mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 18:36:55 +00:00
CyberMind-FR
76cd7c0d96
Complete Remote UI implementation for SecuBox status display: - Python/PIL dashboard with direct framebuffer rendering (no Chromium) - KMS overlay support (vc4-kms-dpi-hyperpixel2r) - tested working - USB OTG composite gadget (CDC-ECM + CDC-ACM) for host connection - 6 concentric rings showing CPU, MEM, DISK, LOAD, TEMP, WiFi metrics - Auto-start systemd service (secubox-dashboard.service) - install_zerow.sh for SD card preparation with all fixes Key fixes discovered during debugging: - Use KMS overlay, not non-KMS (GPIO conflicts on Bookworm) - Framebuffer is RGB565 (16-bit), not BGRA - RPi OS Bookworm requires userconf file for SSH credentials - NetworkManager ignores ifupdown; use direct IP config Files: - secubox_dashboard.py: PIL-based live metrics dashboard - install_zerow.sh: SD card flasher with KMS overlay - secubox-dashboard.service: Auto-start systemd unit - 24 module icons (AUTH/WALL/BOOT/MIND/ROOT/MESH) Tested on: RPi Zero W + HyperPixel 2.1 Round 480x480 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
156 lines
6.6 KiB
Plaintext
156 lines
6.6 KiB
Plaintext
# /etc/secubox/secubox.conf — Configuration SecuBox-DEB
|
||
# Format TOML — généré par firstboot.sh, éditable ensuite
|
||
# Recharger : systemctl restart secubox-\*
|
||
|
||
# ── Global ────────────────────────────────────────────────────────
|
||
[global]
|
||
hostname = "secubox-01"
|
||
timezone = "Europe/Paris"
|
||
board = "mochabin" # mochabin | espressobin-v7 | espressobin-ultra
|
||
debug = false
|
||
log_level = "warning" # debug | info | warning | error
|
||
|
||
# ── API / Auth ────────────────────────────────────────────────────
|
||
[api]
|
||
socket_dir = "/run/secubox" # Dossier des Unix sockets
|
||
jwt_secret = "" # Généré au firstboot — ne pas modifier
|
||
|
||
# Utilisateurs locaux (fallback si pas d'OAuth)
|
||
[auth]
|
||
|
||
[auth.users.admin]
|
||
password = "secubox" # À changer impérativement !
|
||
# password_hash = "$2b$12$..." # bcrypt recommandé (TODO Phase 5)
|
||
|
||
# ── CrowdSec ──────────────────────────────────────────────────────
|
||
[crowdsec]
|
||
lapi_url = "http://127.0.0.1:8080"
|
||
lapi_key = "" # Généré par : cscli bouncers add secubox-bouncer
|
||
|
||
# ── DPI / netifyd ─────────────────────────────────────────────────
|
||
[dpi]
|
||
mode = "inline" # inline | passive
|
||
engine = "netifyd" # netifyd | ndpid
|
||
interface = "eth0" # Interface à surveiller (WAN)
|
||
mirror_if = "ifb0" # Interface miroir pour DPI inline
|
||
|
||
# ── WireGuard ─────────────────────────────────────────────────────
|
||
[wireguard]
|
||
interface = "wg0"
|
||
listen_port = 51820
|
||
|
||
# ── NAC / DHCP ────────────────────────────────────────────────────
|
||
[nac]
|
||
dhcp_interface = "br-lan"
|
||
dhcp_range = "192.168.1.100,192.168.1.254,12h"
|
||
dns_servers = ["9.9.9.9", "149.112.112.112"]
|
||
# Zones : lan_allowed, iot_zone, guest_zone, quarantine
|
||
default_zone = "quarantine" # Nouveaux clients en quarantaine par défaut
|
||
|
||
# ── QoS / Bandwidth ───────────────────────────────────────────────
|
||
[qos]
|
||
interface = "eth0" # Interface WAN pour le shaping
|
||
upload_mbps = 100
|
||
download_mbps = 200
|
||
enabled = false
|
||
|
||
# ── CDN Cache ─────────────────────────────────────────────────────
|
||
[cdn]
|
||
engine = "nginx" # nginx | squid
|
||
cache_dir = "/var/cache/secubox-cdn"
|
||
cache_size = "5g"
|
||
listen_port = 3128
|
||
|
||
# ── VirtualHosts ──────────────────────────────────────────────────
|
||
[vhost]
|
||
nginx_sites_dir = "/etc/nginx/sites-available"
|
||
certbot_email = "admin@example.com"
|
||
default_ssl_mode = "selfsigned" # selfsigned | letsencrypt
|
||
|
||
# ── OAuth2 providers (secubox-auth) ───────────────────────────────
|
||
[oauth]
|
||
# [oauth.google]
|
||
# client_id = ""
|
||
# client_secret = ""
|
||
|
||
# [oauth.github]
|
||
# client_id = ""
|
||
# client_secret = ""
|
||
|
||
# ── Réseau modes ──────────────────────────────────────────────────
|
||
[netmodes]
|
||
current_mode = "router"
|
||
backup_dir = "/var/lib/secubox/netmodes-backup"
|
||
confirm_timeout = 300 # Secondes avant rollback auto si pas confirmé
|
||
|
||
# ── Notifications ─────────────────────────────────────────────────
|
||
[notifications]
|
||
# [notifications.email]
|
||
# smtp_host = "smtp.example.com"
|
||
# smtp_port = 587
|
||
# from = "secubox@example.com"
|
||
# to = "admin@example.com"
|
||
|
||
# [notifications.webhook]
|
||
# url = "https://hooks.example.com/secubox"
|
||
# secret = ""
|
||
|
||
# ── Remote UI / HyperPixel Dashboard ─────────────────────────────
|
||
# Configuration du dashboard kiosk HyperPixel 2.1 Round (480×480 px)
|
||
# sur RPi Zero W — Affichage des métriques SecuBox en temps réel.
|
||
#
|
||
# Déploiement :
|
||
# bash remote-ui/round/deploy.sh -h <rpi-ip> --api-url http://<secubox-ip>:8000
|
||
#
|
||
# Service systemd sur le RPi : secubox-remote-ui.service
|
||
# Ressources limitées : MemoryMax=256M, CPUQuota=80%
|
||
[remote_ui]
|
||
enabled = true
|
||
api_base = "/api/v1/system" # Endpoint métriques (servi par secubox-system)
|
||
refresh_ms = 5000 # Intervalle de rafraîchissement (ms)
|
||
simulate = false # Mode simulation (données fictives)
|
||
|
||
# Seuils d'alerte — CPU (%)
|
||
[remote_ui.thresholds.cpu]
|
||
warn = 70 # Niveau warning
|
||
crit = 85 # Niveau critique
|
||
|
||
# Seuils d'alerte — Mémoire (%)
|
||
[remote_ui.thresholds.mem]
|
||
warn = 75
|
||
crit = 90
|
||
|
||
# Seuils d'alerte — Disque (%)
|
||
[remote_ui.thresholds.disk]
|
||
warn = 80
|
||
crit = 95
|
||
|
||
# Seuils d'alerte — Température CPU (°C)
|
||
[remote_ui.thresholds.temp]
|
||
warn = 65
|
||
crit = 75
|
||
|
||
# Seuils d'alerte — WiFi RSSI (dBm, valeurs négatives)
|
||
[remote_ui.thresholds.wifi]
|
||
warn = -70 # Signal faible
|
||
crit = -80 # Signal critique
|
||
|
||
# Mapping services SecuBox vers les anneaux du dashboard
|
||
# Ordre : centre vers extérieur = AUTH → WALL → BOOT → MIND → ROOT → MESH
|
||
[remote_ui.modules]
|
||
AUTH = "secubox-auth" # Authentification / SSO
|
||
WALL = "secubox-crowdsec" # WAF / IDS / CrowdSec
|
||
BOOT = "secubox-hub" # Dashboard principal
|
||
MIND = "secubox-ai-insights" # IA / Insights
|
||
ROOT = "secubox-system" # Système / Métriques
|
||
MESH = "secubox-p2p" # Réseau mesh P2P
|
||
|
||
# Palette de couleurs (hex)
|
||
[remote_ui.colors]
|
||
AUTH = "#C04E24" # Rouge-orange
|
||
WALL = "#9A6010" # Bronze
|
||
BOOT = "#803018" # Marron foncé
|
||
MIND = "#3D35A0" # Violet/indigo
|
||
ROOT = "#0A5840" # Vert foncé
|
||
MESH = "#104A88" # Bleu marine
|