mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
7c42a80baf
Nginx architecture: - Modular config: each module installs /etc/nginx/secubox.d/<module>.conf - Auto-register on install, auto-remove on purge - Main config includes from secubox.d/*.conf - 27 module snippets for dynamic component management Hub enhancements: - Add roadmap widget showing migration progress (84% complete) - Add /api/v1/hub/roadmap endpoint with category breakdown - Shared sidebar.css for consistent styling across modules New modules: - secubox-portal: JWT authentication, session management - secubox-dns: DNS server management - secubox-mail: Mail server (Postfix) management - secubox-webmail: Roundcube webmail - secubox-users: User account management - secubox-publish: Content publishing - secubox-waf: Web Application Firewall - secubox-mail-lxc: Mail LXC container - secubox-webmail-lxc: Webmail LXC container Debian packaging: - All modules updated with modular nginx support - postinst: creates secubox.d/, reloads nginx - prerm: removes snippet, reloads nginx - rules: installs nginx/<module>.conf Scripts: - new-package.sh: generates modular nginx files for new modules - retrofit-nginx-modular.sh: updates existing packages Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .github/workflows | ||
| .vscode | ||
| board | ||
| cache/repo | ||
| common | ||
| image | ||
| packages | ||
| repo | ||
| scripts | ||
| .gitignore | ||
| build.log | ||
| CLAUDE.md | ||
| README.md | ||
| secubox.conf.example | ||
| setup-dev.sh | ||
| wget-log | ||
| wget-log.1 | ||
| wget-log.2 | ||
| wget-log.3 | ||
| wget-log.4 | ||
| wget-log.5 | ||
| wget-log.6 | ||
| wget-log.7 | ||
SecuBox-DEB
Migration OpenWrt → Debian · GlobalScale Technologies
CyberMind · Gandalf · Mars 2026
Port complet de SecuBox OpenWrt vers Debian bookworm arm64 pour les boards MOCHAbin (Armada 7040) et ESPRESSObin v7/Ultra (Armada 3720).
🏗️ Architecture
OpenWrt / LuCI → Debian bookworm arm64
─────────────────────────────────────────────────────────
RPCD shell backend → FastAPI + Uvicorn (Unix socket)
UCI config /etc/config/ → TOML /etc/secubox/secubox.conf
luci-app-*/htdocs/ (JS/CSS/HTML) → Conservé + XHR réécrits
OpenWrt packages (.ipk) → Paquets Debian (.deb)
opkg → apt + repo secubox.gondwana.systems
Boards supportés :
| Board | SoC | RAM | Réseau | Profil |
|---|---|---|---|---|
| MOCHAbin | Armada 7040 Quad-core 1.8GHz | 4 GB | 2× SFP+ 10GbE + 4× GbE | SecuBox Pro |
| ESPRESSObin v7 | Armada 3720 Dual 1.2GHz | 1–2 GB | WAN + 2× LAN DSA | SecuBox Lite |
| ESPRESSObin Ultra | Armada 3720 Dual 1.2GHz | 2 GB | WAN PoE + 4× LAN + Wi-Fi | SecuBox Lite+ |
📦 Paquets Debian (14 modules)
| Paquet | Source OpenWrt | Description |
|---|---|---|
secubox-core |
(base) | Lib Python partagée, nginx, firstboot |
secubox-hub |
luci-app-secubox |
Dashboard central |
secubox-crowdsec |
luci-app-crowdsec-dashboard |
IDS/IPS CrowdSec |
secubox-netdata |
luci-app-netdata-dashboard |
Monitoring temps réel |
secubox-wireguard |
luci-app-wireguard-dashboard |
VPN WireGuard |
secubox-dpi |
luci-app-netifyd-dashboard |
DPI dual-stream |
secubox-netmodes |
luci-app-network-modes |
Modes réseau |
secubox-nac |
luci-app-client-guardian |
NAC + portail captif |
secubox-auth |
luci-app-auth-guardian |
OAuth2 + vouchers |
secubox-qos |
luci-app-bandwidth-manager |
QoS / HTB |
secubox-mediaflow |
luci-app-media-flow |
Détection streaming |
secubox-cdn |
luci-app-cdn-cache |
Cache CDN local |
secubox-vhost |
luci-app-vhost-manager |
Virtual hosts nginx |
secubox-system |
luci-app-system-hub |
Contrôle système |
🚀 Démarrage rapide (développement)
git clone https://github.com/gkerma/secubox-deb
cd secubox-deb
bash setup-dev.sh
source .venv/bin/activate && source .env
# Porter le frontend d'un module depuis le repo source
bash scripts/port-frontend.sh crowdsec-dashboard
# Lancer l'API en dev
cd packages/secubox-crowdsec
uvicorn api.main:app --reload --host 127.0.0.1 --port 8001
# Tester
curl http://127.0.0.1:8001/health
curl -X POST http://127.0.0.1:8001/auth/login \
-H 'Content-Type: application/json' \
-d '{"username":"admin","password":"secubox"}'
💿 Build image board
# MOCHAbin (nécessite root + debootstrap)
sudo bash image/build-image.sh --board mochabin --out output/
# Flasher
zcat output/secubox-mochabin-bookworm.img.gz | \
dd of=/dev/mmcblk0 bs=4M status=progress
📦 Build paquets .deb
# Un module
cd packages/secubox-crowdsec
dpkg-buildpackage --host-arch arm64 -us -uc -b
# Tous (via CI)
git tag v1.0.0 && git push --tags
# → GitHub Actions build + publish APT repo
🔧 VSCode Tasks (Ctrl+Shift+B)
| Task | Description |
|---|---|
| 📥 Port frontend — module unique | Copier htdocs + réécrire XHR |
| 🚀 Run API — module en dev | Uvicorn local avec hot-reload |
| 📦 Build .deb — module unique | Cross-compile arm64 |
| 🚢 Déployer — TOUT sur le board | SSH rsync + restart services |
| 💿 Build image — MOCHAbin | debootstrap + GPT + .img.gz |
| ⚡ Workflow complet — un module | Port + build en séquence |
🗺️ Suivi de migration
Voir .claude/MIGRATION-MAP.md pour l'état de chaque module.
Démarrer une session de travail avec Claude Code :
claude # dans le répertoire du projet — lit CLAUDE.md automatiquement
📄 Licence
Apache-2.0 © 2026 CyberMind · Gandalf / gkerma