mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 17:37:13 +00:00
b21b2000d8
mitmproxyctl is SecuBox's third routing verb, parallel to:
haproxyctl vhost add/remove (routing layer)
giteactl user add/remove (identity layer)
mitmproxyctl route add/remove (interception layer) ← new
Without this verb, every WAF route change required hand-editing
/srv/mitmproxy/haproxy-routes.json + manual restart. The interception
organ existed but could not be commanded.
Changes:
* Defaults now match board reality:
CONTAINER_NAME : "mitmproxy-waf" -> "mitmproxy"
LXC_PATH : "/var/lib/lxc" -> "/data/lxc"
All overridable via [container] in /etc/secubox/mitmproxy.toml.
* Added --config flag to load any TOML.
* New `route` subcommand:
mitmproxyctl route list
mitmproxyctl route add HOST IP PORT [--no-restart]
mitmproxyctl route remove HOST [--no-restart]
Atomic writes via .tmp + replace, mirror to the LXC-rootfs copy of
haproxy-routes.json automatically, restart prefers in-LXC systemd
`mitmproxy.service` reload over full container bounce.
* `restart` is now reload-friendly when an in-LXC systemd unit exists
(the common case on the live board); falls back to stop+start otherwise.
* `logs` reads via `journalctl -u mitmproxy` in-LXC (was `tail` on a
file path that didn't exist in practice).
After this lands, the gitea WAF unbypass (done by hand today during the
#156 cascade) reduces to:
haproxyctl vhost add gitea.gk2.secubox.in mitmproxy_inspector ssl
mitmproxyctl route add gitea.gk2.secubox.in 192.168.1.200 9080
Three verbs, three layers, one operation. The grammar closes.
Out of scope (separate ticket): the package's debian/postinst still
assumes host-installed mitmproxy under /srv/mitmproxy-waf/, while the
modern board runs the LXC topology this ctl now targets. That refactor
will follow as a postinst -> LXC-bootstrap migration similar to mailctl.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| mitmproxyctl | ||