secubox-deb/image/profiles/x64-live.conf

# ══════════════════════════════════════════════════════════════════
# SecuBox-DEB Build Profile: x64 Live USB
# Target: Bootable USB drives with full SecuBox modules
# ══════════════════════════════════════════════════════════════════

# Profile identification
PROFILE_NAME="x64-live"
PROFILE_DESC="x86_64 Live USB Image with Kiosk"
LOG_PREFIX="live-usb"

# Architecture
TARGET_ARCH="amd64"
TARGET_KERNEL="linux-image-amd64"

# Image settings
IMAGE_NAME="secubox-live-amd64-${DEBIAN_RELEASE}.img"
IMAGE_SIZE="8G"
PARTITION_TYPE="efi"

# Feature flags
INCLUDE_KIOSK=1
INCLUDE_DESKTOP=1
INCLUDE_SLIPSTREAM=1

# SecuBox module profiles
# full: All modules (default)
# lite: Minimal essential modules
# network: Networking and security modules
# custom: User-defined selection
SECUBOX_PROFILE="${SECUBOX_PROFILE:-full}"

# Base packages
BASE_PACKAGES="
    linux-image-amd64
    grub-efi-amd64
    systemd
    systemd-sysv
    dbus
    openssh-server
    sudo
    curl
    wget
    ca-certificates
    gnupg
    nginx
    python3
    python3-pip
    python3-venv
    nftables
    iproute2
    netplan.io
    locales
    console-setup
    vim-tiny
    rsync
    parted
    fdisk
    jq
"

# Python dependencies for SecuBox modules
# Note: python3-cryptography, python3-jose, python3-zmq installed post-debootstrap
# (they fail during debootstrap due to Rust/native compilation)
PYTHON_PACKAGES="
    python3-fastapi
    python3-uvicorn
    python3-httpx
    python3-psutil
    python3-aiosqlite
    python3-jinja2
    python3-jwt
    python3-aiofiles
    python3-pil
    python3-tomli
    python3-pydantic
    python3-toml
    python3-netifaces
"

# Packages to install post-debootstrap (fail during debootstrap)
PYTHON_PACKAGES_POST="
    python3-cryptography
    python3-jose
    python3-zmq
"

# Network and security tools
NETWORK_PACKAGES="
    bridge-utils
    traceroute
    dnsutils
    whois
    mtr-tiny
    nmap
    arping
    avahi-daemon
    avahi-utils
    ieee-data
    procps
    openssl
    wireguard-tools
    dnsmasq
    haproxy
"

# Security services
SECURITY_PACKAGES="
    crowdsec
    glances
    netdata
"

# Kiosk packages (X11 + Chromium)
KIOSK_PACKAGES="
    xserver-xorg
    xserver-xorg-video-all
    xserver-xorg-input-all
    x11-xserver-utils
    xinit
    chromium
    chromium-sandbox
    nodm
    feh
    fonts-dejavu
    fonts-liberation
    fonts-cantarell
"

# Plymouth boot splash
PLYMOUTH_PACKAGES="
    plymouth
    plymouth-themes
"

# Python packages (pip)
PIP_PACKAGES="
    fastapi
    uvicorn[standard]
    httpx
    python-jose
    toml
    pyyaml
    aiofiles
    psutil
    netifaces
"

# SecuBox modules by profile
get_secubox_modules() {
    case "$SECUBOX_PROFILE" in
        full)
            # All available modules
            echo "secubox-full"
            ;;
        lite)
            # Essential modules for low-RAM devices
            echo "secubox-lite"
            ;;
        network)
            # Network security focused
            echo "secubox-core secubox-hub secubox-crowdsec secubox-netdata"
            echo "secubox-wireguard secubox-nac secubox-netmodes secubox-dpi"
            echo "secubox-waf secubox-dns secubox-firewall"
            ;;
        custom)
            # Read from SECUBOX_MODULES environment variable
            echo "${SECUBOX_MODULES:-secubox-core secubox-hub}"
            ;;
        *)
            echo "secubox-full"
            ;;
    esac
}

# Bootloader
BOOTLOADER="grub-efi"
GRUB_DEFAULT="SecuBox Kiosk Mode"
GRUB_TIMEOUT=3

# Network configuration
NETWORK_TYPE="dhcp"
HOSTNAME_PREFIX="secubox-live"

# Kiosk configuration
KIOSK_USER="kiosk"
KIOSK_URL="https://localhost/"
KIOSK_FULLSCREEN=1

# Post-install hooks
post_install_hook() {
    local root="$1"
    local script_dir="$(dirname "${BASH_SOURCE[0]}")/.."

    # Configure kiosk user
    if [[ $INCLUDE_KIOSK -eq 1 ]]; then
        run_chroot "$root" "
            useradd -m -s /bin/bash $KIOSK_USER 2>/dev/null || true
            echo '$KIOSK_USER ALL=(ALL) NOPASSWD: /sbin/poweroff, /sbin/reboot' >> /etc/sudoers.d/kiosk
        "

        # Install kiosk scripts
        mkdir -p "$root/usr/share/secubox/kiosk"
        if [[ -d "$script_dir/kiosk" ]]; then
            cp "$script_dir/kiosk/secubox-kiosk.sh" "$root/usr/share/secubox/kiosk/"
            chmod +x "$root/usr/share/secubox/kiosk/secubox-kiosk.sh"
        fi

        # Install xinitrc for kiosk user
        mkdir -p "$root/home/$KIOSK_USER"
        cat > "$root/home/$KIOSK_USER/.xinitrc" << 'XINITRC'
#!/bin/bash
# SecuBox Kiosk X Session
export DISPLAY=:0
export KIOSK_URL="https://localhost/"
xset s off
xset s noblank
xset -dpms
xsetroot -solid "#0a0a0f"
exec /usr/share/secubox/kiosk/secubox-kiosk.sh
XINITRC
        chmod +x "$root/home/$KIOSK_USER/.xinitrc"

        # Configure nodm for autologin with custom xsession
        cat > "$root/etc/default/nodm" << EOF
NODM_ENABLED=true
NODM_USER=$KIOSK_USER
NODM_FIRST_VT=7
NODM_XSESSION=/home/$KIOSK_USER/.xinitrc
NODM_X_OPTIONS='-nolisten tcp'
NODM_MIN_SESSION_TIME=60
EOF

        # Ensure correct ownership
        run_chroot "$root" "chown -R $KIOSK_USER:$KIOSK_USER /home/$KIOSK_USER"
    fi

    # Install Plymouth theme
    if [[ -d "$root/usr/share/plymouth/themes/secubox" ]]; then
        run_chroot "$root" "plymouth-set-default-theme secubox"
    fi

    # Enable systemd-networkd
    run_chroot "$root" "systemctl enable systemd-networkd"
}