CyberMind-FR bd8e2e382e feat(waf-ng): reconcile to a single HARDENED non-root unit; retire worker@ fan-out (ref #896) ... The board ran a hand-created unhardened ROOT sbxwaf on :8085 while the package shipped only a worker@ fan-out that crash-looped (panic on the root-only cookie-audit log) and, as secubox-waf + RuntimeDirectory=secubox, re-chowned the shared /run/secubox on every crash-restart — breaking every secubox-user socket bind (profiles 502s). Ship ONE hardened unit (secubox-waf-ng.service, :8085, User=secubox-waf, full sandbox, NO RuntimeDirectory — sbxwaf only connects to waker.sock). postinst asserts the perms a non-root sbxwaf needs (haproxy-routes.json 0644, cookie-audit ledger writable by secubox-waf), disables leftover worker@ units, drops the /etc override. Validated live on gk2: 264 routes, real routing, admin/gitea/billets/yacy 200; a WAF restart no longer touches /run/secubox and profiles stays up. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>		2026-07-21 07:28:46 +02:00
..
secubox-waf-ng-worker@.service	fix(profiles,waf-ng): final review fixes for scale-to-zero pilot (ref #896)	2026-07-20 17:33:58 +02:00
secubox-waf-ng.service	feat(waf-ng): reconcile to a single HARDENED non-root unit; retire worker@ fan-out (ref #896)	2026-07-21 07:28:46 +02:00