mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
7890587a92
Extends the Task 1 install-lxc.sh skeleton with the full app deploy
(tar-copy app/+www/ into the LXC, npm ci, torrent.env, in-LXC systemd
unit enable+start), plus the standalone torrent.gk2.secubox.in nginx
vhost, an nft egress visibility tap on the LXC veth, conf/torrent.toml,
and the menu.d entry (icon/category/description).
Picks 10.100.0.160 for the LXC (10.100.0.130 was already taken), pins
a predictable veth (veth-torrent0) so the nft rule can target it, and
bind-mounts /data/torrent from the host so downloaded data and the
disk-floor statfs() check in server.js see real storage instead of
LXC-overlay space.
The nginx vhost is a full standalone server{} block (own server_name),
so it targets sites-available/ (not secubox.d/, which is merged into
the shared hub server block and can't hold a nested server{}) -- Task 8
must update debian/rules accordingly. Its auth gate mirrors the current
LAN-only $lan_client stub (Authelia was decommissioned; there is no
aggregator JWT-verify endpoint to proxy to yet), not the brief's
aggregator/api/v1/auth/verify snippet.
Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
28 lines
1.2 KiB
Plaintext
28 lines
1.2 KiB
Plaintext
# SecuBox-Deb :: secubox-torrent :: host nft egress scope
|
|
# CyberMind — https://cybermind.fr
|
|
#
|
|
# Scopes the torrent LXC's egress. FORWARD/OUTPUT are policy-accept
|
|
# repo-wide (see CLAUDE.md nftables rules) — no blanket DROP is introduced
|
|
# here. This is an explicit visibility tap (LOG on new connections) on the
|
|
# LXC's veth, not an allow/deny gate.
|
|
#
|
|
# Own, fully self-contained table + base chain (mirrors
|
|
# packages/secubox-p2p/nft/secubox-p2p-ephemeral.nft): loads independently
|
|
# of any other table already present on the board, and never issues a
|
|
# global ruleset reset.
|
|
#
|
|
# Matches the exact veth pair name pinned by install-lxc.sh
|
|
# (`lxc.net.0.veth.pair = veth-torrent0`) — LXC otherwise assigns a random
|
|
# vethXXXXXX name on every start, which a static nft rule can't target.
|
|
#
|
|
# Loaded by /etc/nftables.conf via `include "/etc/nftables.d/*.nft"`. Ship
|
|
# this file as zz-torrent-egress.nft at install time (Task 8) so it sorts
|
|
# after any table-creator base file, per repo convention (see
|
|
# feedback_nft_layered_dropins_persistence).
|
|
table inet secubox_torrent {
|
|
chain forward_torrent {
|
|
type filter hook forward priority 0; policy accept;
|
|
iifname "veth-torrent0" ct state new log prefix "[SECUBOX-TORRENT] " level info
|
|
}
|
|
}
|