mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
d67e2c03b7
Wires the scale-to-zero services into debian/ packaging: secubox-wakectl entry point (/usr/sbin), templates/waking.html now ships, secubox-waker and secubox-sleeper systemd units registered via dh_installsystemd --name=, enabled/restarted (try-restart, preserving runtime state) in postinst alongside secubox-profiles.service. postinst now also runs secubox-wakectl waf-sync/health-sync so sbxwaf and the health monitor have their lists from first install (nginx-sync stays unwired per the 2026-07-20 pivot). Hardens secubox-sleeper.service with ProtectSystem=strict and an explicit ReadWritePaths covering the actuator's real write set, traced through api/actuate.py/snapshot.py/audit.py: /run/secubox, /var/lib/secubox/profiles/rollback, /var/log/secubox, /data/lxc, and /etc/secubox/waf (haproxy-routes.json, written on a routed module's STOP — missed by a naive reading of the write set). Documents the lifecycle/wake_class policy, the waker/sleeper mechanism and a pilot procedure in README.md, wiki/Architecture.md and .claude/MODULE-COMPLIANCE.md. Bumps changelog to 0.8.0. Co-Authored-By: Gerald KERMA <devel@cybermind.fr> |
||
|---|---|---|
| .. | ||
| changelog | ||
| control | ||
| install | ||
| postinst | ||
| prerm | ||
| rules | ||
| secubox-profiles.service | ||
| secubox-sleeper.service | ||
| secubox-waker.service | ||