mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
9a0a9873a7
Two latent bugs since #92 that together masked VisitorOrigin: 1. Missing CAP_NET_ADMIN The aggregator runs as User=secubox and calls nft -j list set inet secubox_metrics seen_src which requires CAP_NET_ADMIN. EPERM, subprocess silently returns no output, _read_nft_set returns [], entries stays []. Added: AmbientCapabilities=CAP_NET_ADMIN CapabilityBoundingSet=CAP_NET_ADMIN Coexists with NoNewPrivileges=true (systemd sets the ambient set before the User= drop). 2. MaxMind license barrier secubox-geoipupdate.service had: ConditionPathExists=/etc/secubox/secrets/maxmind.conf So operators without a MaxMind account couldn't activate VisitorOrigin at all. Replaced with a new fetcher /usr/bin/secubox-geoipupdate-fetch that: - Uses MaxMind geoipupdate if /etc/secubox/secrets/maxmind.conf exists AND geoipupdate is installed (Recommends). - Falls back to DB-IP free ASN lite (no signup needed). The file is a MaxMind-compatible mmdb so maxminddb.open_database reads it transparently. Sanity-checked on prod board: metadata: DBIP-ASN-Lite (compat=GeoLite2-ASN) lookup 1.1.1.1 -> AS13335 Cloudflare, Inc. Live verification on gk2 board after applying both fixes: top visitor ASNs (last 60min): AS32934 Facebook 59 hits AS8075 Microsoft 34 hits AS396982 Google 13 hits AS16509 Amazon 6 hits Co-authored-by: CyberMind-FR <gandalf@Gk2.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| changelog | ||
| control | ||
| postinst | ||
| prerm | ||
| rules | ||
| secubox-metrics.service | ||
| secubox.yaml | ||