mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
92 lines
3.1 KiB
Bash
Executable File
92 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# ══════════════════════════════════════════════════════════════════
|
|
# SecuBox APT Repository Installer
|
|
# Usage: curl -fsSL https://apt.secubox.in/install.sh | sudo bash
|
|
# ══════════════════════════════════════════════════════════════════
|
|
set -e
|
|
|
|
REPO_URL="https://apt.secubox.in"
|
|
KEYRING_PATH="/usr/share/keyrings/secubox.gpg"
|
|
SOURCES_PATH="/etc/apt/sources.list.d/secubox.list"
|
|
DIST="${DIST:-bookworm}"
|
|
|
|
# Colors
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
log() { echo -e "${CYAN}[secubox]${NC} $*"; }
|
|
ok() { echo -e "${GREEN}[OK]${NC} $*"; }
|
|
err() { echo -e "${RED}[ERR]${NC} $*" >&2; exit 1; }
|
|
|
|
# Check root
|
|
[[ $EUID -ne 0 ]] && err "This script must be run as root (use sudo)"
|
|
|
|
# Check OS
|
|
if [[ ! -f /etc/debian_version ]]; then
|
|
err "This script only supports Debian-based distributions"
|
|
fi
|
|
|
|
# Detect distribution
|
|
if [[ -f /etc/os-release ]]; then
|
|
. /etc/os-release
|
|
case "${VERSION_CODENAME}" in
|
|
bookworm|bullseye|buster) DIST="${VERSION_CODENAME}" ;;
|
|
trixie|sid) DIST="trixie" ;;
|
|
*) log "Unknown distribution ${VERSION_CODENAME}, using ${DIST}" ;;
|
|
esac
|
|
fi
|
|
|
|
log "Installing SecuBox APT repository..."
|
|
log "Distribution: ${DIST}"
|
|
|
|
# Install prerequisites
|
|
log "Installing prerequisites..."
|
|
apt-get update -qq
|
|
apt-get install -y -qq curl gnupg ca-certificates >/dev/null
|
|
|
|
# Download and install GPG key
|
|
log "Adding GPG key..."
|
|
curl -fsSL "${REPO_URL}/secubox-keyring.gpg" | tee "${KEYRING_PATH}" >/dev/null
|
|
chmod 644 "${KEYRING_PATH}"
|
|
ok "GPG key installed"
|
|
|
|
# Add repository
|
|
log "Adding repository..."
|
|
cat > "${SOURCES_PATH}" <<EOF
|
|
# SecuBox APT Repository
|
|
# https://github.com/gkerma/secubox-deb
|
|
deb [signed-by=${KEYRING_PATH}] ${REPO_URL} ${DIST} main
|
|
EOF
|
|
chmod 644 "${SOURCES_PATH}"
|
|
ok "Repository added"
|
|
|
|
# Update package lists
|
|
log "Updating package lists..."
|
|
apt-get update -qq
|
|
|
|
# Show available packages
|
|
log "Available SecuBox packages:"
|
|
echo ""
|
|
echo " Metapackages (recommended):"
|
|
echo " secubox-full - Complete SecuBox installation (all 33 modules)"
|
|
echo " secubox-lite - Essential modules only (for ESPRESSObin)"
|
|
echo ""
|
|
echo " Individual packages:"
|
|
echo " secubox-core - Core library (required by all)"
|
|
echo " secubox-hub - Central dashboard"
|
|
echo " secubox-* - Individual modules"
|
|
echo ""
|
|
|
|
ok "SecuBox repository installed successfully!"
|
|
echo ""
|
|
echo -e "${GREEN}════════════════════════════════════════════${NC}"
|
|
echo " Install SecuBox:"
|
|
echo ""
|
|
echo " sudo apt install secubox-full # All modules"
|
|
echo " sudo apt install secubox-lite # Essential only"
|
|
echo ""
|
|
echo " Web interface: https://localhost:8443"
|
|
echo -e "${GREEN}════════════════════════════════════════════${NC}"
|