SecuBox - ${NAME^}

#!/usr/bin/env bash # ══════════════════════════════════════════════════════════════════ # scripts/new-package.sh — Scaffold un nouveau paquet secubox-* # # Usage : # bash scripts/new-package.sh mymodule "My Module Description" # # Features: # - FastAPI app with auth # - Debian packaging (control, rules, postinst, prerm) # - Systemd service (Unix socket) # - Modular nginx config (auto-register in /etc/nginx/secubox.d/) # - Menu registration (menu.d) # ══════════════════════════════════════════════════════════════════ set -euo pipefail REPO="$(cd "$(dirname "$0")/.." && pwd)" NAME="${1:-}" DESC="${2:-SecuBox module}" [[ -z "$NAME" ]] && { echo "Usage: $0 [description]"; exit 1; } PKG="secubox-${NAME}" PKG_DIR="$REPO/packages/$PKG" [[ -d "$PKG_DIR" ]] && { echo "❌ $PKG existe déjà"; exit 1; } echo "📦 Création $PKG..." mkdir -p "$PKG_DIR"/{debian,api/routers,www/${NAME},nginx} # ══════════════════════════════════════════════════════════════════ # API FILES # ══════════════════════════════════════════════════════════════════ # ── api/main.py ── cat > "$PKG_DIR/api/main.py" < "$PKG_DIR/api/__init__.py" <<< "" cat > "$PKG_DIR/api/routers/__init__.py" <<< "" # ══════════════════════════════════════════════════════════════════ # NGINX MODULAR CONFIG # ══════════════════════════════════════════════════════════════════ cat > "$PKG_DIR/nginx/${NAME}.conf" < "$PKG_DIR/www/${NAME}/index.html" < SecuBox - ${NAME^}

Module Status

HTML # ══════════════════════════════════════════════════════════════════ # DEBIAN PACKAGING # ══════════════════════════════════════════════════════════════════ # ── debian/control ── cat > "$PKG_DIR/debian/control" < Build-Depends: debhelper-compat (= 13) Standards-Version: 4.6.2 Package: ${PKG} Architecture: all Depends: \${misc:Depends}, secubox-core (>= 1.0), python3-uvicorn Description: ${DESC} Port Debian bookworm du module luci-app-${NAME} de SecuBox OpenWrt. Provides FastAPI backend on /api/v1/${NAME}/ via Unix socket. CTRL # ── debian/rules ── cat > "$PKG_DIR/debian/rules" < "$PKG_DIR/debian/compat" # ── debian/changelog ── cat > "$PKG_DIR/debian/changelog" < $(date -R) CHLOG # ── debian/postinst ── cat > "$PKG_DIR/debian/postinst" <<'POSTINST' #!/bin/bash set -e case "$1" in configure) # Ensure secubox user exists id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories. # NOTE (#623): these are SHARED parents — keep them traversable for every # secubox-* daemon. /run/secubox MUST stay 1777 (world-writable sticky, all # services drop sockets there, ref #471); /var/lib/secubox MUST stay 0755. # NEVER set a shared parent to 0750/0700 — it breaks traversal for non-secubox # users (kbin/toolbox 500). Module-private leaves (/var/lib/secubox/PKGNAME) # may be 0750. Re-asserting 0755/1777 here is idempotent + self-healing. install -d -o root -g root -m 1777 /run/secubox install -d -o secubox -g secubox -m 755 /var/lib/secubox # Ensure nginx secubox.d directory exists install -d -m 755 /etc/nginx/secubox.d # Enable and start service systemctl daemon-reload systemctl enable PKGNAME.service systemctl start PKGNAME.service || true # Reload nginx to pick up new location systemctl reload nginx 2>/dev/null || true ;; esac #DEBHELPER# POSTINST sed -i "s/PKGNAME/${PKG}/g" "$PKG_DIR/debian/postinst" chmod +x "$PKG_DIR/debian/postinst" # ── debian/prerm ── cat > "$PKG_DIR/debian/prerm" <<'PRERM' #!/bin/bash set -e case "$1" in remove|upgrade) # Remove nginx location config rm -f /etc/nginx/secubox.d/MODNAME.conf # Stop and disable service systemctl stop PKGNAME.service 2>/dev/null || true systemctl disable PKGNAME.service 2>/dev/null || true # Reload nginx to remove location systemctl reload nginx 2>/dev/null || true ;; esac #DEBHELPER# PRERM sed -i "s/PKGNAME/${PKG}/g; s/MODNAME/${NAME}/g" "$PKG_DIR/debian/prerm" chmod +x "$PKG_DIR/debian/prerm" # ── systemd unit ── cat > "$PKG_DIR/debian/${PKG}.service" <