mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
24000d67ea
Hub + portal stayed `inactive (dead)` on real-hardware boot. The journal error was `Failed to set up mount namespacing: /run/systemd/ unit-root/run/secubox: No such file or directory` at the NAMESPACE step. Root cause: 96 services declare `RuntimeDirectory=secubox` without the matching `RuntimeDirectoryPreserve=yes`. When any of them stops (including any of the LXC-backed services that fail their health probe and Restart=on-failure for a few cycles), systemd removes /run/secubox on the way out. The next service with the same RuntimeDirectory= that tries to namespace its inputs hits the gap and falls into 226/NAMESPACE failure — Restart hammers a few times, then the unit goes failed-permanent. Earlier fmrelay + sentinelle units got the fix individually (v2.12.0/v2.12.3 era). Now applied to all 96 remaining units in a single sweep via: sed -i '/^RuntimeDirectory=secubox/a RuntimeDirectoryPreserve=yes' "$f" No version bumps in changelog — `dpkg -i --force-depends` in the live-USB slipstream picks up the new .deb regardless of version number.
29 lines
689 B
Desktop File
29 lines
689 B
Desktop File
[Unit]
|
|
Description=SecuBox IPBlock API
|
|
After=network.target secubox-core.service
|
|
Requires=secubox-core.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=secubox
|
|
Group=secubox
|
|
WorkingDirectory=/usr/lib/secubox/ipblock
|
|
ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/ipblock.sock --log-level warning
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
UMask=0000
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
RuntimeDirectory=secubox
|
|
RuntimeDirectoryPreserve=yes
|
|
RuntimeDirectoryMode=0775
|
|
ProtectSystem=full
|
|
ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/nftables.d
|
|
|
|
# Allow nft commands
|
|
AmbientCapabilities=CAP_NET_ADMIN
|
|
CapabilityBoundingSet=CAP_NET_ADMIN
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|