secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 13:59:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
080a4e47a3
secubox-deb/packages
History
CyberMind 080a4e47a3
feat(secubox-mqtt): v2.4.0 rewrite-in-place to LXC + ACL + Mosquitto 2.x (closes #240) (#252) 
Replaces the v1.0.0 host-bound skeleton with the canonical SecuBox LXC
pattern (sibling of authelia/yacy/lyrion). The host-bound mosquitto is
now masked on first install via migrate_from_v1().

Minimum viable v2.4.0 (operator scope choice 2026-05-20):

* LXC at 10.100.0.110 on br-lxc, Mosquitto 2.0.11 (Debian bookworm).
* allow_anonymous false. Per-service ACL with 5 users (z2m, sentinelle,
  domoticz, homeassistant, secubox-api) — randomly generated passwords
  stored at /etc/secubox/secrets/mqtt-<service> (0640 root:secubox).
* Host control plane: FastAPI on /run/secubox/mqtt.sock with endpoints
  /components, /status, /access, /healthz. /access reads from a
  host-side cache /etc/secubox/mqtt-acl.cached (the FastAPI runs as the
  unprivileged secubox user, can't lxc-attach).
* Persistent nftables DNAT in /etc/nftables.d/secubox-mqtt-dnat.nft
  routes LAN traffic on TCP :1883 to the LXC.
* mqttctl follows the SecuBox CTL grammar:
    - introspection: components / status / access
    - lifecycle:     install / reload (+ stubs)
    - module nouns:  topic / client / acl / user (list-only in v2.4.0)
* nginx route /api/v1/mqtt/ on canonical hub vhost (no public vhost —
  the broker is LAN-only, exposed via DNAT not nginx).

Board-validated on gk2:
    $ mqttctl status   →  overall: green
    $ curl --unix-socket /run/secubox/mqtt.sock localhost/status
      → {"overall": "green", "states": {"lxc": "running", "broker": "running", "health": "ok"}}
    $ curl -sk -H "Host: admin.gk2.secubox.in" https://192.168.1.200:9443/api/v1/mqtt/status
      → same
    $ mosquitto_pub -h 10.100.0.110 -t test -m hi
      → "Connection Refused: not authorised."  (anon blocked)
    $ mosquitto_pub -u z2m -P <pw> -t zigbee2mqtt/health -m ok
      → success
    $ nc -zv 192.168.1.200 1883
      → succeeded (LAN DNAT works)
    $ systemctl is-active mosquitto  →  inactive (host one masked)

Out of scope for v2.4.0 (deferred to v2.5):
* 4R double-buffer on the broker config
* Jinja2 templating
* operator-level ACL/user management via /api/v1/mqtt/
* TLS 1.3 on port 8883

Lessons folded in during board cycle:
* Mosquitto 2.x rejects duplicate single-value keys
  (`persistence_location`, `log_dest`) — keep the conf.d snippet
  minimal, the Debian default mosquitto.conf already sets them.
* lxc-info requires root → API uses TCP probe to LXC_IP:MQTT_PORT
  as a privilege-free liveness signal; catches PermissionError on
  `/data/lxc/<name>/` stat (rootfs mode 0770 owned by mapped uid 100000).
* migrate_from_v1 uses bare `systemctl is-active mosquitto` instead of
  a `list-unit-files | grep` prefilter (simpler + actually correct).

Closes #240

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
2026-05-20 13:42:42 +02:00
..
secubox-ad-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-admin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ai-gateway fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ai-insights fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-auth fix(auth+users): /auth/status → /preflight (avoid route collision); engine TOTP window parameter; postinst chmod for writes (ref #120) 2026-05-13 10:55:21 +02:00
secubox-authelia feat(secubox-authelia): SSO IdP LXC scaffolding v1.0.0 (#239) (#242) 2026-05-20 09:53:56 +02:00
secubox-avatar fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-backup fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-c3box feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cdn feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cloner feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-config-advisor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-console feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cookies fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-core fix(secubox-core): don't overwrite /etc/nginx/sites-available/secubox on upgrade (closes #162) (#165) 2026-05-17 07:52:57 +02:00
secubox-crowdsec feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cve-triage fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-cyberfeed fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-daemon/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-defaults ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-device-intel fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-dns feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-dns-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-dns-provider feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-domoticz feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-dpi feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-droplet feat(metablogizer,droplet): orchestrate haproxy + mitmproxy on publish (closes #200) (#209) 2026-05-19 07:42:38 +02:00
secubox-exposure fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-eye-remote feat(eye-remote): /api/v1/health alias for round dashboard probe (#198) 2026-05-18 15:52:41 +02:00
secubox-eye-square fix(eye-square): relocate firstboot.sh out of /usr/local/sbin/ (closes #207) (#208) 2026-05-19 06:53:31 +02:00
secubox-full/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-gitea feat(giteactl): forge runner noun verbs — LXC-only CI execution (closes #190) (#191) 2026-05-17 11:59:59 +02:00
secubox-glances fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-gotosocial fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-grafana fix(lxc-modules): 9 board-deployment fixes for grafana/yacy/rustdesk install-lxc.sh + nginx wiring (#238) 2026-05-20 09:21:48 +02:00
secubox-haproxy ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-hardening feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-health-doctor fix(secubox-health-doctor): drop redundant debian/compat (closes #220) (#221) 2026-05-19 11:44:35 +02:00
secubox-hexo fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-homeassistant feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-hub fix(secubox-hub): health-banner isHubVhost gate + drop stale nac/soc www/ (closes #247) (#250) 2026-05-20 12:53:46 +02:00
secubox-identity fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-interceptor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-iot-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ipblock fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-jabber feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-jellyfin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-jitsi fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ksm fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-led-heartbeat fix(image): silence Pi-only services on x64 + broaden X11 driver set (closes #226) (#227) 2026-05-19 14:38:20 +02:00
secubox-lite/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-localai feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-localrecall fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-lyrion feat(secubox-lyrion): LAN UI + LMS prefs + slimproto DNAT (closes #248) (#251) 2026-05-20 12:53:50 +02:00
secubox-mac-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-magicmirror feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mail fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mail-lxc Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-master-link fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-matrix feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mcp-server fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mediaflow feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mesh fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-meshname fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metablogizer feat(metablogizer,droplet): orchestrate haproxy + mitmproxy on publish (closes #200) (#209) 2026-05-19 07:42:38 +02:00
secubox-metabolizer fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metacatalog fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metoblizer ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-metrics fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mirror feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mitmproxy fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mmpm feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-modem feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mqtt feat(secubox-mqtt): v2.4.0 rewrite-in-place to LXC + ACL + Mosquitto 2.x (closes #240) (#252) 2026-05-20 13:42:42 +02:00
secubox-nac feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-ndpid feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netdata feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netdiag fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-netifyd feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netmodes feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-nettweak fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-network-anomaly fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-newsbin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-nextcloud feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-ollama fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-openclaw fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ossec feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-p2p feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-peertube fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-photoprism fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-picobrew fix(image): silence Pi-only services on x64 + broaden X11 driver set (closes #226) (#227) 2026-05-19 14:38:20 +02:00
secubox-portal feat(portal): regenerate full dashboard — navbar+vhosts+certs+attacks+metrics+cookies (closes #192) (#193) 2026-05-18 05:59:17 +02:00
secubox-publish feat(publishctl): rename metactl -> publishctl + add post noun (closes #180) (#189) 2026-05-17 11:38:46 +02:00
secubox-qos feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-redroid feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-repo feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-reporter fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rezapp feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-roadmap feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-routes fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rtty fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rustdesk fix(lxc-modules): 9 board-deployment fixes for grafana/yacy/rustdesk install-lxc.sh + nginx wiring (#238) 2026-05-20 09:21:48 +02:00
secubox-saas-relay feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-simplex feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-smart-strip feat(hardware): Add Smart-Strip HMI module (SBX-STR-01) + fix lite profile build 2026-04-27 19:03:08 +02:00
secubox-smtp-relay fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-soc fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-soc-agent feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-soc-gateway feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-soc-web fix(secubox-soc-web): remove duplicate /soc/ location from nginx snippet (closes #163) (#166) 2026-05-17 07:53:00 +02:00
secubox-streamforge feat(streamforgectl): forge project noun verbs (closes #183) (#187) 2026-05-17 11:38:41 +02:00
secubox-streamlit feat(streamlitctl): add app info + app restart verbs (closes #182) (#188) 2026-05-17 11:38:44 +02:00
secubox-system feat(eye-remote): multi-gadget DHCP on eye-br0 — Phase 1 (#161) 2026-05-17 06:04:54 +02:00
secubox-system-hub feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-threat-analyst fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-threats fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-tor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-torrent fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-traffic fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-turn fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ui-manager feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-users fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vault feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-vhost feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-vm feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-voip fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vortex-dns fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vortex-firewall fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-waf fix(secubox-waf): apply double-cache pattern on /stats + /alerts (closes #145) (#146) 2026-05-18 08:21:17 +02:00
secubox-watchdog fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-wazuh feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-webmail Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-webmail-lxc Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-webradio feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-wireguard feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-yacy fix(secubox-yacy): ship public vhost + acme-challenge + admin auto-inject (closes #246) (#249) 2026-05-20 12:53:42 +02:00
secubox-zigbee feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-zkp fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
zkp-hamiltonian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00