CyberMind 122cd6cebc WebUI Obfuscation - admin.HOSTNAME.secubox.in Only (#96) ... * docs(spec+plan): WebUI obfuscation design and implementation plan (ref #44) Spec: docs/superpowers/specs/2026-05-12-webui-obfuscation-design.md Plan: docs/superpowers/plans/2026-05-12-webui-obfuscation.md The design locks the SecuBox WebUI to admin.<HOSTNAME>.<DOMAIN_SUFFIX> via strict-regex ACLs in HAProxy AND nginx, both driven by /etc/default/secubox as the single source of truth. New package secubox-defaults ships the env file; secubox-haproxy API exposes /webui/admin-domain (info), /webui/nginx-config (JWT, rendered vhost), /webui/refresh (JWT, cache invalidate). A safe renderer script writes the nginx vhost atomically; haproxyctl + Python /generate both inject the strict ACL at the top of http-in and https-in frontends. Plan has 15 tasks with TDD steps, exact file paths, and complete code in every step (no TBD/TODO). Acceptance criteria + integration test script included. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(secubox-defaults): scaffold package skeleton (ref #44) * feat(secubox-defaults): ship /etc/default/secubox env file (ref #44) * feat(secubox-defaults): postinst autodetect + dpkg-trigger (ref #44) * feat(secubox-haproxy): webui_identity helper + tests (ref #44) Implement webui_identity module that parses /etc/default/secubox and exposes canonical admin URL + regex pattern for HAProxy acl. New module: - api/webui_identity.py: Parses SECUBOX_HOSTNAME and SECUBOX_DOMAIN_SUFFIX with LRU cache and invalidation support. Tests (TDD): - tests/test_webui_identity.py: 5 test cases covering basic parsing, missing hostname validation, custom suffix handling, comment handling, and cache invalidation. - tests/conftest.py: sys.path bootstrap for api/ imports. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(webui_identity): catch OSError on defaults read + test (ref #44) * feat(secubox-haproxy): GET /webui/admin-domain endpoint (ref #44) * feat(secubox-haproxy): GET /webui/nginx-config rendered vhost (ref #44) * feat(secubox-haproxy): POST /webui/refresh cache invalidation (ref #44) * feat(secubox-haproxy): secubox-render-nginx-webui safe renderer (ref #44) * feat(haproxyctl): inject strict-regex WebUI ACL at frontend top (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): /generate symmetry with strict WebUI ACL (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): dpkg-trigger refresh on secubox-defaults-changed (ref #44) * build(secubox-haproxy): depend on secubox-defaults (ref #44) * test(infra): integration test for WebUI obfuscation (ref #44) * docs: HISTORY Session 159 — WebUI obfuscation (ref #44) Records the complete WebUI obfuscation work: new secubox-defaults package, three /webui/* endpoints, nginx renderer script, haproxyctl + Python generator symmetry, dpkg trigger plumbing, integration test. Includes notes on the brainstorming → spec → plan → subagent-driven execution flow and the 6 fix iterations caught by reviewers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-12 14:07:11 +02:00
..
test_44_webui_obfuscation.sh	WebUI Obfuscation - admin.HOSTNAME.secubox.in Only (#96)	2026-05-12 14:07:11 +02:00