mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
d67e2c03b7
Wires the scale-to-zero services into debian/ packaging: secubox-wakectl entry point (/usr/sbin), templates/waking.html now ships, secubox-waker and secubox-sleeper systemd units registered via dh_installsystemd --name=, enabled/restarted (try-restart, preserving runtime state) in postinst alongside secubox-profiles.service. postinst now also runs secubox-wakectl waf-sync/health-sync so sbxwaf and the health monitor have their lists from first install (nginx-sync stays unwired per the 2026-07-20 pivot). Hardens secubox-sleeper.service with ProtectSystem=strict and an explicit ReadWritePaths covering the actuator's real write set, traced through api/actuate.py/snapshot.py/audit.py: /run/secubox, /var/lib/secubox/profiles/rollback, /var/log/secubox, /data/lxc, and /etc/secubox/waf (haproxy-routes.json, written on a routed module's STOP — missed by a naive reading of the write set). Documents the lifecycle/wake_class policy, the waker/sleeper mechanism and a pilot procedure in README.md, wiki/Architecture.md and .claude/MODULE-COMPLIANCE.md. Bumps changelog to 0.8.0. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
10 lines
314 B
Bash
Executable File
10 lines
314 B
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
if [ "$1" = "remove" ]; then
|
|
systemctl stop secubox-profiles.service secubox-waker.service secubox-sleeper.service || true
|
|
systemctl disable secubox-profiles.service secubox-waker.service secubox-sleeper.service || true
|
|
systemctl reload nginx 2>/dev/null || true
|
|
fi
|
|
#DEBHELPER#
|
|
exit 0
|