mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 15:37:03 +00:00
5b7b088a4a
The 2026-05-23 incident wiped database.db during a z2m crash-loop
against a down MQTT broker — network_key regenerated, 5 devices
lost, manual re-pairing required. v2.6.0 adds the safety net so
the next time something corrupts z2m state, the operator clicks
Restore in the webui instead of factory-resetting hardware.
Host-side scripts:
- sbin/zigbee-backup: snapshots database.db, configuration.yaml,
coordinator_backup.json, state.json to /data/backup/zigbee/
<UTC-ts>/. Refuses on unhealthy state (z2m port closed OR
database.db < 1 KB). Rotates to last 24.
- sbin/zigbee-restore <ts>: stops z2m, archives current state as
pre-restore-<now>, restores files, restarts z2m.
systemd timer: secubox-zigbee-backup.timer — OnBootSec=15min,
OnUnitActiveSec=1h, RandomizedDelaySec=5min, Persistent. Enabled
+ started by postinst.
API: GET /backups, POST /backup, POST /restore {id}. The FastAPI
calls the scripts via 'sudo -n /usr/sbin/zigbee-*' which works via
new /etc/sudoers.d/secubox-zigbee NOPASSWD grant. Required
relaxing NoNewPrivileges=true to false on secubox-zigbee.service
(attack surface still gated by nginx + Authelia + 2-script
whitelist; documented in the unit).
UI: Backups card above About with newest-first table (timestamp,
device count, DB size) + per-row Restore button (confirm dialog).
Backup now + Refresh buttons.
LXC ordering fix in install-lxc.sh:
- lxc.start.order = 20 + lxc.start.delay = 20 — zigbee LXC starts
AFTER mqtt and waits 20s before next container.
- z2m systemd ExecStartPre TCP-probes 10.100.0.110:1883 for up to
60s; refuses to start if MQTT broker unreachable. Stops the
'crash-loop while broker down → DB corruption' chain.
Live-validated on gk2: API POST /backup → snapshot
20260523T073901Z written, listed via GET /backups, all 4 files
present on disk. Timer active.
Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
45 lines
2.7 KiB
Makefile
Executable File
45 lines
2.7 KiB
Makefile
Executable File
#!/usr/bin/make -f
|
|
%:
|
|
dh $@
|
|
|
|
override_dh_auto_install:
|
|
# Host control plane (FastAPI)
|
|
install -d debian/secubox-zigbee/usr/lib/secubox/zigbee
|
|
cp -r api debian/secubox-zigbee/usr/lib/secubox/zigbee/
|
|
# CTL
|
|
install -d debian/secubox-zigbee/usr/sbin
|
|
install -m 755 sbin/zigbeectl debian/secubox-zigbee/usr/sbin/zigbeectl
|
|
# v2.6.0 backup / restore helpers + hourly timer
|
|
install -m 755 sbin/zigbee-backup debian/secubox-zigbee/usr/sbin/zigbee-backup
|
|
install -m 755 sbin/zigbee-restore debian/secubox-zigbee/usr/sbin/zigbee-restore
|
|
install -d debian/secubox-zigbee/lib/systemd/system
|
|
install -m 644 systemd/secubox-zigbee-backup.service debian/secubox-zigbee/lib/systemd/system/secubox-zigbee-backup.service
|
|
install -m 644 systemd/secubox-zigbee-backup.timer debian/secubox-zigbee/lib/systemd/system/secubox-zigbee-backup.timer
|
|
# v2.6.0 sudoers grant: lets secubox-zigbee FastAPI trigger the
|
|
# backup / restore scripts (run as root, need access to LXC files).
|
|
install -d debian/secubox-zigbee/etc/sudoers.d
|
|
install -m 440 sudoers.d/secubox-zigbee debian/secubox-zigbee/etc/sudoers.d/secubox-zigbee
|
|
# Web UI
|
|
install -d debian/secubox-zigbee/usr/share/secubox/www
|
|
[ -d www ] && cp -r www/. debian/secubox-zigbee/usr/share/secubox/www/ || true
|
|
# Menu entry
|
|
install -d debian/secubox-zigbee/usr/share/secubox/menu.d
|
|
[ -d menu.d ] && cp -r menu.d/. debian/secubox-zigbee/usr/share/secubox/menu.d/ || true
|
|
# nginx canonical-hub snippet (SecuBox config module + API). Installed to
|
|
# both secubox.d/ and secubox-routes.d/ (per v2.11.1 lesson).
|
|
install -d debian/secubox-zigbee/etc/nginx/secubox.d
|
|
[ -f nginx/zigbee.conf ] && cp nginx/zigbee.conf debian/secubox-zigbee/etc/nginx/secubox.d/ && (install -d debian/secubox-zigbee/etc/nginx/secubox-routes.d && cp nginx/zigbee.conf debian/secubox-zigbee/etc/nginx/secubox-routes.d/) || true
|
|
# Public Zigbee Manager vhost (zigbee.gk2.secubox.in). Operator enables
|
|
# with ln -s ../sites-available/zigbee.conf /etc/nginx/sites-enabled/
|
|
install -d debian/secubox-zigbee/etc/nginx/sites-available
|
|
[ -f nginx/zigbee-vhost.conf ] && install -m 644 nginx/zigbee-vhost.conf debian/secubox-zigbee/etc/nginx/sites-available/zigbee.conf || true
|
|
# Config example
|
|
install -d debian/secubox-zigbee/etc/secubox
|
|
[ -f conf/zigbee.toml.example ] && cp conf/zigbee.toml.example debian/secubox-zigbee/etc/secubox/zigbee.toml.example || true
|
|
# LXC bootstrap
|
|
install -d debian/secubox-zigbee/usr/share/secubox/lib/zigbee
|
|
[ -d lib/zigbee ] && cp -r lib/zigbee/. debian/secubox-zigbee/usr/share/secubox/lib/zigbee/ || true
|
|
# install-lxc.sh must be executable (cp -r doesn't always preserve +x from git)
|
|
[ -f debian/secubox-zigbee/usr/share/secubox/lib/zigbee/install-lxc.sh ] && \
|
|
chmod 755 debian/secubox-zigbee/usr/share/secubox/lib/zigbee/install-lxc.sh
|