mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00

History

CyberMind 5e93c73600 feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306 ) (#307 ) The hub's `_compute_menu_sync()` drops menu entries lacking an `id` field. 6+ packages (lyrion, yacy, zigbee, rustdesk, grafana, authelia) shipped a different schema (`title/url/section/module`) so they NEVER appeared in the navbar. Plus the existing CATEGORY_META declared 12 sections (dashboard/security/network/system/core/users/services/ privacy/monitoring/publishing/apps/admin), not the 6 SecuBox charter modules. Changes: * All 121 packages/secubox-/menu.d/.json normalised to the canonical schema (id, name, path, category, icon, order, description). Legacy schema aliases (title/url/module/section) preserved as fallbacks then dropped from the file. * Each menu entry's category remapped to one of the 6 charter modules: AUTH (auth/users/identity/zkp/nac/openclaw), WALL (crowdsec/waf/mitmproxy/hardening/threat-* /cve-triage/...), BOOT (kernel-build/eye-remote/master-link/droplet/cloner/backup/...), MIND (ai-gateway/mcp-server/grafana/ndpid/netifyd/glances/...), ROOT (system/hub/portal/console/admin/vault/vm/rtty/...), MESH (wireguard/dns/tor/matrix/gitea/nextcloud/mail/lyrion/yacy/ zigbee/dns-provider/rustdesk/... — all network + comms apps). * secubox-hub v1.4.0 — CATEGORY_META rewritten with the 6 charter modules carrying their official color from DESIGN-CHARTER.md and the complementary-pair order. DEFAULT_MENU fallback remapped too. * secubox-zigbee v2.5.3 — www/zigbee/index.html rewritten with the canonical SecuBox scaffold (body display:flex, sidebar 220px fixed, .main reserving 48px for the global-menu-bar). MESH palette. Browser side: operators need to clear localStorage sbx_menu_cache (or hard-refresh after the 1h TTL) to see the new sections after deploy. Co-authored-by: CyberMind-FR <gandalf@Gk2.net>		2026-05-21 10:03:05 +02:00
..
api	feat: cookie audit pipeline (RGPD / ePrivacy reconciler) (#159 )	2026-05-16 13:53:40 +02:00
bin	fix(secubox-metrics): VisitorOrigin entries=[] forever — CAP_NET_ADMIN + DB-IP fallback (closes #194 ) (#195 )	2026-05-18 06:16:43 +02:00
debian	fix(secubox-metrics): VisitorOrigin entries=[] forever — CAP_NET_ADMIN + DB-IP fallback (closes #194 ) (#195 )	2026-05-18 06:16:43 +02:00
menu.d	feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306 ) (#307 )	2026-05-21 10:03:05 +02:00
nftables	Health banner: live panel (visitor-origin + live-hosts + cert-status) (#98 )	2026-05-12 16:27:56 +02:00
systemd	fix(secubox-metrics): VisitorOrigin entries=[] forever — CAP_NET_ADMIN + DB-IP fallback (closes #194 ) (#195 )	2026-05-18 06:16:43 +02:00
tests	feat: cookie audit pipeline (RGPD / ePrivacy reconciler) (#159 )	2026-05-16 13:53:40 +02:00
www/metrics	fix(web): rewrite stale /portal/login.html -> /login.html (closes #222 ) (#223 )	2026-05-19 11:44:43 +02:00
README.md	feat: cookie audit pipeline (RGPD / ePrivacy reconciler) (#159 )	2026-05-16 13:53:40 +02:00

README.md

📈 System Metrics

Real-time system metrics dashboard

Category: Dashboard

Screenshot

Features

CPU/Memory
Network stats
Disk I/O
Historical data

Installation

# Add SecuBox repository
curl -fsSL https://apt.secubox.in/install.sh | sudo bash

# Install package
sudo apt install secubox-metrics

Configuration

Configuration file: /etc/secubox/metrics.toml

API Endpoints

GET /api/v1/metrics/status - Module status
GET /api/v1/metrics/health - Health check

Endpoints — live panel (issue #92)

Three public endpoints feed the health-banner live panel. All are unauthenticated, CORS-open, and Cache-Control: public, max-age=300.

Method	Path	Schema (high-level)
GET	`/api/v1/metrics/visitor-origin`	`{enabled, window_minutes, entries:[{asn,org,count}]}`
GET	`/api/v1/metrics/live-hosts`	`{enabled, window_minutes, entries:[{host,count}]}`
GET	`/api/v1/metrics/cert-status`	`{enabled, summary, next_renewal, warnings}`

Config blocks live in /etc/secubox/secubox.conf:

[visitor_origin]
enabled = true
min_count = 5

[live_hosts]
enabled = true

[cert_status]
enabled = true
warn_days = 30

[cookie_audit]
enabled = true

Reconciles two cookie streams to detect RGPD violations on operator-owned vhosts:

Method	Path	Description
POST	`/api/v1/cookie-audit/ingest`	Browser snapshot ingest (credentials: omit, hashed)
GET	`/api/v1/cookie-audit/report?host=…`	Per-vhost reconciled report
GET	`/api/v1/cookie-audit/summary`	Global rollup (counts + violations)

Each cookie's verdict carries a source flag — http (only server Set-Cookie), js (only document.cookie, set by client-side script), or both. A js-source cookie that is not strictly_necessary flips rgpd_violation = true (LCEN art. 82 / ePrivacy). The default classifier covers GA/Matomo/Hotjar/Facebook/Microsoft Clarity patterns; extend via [cookie_audit.classifier] in secubox.conf. Cookie values are sha256-hashed end-to-end — the API never receives raw values.

Disabled by default. Requires the companion mitmproxy cookie_audit addon (see packages/secubox-mitmproxy/README.md) and the browser-side shared/cookie-inventory.js (loaded automatically via the WAF banner injection).

MaxMind GeoLite2-ASN refresh: install geoipupdate (available in Debian bookworm's contrib repository; secubox-metrics lists it as a Recommends, not Depends, so apt install secubox-metrics succeeds without contrib enabled). Drop a license file at /etc/secubox/secrets/maxmind.conf (mode 0600, owner secubox). The secubox-geoipupdate.timer runs weekly; if either the binary or the key is absent, the unit is a silent no-op and the VisitorOrigin banner section stays hidden.