mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 12:34:38 +00:00
122cd6cebc
* docs(spec+plan): WebUI obfuscation design and implementation plan (ref #44) Spec: docs/superpowers/specs/2026-05-12-webui-obfuscation-design.md Plan: docs/superpowers/plans/2026-05-12-webui-obfuscation.md The design locks the SecuBox WebUI to admin.<HOSTNAME>.<DOMAIN_SUFFIX> via strict-regex ACLs in HAProxy AND nginx, both driven by /etc/default/secubox as the single source of truth. New package secubox-defaults ships the env file; secubox-haproxy API exposes /webui/admin-domain (info), /webui/nginx-config (JWT, rendered vhost), /webui/refresh (JWT, cache invalidate). A safe renderer script writes the nginx vhost atomically; haproxyctl + Python /generate both inject the strict ACL at the top of http-in and https-in frontends. Plan has 15 tasks with TDD steps, exact file paths, and complete code in every step (no TBD/TODO). Acceptance criteria + integration test script included. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(secubox-defaults): scaffold package skeleton (ref #44) * feat(secubox-defaults): ship /etc/default/secubox env file (ref #44) * feat(secubox-defaults): postinst autodetect + dpkg-trigger (ref #44) * feat(secubox-haproxy): webui_identity helper + tests (ref #44) Implement webui_identity module that parses /etc/default/secubox and exposes canonical admin URL + regex pattern for HAProxy acl. New module: - api/webui_identity.py: Parses SECUBOX_HOSTNAME and SECUBOX_DOMAIN_SUFFIX with LRU cache and invalidation support. Tests (TDD): - tests/test_webui_identity.py: 5 test cases covering basic parsing, missing hostname validation, custom suffix handling, comment handling, and cache invalidation. - tests/conftest.py: sys.path bootstrap for api/ imports. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(webui_identity): catch OSError on defaults read + test (ref #44) * feat(secubox-haproxy): GET /webui/admin-domain endpoint (ref #44) * feat(secubox-haproxy): GET /webui/nginx-config rendered vhost (ref #44) * feat(secubox-haproxy): POST /webui/refresh cache invalidation (ref #44) * feat(secubox-haproxy): secubox-render-nginx-webui safe renderer (ref #44) * feat(haproxyctl): inject strict-regex WebUI ACL at frontend top (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): /generate symmetry with strict WebUI ACL (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): dpkg-trigger refresh on secubox-defaults-changed (ref #44) * build(secubox-haproxy): depend on secubox-defaults (ref #44) * test(infra): integration test for WebUI obfuscation (ref #44) * docs: HISTORY Session 159 — WebUI obfuscation (ref #44) Records the complete WebUI obfuscation work: new secubox-defaults package, three /webui/* endpoints, nginx renderer script, haproxyctl + Python generator symmetry, dpkg trigger plumbing, integration test. Includes notes on the brainstorming → spec → plan → subagent-driven execution flow and the 6 fix iterations caught by reviewers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| architecture | ||
| assets | ||
| design | ||
| errata | ||
| eye-remote | ||
| hardware | ||
| reference | ||
| references/gst | ||
| reports | ||
| screenshots | ||
| superpowers | ||
| wiki | ||
| AI-BUILD-PROMPT.md | ||
| FAQ-BUSYBOX-RESCUE.md | ||
| LED-HEALTHBUMP.md | ||
| LIVE-USB.md | ||
| MODULES.md | ||
| OPENWRT-CRT-THEME.md | ||
| OPENWRT-DEBIAN-COMPARISON.md | ||
| OPENWRT-MASTERLINK.md | ||
| OPENWRT-MESH-DAEMON.md | ||
| PROMPT-BUSYBOX-TECHTIP.md | ||
| SCREENSHOTS-VM.md | ||
| SECUBOX-DEV-METHODOLOGY.md | ||
| TOOLS.md | ||
| UI-GUIDE.md | ||