WALL = "secubox-crowdsec"            # WAF / IDS / CrowdSec
BOOT = "secubox-hub"                 # Dashboard principal
MIND = "secubox-ai-insights"         # IA / Insights
ROOT = "secubox-system"              # Système / Métriques
MESH = "secubox-p2p"                 # Réseau mesh P2P

# Palette de couleurs (hex)
[remote_ui.colors]
AUTH = "#C04E24"                     # Rouge-orange
WALL = "#9A6010"                     # Bronze
BOOT = "#803018"                     # Marron foncé
MIND = "#3D35A0"                     # Violet/indigo
ROOT = "#0A5840"                     # Vert foncé
MESH = "#104A88"                     # Bleu marine