- Include all built .ipk packages in luci-app-secubox-bonus
- Generate Packages index and apps-local.json manifest
- Remove .gitignore to allow package tracking
- Enables offline package installation via SecuBox > Local Packages
Packages included:
- 27 luci-app-* packages
- 11 secubox-app-* packages
- luci-theme-secubox
- secubox-core
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create /etc/opkg/customfeeds.conf with secubox feed pre-configured
- Install file via Makefile instead of postinst script
- Mark as conffile to preserve user modifications on upgrade
- Add .gitignore to exclude built .ipk files from git tracking
(packages are embedded at build time by embed_local_feed)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add embed_local_feed() to local-build.sh that copies built packages
into bonus app as /www/secubox-feed/ for offline installation
- Generate Packages index and apps-local.json manifest for opkg
- Add RPCD backend (luci.secubox-store) for package install/remove
- Add LuCI view for browsing and managing local packages
- Fix OPENWRT_ONLY_PACKAGES to allow secubox-app-* wrappers in SDK build
- Remove experimental python3-* packages (unfinished mitmproxy native plan)
- Set rootfs partition size to 16GB for larger overlay
- Bump luci-app-secubox-bonus to v0.2.0
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New package: crowdsec-firewall-bouncer (v0.0.34)
- Based on official OpenWrt package from openwrt/packages
- Full nftables integration with IPv4/IPv6 support
- Timeout-based sets for automatic ban expiration
- Input and forward chain filtering
- Interface-based filtering
- procd service management with ujail support
- UCI configuration
Init script features:
- Creates nftables tables: crowdsec (IPv4), crowdsec6 (IPv6)
- Creates timeout-enabled sets for blocklists
- Generates YAML config from UCI settings
- Automatic cleanup on service stop
Updated secubox-app-crowdsec-bouncer to v0.0.32
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New features:
- New RPCD method: acquisition_metrics for detailed stats
- Realtime metrics display with 10-second polling
- Visual stat cards: lines read, parsed, unparsed, buckets
- Parse rate progress bar with color coding
- Active acquisition sources badges
- Rate calculation (events/sec) between polls
- Live update indicator with timestamp
API changes:
- Added getAcquisitionMetrics() to API layer
- Added acquisition_metrics to ACL permissions
Bumped version to 0.7.0-17
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
OpenWrt uses logd by default which doesn't write to files.
CrowdSec file-based acquisition needs /var/log/messages to exist.
Changes:
- Init script: setup_syslog() configures log_file before each start
- Defaults script: setup_syslog_file() configures at install time
- openwrt-syslog.yaml: Remove non-existent /var/log/syslog reference
The init script sets:
uci set system.@system[0].log_file='/var/log/messages'
uci set system.@system[0].log_size='512'
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Native OpenWrt package for zstandard compression library.
Can be used as alternative to pip installation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The zstandard package required by mitmproxy 8.1.1 doesn't have musllinux
wheels in older versions, causing pip to try compiling from source which
fails without gcc on the router.
Fix: Pre-install zstandard 0.23.0 which has musllinux aarch64 wheels
before installing mitmproxy.
Changes:
- Bump version to 2.1.0
- Revert to pip-based installation (native build requires full toolchain)
- Add zstandard 0.23.0 pre-install step in postinst
- Restore wrapper scripts for mitmproxy/mitmdump/mitmweb
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add OpenWrt .config for mvebu/cortexa72 target
- Update .gitignore
- Update Claude settings
- Minor portal.js update
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
mitmproxy 9.x requires mitmproxy-wireguard (Rust).
Version 8.1.1 is pure Python and works on OpenWrt.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
mitmproxy 10.x requires mitmproxy-rs which needs Rust compiler.
Version 9.0.1 is pure Python and works on OpenWrt.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
LuCI requires modules to use baseclass.extend() pattern.
Fixed "factory yields invalid constructor" error.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Portal Integration:
- Add mitmproxy to Security section with service status tracking
- Add vhost-manager to new Services section
- Add Services section to portal navigation header
- Update path detection for security/mitmproxy and services/vhosts
mitmproxy Changes:
- Move menu from admin/secubox/mitmproxy to admin/secubox/security/mitmproxy
- Update view navigation links to use new path structure
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
mitmproxy 11.x requires Python 3.12 which is not available on OpenWrt.
Version 10.4.2 is the last stable release supporting Python 3.10+.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Switch to runtime pip installation instead of build-time
- Remove complex build dependencies (python3-package.mk)
- Add wrapper scripts for mitmproxy, mitmdump, mitmweb
- Postinst installs mitmproxy==11.1.3 via pip on device
- Supports all architectures with PKGARCH:=all
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update mitmproxy to v11.1.3
- Build from Python source (no prebuilt arm64 binaries)
- Add Python dependencies
- Add mitmproxy to local-build.sh and sync-openwrt-packages.sh
- Set PKGARCH:=all for Python package
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New packages for full URL/cookie/header capture via MITM proxy:
secubox-app-mitmproxy:
- Downloads mitmproxy v11.1.2 binary for aarch64
- Transparent proxy mode with iptables integration
- mitmweb UI on port 8081
- Auto CA certificate generation
- mitmproxyctl CLI management tool
luci-app-mitmproxy:
- SecuBox themed dashboard with red color scheme
- Real-time request capture view
- Top hosts statistics
- CA certificate management
- Full UCI settings interface
- RPCD backend for ubus API
This enables full HTTP/HTTPS inspection including:
- Complete URLs (not just hostnames like nDPId)
- Cookies and headers
- Request/response bodies
- Flow recording for replay
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
OpenWrt jq is compiled without ONIGURUMA regex library, so test()
function doesn't work. Replace all regex patterns with contains()
for streaming service detection.
- Use ascii_downcase + contains() for pattern matching
- Define is_streaming, get_category, get_quality as jq functions
- Detects: YouTube, Netflix, Spotify, WhatsApp, Discord, Zoom, etc.
- Bump version to 0.6.2
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove PKG_FILE_MODES that caused chown build errors
- Add missing $(eval $(call BuildPackage)) macro
- Add explicit install rules for all resources
- Bump version to 0.6.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Portal (luci-app-secubox-portal):
- Fix service status showing 0/9 by checking if init scripts exist
- Only count installed services in status display
- Use pgrep fallback when init script status fails
nDPId Dashboard (luci-app-ndpid):
- Add default /etc/config/ndpid configuration
- Add /etc/init.d/ndpid-compat init script
- Enable compat service in postinst for app detection
- Fix Makefile to install init script and config
CrowdSec Dashboard:
- Add CLAUDE.md with OpenWrt-specific guidelines (pgrep without -x)
- CSS fixes for hiding LuCI left menu in all views
- LAPI repair improvements with retry logic
New Packages:
- secubox-app-crowdsec: OpenWrt-native CrowdSec package
- secubox-app-netifyd: Netifyd DPI integration
- luci-app-secubox: Core SecuBox hub
- luci-theme-secubox: Custom theme
Removed:
- luci-app-secubox-crowdsec (replaced by crowdsec-dashboard)
- secubox-crowdsec-setup (functionality moved to dashboard)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Stop CrowdSec before repair for clean state
- Create all required directories with proper permissions
- Regenerate local_api_credentials.yaml if missing
- Wait for LAPI port 8080 with retries before machine registration
- Use 30s timeout for repair operations
- Add retry logic for final LAPI verification
- Better error reporting with detailed steps
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Instead of trying to parse opkg output directly, use the same
secubox-appstore list --json command that the modules page uses.
This ensures consistent installation detection across both views.
The get_appstore_apps method now:
1. Gets modules list from secubox-appstore (which properly detects installed packages)
2. Merges installation status into catalog apps
3. Returns apps with correct installed/enabled/status fields
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The app store was showing all apps as not installed because the
get_appstore_apps RPC method didn't check installation status.
Now it:
- Gets list of installed packages via opkg list-installed
- Adds 'installed: true/false' to each app based on whether
its required package is in the installed list
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update portal.js sections to include:
- Portal (home page)
- Hub (SecuBox dashboard)
- Admin (Admin Control Panel)
- Security, Network, Monitoring, System (existing)
Update index.js to render Portal/Hub/Admin as links to separate
pages while keeping Security/Network/Monitoring/System as tabs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add portal header and dark theme styling to all Media Flow subviews:
- clients.js: Client statistics with portal header
- services.js: Service statistics with portal header
- history.js: Stream history with portal header
- alerts.js: Streaming alerts with portal header
Each view now includes:
- SecuBox global header with Hub, Admin, Security, Network, Monitoring, System navigation
- Internal Media Flow navigation (Dashboard, Clients, Services, History, Alerts)
- Consistent dark theme styling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added startHeaderObserver() for continuous DOM monitoring
- Observer watches for new header elements and hides them immediately
- Added interval-based backup hiding every 100ms
- Ensures OpenWrt header stays hidden even after dynamic content loads
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Enhanced CSS selectors to hide all non-SecuBox headers
- Added visibility:hidden and height:0 for complete removal
- Added JavaScript detection for cyan/blue background headers
- Hide headers that are siblings of secubox-page-wrapper
- Target OpenWrt-specific elements like .showSide and .darkMask
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added 'Hub' link pointing to main SecuBox dashboard (luci-app-secubox)
- Added 'Admin' link pointing to Admin Control Panel (luci-app-secubox-admin)
- Updated section detection for proper active state highlighting
- Organized sections: Portal, Hub, Admin, Security, Network, Monitoring, System
- Improved path detection for all SecuBox apps and modules
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add menu entry for admin/secubox/settings in portal menu
- Update portal.js to use the shorter settings path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change nav bar background from rgba(255,255,255,0.05) to solid #141419
- Add subtle border for visual separation
- Ensures proper dark theme appearance for navigation tabs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add internal navigation bars to nDPId (Dashboard, Flows, Settings)
- Add internal navigation bars to Netifyd (Dashboard, Flows, Devices, Applications, Settings)
- Complete dark theme CSS for Netifyd with LuCI element overrides
- Add CSS loading to all Netifyd views
- Version bumps: luci-app-ndpid 1.1.1, luci-app-secubox-netifyd 1.2.1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add unified SecuBox header navigation to all 5 Netifyd views:
- dashboard.js, devices.js, flows.js, applications.js, settings.js
Pattern: Wrap view content with secubox-page-wrapper and prepend
SbHeader.render() to hide LuCI sidebar when in portal context.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add unified SecuBox header navigation to all 3 nDPId views:
- dashboard.js, flows.js, settings.js
Pattern: Wrap view content with secubox-page-wrapper and prepend
SbHeader.render() to hide LuCI sidebar when in portal context.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change CSS default from light to dark mode in :root selector
(System Hub common.css in both theme and app)
- Add CSS rules to hide LuCI view tabs (.cbi-tabmenu, ul.tabs, etc.)
when in SecuBox mode
- Update hideOpenWrtUI() to also hide view tabs via JavaScript
This ensures consistent dark theme styling without depending on
data-secubox-theme attribute timing, and hides LuCI's native
navigation tabs when displaying SecuBox header.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Remove '/overview' from the redirect path to let the menu's
firstchild action handle the navigation properly.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add unified SecuBox header navigation to all 10 System Hub views
for consistent portal integration when accessed from SecuBox Portal:
- overview.js, health.js, services.js, diagnostics.js
- logs.js, backup.js, components.js, settings.js
- dev-status.js, remote.js
Pattern: Wrap view content with secubox-page-wrapper and prepend
SbHeader.render() to hide LuCI sidebar when in portal context.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add unified SecuBox header navigation to all 12 Network Modes views
for consistent portal integration when accessed from SecuBox Portal:
- overview.js, router.js, accesspoint.js, doublenat.js
- multiwan.js, relay.js, sniffer.js, travel.js
- vpnrelay.js, dmz.js, wizard.js, settings.js
Pattern: Wrap view content with secubox-page-wrapper and prepend
SbHeader.render() to hide LuCI sidebar when in portal context.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds the unified SecuBox portal header navigation to:
- Client Guardian: overview, clients, zones, logs, alerts, parental, settings
- Media Flow: dashboard
- Netdata Dashboard: dashboard, settings
This hides the LuCI sidebar and provides consistent SecuBox navigation
across all dashboards when accessed from the SecuBox Portal.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Complete rewrite of Media Flow dashboard with modern dark theme
- Add inline CSS similar to nDPId dashboard style
- Add stats grid with flow count, stream count, service status
- Add clean cards for active streams display
- Add SecuBox header to CrowdSec overview page
- Fix sidebar visibility in CrowdSec pages
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Render flow count and streaming count immediately from load() data
- No longer rely on async update after DOM insertion
- Use setTimeout fallback for periodic updates
- Fixes data not appearing on initial page load
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Move updateFlowStats/updateServiceStats calls after DOM is ready
- Use requestAnimationFrame to ensure elements exist before updating
- Fixes "0 flows" display bug when data was actually available
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix notice boxes with dark theme compatible colors
- Fix flow stats section background (was white on dark)
- Fix donut chart center fill color for dark theme
- Fix progress bars and text colors throughout
- Use rgba() for semi-transparent backgrounds
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add PKG_NAME to luci-app-secubox-portal Makefile
- Add PKG_LICENSE to luci-app-zigbee2mqtt Makefile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add recovery/reset mode to CrowdSec wizard for bouncer registration issues
- Handle existing bouncer detection with database-level cleanup fallback
- Fix Media Flow pgrep -x issue and add start/stop service ACL permissions
- Fix duplicate nav bar in CrowdSec wizard with aggressive CSS hiding
- Add shared SecuBox header component for consistent navigation
- Fix all portal app links to match actual menu.d paths
- Add UI switcher between SecuBox Portal and standard LuCI
- Hide OpenWrt header and sidebar in SecuBox mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New package: luci-app-secubox-portal v1.0.0
Creates unified entry point for all SecuBox applications with:
Portal Features:
- Top navigation bar with SecuBox branding
- Section-based navigation: Dashboard, Security, Network, Monitoring, System
- "Return to Standard LuCI" link for quick access to main LuCI interface
- Real-time service status detection for all apps
Dashboard Section:
- System overview with hostname, model, uptime, memory usage
- Quick stats showing running services count
- Featured apps grid with quick access cards
- Service status indicators (running/stopped)
App Registry:
- Security: CrowdSec, Client Guardian, Auth Guardian
- Network: Bandwidth Manager, Traffic Shaper, WireGuard, Network Modes
- Monitoring: Media Flow, nDPId, Netifyd, Netdata
- System: System Hub, CDN Cache, SecuBox Settings
Styling:
- Full dark theme with cyber aesthetic
- App cards with icon backgrounds and status dots
- Responsive design for mobile devices
- Smooth section transitions with animations
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add media-flow-ndpid-collector script for collecting streaming data from nDPId
- Update RPCD backend to detect and use nDPId as primary DPI source
- Update frontend dashboard to show DPI source indicator (nDPId/netifyd/none)
- Add active streams table displaying real-time streaming activity
- Update init.d script to auto-detect and use best available collector
- Remove hard dependency on netifyd, make DPI engines optional
- Bump version to 0.6.0
nDPId provides local deep packet inspection without requiring cloud
subscription, enabling accurate streaming service detection (Netflix,
YouTube, Spotify, etc.) with quality estimation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create nav.js for Client Guardian with SecuBox themed tabs
- Create nav.js for CrowdSec dashboard with themed navigation
- Update all Client Guardian views to use CgNav.renderTabs()
- Update all CrowdSec views to use CsNav.renderTabs()
- Update Client Guardian menu.json paths from /client-guardian/ to /guardian/
- Hide default LuCI tabs via CSS injection for both dashboards
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add rtty support for reverse proxy terminal access to relay server
- Add ttyd web console with embedded iframe terminal
- Fix pgrep -x issues by replacing with pidof (BusyBox compatible)
- Update API.js to v0.4.0 with rtty parameters
- Rewrite remote.js view with rtty configuration UI:
- Server host/port/token/description fields
- SSL/TLS toggle
- Connect/Disconnect controls
- Device ID display (auto-generated from MAC)
- Add RPCD methods: ttyd_status, ttyd_install, ttyd_start, ttyd_stop, ttyd_configure
- Update ACL permissions for new methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Monitoring page:
- Move Current Statistics card above histogram charts
- Replace Network Throughput with System Load chart
- Fix API field mapping (usage_percent vs percent)
- Parse load from cpu.load string format
nDPId app:
- Add get_detailed_flows and get_categories RPCD methods
- Fix subshell variable scope bug in RPCD script
- Add interface scanning from /sys/class/net
- Update ACL permissions for new methods
- Enhance flows.js with Array.isArray data handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add catch() handler for getInterfaces() API call
- Provide fallback interface list if API returns null
- Bump release to r2
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Set luci-app-ndpid version to 0.9.1
- Fix sync-openwrt-packages.sh to search subdirectories (base/, packages/)
- Add missing packages: ndpid, crowdsec-firewall-bouncer, secubox-core, etc.
- Add all LuCI SecuBox apps to sync list
- Improve checksums handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
LuCI JavaScript modules must use baseclass.extend() pattern instead
of returning plain objects. This fixes the "factory yields invalid
constructor" error.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change path from admin/services/ndpid to admin/secubox/ndpid
- Rename menu title to "nDPId Intelligence"
- Set order 35 (between Network Intelligence and other apps)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Improve dashboard rendering and service status display
- Fix settings UI layout and validation
- Update RPCD backend for better error handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-app-ndpid: nDPId daemon with bundled libndpi 5.x
- Add luci-app-ndpid: LuCI web interface for nDPId management
- Add migration documentation from netifyd to nDPId
- Uses git dev branch for latest libndpi API compatibility
- Builds nDPId + nDPIsrvd event broker for microservice architecture
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace div-based tables with native HTML tables for proper column alignment
- Add inline styles for consistent rendering across themes
- Fix Flow Activity by Interface table layout
- Fix Application List table layout with sortable headers
- Add pill-style badges and progress bars for better UX
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The procd service uses 'instance1' as instance name, not 'netifyd'.
Update the status check to iterate all instances instead of looking
for a hardcoded instance name.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Collect available stats from status.json (flows_active, flow_count,
cpu, memory, interface stats) instead of expecting individual flows
- Save current stats to /tmp/netifyd-stats.json
- Maintain history in /tmp/netifyd-stats-history.json (up to 24h)
- Fix architecture detection in plugin-setup script
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Netify.ai only provides pre-built plugin packages for x86 architecture.
Add detection to warn users on ARM/MIPS systems and provide alternatives:
- Use netifyd's built-in flow sink for local export
- Base netifyd from OpenWrt includes DPI without plugins
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Adapt RPCD backend to use netifyd 5.x status.json structure
- Read flows_active/flow_count from proper fields
- Extract agent_version instead of version
- Parse interface stats from .stats object
- Add get_network_stats endpoint with CPU/memory metrics
- Update dashboard to show netifyd limitation notice
- Display flow count and network statistics instead of streams
Note: netifyd 5.x requires cloud subscription for application
detection. Local mode only provides aggregate flow statistics.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
POSIX sh doesn't support 'local' inside case statements.
Removed all 'local' declarations in the call handler.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Major improvements to the Media Flow streaming detection module:
Backend (RPCD):
- Rewrite JSON handling to avoid subshell issues
- Use jq for all JSON processing (more reliable)
- Add delete_alert, clear_history, get_settings, set_settings methods
- Expand streaming service patterns (more services detected)
- Better bandwidth/quality estimation from netifyd data
Data Collection:
- Add media-flow-collector script for periodic data collection
- Add init script with cron job management
- History persists across service restarts
- Configurable retention period
Frontend:
- Remove unused Theme imports
- Fix history view to use correct field names
- Add Clear History button
- Add time period filter with refresh
- Improved table display with category icons
New streaming services detected:
- Video: Peacock, Paramount+, Crunchyroll, Funimation
- Audio: Amazon Music, YouTube Music
- Video calls: FaceTime, WhatsApp
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The netifyd collector cron job now persists across reboots:
- Add collector_enabled option to UCI config (secubox-netifyd.sink)
- Create init script (secubox-netifyd-collector) to manage cron job
- Update netifyd-collector-setup with enable/disable/status commands
- Apply collector settings on first boot via uci-defaults
Usage:
netifyd-collector-setup unix /tmp/netifyd-flows.json # Enable
netifyd-collector-setup disable # Disable
netifyd-collector-setup status # Show status
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When deleting multiple UCI firewall rules by index, the indices shift
after each deletion. The previous method using section names didn't
work reliably with fw4's anonymous rules.
New approach uses a while loop that:
- Iterates through rules by index
- Deletes matching rule and restarts from beginning
- Continues until no matching rules found
This ensures all secubox_wan_* rules are properly removed before
reapplying new ones.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Rewrite secubox-wan-access to use src="*" (all zones, DMZ style)
- Remove firewall include script (was causing loops)
- Keep only hotplug script for WAN interface up events
- Rules saved in UCI persist across reboots
- Firewall reload runs in background (&) to avoid blocking
- secubox-core bumped to 0.9.0-3
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add apply-noreload command that skips firewall reload
- Firewall include now uses apply-noreload to avoid loop
- apply command still reloads firewall for manual use
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add firewall include script (/etc/firewall.secubox-wan) for fw4 compatibility
- Add hotplug script (/etc/hotplug.d/iface/99-secubox-wan) for WAN interface events
- Configure firewall include in postinst (type=script for fw4)
- secubox-core bumped to 0.9.0-2
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added "wan" zone to all network profiles (family_home, small_business, etc.)
- Zone provides internet access without local network access
- Allows users to easily grant internet-only access to clients
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix duplicate firewall rules issue by using section names instead of indices
- UCI section deletion now properly handles all rules for a MAC address
- Prevents index shifting problems when deleting multiple rules
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove duplicate apply_client_rules function (second definition was overriding first)
- Improve zone-based firewall rule application:
- Proper MAC address normalization (uppercase)
- Clean rule names without colons (CG_BLOCK_AABBCCDD)
- Quarantine zone blocks WAN but allows DNS/DHCP
- Zone settings (internet_access, local_access) properly applied
- Firewall reload is now synchronous for immediate effect
- Improve remove_client_rules to find and delete all CG_ prefixed rules
- Add debug logging for troubleshooting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
System Hub enhancements:
- Add cron-based scheduled backup configuration (daily/weekly/monthly)
- Add backup schedule RPCD methods (get_backup_schedule, set_backup_schedule)
- Add live streaming logs with LIVE badge, play/pause, 2s refresh
- Add real component installation detection from secubox state field
- Add service running status detection for components
- Add category-based icons for components (security, network, monitoring)
- Fix status emoji display (✅⚠️❓) for Quick Status Indicators
UI improvements:
- New Scheduled Backups card in backup page with enable/disable toggle
- Time picker for backup schedule (hour/minute selectors)
- Day of week/month selectors for weekly/monthly backups
- Live indicator badge with pulse animation for logs
- Play/Pause button for log streaming control
- New log highlighting with fade-in animation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add console_status, console_enroll, console_disable RPCD methods
- Insert Console enrollment as Step 2 in the 7-step wizard
- Add API declarations and ACL permissions for console operations
- Enable share_manual_decisions, share_tainted, share_context by default on enrollment
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add repair_lapi() RPCD method to auto-fix LAPI configuration issues:
- Creates /srv/crowdsec/data directory if missing
- Fixes data_dir and db_path in config.yaml
- Re-registers localhost machine if needed
- Restarts CrowdSec and verifies LAPI is working
- Fix register_bouncer() to handle existing bouncers:
- Deletes existing bouncer before re-registering
- Gets fresh API key on re-registration
- Fix update_firewall_bouncer_config() UCI path:
- Changed from crowdsec.bouncer.$key to crowdsec.@bouncer[0].$key
- Added api_key to allowed parameters
- Rewrite metrics.js with SecuBox cyber-card theming:
- Use Theme.init() for proper theme initialization
- Replace cs-* classes with cyber-* classes
- Add CSS variable fallbacks for light/dark theme support
- Fix hub data parsing for proper component counts
- Add theme require to wizard.js
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix Client Guardian JS files: replace invalid 'require X as Y' syntax
with direct RPC declarations (LuCI doesn't support as alias)
- Add factory default profile to Client Guardian profiles.json
- Redesign Netifyd devices page with modern card-based UI:
- Device type detection with emoji icons
- Gradient summary cards for stats
- Responsive grid layout
- Traffic distribution bars
- Real-time refresh with pulse animation
- Fix Netifyd RPC calls: use correct luci.secubox-netifyd object name
- Add WAN access control feature to secubox-admin
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add wizard.js view for setup wizard integration
- Profile-based configuration (family, iot, secure, business templates)
- Apply zone settings from wizard profiles
- Integration with SecuBox Admin wizard system
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Wizard App Filtering:
- Only show apps with has_wizard=true in App Wizards section
- Previously showed all 39 catalog apps, now shows only 2 with wizards
- Improved user experience by hiding apps without configuration wizards
Profile Application Fixes:
- Fixed API method name: apply_profile → applyProfile (camelCase)
- Fixed parameter name: profile_id → profile
- Added proper JSON response handling with success/message fields
- Fixed rollback_profile → rollbackProfile method name
- Implemented rollbackProfile RPC method using secubox-recovery
- Added rollbackProfile to RPC method list registration
- Profile apply now returns structured success/error responses
- Rollback restores last snapshot created before profile application
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Modified list_apps RPC method to include apps from plugin manifests
- Previously only catalog apps could have has_wizard flag
- Now scans /usr/share/secubox/plugins/*/manifest.json files
- Adds apps with wizard.fields to the apps list even if not in catalog
- If app exists in catalog, adds has_wizard flag
- If app not in catalog, creates new app entry with manifest data
- Fixes wizard page showing "No manifests detected"
- Apps domoticz and lyrion now appear with Configure button
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
