mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
bf1babb37c
Includes all package APIs with public dashboard endpoints: - secubox-system: System Hub with /info, /resources, /security - secubox-crowdsec: CrowdSec dashboard with /status, /hub, /metrics, actions - secubox-wireguard: WireGuard VPN with /interfaces, /peers, start/stop - secubox-netdata: Monitoring with /stats, /processes, /alerts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
97 lines
4.4 KiB
Plaintext
97 lines
4.4 KiB
Plaintext
# /etc/secubox/secubox.conf — Configuration SecuBox-DEB
|
|
# Format TOML — généré par firstboot.sh, éditable ensuite
|
|
# Recharger : systemctl restart secubox-\*
|
|
|
|
# ── Global ────────────────────────────────────────────────────────
|
|
[global]
|
|
hostname = "secubox-01"
|
|
timezone = "Europe/Paris"
|
|
board = "mochabin" # mochabin | espressobin-v7 | espressobin-ultra
|
|
debug = false
|
|
log_level = "warning" # debug | info | warning | error
|
|
|
|
# ── API / Auth ────────────────────────────────────────────────────
|
|
[api]
|
|
socket_dir = "/run/secubox" # Dossier des Unix sockets
|
|
jwt_secret = "" # Généré au firstboot — ne pas modifier
|
|
|
|
# Utilisateurs locaux (fallback si pas d'OAuth)
|
|
[auth]
|
|
|
|
[auth.users.admin]
|
|
password = "secubox" # À changer impérativement !
|
|
# password_hash = "$2b$12$..." # bcrypt recommandé (TODO Phase 5)
|
|
|
|
# ── CrowdSec ──────────────────────────────────────────────────────
|
|
[crowdsec]
|
|
lapi_url = "http://127.0.0.1:8080"
|
|
lapi_key = "" # Généré par : cscli bouncers add secubox-bouncer
|
|
|
|
# ── DPI / netifyd ─────────────────────────────────────────────────
|
|
[dpi]
|
|
mode = "inline" # inline | passive
|
|
engine = "netifyd" # netifyd | ndpid
|
|
interface = "eth0" # Interface à surveiller (WAN)
|
|
mirror_if = "ifb0" # Interface miroir pour DPI inline
|
|
|
|
# ── WireGuard ─────────────────────────────────────────────────────
|
|
[wireguard]
|
|
interface = "wg0"
|
|
listen_port = 51820
|
|
|
|
# ── NAC / DHCP ────────────────────────────────────────────────────
|
|
[nac]
|
|
dhcp_interface = "br-lan"
|
|
dhcp_range = "192.168.1.100,192.168.1.254,12h"
|
|
dns_servers = ["9.9.9.9", "149.112.112.112"]
|
|
# Zones : lan_allowed, iot_zone, guest_zone, quarantine
|
|
default_zone = "quarantine" # Nouveaux clients en quarantaine par défaut
|
|
|
|
# ── QoS / Bandwidth ───────────────────────────────────────────────
|
|
[qos]
|
|
interface = "eth0" # Interface WAN pour le shaping
|
|
upload_mbps = 100
|
|
download_mbps = 200
|
|
enabled = false
|
|
|
|
# ── CDN Cache ─────────────────────────────────────────────────────
|
|
[cdn]
|
|
engine = "nginx" # nginx | squid
|
|
cache_dir = "/var/cache/secubox-cdn"
|
|
cache_size = "5g"
|
|
listen_port = 3128
|
|
|
|
# ── VirtualHosts ──────────────────────────────────────────────────
|
|
[vhost]
|
|
nginx_sites_dir = "/etc/nginx/sites-available"
|
|
certbot_email = "admin@example.com"
|
|
default_ssl_mode = "selfsigned" # selfsigned | letsencrypt
|
|
|
|
# ── OAuth2 providers (secubox-auth) ───────────────────────────────
|
|
[oauth]
|
|
# [oauth.google]
|
|
# client_id = ""
|
|
# client_secret = ""
|
|
|
|
# [oauth.github]
|
|
# client_id = ""
|
|
# client_secret = ""
|
|
|
|
# ── Réseau modes ──────────────────────────────────────────────────
|
|
[netmodes]
|
|
current_mode = "router"
|
|
backup_dir = "/var/lib/secubox/netmodes-backup"
|
|
confirm_timeout = 300 # Secondes avant rollback auto si pas confirmé
|
|
|
|
# ── Notifications ─────────────────────────────────────────────────
|
|
[notifications]
|
|
# [notifications.email]
|
|
# smtp_host = "smtp.example.com"
|
|
# smtp_port = 587
|
|
# from = "secubox@example.com"
|
|
# to = "admin@example.com"
|
|
|
|
# [notifications.webhook]
|
|
# url = "https://hooks.example.com/secubox"
|
|
# secret = ""
|