New packages:
- luci-app-webradio: Web radio management with Lyrion bridge tab
- luci-app-turn: TURN/STUN server UI for WebRTC (Jitsi integration)
- secubox-app-lyrion-bridge: Lyrion → Squeezelite → FFmpeg → Icecast pipeline
- secubox-app-squeezelite: Squeezelite audio player with FIFO output
- secubox-app-turn: TURN server with ACME SSL and Jitsi setup
- secubox-app-webradio: Icecast/ezstream web radio server
Features:
- HTTPS streaming via HAProxy (stream.gk2.secubox.in)
- Lyrion Music Server bridge for streaming playlists to Icecast
- TURN server with time-limited credential generation
- CrowdSec integration for WebRadio security
- Schedule-based radio programming with jingles
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use SecuBox blue cyberpunk theme (matching login.html)
- Check secubox_token for authentication, redirect to login.html if missing
- Add Guacamole to administration services
- Consistent styling across all portal pages
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add login.html with RPCD authentication via luci.secubox-users
- Add reset.html for token-based password recovery
- Both pages use SecuBox cyberpunk dark theme
- Default password: Secubox@2026
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Portal login now authenticates against SecuBox users (UCI config)
instead of hardcoded credentials.
New RPCD methods in luci.secubox-users:
- authenticate: Verify username/password, return session token
- recover: Send password reset email
- reset_password: Set new password with recovery token
Portal pages:
- login.html: Login form with password recovery link
- reset.html: Password reset form (from email link)
Features:
- SHA256 password hashing
- Session tokens stored in /tmp/secubox-sessions/
- Email-based password recovery via mailctl
- Public ACL access (no LuCI login required)
- Passwords synced to services if sync_passwords=1
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add upload_and_create_site: one-click deploy with auto HAProxy setup
- Add unpublish_site: remove HAProxy vhost while preserving content
- Add set_auth_required: toggle authentication requirement per site
- Add get_sites_exposure_status: exposure/cert status for all sites
- Simplify dashboard to KISS UI pattern with status badges
- Action buttons: Share, Upload, Expose/Unpublish, Lock/Unlock, Delete
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reduce dashboard from ~1000 to ~400 lines following MetaBlogizer pattern:
- Replace cbi-value divs with simple status table
- Compact instances table with Enable/Disable/Expose/Delete actions
- Compact apps table with Edit/Delete actions
- Inline forms for adding instances and uploading files
- Remove Gitea section and rename functions
- Cleaner emancipate modal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Videos imported via yt-dlp are now automatically uploaded to PeerTube:
- OAuth authentication using UCI-stored admin credentials
- Video upload via PeerTube REST API
- Real-time job status polling with import_job_status method
- Progress indicator in LuCI UI
- Automatic cleanup of temp files
New RPCD method: import_job_status for polling job progress.
Version bumped to 1.1.0.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The IP Blocklist backend package was missing from the feed.
Manually built and added the IPK since wget-ssl dependency
failed to build in the SDK.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace jsonfilter with grep for CrowdSec decision counting
- Add ipset existence check before listing blocked IPs
- Add safety fallbacks for empty/invalid counts
- Bump version to 0.5.2-r2
The jsonfilter -e '@[*]' approach failed with CrowdSec's
multi-line JSON output, causing exit code 251 errors.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Return Mbps as decimal strings instead of integers (shows 0.45 instead of 0)
- Replace iptables tracking with conntrack/nftables for per-client bytes
- Works with nftables kernel that has no iptables compatibility
Note: Add cron job for historical data: */5 * * * * ubus call luci.bandwidth-manager record_stats
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The CrowdSec dashboard was reading from /srv/mitmproxy/threats.log
but the WAF input instance writes to /srv/mitmproxy-in/threats.log.
Fixed paths:
- threats.log: /srv/mitmproxy -> /srv/mitmproxy-in
- autoban-processed.log: /srv/mitmproxy -> /srv/mitmproxy-in
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Portal page with all service links using *.gk2.secubox.in format
- User guide with updated gk2 subdomain URLs
- Guide link added to login page bottom
- HAProxy vhost configured for portal.secubox.in
- WAF routing enabled through mitmproxy
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add upload.js wizard with multi-target publishing (HexoJS, Gitea, Streamlit, MetaBlogizer)
- Add submit.js for user content submission with moderation workflow
- Add moderation RPCD methods: submit_for_review, list_pending, approve_submission, reject_submission
- Update ACL with new moderation permissions
- Add menu entries for Upload and Submit & Moderate views
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add MixMonitor integration for automatic call recording
- Add voipctl rec commands: enable/disable/status/list/play/download/delete/cleanup
- Add recordings.js LuCI view with audio player and date filtering
- Add RPCD methods for recording management
- Add UCI config section for recording settings (format, retention)
- Fix OVH API signature to use openssl instead of sha1sum
- Improve PJSIP trunk config with realm and qualify settings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add luci-app-voip, luci-app-jabber, luci-app-jitsi, luci-app-mail,
luci-app-nextcloud, luci-app-webradio to AI & Communication category.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add Jingle VoIP, SMS Relay, and Voicemail Notifications sections to
the Jabber overview.js. Expose 9 new RPC methods in api.js for VoIP
control. Also includes remaining VoIP package updates (dialer view,
asterisk-config.sh) from previous session.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added 4 new WAF categories: voip (12), xmpp (10), cve_voip (9), cve_xmpp (8)
- Self-hosted Jitsi Meet deployed at meet.gk2.secubox.in
- Full LXC container with Prosody/Jicofo/JVB/Nginx
- Webchat updated to use self-hosted Jitsi
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Asterisk was removed from Debian Bookworm main repositories.
Added Bullseye repo with pinning to install asterisk packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New packages:
- secubox-app-voip: Asterisk PBX in LXC container
- luci-app-voip: Dashboard with extensions, trunks, click-to-call
VoIP features:
- voipctl CLI for container, extensions, trunks, calls, voicemail
- OVH Telephony API auto-provisioning for SIP trunks
- Click-to-call web interface with quick dial
- RPCD backend with 15 methods
Jabber VoIP integration:
- Jingle VoIP support (STUN/TURN via mod_external_services)
- SMS relay via OVH (messages to sms@domain)
- Voicemail notifications via Asterisk AMI → XMPP
- 9 new RPCD methods for VoIP features
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add webchat setup with Converse.js for browser-based chat access
- Fix Prosody HTTP binding to all interfaces (not just localhost)
- Add http_interfaces and https_interfaces to config
- Run Prosody as prosody user to avoid root permission issues
- Add /chat/ path for webchat served by Prosody http_files module
- Mount webchat directory in LXC container for easy customization
- Update install/emancipate output to show webchat URL
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Run Prosody as prosody user (not root) via su -s /bin/sh
- Fix process detection to look for lua.*prosody pattern
- Generate SSL certs using openssl instead of prosodyctl
- Remove deprecated cross_domain_websocket option
- Create config file before certificate generation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New packages:
- secubox-app-jabber: LXC-based Prosody XMPP server with:
- Debian Bookworm container
- Full XMPP support (C2S, S2S, MUC, MAM)
- HTTP upload for file sharing
- BOSH and WebSocket for web clients
- SSL/TLS encryption
- User and room management via jabberctl
- luci-app-jabber: LuCI dashboard with:
- Status overview and service controls
- User management (add/delete)
- Emancipate workflow (HAProxy + SSL + DNS)
- Connection info display
- Log viewer
CLI commands:
jabberctl install/uninstall/start/stop/status
jabberctl user add/del/passwd/list
jabberctl room create/delete/list
jabberctl emancipate <domain>
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Install yt-dlp in PeerTube LXC container for video downloads
- Add RPCD methods: import_video, import_status
- Add UI section with URL input and download button
- Support YouTube, Vimeo, and 1000+ video sites
- Download videos to import folder for PeerTube admin upload
- Show download status and video count
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replaced unstable Alpine container with Debian 12 Bookworm
- Fixed persistent Dovecot permission issues (UID/GID mismatch)
- Postfix + Dovecot properly configured for Debian
- Mail data and SSL certificates preserved
- Webmail now working reliably
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Security KISS Dashboard:
- Add ndpid (nDPI daemon) to RPCD status method
- Add ndpid to services monitoring array (6 services total)
APPS Portal:
- Add Streamlit to Services category (Python data apps)
- Add MetaBlogizer to Services category (AI blog generation)
Also includes secubox-cloner enhancements from earlier session.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add wazuh_running status check to RPCD handler
- Display Wazuh alongside CrowdSec, netifyd, mitmproxy in dashboard
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Complete WebRadio management interface for OpenWrt:
- Dashboard with server status, listeners, now playing
- Icecast/Ezstream server configuration
- Playlist management with shuffle/upload
- Programming grid scheduler with jingle support
- Live audio input via DarkIce (ALSA)
- Security: SSL/TLS, rate limiting, CrowdSec integration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Both user_add and user_passwd functions now set correct permissions
(644 root:dovecot) after updating /etc/dovecot/users inside the
container. This prevents "Permission denied" errors on authentication
after adding users or changing passwords.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
