mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-30 00:19:30 +00:00
6b9732278a
Third module against docs/MODULE-GUIDELINES.md (after grafana #231, yacy #233). Opens the REMOTE-ACCESS layer of the SecuBox CTL grammar — sister to OPS MONITORING / SEARCH. RustDesk hbbs (signal) and hbbr (relay) — TWO daemons — run on separate systemd units in a Debian bookworm LXC at 10.100.0.90 on br-lxc. rustdeskctl components surfaces them as independent components (4 total: lxc + hbbs + hbbr + host-api), not aggregated. Two deviations from the grafana/yacy pattern, both forced by the RustDesk protocol shape: 1) HAProxy stream-mode (TCP) for ports 21115/21116/21117 — see haproxy/rustdesk-stream.cfg, installed to /etc/haproxy/secubox-streams/. mitmproxy is bypassed for these ports because they don't speak HTTP. 2) nftables DNAT for 21116/udp inside install-lxc.sh — mitmproxy cannot inspect raw UDP NAT-traversal traffic, so the host forwards UDP packets directly to the LXC. Rule lives in the inet secubox table. The web admin UI (port 21114) still routes through nginx like the other two modules (`/api/v1/rustdesk/` Unix socket + `/rustdesk/` iframe target to the LXC). install-lxc.sh is idempotent: creates LXC + bridge if missing, debootstraps, downloads + unzips the RustDesk Linux amd64 release, writes hbbs + hbbr systemd units, generates an ed25519 pre-shared key (/etc/secubox/secrets/rustdesk-key) for client config, installs the nftables UDP DNAT. CTL stubs the remote-access nouns (peer/relay/key/session) behind a clear "not yet implemented" exit 2 for v1.0.0; three-fold + install/reload surface is operator-usable from day one. Same packaging template as #231/#233 (no debian/compat, idempotent postinst, conditional nginx reload, NoNewPrivileges service unit). Slipstreams automatically into the next image build. Co-authored-by: CyberMind-FR <gandalf@Gk2.net> |
||
|---|---|---|
| .. | ||
| rustdesk-stream.cfg | ||