secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 12:34:38 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
c64b7e569e
secubox-deb/packages
History
CyberMind-FR c64b7e569e feat(secubox-zigbee): v2.4.0 rewrite-in-place to LXC + npm + z2m 2.10.1 (closes #241) 
Replaces the v1.0.0 host-bound skeleton with the canonical SecuBox LXC
pattern (sibling of mqtt v2.4.0). Depends `secubox-mqtt (>= 2.4)` —
credentials are read from /etc/secubox/secrets/mqtt-z2m at install time
and rendered into z2m's configuration.yaml.

Minimum viable v2.4.0 (operator scope choice 2026-05-20):

* LXC at 10.100.0.111 on br-lxc. Node 20 from NodeSource (Debian
  bookworm only ships Node 18, too old for z2m 2.x).
* zigbee2mqtt 2.10.1 installed from the npm registry (NOT from the
  GitHub tag — the tag ships only TypeScript sources and `npm start`
  requires a working pnpm build chain that broke on v2.0.0 with a
  TS error in worker-timers-broker. The npm tarball ships a pre-built
  dist/ which sidesteps the entire build dance.)
* Hard limits per docs/superpowers/specs/2026-05-20-secubox-zigbee-mqtt-iot-stack.md:
  - permit_join: false in configuration.yaml
  - network_key / pan_id / ext_pan_id: GENERATE
  - daemon User=zigbee2mqtt + dialout group + NoNewPrivileges=true +
    ProtectSystem=strict
* udev rule /etc/udev/rules.d/99-secubox-zigbee.rules creates
  /dev/secubox-zgb when a Sonoff CC2652P (1a86:55d4), ConBee II
  (1cf1:0030), or CP210x (10c4:ea60) is plugged in. LXC config
  bind-mounts /dev/secubox-zgb with create=file,optional so the LXC
  starts whether or not the dongle is present.
* zigbeectl follows the SecuBox CTL grammar:
  - introspection: components / status / access
  - lifecycle:     install / reload (+ stubs)
  - module nouns:  device / network / topology / permit-join
* Host control plane: FastAPI on /run/secubox/zigbee.sock with
  /components, /status, /access, /healthz. Reverse-proxied at
  /api/v1/zigbee/. Reads zigbee2mqtt/bridge/state from the broker
  to populate the bridge component state.

Board-validated on gk2 (no dongle plugged):
    $ zigbeectl status
    lxc       running      zigbee @ 10.100.0.111 on br-lxc
    device    absent       no Zigbee dongle plugged — z2m will idle
    daemon    running      zigbee2mqtt, frontend port 8080
    bridge    unknown      zigbee2mqtt/bridge/state @ 10.100.0.110:1883
    host-api  running      secubox-zigbee.service (uvicorn)
    overall: yellow

    $ curl -I http://10.100.0.111:8080/
    HTTP/1.1 200 OK   # z2m onboarding page (radio absent → onboarding)

    $ curl -sk -H 'Host: admin.gk2.secubox.in' https://192.168.1.200:9443/api/v1/zigbee/status
    {"overall": "yellow", "states": {"lxc":"running","device":"absent",
                                     "daemon":"running","bridge":"unknown"}}

Lessons folded in during the board cycle:

1. z2m 2.x GitHub tags ship only TS sources. The npm tarball ships
   pre-built dist/ — install via `npm install zigbee2mqtt@<ver>`,
   not `git clone + pnpm run build`.
2. `sudo` is broken inside unprivileged LXCs (/etc/sudo.conf is owned
   by mapped uid 100000). Use `runuser -u <user> --` instead.
3. `install -d` on an existing directory doesn't always re-apply
   mode/owner on bookworm — chmod/chown explicitly when widening
   /etc/secubox/secrets/ from the mqtt-default 0700 root:root.
4. Long-standing bug in `config_get` (shared with sibling ctls):
   `cut | tr` returns 0 even when grep matches nothing, so the
   `|| echo $default` never fires. Capture into a variable, test
   empty, then fall back to default.

Out of scope for v2.4.0 (deferred to v2.5):

* Z2MBridge async pub/sub pattern (full /devices, /topology,
  /permit_join, /bind, /ota/* endpoints with request/response
  correlation IDs)
* Frontend authentication (currently LAN-only no-auth)
* Coordinator firmware OTA via the host API

Closes #241
2026-05-20 14:08:05 +02:00
..
secubox-ad-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-admin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ai-gateway fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ai-insights fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-auth fix(auth+users): /auth/status → /preflight (avoid route collision); engine TOTP window parameter; postinst chmod for writes (ref #120) 2026-05-13 10:55:21 +02:00
secubox-authelia feat(secubox-authelia): SSO IdP LXC scaffolding v1.0.0 (#239) (#242) 2026-05-20 09:53:56 +02:00
secubox-avatar fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-backup fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-c3box feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cdn feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cloner feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-config-advisor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-console feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cookies fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-core fix(secubox-core): don't overwrite /etc/nginx/sites-available/secubox on upgrade (closes #162) (#165) 2026-05-17 07:52:57 +02:00
secubox-crowdsec feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-cve-triage fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-cyberfeed fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-daemon/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-defaults ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-device-intel fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-dns feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-dns-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-dns-provider feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-domoticz feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-dpi feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-droplet feat(metablogizer,droplet): orchestrate haproxy + mitmproxy on publish (closes #200) (#209) 2026-05-19 07:42:38 +02:00
secubox-exposure fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-eye-remote feat(eye-remote): /api/v1/health alias for round dashboard probe (#198) 2026-05-18 15:52:41 +02:00
secubox-eye-square fix(eye-square): relocate firstboot.sh out of /usr/local/sbin/ (closes #207) (#208) 2026-05-19 06:53:31 +02:00
secubox-full/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-gitea feat(giteactl): forge runner noun verbs — LXC-only CI execution (closes #190) (#191) 2026-05-17 11:59:59 +02:00
secubox-glances fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-gotosocial fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-grafana fix(lxc-modules): 9 board-deployment fixes for grafana/yacy/rustdesk install-lxc.sh + nginx wiring (#238) 2026-05-20 09:21:48 +02:00
secubox-haproxy ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-hardening feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-health-doctor fix(secubox-health-doctor): drop redundant debian/compat (closes #220) (#221) 2026-05-19 11:44:35 +02:00
secubox-hexo fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-homeassistant feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-hub fix(secubox-hub): health-banner isHubVhost gate + drop stale nac/soc www/ (closes #247) (#250) 2026-05-20 12:53:46 +02:00
secubox-identity fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-interceptor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-iot-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ipblock fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-jabber feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-jellyfin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-jitsi fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ksm fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-led-heartbeat fix(image): silence Pi-only services on x64 + broaden X11 driver set (closes #226) (#227) 2026-05-19 14:38:20 +02:00
secubox-lite/debian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-localai feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-localrecall fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-lyrion feat(secubox-lyrion): LAN UI + LMS prefs + slimproto DNAT (closes #248) (#251) 2026-05-20 12:53:50 +02:00
secubox-mac-guard fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-magicmirror feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mail fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mail-lxc Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-master-link fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-matrix feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mcp-server fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mediaflow feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mesh fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-meshname fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metablogizer feat(metablogizer,droplet): orchestrate haproxy + mitmproxy on publish (closes #200) (#209) 2026-05-19 07:42:38 +02:00
secubox-metabolizer fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metacatalog fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-metoblizer ci+packaging: unblock v2.9.0 release — 4 package fixes + partial-release resilience 2026-05-17 10:14:50 +02:00
secubox-metrics fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mirror feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mitmproxy fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-mmpm feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-modem feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-mqtt feat(secubox-mqtt): v2.4.0 rewrite-in-place to LXC + ACL + Mosquitto 2.x (closes #240) (#252) 2026-05-20 13:42:42 +02:00
secubox-nac feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-ndpid feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netdata feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netdiag fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-netifyd feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-netmodes feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-nettweak fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-network-anomaly fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-newsbin fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-nextcloud feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-ollama fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-openclaw fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ossec feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-p2p feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-peertube fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-photoprism fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-picobrew fix(image): silence Pi-only services on x64 + broaden X11 driver set (closes #226) (#227) 2026-05-19 14:38:20 +02:00
secubox-portal feat(portal): regenerate full dashboard — navbar+vhosts+certs+attacks+metrics+cookies (closes #192) (#193) 2026-05-18 05:59:17 +02:00
secubox-publish feat(publishctl): rename metactl -> publishctl + add post noun (closes #180) (#189) 2026-05-17 11:38:46 +02:00
secubox-qos feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-redroid feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-repo feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-reporter fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rezapp feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-roadmap feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-routes fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rtty fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-rustdesk fix(lxc-modules): 9 board-deployment fixes for grafana/yacy/rustdesk install-lxc.sh + nginx wiring (#238) 2026-05-20 09:21:48 +02:00
secubox-saas-relay feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-simplex feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-smart-strip feat(hardware): Add Smart-Strip HMI module (SBX-STR-01) + fix lite profile build 2026-04-27 19:03:08 +02:00
secubox-smtp-relay fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-soc fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-soc-agent feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-soc-gateway feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-soc-web fix(secubox-soc-web): remove duplicate /soc/ location from nginx snippet (closes #163) (#166) 2026-05-17 07:53:00 +02:00
secubox-streamforge feat(streamforgectl): forge project noun verbs (closes #183) (#187) 2026-05-17 11:38:41 +02:00
secubox-streamlit feat(streamlitctl): add app info + app restart verbs (closes #182) (#188) 2026-05-17 11:38:44 +02:00
secubox-system feat(eye-remote): multi-gadget DHCP on eye-br0 — Phase 1 (#161) 2026-05-17 06:04:54 +02:00
secubox-system-hub feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-threat-analyst fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-threats fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-tor fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-torrent fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-traffic fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-turn fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-ui-manager feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-users fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vault feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-vhost feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-vm feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-voip fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vortex-dns fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-vortex-firewall fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-waf fix(secubox-waf): apply double-cache pattern on /stats + /alerts (closes #145) (#146) 2026-05-18 08:21:17 +02:00
secubox-watchdog fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
secubox-wazuh feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-webmail Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-webmail-lxc Mail stack: Phase 1 — source-catch-up + legacy package cleanup (#141) 2026-05-15 13:26:21 +02:00
secubox-webradio feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-wireguard feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00
secubox-yacy fix(secubox-yacy): ship public vhost + acme-challenge + admin auto-inject (closes #246) (#249) 2026-05-20 12:53:42 +02:00
secubox-zigbee feat(secubox-zigbee): v2.4.0 rewrite-in-place to LXC + npm + z2m 2.10.1 (closes #241) 2026-05-20 14:08:05 +02:00
secubox-zkp fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
zkp-hamiltonian feat(secubox): complete meta-script generator Tasks 14-17 2026-05-11 05:32:29 +02:00