mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
122cd6cebc
* docs(spec+plan): WebUI obfuscation design and implementation plan (ref #44) Spec: docs/superpowers/specs/2026-05-12-webui-obfuscation-design.md Plan: docs/superpowers/plans/2026-05-12-webui-obfuscation.md The design locks the SecuBox WebUI to admin.<HOSTNAME>.<DOMAIN_SUFFIX> via strict-regex ACLs in HAProxy AND nginx, both driven by /etc/default/secubox as the single source of truth. New package secubox-defaults ships the env file; secubox-haproxy API exposes /webui/admin-domain (info), /webui/nginx-config (JWT, rendered vhost), /webui/refresh (JWT, cache invalidate). A safe renderer script writes the nginx vhost atomically; haproxyctl + Python /generate both inject the strict ACL at the top of http-in and https-in frontends. Plan has 15 tasks with TDD steps, exact file paths, and complete code in every step (no TBD/TODO). Acceptance criteria + integration test script included. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(secubox-defaults): scaffold package skeleton (ref #44) * feat(secubox-defaults): ship /etc/default/secubox env file (ref #44) * feat(secubox-defaults): postinst autodetect + dpkg-trigger (ref #44) * feat(secubox-haproxy): webui_identity helper + tests (ref #44) Implement webui_identity module that parses /etc/default/secubox and exposes canonical admin URL + regex pattern for HAProxy acl. New module: - api/webui_identity.py: Parses SECUBOX_HOSTNAME and SECUBOX_DOMAIN_SUFFIX with LRU cache and invalidation support. Tests (TDD): - tests/test_webui_identity.py: 5 test cases covering basic parsing, missing hostname validation, custom suffix handling, comment handling, and cache invalidation. - tests/conftest.py: sys.path bootstrap for api/ imports. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(webui_identity): catch OSError on defaults read + test (ref #44) * feat(secubox-haproxy): GET /webui/admin-domain endpoint (ref #44) * feat(secubox-haproxy): GET /webui/nginx-config rendered vhost (ref #44) * feat(secubox-haproxy): POST /webui/refresh cache invalidation (ref #44) * feat(secubox-haproxy): secubox-render-nginx-webui safe renderer (ref #44) * feat(haproxyctl): inject strict-regex WebUI ACL at frontend top (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): /generate symmetry with strict WebUI ACL (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): dpkg-trigger refresh on secubox-defaults-changed (ref #44) * build(secubox-haproxy): depend on secubox-defaults (ref #44) * test(infra): integration test for WebUI obfuscation (ref #44) * docs: HISTORY Session 159 — WebUI obfuscation (ref #44) Records the complete WebUI obfuscation work: new secubox-defaults package, three /webui/* endpoints, nginx renderer script, haproxyctl + Python generator symmetry, dpkg trigger plumbing, integration test. Includes notes on the brainstorming → spec → plan → subagent-driven execution flow and the 6 fix iterations caught by reviewers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 2026-04-21-eye-remote-v2-implementation.md | ||
| 2026-04-23-eye-remote-bootstrap.md | ||
| 2026-04-24-eye-remote-touchscreen-controller.md | ||
| 2026-04-26-eye-remote-swiss-army.md | ||
| 2026-05-02-haproxy-webui-crud.md | ||
| 2026-05-03-mitmproxy-waf-migration.md | ||
| 2026-05-05-openwrt-to-debian-migration.md | ||
| 2026-05-10-meta-script-generator.md | ||
| 2026-05-11-secubox-apt-clone.md | ||
| 2026-05-12-apt-public-repo-staging.md | ||
| 2026-05-12-license-headers.md | ||
| 2026-05-12-multi-agent-worktree-workflow.md | ||
| 2026-05-12-opad-doctrine-documents.md | ||
| 2026-05-12-ssl-health-banner.md | ||
| 2026-05-12-webui-obfuscation.md | ||