secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-30 05:06:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
bc5c222550
secubox-deb/packages
History
CyberMind-FR bc5c222550 fix(toolbox): R3 verification page on kbin reads wrong source IP (ref #498) 
Screenshot from the iPhone showed mitm-wg's R3 banner header firing
correctly (SHA1 visible) but the verification card body reading
"Hors tunnel R3 — tu accèdes à kbin via Internet direct". The detection
chain was wrong in two places :

1. mitm-wg proxied upstream WITHOUT propagating the WG peer IP.  By the
   time the request landed at the toolbox FastAPI (after looping
   wg-toolbox → mitm-wg → HAProxy → nginx) it carried the box's own IP
   as the source.

2. The toolbox FastAPI's R3 check read request.client.host — which is
   the proxy peer (unix socket) not the real client. Even when XFF was
   set by nginx the code ignored it.

3. The verification page JS probes http://10.99.0.1:8088/qr/splash.png
   to detect tunnel state. That address is on the wlan AP iface which
   is linkdown in normal operation — packets from the WG subnet had no
   reply path (rp_filter symmetry violation) and the image always
   failed to load, so JS concluded "off tunnel" no matter what.

Fixes :

  - New mitmproxy addon `inject_xff.py` loaded FIRST in mitm-wg launch.
    Sets `X-Forwarded-For` carrying flow.client_conn.peername plus
    sentinel headers `X-Through-R3-Tunnel: 1` and `X-R3-Peer: <ip>` so
    downstream backends can detect tunnel state cheaply.
  - `secubox_toolbox/api.py` : new `_client_ip(request)` helper that
    prefers `X-R3-Peer` > leftmost XFF > raw socket peer. Splash and
    `_resolve()` both use it now.
  - `nftables.d/secubox-toolbox-wg.nft` : adds DNAT
    iif wg-toolbox dst 10.99.0.1 tcp dport 8088 → 10.99.1.1:8088 so
    the JS probe lands on the captive portal even when wlan is down.
  - `systemd/secubox-toolbox.service.d/20-bind-all.conf` : binds the
    captive portal uvicorn on 0.0.0.0:8088 (was 10.99.0.1:8088, only
    reachable on wlan). The DNAT above + this bind together let WG
    peers hit the verification probe successfully.

Live on gk2 : `http://10.99.1.1:8088/qr/splash.png` returns 200,
mitm-wg launches with inject_xff first in the addon chain, refresh of
kbin.gk2.secubox.in verification page now follows the "Tunnel R3 actif"
path.
2026-06-07 07:55:57 +02:00
..
secubox-ad-guard fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-admin fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-aggregator fix: Phase 7 follow-up bugs — magicmirror, openclaw, ghost dirs (ref #498) 2026-06-06 16:48:38 +02:00
secubox-ai-gateway docs(ai,dpi,mesh,soc): naming-clarity sweep on 5 cluster-member placeholders (closes #386) 2026-05-27 08:55:41 +02:00
secubox-ai-insights fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-auth feat(core,auth): SSO-lite session cookie accepted by require_jwt + set on login (ref #400) 2026-05-28 11:31:38 +02:00
secubox-authelia feat(authelia): LAN whitelist on admin.gk2.secubox.in (bypass SSO from inside) 2026-05-24 14:58:43 +02:00
secubox-avatar feat(secubox-toolbox+core+5modules): Phase 2b wire mitm addons to receiving modules (ref #488) 2026-06-05 07:46:50 +02:00
secubox-backup docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-c3box fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-cdn fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-certs feat(secubox-certs): reconstruct source package from running deployment (closes #308) (#309) 2026-05-21 10:40:59 +02:00
secubox-cloner feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-config-advisor docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-console feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-cookies feat(secubox-toolbox+core+5modules): Phase 2b wire mitm addons to receiving modules (ref #488) 2026-06-05 07:46:50 +02:00
secubox-core fix(secubox-core): /etc/secubox parent dir 0750 → 0755 (ref #468) (#470) 2026-06-03 09:11:14 +02:00
secubox-crowdsec fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-cve-triage docs(dns,threats): naming-clarity sweep on 6 placeholder Descriptions (closes #383) 2026-05-27 08:25:54 +02:00
secubox-cyberfeed fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-daemon/debian fix(daemon): rename secubox-c3box → secubox-daemon-c3box (closes #378) 2026-05-27 07:23:57 +02:00
secubox-defaults ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-device-intel docs(identity,monitoring): naming-clarity sweep on 4 placeholder Descriptions (closes #385) 2026-05-27 08:50:05 +02:00
secubox-dns docs(dns,threats): naming-clarity sweep on 6 placeholder Descriptions (closes #383) 2026-05-27 08:25:54 +02:00
secubox-dns-guard docs(dns,threats): naming-clarity sweep on 6 placeholder Descriptions (closes #383) 2026-05-27 08:25:54 +02:00
secubox-dns-provider fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-domoticz feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-dpi feat(secubox-toolbox+core+5modules): Phase 2b wire mitm addons to receiving modules (ref #488) 2026-06-05 07:46:50 +02:00
secubox-droplet fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-egress docs(specs): integrate CM-WALL-EGRESS-2026-06 v0.1.0-draft + agent context 2026-06-02 11:13:44 +02:00
secubox-exposure feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-eye-remote fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-eye-square fix(eye-square): relocate firstboot.sh out of /usr/local/sbin/ (closes #207) (#208) 2026-05-19 06:53:31 +02:00
secubox-fmrelay fix(packaging): drop duplicate debian/compat files (unblocks v2.13.0 publish) 2026-05-30 05:56:40 +02:00
secubox-full/debian
secubox-gitea docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-glances fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-gotosocial feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-grafana feat(yacy,grafana,rustdesk): apply dual-vhost MUST pattern (MODULE-GUIDELINES §4) 2026-05-24 10:24:35 +02:00
secubox-haproxy fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-hardening docs(navbar): resort hardening + repo into root category (closes #389) 2026-05-27 11:45:16 +02:00
secubox-health-doctor fix(secubox-health-doctor): drop redundant debian/compat (closes #220) (#221) 2026-05-19 11:44:35 +02:00
secubox-hexo fix(navbar): emoji icons via menu-data fallback + replace remaining FA names 2026-05-24 11:25:05 +02:00
secubox-homeassistant feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-hub fix(hub): merge VHost error→down in pre-computed summary path (closes #392) 2026-05-27 13:16:23 +02:00
secubox-identity docs(identity,monitoring): naming-clarity sweep on 4 placeholder Descriptions (closes #385) 2026-05-27 08:50:05 +02:00
secubox-interceptor fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-iot-guard docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-ipblock fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-jabber feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-jellyfin feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-jitsi fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-ksm fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-led-heartbeat fix(led-heartbeat): v2.1.2 — postinst disables legacy bumper, pulse swings full 0-1 2026-05-24 08:59:40 +02:00
secubox-lite/debian
secubox-localai feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-localrecall docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-lyrion docs: codify dual-vhost MUST for modules with a real web UI 2026-05-24 10:06:56 +02:00
secubox-mac-guard fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-magicmirror fix: Phase 7 follow-up bugs — magicmirror, openclaw, ghost dirs (ref #498) 2026-06-06 16:48:38 +02:00
secubox-mail fix(mail): Roundcube SQLite by default (closes #152) 2026-05-29 09:34:32 +02:00
secubox-mail-lxc/debian cleanup(mail): prune dead source content from transitional packages (closes #380) 2026-05-27 07:34:54 +02:00
secubox-master-link/debian feat(p2p,master-link): fold master-link into secubox-p2p (closes #384) 2026-05-27 08:45:34 +02:00
secubox-matrix fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-mcp-server docs(ai,dpi,mesh,soc): naming-clarity sweep on 5 cluster-member placeholders (closes #386) 2026-05-27 08:55:41 +02:00
secubox-mediaflow fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-mesh fix(secubox-mesh): drop postinst /run/secubox parent overwrite (ref #471) (#473) 2026-06-04 05:29:23 +02:00
secubox-mesh-bt docs(specs): integrate CM-MESH-MPCIE-2026-06 v0.2.1-draft 2026-06-02 11:06:40 +02:00
secubox-meshname docs(ai,dpi,mesh,soc): naming-clarity sweep on 5 cluster-member placeholders (closes #386) 2026-05-27 08:55:41 +02:00
secubox-metablogizer fix(secubox-metablogizer): v1.2.1 — uvicorn --log-level info, surface webhook deploy success (#329) 2026-05-22 07:07:17 +02:00
secubox-metabolizer fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-metacatalog fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-metoblizer fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-metrics feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-mirror fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-mitmproxy feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00
secubox-mmpm/debian feat(magicmirror): fold secubox-mmpm into secubox-magicmirror (closes #381) 2026-05-27 07:54:45 +02:00
secubox-modem fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-mqtt fix(navbar): emoji icons + restore MQTT menu entry overwritten with Lyrion content 2026-05-23 18:42:51 +02:00
secubox-nac fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-ndpid docs(ai,dpi,mesh,soc): naming-clarity sweep on 5 cluster-member placeholders (closes #386) 2026-05-27 08:55:41 +02:00
secubox-netdata fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-netdiag fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-netifyd feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-netmodes feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-nettweak fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-network-anomaly docs(dns,threats): naming-clarity sweep on 6 placeholder Descriptions (closes #383) 2026-05-27 08:25:54 +02:00
secubox-newsbin feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-nextcloud Merge remote-tracking branch 'origin/master' into fix/394-nextcloud-remove-authelia-auth-request-f 2026-05-29 09:26:37 +02:00
secubox-ollama feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-openclaw fix: Phase 7 follow-up bugs — magicmirror, openclaw, ghost dirs (ref #498) 2026-06-06 16:48:38 +02:00
secubox-ossec feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-p2p feat(p2p,master-link): fold master-link into secubox-p2p (closes #384) 2026-05-27 08:45:34 +02:00
secubox-peertube feat(peertube,avatar): privilege-separated cookie install via root path-unit (closes #407) 2026-05-28 12:36:56 +02:00
secubox-photoprism fix(#410): user-provision verbs validated live on gk2 2026-05-29 08:28:22 +02:00
secubox-picobrew feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-portal feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-publish fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-qos feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-rbs-sensor feat(secubox-rbs-sensor): WALL/OPAD sensor scaffold for EP06-E (closes #236) (#256) 2026-05-20 16:04:01 +02:00
secubox-redroid feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-repo docs(navbar): resort hardening + repo into root category (closes #389) 2026-05-27 11:45:16 +02:00
secubox-reporter fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-rezapp feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-roadmap fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-routes fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-rtty fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-rustdesk feat(yacy,grafana,rustdesk): apply dual-vhost MUST pattern (MODULE-GUIDELINES §4) 2026-05-24 10:24:35 +02:00
secubox-saas-relay fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-sentinelle-gsm fix(sentinelle-gsm): skip dh_shlibdeps on prebuilt secubox-redsea (closes #425) 2026-05-30 11:50:13 +02:00
secubox-simplex fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-smart-strip
secubox-smtp-relay fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-soc feat(secubox-toolbox+core+5modules): Phase 2b wire mitm addons to receiving modules (ref #488) 2026-06-05 07:46:50 +02:00
secubox-soc-agent fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-soc-gateway fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-soc-web fix(secubox-soc-web): remove duplicate /soc/ location from nginx snippet (closes #163) (#166) 2026-05-17 07:53:00 +02:00
secubox-streamforge fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-streamlit fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-system fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-system-hub
secubox-system-tuning feat(system-tuning): new package for swap + LXC cgroup memory caps (closes #391) 2026-05-27 13:10:20 +02:00
secubox-threat-analyst feat(secubox-toolbox+core+5modules): Phase 2b wire mitm addons to receiving modules (ref #488) 2026-06-05 07:46:50 +02:00
secubox-threats fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-toolbox fix(toolbox): R3 verification page on kbin reads wrong source IP (ref #498) 2026-06-07 07:55:57 +02:00
secubox-tor docs(standalone,lxc): final naming-clarity sweep on 8 placeholder Descriptions (closes #387) 2026-05-27 09:13:36 +02:00
secubox-torrent fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-traffic feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-turn fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-ui-manager
secubox-users docs(identity,monitoring): naming-clarity sweep on 4 placeholder Descriptions (closes #385) 2026-05-27 08:50:05 +02:00
secubox-vault feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-vhost fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-vm feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-voip fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-vortex-dns docs(dns,threats): naming-clarity sweep on 6 placeholder Descriptions (closes #383) 2026-05-27 08:25:54 +02:00
secubox-vortex-firewall fix(vortex-firewall): unmask + enable nftables at install so LXC NAT survives reboot (closes #150) 2026-05-29 09:37:06 +02:00
secubox-waf feat: wg boot-survival + WAF bans/history tracking (ref #498) 2026-06-07 07:12:13 +02:00
secubox-watchdog docs(identity,monitoring): naming-clarity sweep on 4 placeholder Descriptions (closes #385) 2026-05-27 08:50:05 +02:00
secubox-wazuh fix(wazuh): postinst tolerates masked unit 2026-05-27 05:52:11 +02:00
secubox-webext feat(webext): avatar personas — selectable login bundles + one-click Become (ref #409) 2026-05-28 14:13:20 +02:00
secubox-webmail/debian cleanup(mail): prune dead source content from transitional packages (closes #380) 2026-05-27 07:34:54 +02:00
secubox-webmail-lxc/debian cleanup(mail): prune dead source content from transitional packages (closes #380) 2026-05-27 07:34:54 +02:00
secubox-webradio feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
secubox-wireguard fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
secubox-yacy feat(yacy,grafana,rustdesk): apply dual-vhost MUST pattern (MODULE-GUIDELINES §4) 2026-05-24 10:24:35 +02:00
secubox-yggdrasil refactor: move secubox-mesh (Yggdrasil VPN) → secubox-yggdrasil (closes #450) 2026-06-02 09:49:22 +02:00
secubox-zigbee docs: codify dual-vhost MUST for modules with a real web UI 2026-05-24 10:06:56 +02:00
secubox-zkp fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
zkp-hamiltonian fix(zkp-hamiltonian): drop duplicate debian/compat (same bomb as fmrelay) 2026-05-30 05:56:55 +02:00