CyberMind-FR dee65ed6c8 fix(profiles): sleeper unit not ProtectSystem=strict (drives LXC in-process) (ref #896) ... secubox-sleeper.service actuates in-process as root (no sudo/systemd-run, unlike the panel/waker which escape their own sandbox before touching systemd/LXC). ProtectSystem=strict made everything under /run read-only outside the listed ReadWritePaths, but lxc-start/lxc-stop write LXC-internal runtime/lock/cgroup paths (/run/lxc/, /run/lock/lxc/, mount- namespace setup) that are not part of this codebase's stable contract to enumerate. api/actuate.py::_issue only hard-fails on rc is None, so the resulting EROFS would have been silent: auto-sleep for every LXC-backed on-demand module would quietly stop working. Drop ProtectSystem=strict and ReadWritePaths=; keep ProtectHome=true, PrivateTmp=true, NoNewPrivileges=true, and RuntimeDirectory=secubox. A root daemon driving LXC in-process without ProtectSystem is at this codebase's normal floor, not a regression. debian/postinst: keep pre-creating /var/log/secubox and /var/lib/secubox/profiles/rollback (still needed by the actuator regardless of sandboxing), reword the comment to drop the ProtectSystem=strict framing. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>		2026-07-20 17:14:53 +02:00
..
secubox-ad-guard	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-admin	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-aggregator
secubox-ai-gateway	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-ai-insights	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-annuaire	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-appstore	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-auth	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-avatar	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-backup	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-billets
secubox-c3box	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-cdn	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-certs
secubox-cloner
secubox-config-advisor	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-console
secubox-cookies
secubox-core
secubox-crowdsec	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-cve-triage	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-cyberfeed	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-daemon/debian
secubox-defaults
secubox-device-intel	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-dns	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-dns-guard	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-dns-provider	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-domoticz
secubox-dpi	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-droplet	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-egress
secubox-exposure
secubox-eye-remote
secubox-eye-square
secubox-fmrelay	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-frigate	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-full/debian
secubox-gitea	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-glances	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-gotosocial
secubox-grafana
secubox-haproxy	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-hardening	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-health-doctor
secubox-hexo
secubox-homeassistant
secubox-hub	feat(profiles): boot reconciliation + watchdog exclusion for on-demand (ref #896)	2026-07-20 16:51:56 +02:00
secubox-identity	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-interceptor
secubox-iot-guard	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-ipblock	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-jabber
secubox-jellyfin
secubox-jitsi
secubox-ksm	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-led-heartbeat
secubox-lite/debian
secubox-localai
secubox-localrecall	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-lyrion
secubox-mac-guard	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-macro
secubox-magicmirror
secubox-maigret
secubox-mail	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mail-lxc/debian
secubox-master-link
secubox-matrix	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mcp-server	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mediaflow	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mesh
secubox-mesh-bt
secubox-meshname	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-metablogizer	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-metabolizer	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-metacatalog	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-metoblizer
secubox-metrics
secubox-mirror	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mitmproxy	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mmpm/debian
secubox-modem	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-mqtt
secubox-nac	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-ndpid	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-netdata	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-netdiag	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-netifyd	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-netmodes	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-nettweak	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-network-anomaly	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-newsbin
secubox-nextcloud	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-ollama
secubox-openclaw
secubox-ossec
secubox-p2p	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-peertube	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-photoprism	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-picobrew
secubox-podcaster	fix(podcaster): stage YouTube imports on the SSD, not the eMMC root	2026-07-17 19:30:35 +02:00
secubox-portal
secubox-profiles	fix(profiles): sleeper unit not ProtectSystem=strict (drives LXC in-process) (ref #896)	2026-07-20 17:14:53 +02:00
secubox-proxypac	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-publish	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-qos	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-rbs-sensor
secubox-reality	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-redroid
secubox-repo	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-reporter	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-rezapp
secubox-roadmap	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-routes	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-rtty	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-rustdesk
secubox-saas-relay	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-security-posture
secubox-sentinelle-gsm
secubox-simplex
secubox-smart-strip
secubox-smtp-relay	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-soc	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-soc-agent
secubox-soc-gateway
secubox-soc-web
secubox-spiderfoot
secubox-streamforge	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-streamlit	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-system	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-system-hub
secubox-system-tuning
secubox-threat-analyst	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-threatmesh
secubox-threats	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-toolbox
secubox-toolbox-ng	fix(waf-ng): vhost signal excludes WAF-blocked/banned traffic (real activity only) (ref #896)	2026-07-20 16:17:59 +02:00
secubox-tor	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-torrent	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-traffic
secubox-turn	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-ui-manager
secubox-users	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-vault
secubox-vhost	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-vm
secubox-voip	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-vortex-dns	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-vortex-firewall	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-waf	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-waf-ng	feat(waf-ng): per-vhost last-request/active-conns signal emitter (ref #896)	2026-07-20 16:04:58 +02:00
secubox-watchdog	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-wazuh
secubox-webext
secubox-webmail
secubox-webmail-lxc/debian
secubox-webradio
secubox-wireguard	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-yacy
secubox-yggdrasil	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
secubox-zigbee
secubox-zkp	release: bump minor on the 87 modules converted to Wants=secubox-core (Phase 2)	2026-07-19 09:08:22 +02:00
zkp-hamiltonian