secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 22:07:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Mirror of https://github.com/CyberMind-FR/secubox-deb.git
2,696 Commits 380 Branches 117 Tags 280 MiB
Python 45.2%
HTML 20.4%
Shell 13%
JavaScript 9%
Go 5.9%
Other 6.3%
bb3c56c2cd
Go to file
CyberMind bb3c56c2cd
Some checks are pending
License Headers / check (push) Waiting to run
Details
feat(#817): Device Guardian consolidation — merge 5 device modules into secubox-nac (Project A) (#818) 
* docs(device-guardian): Project A consolidation design — merge 5 device modules into nac (ref #817)

* docs(device-guardian): Project A implementation plan — 9 tasks (ref #817)

* feat(nac): SQLite device store + idempotent legacy migration (ref #817)

Add packages/secubox-nac/api/store.py — pure-stdlib sqlite3 module with
canon_mac(), DeviceStore (WAL, best-value upsert, list/get/count,
history), and migrate_legacy() for idempotent, per-source best-effort
import of mac-guard/device-intel/iot-guard legacy shapes. Reserved
Project-B columns (plane/provenance/geo_cc/geo_asn) created but unused.

Task 1 of the Device Guardian consolidation plan (docs/superpowers/plans/
2026-07-05-device-guardian-consolidation.md).

* fix(nac): store — preserve first_seen, skip corrupt legacy sources, no stray db, SPDX (ref #817)

* feat(nac): unified dnsmasq+ISC+ARP discovery merge (ref #817)

* fix(nac): discovery — latest ISC lease wins the IP on renewal (ref #817)

The merge loop only updated ip/source on a strict rank increase
(incoming_rank > existing_rank), so equal-rank sightings for the same
MAC never touched ip/source. Since dnsmasq -> isc -> arp is processed
in non-increasing rank order, multiple ISC dhcpd.leases blocks for one
MAC (a fresh block per renewal) are equal-rank ties, and the first
(oldest) block's ip was frozen instead of the latest one winning, as
the original secubox-device-intel._get_dhcp_leases did.

Change the condition to incoming_rank >= existing_rank so the latest
same-or-higher-rank sighting updates source, and overwrites ip when
the incoming ip is non-empty. Hostname rule and the lower-rank branch
are unchanged, so a later ARP sighting still cannot clobber a
higher-rank ip/hostname/source.

Add test_isc_latest_lease_wins: two ISC lease blocks for one MAC with
ip/hostname renewal, asserting the latest block wins. Confirmed this
test fails against the pre-fix >-only logic.

* feat(nac): absorbed enrichers — OUI vendor + device-type/risk + OpenWrt fingerprint (ref #817)

* fix(nac): enrich — is_router strictly vendor-based; cover classify/oui edge cases (ref #817)

* feat(nac): background collector + double-cache; handlers def, no inline scan (ref #817)

Task 4 of the Device Guardian consolidation: a Collector background
loop now owns all discover -> enrich -> upsert work (replacing
_monitor_clients), publishing an in-memory snapshot(). The status,
clients, and client/{mac} handlers become plain def reading the SQLite
store / collector cache instead of calling _discover_clients() inline
on every request -- the #808 aggregator SPOF.

* fix(nac): finish #808 — def-convert alerts/list_quarantine/summary; first_seen + recent_events (ref #817)

alerts/list_quarantine were still `async def` calling blocking
_discover_clients() inline on the shared aggregator loop; summary
awaited alerts on top of that (double loop-block). Converted all three
to plain `def` reading the SQLite store/collector snapshot instead,
completing the #808 SPOF fix started for status/clients/client.

Also: collector.cycle_once() now stamps first_seen on newly discovered
devices (store.upsert keeps the earliest via COALESCE), and get_client's
recent_events merges the SQLite device_history (client_joined) with the
JSON event log so a device's join event shows up again.

* feat(nac): allow/deny actions + def-convert action handlers (finish #808) (ref #817)

Task 5: fold mac-guard's allow/deny into nac's zones/nft. New
POST /allow/{mac} and /deny/{mac} set allow_state in the SQLite store
and mirror it into nft's existing inet secubox_nac blocked/lan_allowed
sets via _nft_add_element/_nft_delete_element (mac-guard's separate
inet secubox_mac_guard table stays retired; its element migration is
Task 9).

Carried from Task 4 review: zones, add_to_zone, remove_from_zone,
approve_client, ban_client, update_client, quarantine_client and
unquarantine were still async def wrapping blocking subprocess/nft
calls on the shared aggregator loop (#808). Converted to plain def so
FastAPI threadpools them off the loop; add_to_zone/ban_client's webhook
notify now fires via a new _fire_webhook_sync helper
(asyncio.run_coroutine_threadsafe against the loop captured at
startup) since a plain def can no longer await _notify_webhooks
directly.

Tests: tests/test_actions.py mocks nft via monkeypatched
_nft_add_element/_nft_delete_element/_nft_list_set (+ subprocess.run,
since ban_client/unban_client build raw nft argv) into an in-memory
set-membership dict; covers deny/allow/allow-then-deny, zones,
add_to_zone+approve_client, and ban_client+unban_client.

* feat(nac): absorbed endpoints — vendors/scan/probe/mdns/groups/export (ref #817)

* fix(nac): /scan enriches + validates subnet; /probe IP + CSV injection guards (ref #817)

* feat(nac): retire mac-guard/device-intel/iot-guard via 308 redirects; auth-gate network-anomaly (ref #817)

secubox-mac-guard, secubox-device-intel and secubox-iot-guard are
superseded by secubox-nac's consolidated Device Guardian. Their
api/main.py are reduced to thin shims: every route 308-redirects to
its secubox-nac equivalent (/devices->/clients, /device/{mac}->
/client/{mac}, /whitelist|/allow->/allow, /blacklist|/deny->/deny,
/scan, /vendors, /groups, /export/* pass through unchanged, and a
catch-all forwards anything else), with an X-SecuBox-Deprecated
header. /health stays a plain 200 so liveness probes never 308-loop.
Package removal is a separate, gated follow-up.

secubox-network-anomaly stays (separate traffic-anomaly engine) but
its /status endpoint was unauthenticated while every sibling route
already required a JWT; it now matches.

* feat(nac): webui — vendor/type/risk columns, groups view, export; drop retired webuis (ref #817)

- clients.js: render enriched /clients fields — oui_vendor, device_type,
  risk_level (color-coded badge)/risk_score, and OpenWrt/SecuBox/Router
  fingerprint badges. All values are attacker-influenceable (DHCP
  hostname/vendor) and are rendered exclusively via E()/textContent,
  never innerHTML. Null/missing device_type/vendor/risk render as
  "unknown"/"—", never "null". Adds an Export CSV button (direct link to
  GET /export/csv — auth via the existing SSO session cookie, same as
  every other same-origin nav link in this app; no new auth scheme).
- groups.js (new): list/create/delete device groups and assign a device
  to a group, hitting GET/POST/DELETE /groups* — mirrors zones.js's
  structure and auth (sbxFetch).
- nav.js: register the new "Groupes" tab alongside Zones.
- Remove packages/secubox-{mac-guard,device-intel,iot-guard}/www — their
  functionality is now consolidated into nac; secubox-network-anomaly/www
  is untouched (stays standalone per plan).

Note for Task 9: device-intel/iot-guard's debian/rules unconditionally
`cp -r www/<name>/.` — now broken since www/ is gone; mac-guard's rule is
already guarded (`[ -d www ] && ... || true`). Needs a debian/rules fix
when Task 9 retires/redirects these packages.

* chore(nac): packaging — ieee-data dep, nft migration, retirement redirects, changelog 3.0.0; fix retired debian/rules www (ref #817)

* fix(nac): whole-branch — lazy init for in-aggregator mount, collector off-loop, sqlite lock, batched zone lookup, sentinel-preserve (ref #817)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(nac): risk_score split — known router low, unknown router high (rogue-AP signal) (ref #817)

Split the router risk axis out of the generic device-type/open-ports
scoring: a router/gateway already known (allow-listed or already in the
store) is trusted infrastructure -> low risk; a newly-seen/unknown
router is a rogue-AP signal -> high risk, regardless of open ports.
Removes the old flat -10 "trusted router" discount. Non-router devices
keep the existing scoring unchanged.

risk_score() gains an is_known=False parameter (backward compatible).
collector.cycle_once() and main.scan() now compute is_known from the
prior store row (existing row or allow_state == "allow") before
upserting, reusing the row they already fetch for is_new/enrichment.

* feat(nac): mesh-sync (p2p peers as devices) + fingerprinted-router classification for rogue-AP risk (ref #817)

Part A: absorb iot-guard's missed "mesh-sync" capability. GET /mesh/peers
and POST /mesh/sync now live in nac, reading live P2P peers over
/run/secubox/p2p.sock (HTTP-over-UDS GET /peers, fail-safe -> [] on any
error/timeout/absent socket) and upserting one sb:-prefixed synthetic
device per peer (iot-guard's exact md5-hash MAC scheme), device_type
"mesh_node", source "mesh". iot-guard's retired redirect-shim catch-all
already forwards /mesh/* here, so no shim change needed.

Part B: classify_device_type's "router" keyword list is much narrower
than ROUTER_VENDORS (misses tp-link/asus/linksys/d-link/gl.inet/xiaomi/
huawei), so a router-vendor MAC with a generic hostname fingerprinted
is_router=True still classified as device_type="unknown" and skipped
risk scoring entirely (the omit-unknown guard) -- the known-router-vs-
rogue-AP HIGH signal never fired for the most common vendor case. Both
enrichment call sites (Collector.cycle_once and /scan) now reclassify
device_type="unknown"+is_router to "router" before scoring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(nac): postinst ensures secubox_nac table + zone sets (incl lxc_zone)

Nothing shipped created nac's inet secubox_nac table or its zone sets — they
were assumed to pre-exist (they don't: the live board had no such table), so
operator 'move to zone' failed for every zone and the mac-guard element
migration silently no-op'd. postinst now creates the table + all ZONES sets
(lan_allowed, lxc_zone, iot_zone, guest_zone, quarantine_zone) + blocked,
idempotently and best-effort, before the migration. Makes operator moves to
the LXC Containers zone work on a fresh install. nft commands validated on
gk2 (create/idempotent re-add/add-element/list), no live drift left.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>

---------

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 09:58:01 +02:00
.claude docs: track metalogue OSINT suite (#845) — wiki + WIP + HISTORY + TODO 2026-07-13 05:44:28 +02:00
.gitea/workflows
.github secubox-p2p: Kademlia DHT + federation health-checks + hierarchical master-link (#774) (#775) 2026-07-03 06:59:35 +02:00
.superpowers build(metablogizer): ship publishctl sudoers; changelog 1.3.0 2026-07-11 13:35:47 +02:00
.vscode
apt
board fix(wireguard): sudo-route wgctl/wg (root needed for wg show dump) so webui lists interfaces+peers; fix(mochabin): clean netplan — WAN=eth2 DHCP metric100, drop stray lan3 IP (boot-wedge) 2026-07-10 06:53:38 +02:00
cache/repo
clients feat(clients): persistent WG identity (APK) + Tor status in webext/APK (ref #683) 2026-06-19 17:03:15 +02:00
cmd/secubox
common feat(toolbox): activate Sentinel + surface compromise detections (WebUI tab · kbin report · PDF) — ref #823 (#825) 2026-07-06 17:39:42 +02:00
config
daemon
docs feat(#817): Device Guardian consolidation — merge 5 device modules into secubox-nac (Project A) (#818) 2026-07-13 09:58:01 +02:00
doctrine/opad
hardware
image refactor: decommission secubox-authelia (SSO IdP) — remove package, keep gate authelia-free 2026-07-02 08:14:08 +02:00
kernel-build
packages feat(#817): Device Guardian consolidation — merge 5 device modules into secubox-nac (Project A) (#818) 2026-07-13 09:58:01 +02:00
profiles
prototypes
redroid
remote-ui
repo
schemas
scripts docs(wiki): drop decommissioned Authelia SSO from Modules catalog (128→127) 2026-07-04 07:00:50 +02:00
templates
tests
tools
vm
wiki docs: track metalogue OSINT suite (#845) — wiki + WIP + HISTORY + TODO 2026-07-13 05:44:28 +02:00
.cache-lint-allowlist.toml
.gitignore build: ignore dh_installtmpfiles *.postinst.debhelper build artifacts 2026-07-11 14:44:39 +02:00
build-eye-remote-full.sh
CLAUDE.md feat(billets): admin password reset + guideline reskin (cyan hybrid-dark) + doc 2026-07-12 07:15:15 +02:00
HOWTO-grammar.md
LICENCE-CMSD-1.0.md
LICENSE-CMSD-1.0.en.md
LICENSING.md
PROMPT_SYSTEM.md
pytest.ini secubox-p2p: Kademlia DHT + federation health-checks + hierarchical master-link (#774) (#775) 2026-07-03 06:59:35 +02:00
README.md chore(toolbox): 2.7.0 middle release — kbin milestone + Tor chapter (ref #683) 2026-06-19 11:48:32 +02:00
REPORT-2026-04-10.md
secubox.conf.example feat(auth): configurable forced admin TOTP enrollment (ref #778) (#781) 2026-07-03 06:51:43 +02:00
setup-dev.sh
TOOLS.md

README.md

SecuBox

SecuBox OS - Network Security Appliance

Your Network Security Appliance — Plug, Protect, Peace of Mind

Release Packages Live USB Installer License: CMSD-1.0

📡 VILLAGE3B — Cabine Numérique Gondwana ToolBoX

Poster grand public VILLAGE3B

Diagnostic compromission iPhone gratuit · Anonyme · Open Source

3 niveaux d'opt-in (R0 bypass complet, R1 analyse passive ✓ recommandée, R2 TLS-break + bandeau). Rapport téléchargeable avec 9 widgets metrics : 🌐 connexions · 📡 hôtes · ✅ OK 2xx · 🔒 cert-pinning · 📺 apps · 🍪 trackers · 🌍 pays · 🎯 score · 📱 device. Conformité CSPN ANSSI + LCEN. Aucune donnée externe.

🕸️ Cartographie sociale — « You Have Been Tracked » (Phase 11)

Poster YOU HAVE BEEN TRACKED — cartographie sociale kbin

Le même navigateur, reconnu de site en site.

En R3 consenti, la cabine corrèle les cookies tiers et les fingerprints JA4 par device pour révéler, en temps réel, quels acteurs commerciaux reconnaissent votre navigateur à travers les sites visités. Un relais ad-tech reliant 4 éditeurs (360yield + seedtag + smartadserver + smilewanted via la même IP) saute aux yeux dans le graphe force-dirigé.

  • Vue per-client : https://kbin.gk2.secubox.in/social/me (🕸️ « Ma carto »)
  • Graphe d3 plein écran (pan / pinch-zoom), évidence cross-site, effacement RGPD art. 17, rapport PDF bilingue (Phase 11.C).
  • Anonyme : mac_hash à sel rotatif 24h, aucune valeur de cookie brute persistée. Tout calculé localement.
  • Tableau opérateur : admin.gk2.secubox.in/toolbox/#social.
  • Brief poster : docs/marketing/POSTER-you-have-been-tracked.md
  • Plan + design lock : #502

🗡️ kbin — le premier outil du couteau suisse cyber

kbin (kbin.gk2.secubox.in) est le portail public de la ToolBoX SecuBox — la cabine numérique et première lame du couteau suisse cyber modulaire de cybermind.fr. On s'y branche, on surfe normalement, et la lame inspecte et protège le trafic de façon transparente :

🗡️ Lame
⚡ Performance transparente — on ne déchiffre que ce qu'on modifie (SNI-splice sélectif)
🔒 Full encrypted — inspection MITM complète, forge de cert par hôte, fingerprint Chrome uTLS
☠️ Injection de poison & smog — le trafic ad-tech ressort empoisonné, pas seulement bloqué
🚫 Bandeau anti-adware — transparence injectée, immune au CSP, SPA-aware
🛡️ Safe browsing — Vortex DNS + blacklist nft + détection anti-bot

Prochaine lame — 🧅 mode Tor quick-switch (#683). Un tap → le surf ressort par le réseau Tor (egress sortant, pseudo-network) : l'inspection reste intacte, seule l'IP de sortie devient anonyme. Fail-closed, opt-in, sans fuite DNS.

License — CyberMind Source-Disclosed (CMSD-1.0)

Source disclosed, rights reserved.

This software is released under the CyberMind Source-Disclosed License v1.0 — a source-available license designed for transparency and security auditability while preserving all commercial rights.

What you CAN do What you CANNOT do
Read and study the source code Use in production (any environment)
Compile for isolated testing/audit Redistribute or create derivatives
Publish security research results Integrate into other products
Quote in academic/journalistic contexts Provide as hosted service (SaaS)

ANSSI CSPN Ready: The license explicitly authorizes audits by accredited security labs (CESTI, CC equivalents) without prior authorization.

See LICENCE-CMSD-1.0.md (French, authoritative) or LICENSE-CMSD-1.0.en.md (English, informative).

Metric Value
Packages 139 .deb packages
Migration 131/139 modules migrated
APIs FastAPI + JWT auth
![Arch](https://img.shields.io/badge/Architecture-amd64_ _arm64-orange)

SecuBox transforms any compatible device into a complete network security appliance with VPN, firewall, intrusion detection, and web dashboard — all preconfigured and ready to use.

Status (2026-06-02) — Versioning is dev alpha. The current line (v2.13.x) is all-in-the-pipe working — partly efficient, partly modules-integration-ready, partly upgradeable, first-point POC. Design philosophy : KISS. SecuBox aims to be a full operating system for a security tool — a Swiss army knife + modular OS appliance. See the wiki Use-Cases page for scenario-by-scenario tweaks.

Latest Releases

Latest stable All releases Downloads

v2.13.x — Main system line (2026-05-29 → ongoing)

The current release line. v2.13.4 unblocked the arm64 APT publish (chain #425 / #427 / #431). v2.13.10 produced the first working rpi400 kiosk image (chain #433 / #436). v2.13.11 mass-masks non-essential services so the kiosk boots on a 4 GB Pi 400 (#442). v2.13.12 enables the X cursor on the kiosk for salon-ready operator visibility (#444).

Target File Notes
VirtualBox / QEMU / KVM (amd64) secubox-vm-x64-bookworm.img.gz service cascade in VBox is a known limit, #422
Live USB / amd64 PC secubox-live-amd64-bookworm.img.gz validated in VBox, boots to kiosk login
MOCHAbin (Marvell Armada 7040) secubox-mochabin-bookworm.img.gz primary appliance target
Raspberry Pi 400 / Pi 4 secubox-rpi-arm64-bookworm.img.gz kiosk-by-default since v2.13.10
Installer ISO (any amd64 host) secubox-installer-amd64-bookworm.iso.gz dual format .iso + .img
APT repository https://apt.secubox.in/ signed arm64 + amd64 since v2.13.4
SHA256SUMS SHA256SUMS verify every download

All artefacts are attached to the latest release page — links above are illustrative ; the shield at the top of this section follows the latest stable tag automatically.

v2.2.1-eye-remote — Round display (2026-05-11)

Side-line image for the Pi Zero W round-display dashboard. Not part of the main v2.x.y line — refreshed independently when the kiosk stack moves.

Target Download
Pi Zero W + HyperPixel 2.1 Round secubox-eye-remote-2.2.1.img.xz

Verifying downloads

Every release attaches a SHA256SUMS file alongside the artifacts. Verify before flashing:

sha256sum -c SHA256SUMS 2>&1 | grep -v 'OK$' || echo "all hashes match"

For the amd64 VirtualBox target there's a turn-key tester bundle under output/ci-vm-x64-25983593168/ — drop-in verify.sh + raw_to_vdi.py (no qemu-img/VBoxManage needed) + step-by-step README.md. Boot in 4 commands; see output/ci-vm-x64-25983593168/FIX-PXE.md if the VBox EFI ever lands on the PXE screen.

→ See all releases on GitHub

What You Get

  • VPN Server — WireGuard with QR codes for mobile devices
  • Intrusion Detection — CrowdSec IDS/IPS with automatic threat blocking
  • WAF Active Enforcement — mitm pattern detection → CrowdSec → nft kernel drop (~12s round-trip). Plus pre-mitm rate-limit (slowloris kill) and nginx honeypot routes. See wiki.
  • R3 Portable Tunnel — WireGuard + transparent mitm so the cabine's privacy analysis follows you anywhere (4G, public WiFi). Multi-OS install guide here.
  • Network Monitoring — Real-time traffic analysis and bandwidth control
  • Web Dashboard — Modern dark-themed interface accessible from any browser
  • Automatic Updates — Security patches applied automatically

Quick Start

Option 1: VirtualBox (Try It Now)

Download and run in VirtualBox — no hardware required:

# Download the image
wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz

# Extract
gunzip secubox-live-amd64-bookworm.img.gz

# Create VM (requires VBoxManage)
./scripts/create-secubox-vm.sh secubox-live-amd64-bookworm.img

Access: Open https://localhost:9443 in your browser Login: admin / secubox

Option 2: Live USB (Any PC)

Boot from USB on any x86_64 computer:

# Download
wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz

# Flash to USB (replace /dev/sdX with your USB device)
zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress

Boot from USB, then access the dashboard at https://<device-ip>/

Option 3: Dedicated Hardware

For 24/7 operation, flash to dedicated hardware:

Device Best For Image
Raspberry Pi 4/5 Home use secubox-rpi-arm64-*.img.gz
ESPRESSObin Small office secubox-espressobin-v7-*.img.gz
MOCHAbin Enterprise secubox-mochabin-*.img.gz
Any x86_64 PC Repurposed hardware secubox-live-amd64-*.img.gz

Features

Security Dashboard

Central control panel showing system health, active threats, and quick actions.

VPN (WireGuard)

Create VPN connections with one click. Scan QR codes on mobile devices.

Intrusion Detection (CrowdSec)

Automatic threat detection and IP blocking with community threat intelligence.

Network Control

  • Bandwidth management (QoS)
  • Device access control
  • Deep packet inspection
  • Virtual hosts with SSL

System Management

  • Service control
  • Log viewer
  • Automatic backups
  • Easy updates

CTL Grammar — modular tools box

Copyright spiritual concept · Gérald Kerma · 1991

Each SecuBox module exposes its capability through three surfaces — a web UI, a FastAPI API, and a CTL command (/usr/sbin/<module>ctl). The CTL is the grammar of the system: each verb is a sentence addressed to a specific layer of the operator's expressive control over their own infrastructure.

Layer Verb
ROUTING haproxyctl vhost add/remove
INTERCEPTION mitmproxyctl route add/remove/list
REPLICATION giteactl repo mirror add/remove
IDENTITY giteactl user add/remove
CI EXECUTION giteactl runner add/remove/list
PUBLISHING publishctl post / dropletctl publish / metablogizerctl site
EMANCIPATE metablogizerctl tor expose/revoke
HOSTING streamlitctl app deploy/.../info
DEV WORKBENCH streamforgectl project create/.../templates
OPS MONITORING healthctl check/list/status/alert

Composing the verbs expresses end-to-end workflows in three lines of shell. See docs/grammar.md for the conceptual frame and the layered architecture map.

To add a 9th verb, follow HOWTO-grammar.md — the six-step recipe takes about an hour for a Bash CTL.

Eye Remote — External Dashboard

SecuBox Eye Remote

A standalone round display that connects to SecuBox via USB OTG, showing real-time metrics with a cyberpunk 3D visualization.

Feature Description
Hardware Raspberry Pi Zero W + HyperPixel 2.1 Round (480×480)
Connection USB OTG composite gadget (network + serial)
Display 3D rotating cube + rainbow ring metrics
Metrics CPU, Memory, Disk, Temperature, WiFi RSSI

Quick Start

# Download Eye Remote image
wget https://github.com/CyberMind-FR/secubox-deb/releases/download/v2.2.1-eye-remote/secubox-eye-remote-2.2.1.img.xz

# Flash to SD card
xzcat secubox-eye-remote-2.2.1.img.xz | sudo dd of=/dev/sdX bs=4M status=progress
  1. Insert SD in Pi Zero W with HyperPixel display
  2. Connect USB DATA port (middle) to SecuBox
  3. Dashboard appears automatically (~60s boot)

SSH: pi@10.55.0.2 (password: raspberry)

📖 Full documentation: remote-ui/round/README.md

Default Credentials

Service Username Password
Web Dashboard admin secubox
SSH root secubox

Change these immediately after first login!

Support

License

CMSD-1.0 (CyberMind Source-Disclosed License) © 2026 CyberMind · Gérald Kerma See LICENCE-CMSD-1.0.md for terms.

Technical Reference (Click to Expand)

Architecture

OpenWrt / LuCI                   →    Debian bookworm
─────────────────────────────────────────────────────────
RPCD shell backend               →    FastAPI + Uvicorn (Unix socket)
UCI config /etc/config/          →    TOML /etc/secubox/secubox.conf
luci-app-*/htdocs/ (JS/CSS/HTML) →    Conservé + XHR réécrits
OpenWrt packages (.ipk)          →    Paquets Debian (.deb)
opkg                             →    apt + repo apt.secubox.in

Supported Hardware

Board SoC RAM Network Profile
MOCHAbin Armada 7040 Quad 1.8GHz 4 GB 2× SFP+ 10GbE + 4× GbE Pro
ESPRESSObin v7 Armada 3720 Dual 1.2GHz 1–2 GB WAN + 2× LAN DSA Lite
ESPRESSObin Ultra Armada 3720 Dual 1.2GHz 2 GB WAN PoE + 4× LAN + Wi-Fi Lite+
Raspberry Pi 4/400 BCM2711 Quad 1.5-1.8GHz 2-8 GB GbE + USB Lite
Raspberry Pi 5 BCM2712 Quad 2.4GHz 4-8 GB GbE + USB Full
VM x86_64 Any 2+ GB Virtio/NAT Full

Packages (126 modules)

Core: secubox-core, secubox-hub, secubox-portal, secubox-system

Security: secubox-crowdsec, secubox-wireguard, secubox-auth, secubox-nac, secubox-waf, secubox-users

Network: secubox-netmodes, secubox-dpi, secubox-qos, secubox-vhost, secubox-haproxy

Monitoring: secubox-netdata, secubox-mediaflow, secubox-cdn

DNS/Email: secubox-dns, secubox-mail, secubox-webmail

Publishing: secubox-droplet, secubox-streamlit, secubox-metablogizer, secubox-publish

API Reference

All modules expose REST APIs at /api/v1/<module>/

# Login
curl -X POST https://localhost/api/v1/portal/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"secubox"}'

# Use token
curl https://localhost/api/v1/hub/status \
  -H 'Authorization: Bearer <token>'

Key Endpoints:

  • GET /api/v1/hub/dashboard — Dashboard data
  • GET /api/v1/crowdsec/decisions — Active bans
  • POST /api/v1/crowdsec/ban — Ban IP
  • GET /api/v1/wireguard/peers — VPN peers
  • GET /api/v1/wireguard/qrcode/{peer} — Peer QR code

Configuration

Main config: /etc/secubox/secubox.conf (TOML)

[general]
hostname = "secubox"
timezone = "Europe/Paris"

[auth]
jwt_secret = "your-secret-key"
session_timeout = 86400

[network]
wan_interface = "eth0"
lan_interface = "eth1"

Development

# Setup
bash setup-dev.sh && source .venv/bin/activate

# Run module API
cd packages/secubox-crowdsec
uvicorn api.main:app --reload --port 8001

# Build package
dpkg-buildpackage -us -uc -b

# Build image
sudo bash image/build-image.sh --board vm-x64 --vdi

UI Design Guidelines

Color Palette (Cyberpunk/Hermetic):

Variable Color Usage
--cosmos-black #0a0a0f Background
--gold-hermetic #c9a84c Accents, titles
--cinnabar #e63946 Alerts, errors
--matrix-green #00ff41 Success
--void-purple #6e40c9 Links
--cyber-cyan #00d4ff Info, hover
--text-primary #e8e6d9 Main text

Typography: Cinzel (titles), IM Fell English (body), JetBrains Mono (code)

Documentation