Streamlit upload now matches MetaBlogizer KISS pattern:
- Auto-detects ZIP files by magic bytes (PK header)
- Extracts app.py from ZIP archives automatically
- Adds UTF-8 encoding declaration to Python files
- Installs requirements.txt dependencies in background
- Restarts instance on re-upload for immediate update
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Upload modal now defaults to replacing index.html
- "Set as index" checkbox checked by default
- Uncheck to use original filename (shows destination field)
- Fixes issue where uploads weren't updating main page
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Changed button logic from exp.vhost_exists to exp.emancipated
- Non-emancipated sites now correctly show "Expose" button
- Emancipated sites show "Unpublish" button
- vhost_exists was incorrectly true for some non-emancipated sites
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add auto-republish to method_upload_file (was only in upload_finalize)
- Add Gitea push to cmd_publish when gitea.enabled=1
- Use haproxyctl reload instead of init.d (container-aware)
- Uploaded content now triggers full republish flow for emancipated sites
This fixes the issue where uploading new HTML content didn't update
the live site because republish wasn't triggered.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- New RPC method `change_password` in luci.secubox-users
- Verifies current password before allowing change
- Syncs new password to all enabled services (email, jabber, nextcloud)
- Matrix/PeerTube require manual password update (noted in response)
- Portal UI updates:
- New "Account" section with "Change Password" card
- Password change modal with current/new/confirm fields
- "My Services" card showing enabled services
- ACL updated to include new authentication methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Move UCI domain update BEFORE slow haproxyctl reload (prevents RPC timeout)
- Run HAProxy generate/reload/cert in background subshell
- Fix vhost name encoding: use tr '.-' '_' (matches streamlitctl)
- Use sed instead of jq for mitmproxy routes (jq may not be installed)
- Tested: domain edit returns immediately, UCI updated correctly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Show domain column with editable input for non-exposed instances
- Show clickable domain link + edit button for exposed instances
- Add editDomain modal for changing domain on exposed instances
- Domain input pre-filled with default (id.gk2.secubox.in)
- Separate Status column for SSL/WAF badges
- Update API to support domain parameter in renameInstance
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update _emancipate_haproxy() to use mitmproxy_inspector backend
- Add mitmproxy route entries for domain -> streamlit port
- Aligns CLI behavior with RPCD emancipate_instance
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add auto Gitea push on emancipate and app rename
- Route emancipated instances through mitmproxy_inspector (WAF) by default
- Add mitmproxy route entries for domains
- Enhanced rename_app to actually rename folders/files
- Enhanced rename_instance to update HAProxy vhost and mitmproxy routes
- Display WAF badge in dashboard for exposed instances
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add lxc_start_bg() and lxc_reload() functions for container management
- Replace all /etc/init.d/haproxy calls with container-aware functions
- Fix haproxy-sync-certs to use haproxyctl reload
- Host HAProxy init script disabled, container is sole handler
Resolves intermittent 404 errors caused by dual HAProxy instances.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add --version and --profile CLI options to secubox-cloner build command
- Add versions command to list available OpenWrt releases (24.10.5, 24.10.0, 23.05.5, 23.05.4)
- Add package profiles: slim (minimal), core (mesh essentials), full (clone current device)
- Add list_versions and list_build_profiles RPCD methods for LuCI
- Update build_image RPCD to accept version and profile parameters
- Update ACL permissions for new read methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replaces unreliable nohup-based remote flash with staged approach:
1. remote_prepare_flash: Upload image + store options
2. remote_confirm_flash: Execute sysupgrade directly
3. remote_flash_status: Check flash state
4. remote_cancel_flash: Abort pending flash
Key fixes:
- Use /tmp for firmware (large tmpfs vs small rootfs)
- Direct sysupgrade execution (no nohup, works on OpenWrt)
- Proper dbclient SSH without unavailable commands
- Background job with & instead of nohup
Tested: x86_64 VM successfully flashed from 24.10.5 to 24.10.0
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add Factory tab to Cloning Station with:
- Discovery Mode toggle (enable/disable zero-touch provisioning)
- Pending Devices list with approve/reject and profile assignment
- Bulk Token Generator (1-50 tokens with profile selection)
- Hardware Inventory table (MAC, Model, CPU, RAM, Storage)
Implementation:
- 8 RPC declarations for factory methods
- 5 state properties for factory data
- 5 render functions, 6 event handlers
- Factory data polling in 5-second refresh cycle when on tab
- KISS theme UI components throughout
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fixes Roundcube IMAP "Internal error occurred" caused by Dovecot
running mail processes as uid 102 (Alpine default) instead of the
actual vmail user uid 5000.
Changes:
- configure_postfix: virtual_uid_maps/gid_maps 102/105 → 5000/5000
- configure_dovecot: mail_uid/gid, first_valid_uid, userdb args
- cmd_add_user: passwd file entries and ownership
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add inventory.sh for hardware inventory collection (MAC, serial, model, CPU, RAM, storage)
- Add profiles.sh for profile management and device matching
- Add default.json profile template for auto-provisioned peers
- Add discovery mode to master-link.sh with pending queue and approval workflow
- Add bulk token generation (up to 100 tokens per batch)
- Enhance 50-secubox-clone-provision with inventory collection and discovery join
- Add 9 new RPCD methods to luci.cloner for factory provisioning
- Fix p2p-mesh.sh to be silent when sourced as library
- Add UCI options: discovery_mode, auto_approve_known, discovery_window, default_profile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
P2P Mesh Intelligence implementation:
- Add ZKP trust bonus (+20) for verified peers in IOC validation
- Create blockchain.sh for permanent threat_ioc and ioc_feedback blocks
- Create feedback.sh for IOC effectiveness tracking and reputation updates
- Enhance gossip.sh IOC handler with ZKP-validated trust checks
- Add SCORE_IOC_EFFECTIVE (+5) and SCORE_IOC_FALSE_POSITIVE (-8) to reputation
- Add zkp_trust_bonus and feedback config options
fix(mailserver): Correct vmail UID from 102 to 5000
Dovecot was using wrong UID (102/redis instead of 5000/vmail) causing
permission denied errors when accessing mailboxes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Changed _check_interval from 10 to 1 to ensure new routes are picked up
immediately when the haproxy-routes.json file is updated.
This fixes the quick publish flow where new sites weren't accessible
immediately because mitmproxy only checked for route changes every
10 requests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added entry #45 documenting the fix for 404 errors after MetaBlogizer
site upload/publish caused by missing original_backend field in HAProxy
vhost configs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When MetaBlogizer creates HAProxy vhosts, it routes through mitmproxy_inspector
for WAF inspection. However, mitmproxyctl sync-routes needs the original_backend
field to determine where to forward traffic after WAF inspection.
Without original_backend, sites would return 404 after upload because mitmproxy
had no route to forward traffic to the actual backend.
This fix adds original_backend=$backend_name to all 3 vhost creation locations:
- method_create_site (line 491)
- method_emancipate_site (line 1210)
- method_upload_and_create_site (line 2001)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Upload workflow now works without needing to unpublish/expose again.
The reload_haproxy() function now calls mitmproxyctl sync-routes to
ensure mitmproxy picks up new routes immediately after vhost creation.
Root cause: Upload created HAProxy vhost and mitmproxy route file entry,
but mitmproxy never received a reload signal to activate the route.
Running emancipate fixed it because it called mitmproxyctl sync-routes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- metablogizer: reload_haproxy() now copies config to /etc/haproxy.cfg
- haproxyctl: generate_config() syncs to /etc/haproxy.cfg after generation
- Fixes issue where newly uploaded sites return 404 because HAProxy
reads config from /etc/haproxy.cfg but config was only generated to
/srv/haproxy/config/haproxy.cfg
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
HAProxy runs on the host, not in an LXC container. The LED pulse
script was incorrectly checking `lxc-attach -n haproxy -- pgrep haproxy`
which always failed, causing constant SPUNK ALERT red LED flashing.
Changed to check host process directly with `pgrep haproxy`.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Rename luci.master_link to luci.master-link to match the expected
OpenWrt RPCD naming convention.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Move kiss-theme.js from luci-app-secubox-portal to theme package
- Bump theme version to 0.4.8
- Prevents file conflict between packages
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add convert_to_qcow2() function using qemu-img
- Add QCOW2_FILE output path variable
- Create proxmox-import.sh helper script for easy VM import
- Update distribution package to include QCOW2 and Proxmox script
- Add Proxmox VE instructions to README
- Update usage help with QCOW2 output
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add extra_media_paths UCI option for additional bind mounts
- Supports both simple paths (/mnt/usb) and mapped paths (host:container)
- Automatically skips non-existent paths with info message
Example UCI config:
option extra_media_paths '/mnt/sdb1:/mnt/usb /mnt/nas:/mnt/nas'
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove cgroup:mixed from mount.auto (incompatible with cgroup v2)
- Add lxc.net.0.type = none for proper host network sharing
- Add lxc.seccomp.profile = and lxc.autodev = 1 for cgroup v2
Fixes container startup failure with "Failed to mount /sys/fs/cgroup"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
BusyBox ash's read command collapses consecutive tab delimiters,
causing the protected field to end up in the wrong variable.
Fix: Use "-" as placeholder for empty fields, then strip it when reading.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add lock badge CSS for protected site cards
- Add login banner for unauthenticated users
- Detect auth_required flag from metablogizer UCI config
- Hide protected cards until sessionStorage token present
- Filter respects authentication state in search and category views
Works with secubox-core portal-auth system.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sites on *.gk2.secubox.in were failing because HAProxy couldn't match
the SNI to the correct certificate. New add_haproxy_cert() helper:
- Extracts base domain from subdomain
- Creates UCI cert entry mapping domain to wildcard cert file
- Applied to all vhost creation paths (create, upload, republish)
Sites now work immediately after one-click deploy without manual
certificate configuration.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace fragile sed-based JSON manipulation with Python for adding
mitmproxy routes. The new add_mitmproxy_route() helper function:
- Updates both /srv/mitmproxy/ and /srv/mitmproxy-in/ routes files
- Uses proper JSON parsing instead of string substitution
- Ensures sites are immediately accessible after one-click deploy
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When editing a site and changing its domain, automatically:
- Remove the old HAProxy vhost for the previous domain
- Create a new vhost for the new domain with priority=50
- Regenerate and reload HAProxy configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add inline Edit button for each site in the dashboard allowing users
to modify site name, domain, description, and enabled status directly
from the overview page without navigating to settings.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New package secubox-app-talk-hpb:
- Docker-based signaling server and Janus WebRTC gateway
- Auto-generates TURN/SIGNALING/INTERNAL secrets
- Creates HAProxy vhost with SSL/ACME
- STUN/TURN server with UDP+TCP support
- CLI tool: talk-hpbctl setup/status/test/logs
Hub generator v5:
- Add PeerTube videos with thumbnails and duration badges
- Fix Streamlit instance detection (=instance vs =app)
- Total count now: sites + streamlit + videos
MetaBlogizer fix:
- Add priority=50 to new vhosts to prevent wildcard catch
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Multi-view portal with grid/list/compact modes
- Automatic site categorization (Intelligence, Dev, Finance, etc.)
- Iframe thumbnail previews of real site content
- Tag cloud and category tabs with emoji indicators
- Instant search by domain/name/category
- Auto-refresh via cron every 5 minutes
- Created explicit vhosts for 54 MetaBlogizer sites
- Fixed wildcard routing priority
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
