gandalf/secubox-openwrt
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,482 Commits 4 Branches 293 Tags 320 MiB
fd54253f66
Commit Graph

9 Commits

Author SHA1 Message Date
CyberMind-FR
19632e38e0 feat(routing): Centralize mitmproxy route management in secubox-core 
Add centralized route registry (`secubox-route`) in secubox-core to eliminate
route management duplication across metablogizerctl, streamlitctl, and
mitmproxyctl.

New features:
- `/etc/config/secubox-routes` - UCI config for central route registry
- `/usr/sbin/secubox-route` - CLI for route management (add, remove, sync)
- Import routes from HAProxy, MetaBlogizer, Streamlit with source tracking
- Auto-sync to all mitmproxy instances on route changes
- Skip wildcard domains and LuCI (port 8081) routes

Updated services to use centralized registry:
- metablogizerctl: Use secubox-route add instead of mitmproxyctl sync
- streamlitctl: Use secubox-route add with domain/port params
- peertubectl: Use secubox-route add for emancipation
- vhost-manager/mitmproxy.sh: Prefer secubox-route when available
- mitmproxyctl: Delegate to secubox-route import-all for sync-routes

This prevents route mixups between services and provides a single
source of truth for all WAF routing configuration.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-28 08:56:04 +01:00
CyberMind-FR
549c0425e7 feat: Stats evolution, LED tri-color pulse, Widget Fabricator 
Stats Collection:
- Add unified secubox-stats-collector for crowdsec/mitmproxy/firewall
- Add secubox-status-json and metablogizer-json for landing page
- JSON cache files in /tmp/secubox/ for double-buffer status

LED Pulse Daemon:
- Tri-color status sync matching control panel (Health/CPU/Memory)
- SPUNK ALERT mode for critical service failures (HAProxy/CrowdSec down)
- Integrated into secubox-core init.d for auto-start on boot

Landing Page:
- Add Blogaliser section with MetaBlogizer sites
- Add health indicators (green/yellow/red status dots)
- Add security stats (dropped, bans, connections)

Streamlit Enhancements:
- Add test_upload RPCD method for upload validation
- Add reupload button for replacing existing apps
- Add secubox_control.py reading from cache (LXC-compatible)
- Update ACL and API for new methods

HAProxy Fixes:
- Fix invalid use_backend entries (IP:port -> backend names)
- Add streamlit_hello backend
- Save routing to UCI config for persistence

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-06 20:43:45 +01:00
CyberMind-FR
5205b3b2bd feat(secubox-core): Add LED heartbeat for MochaBin and Vortex services dashboard 
- Add LED heartbeat to secubox-core daemon using MochaBin's RGB LEDs (led1)
  - Green flash: system healthy
  - Double red flash: warning state
  - Long red flash: error state
  - Blue flash: boot/startup
- LED pulses once per watchdog cycle (default 60s)
- New UCI options: led_heartbeat (default 1), watchdog_interval (default 60)
- Add "Node Services" section to Vortex DNS LuCI dashboard showing published sites
- Bump secubox-core version to 0.10.0-r12

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-02-06 09:38:13 +01:00
CyberMind-FR
b64f9a0a1d feat(appstore): Implement KISS Evolution - feeds, profiles, skills, feedback 
Add four major features to enhance SecuBox AppStore:

1. Feed Source Management:
   - Feed types: published, unpublished, development
   - Share tokens for private feed access
   - CLI: secubox feed list/add/share/import
   - LuCI: Feed type badges and share URLs in catalog-sources

2. Profile Export/Import:
   - Export configurations with feed sources embedded
   - Import from URL or file with merge/replace modes
   - CLI: secubox profile export/import/share
   - LuCI: New profiles.js view with export/import dialogs

3. Skill System:
   - Capability discovery from module catalogs
   - Quality indicators based on provider count
   - CLI: secubox skill list/providers/install/check
   - LuCI: New skills.js view with provider browser

4. Feedback Loop:
   - Issue reporting and resolution tracking
   - Search existing resolutions
   - CLI: secubox feedback report/resolve/search/list
   - LuCI: New feedback.js view for knowledge base

Technical changes:
- RPCD backend with 17 new API methods
- POSIX shell compatibility fixes (ESC via printf, tr A-Z a-z)
- LuCI menu entries for new views

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-30 19:46:27 +01:00
CyberMind-FR
b7fb268f71 feat: Fix Client Guardian RPC, redesign Netifyd devices UI (v0.6.0-r26) 
- Fix Client Guardian JS files: replace invalid 'require X as Y' syntax
  with direct RPC declarations (LuCI doesn't support as alias)
- Add factory default profile to Client Guardian profiles.json
- Redesign Netifyd devices page with modern card-based UI:
  - Device type detection with emoji icons
  - Gradient summary cards for stats
  - Responsive grid layout
  - Traffic distribution bars
  - Real-time refresh with pulse animation
- Fix Netifyd RPC calls: use correct luci.secubox-netifyd object name
- Add WAN access control feature to secubox-admin

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-08 13:52:45 +01:00
CyberMind-FR
e13a3f5b84 hello 2026-01-04 19:50:25 +01:00
CyberMind-FR
4b8d72b6f6 feat: add cyberpunk theme to Apps Manager with debug logging and UCI config 
SecuBox Core (v0.8.0-7):
- Added UCI config /etc/config/secubox-appstore with multi-source catalog
- Sources: GitHub (priority 1), Local Web, USB, Embedded fallback

LuCI Admin Apps Manager (v1.0.0-11):
- Cyberpunk UI transformation with debug logging
- Neon terminal aesthetic with animated status indicators
- Enhanced error handling with empty state messaging

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-04 17:09:31 +01:00
CyberMind-FR
77dbd3d499 feat: Multi-source AppStore with version management and updates UI (Phases 1-3) 
Implement comprehensive multi-source catalog system with automatic fallback,
advanced version tracking, and rich update management interfaces.

## Phase 1: Backend Infrastructure (COMPLETE)

### UCI Configuration
- **New**: `/etc/config/secubox-appstore`
  - 4 source types: GitHub (remote), local web (remote), USB (local), embedded (fallback)
  - Priority-based fallback (1=highest, 999=embedded last resort)
  - Settings: auto_sync, force_source, check_updates_on_boot, notify_updates
  - Update checking with configurable intervals

### Catalog Sync Script
- **New**: `/usr/sbin/secubox-catalog-sync` (364 lines)
  - Automatic multi-source fallback by priority
  - Download tools: uclient-fetch, wget, curl (auto-detect)
  - HTTP caching: ETag support, 304 Not Modified handling
  - JSON validation before use
  - Metadata tracking with jq
  - Logging to syslog
  - Source types: remote (HTTPS/HTTP), local (filesystem), embedded (ROM)

### CLI Enhancement
- **Modified**: `/usr/sbin/secubox-appstore`
  - New commands: `sync [source]`, `check-updates [--json]`, `changelog <app> [version]`
  - `get_active_catalog()`: Reads from cache or embedded
  - `sync_catalog()`: Wrapper for secubox-catalog-sync
  - `check_updates()`: Version comparison with opkg
  - `get_changelog()`: Extracts from catalog JSON

### Metadata Structure
- **New**: `/usr/share/secubox/catalog-metadata.json.example`
  - Active source tracking
  - Source status (online/offline/error)
  - ETag cache for HTTP sources
  - Installed apps version tracking
  - Update statistics

### Makefile Updates
- **Modified**: `secubox-core/Makefile`
  - PKG_RELEASE: 5 → 6
  - Added conffiles: `/etc/config/secubox-appstore`
  - Install secubox-catalog-sync binary
  - Install catalog-metadata.json.example
  - Added dependency: +jq
  - postinst: Create cache directories (/var/cache/secubox/catalogs, /var/lib/secubox)

## Phase 2: RPCD Backend (COMPLETE)

### New RPC Methods
- **Modified**: `/usr/libexec/rpcd/luci.secubox`
  - `get_catalog_sources()`: List configured sources from UCI, status from metadata
  - `set_catalog_source(source)`: Configure force_source in UCI
  - `sync_catalog([source])`: Trigger catalog sync (auto-fallback or specific)
  - `check_updates()`: Compare installed vs catalog versions
  - `get_app_versions(app_id)`: Detailed version info (pkg, app, installed, catalog)
  - `get_changelog(app_id, from, to)`: Extract changelog from catalog
  - `get_widget_data(app_id)`: Widget metrics (Phase 5 prep)

All methods integrate with:
- UCI config parsing (`config_load`, `config_foreach`)
- Metadata file reading (`/var/lib/secubox/catalog-metadata.json`)
- Catalog reading (`/var/cache/secubox/catalogs/*.json` or embedded)
- opkg version checking

## Phase 3: Frontend LuCI Views (COMPLETE)

### API Module Enhancement
- **Modified**: `secubox-admin/api.js`
  - New RPC declarations: 7 new methods
  - Exports: `getCatalogSources`, `setCatalogSource`, `syncCatalog`,
            `checkUpdates`, `getAppVersions`, `getChangelog`, `getWidgetData`

### Catalog Sources Management
- **New**: `view/secubox-admin/catalog-sources.js` (370 lines)
  - Live source status display (online/offline/error)
  - Priority-based ordering
  - Active source indicator
  - Per-source actions: Sync, Test, Set Active, Enable/Disable
  - Summary stats: Total sources, active source, updates available
  - Auto-refresh every 30 seconds
  - Timestamp formatting (relative: "5 minutes ago", "2 days ago")

### Updates Manager
- **New**: `view/secubox-admin/updates.js` (380 lines)
  - Available updates list with version comparison
  - Changelog preview in update cards
  - Version arrows: "0.3.0-1 → 0.4.0-2"
  - Per-app actions: Update Now, View Full Changelog, Skip Version
  - Batch update: "Update All" button
  - Check for Updates: Sync + check flow
  - Auto-refresh every 60 seconds
  - No updates state: Checkmark with message

### Apps Manager Enhancement
- **Modified**: `view/secubox-admin/apps.js`
  - Load update info on page load
  - Update available badges (warning style)
  - Version display with tooltip (installed → available)
  - Visual indicators: `.has-update`, `.version-outdated` classes
  - New filter: "Updates Available" / "Installed" / "Not Installed"
  - Changelog button on all apps (installed or not)
  - Update button for apps with available updates
  - `updateApp()`: Shows changelog before update
  - `viewChangelog()`: Modal with version history
  - `filterByStatus()`: Filter by update/install status

### Menu Integration
- **Modified**: `menu.d/luci-app-secubox-admin.json`
  - New entries:
    - "Updates" (order: 25) → `/admin/secubox/admin/updates`
    - "Catalog Sources" (order: 27) → `/admin/secubox/admin/catalog-sources`
  - Placed between Apps Manager and App Settings

## Data Flow Architecture

```
User Action (Web UI)
  ↓
LuCI View (catalog-sources.js, updates.js, apps.js)
  ↓
API Module (api.js RPC calls)
  ↓
RPCD Backend (luci.secubox)
  ↓
CLI Scripts (secubox-appstore, secubox-catalog-sync)
  ↓
Data Layer
  ├── UCI Config (/etc/config/secubox-appstore)
  ├── Cache (/var/cache/secubox/catalogs/*.json)
  ├── Metadata (/var/lib/secubox/catalog-metadata.json)
  └── Embedded (/usr/share/secubox/catalog.json)
```

## Fallback Logic

1. User triggers sync (or auto-sync)
2. secubox-catalog-sync reads UCI config
3. Sorts sources by priority (1 = GitHub, 2 = Local Web, 3 = USB, 999 = Embedded)
4. Attempts each source in order:
   - GitHub HTTPS → timeout/fail → Next
   - Local Web → unreachable → Next
   - USB → not mounted → Next
   - Embedded → Always succeeds (ROM)
5. First successful source becomes active
6. Metadata updated with status, ETag, timestamp
7. Cache written to `/var/cache/secubox/catalogs/<source>.json`

## Version Tracking

- **PKG_VERSION**: OpenWrt package version (e.g., "0.4.0")
- **PKG_RELEASE**: Build release number (e.g., "2")
- **pkg_version**: Full package string "0.4.0-2" (in catalog)
- **app_version**: Underlying app version (e.g., "0.4.0")
- **installed_version**: From `opkg list-installed`
- **catalog_version**: From active catalog JSON
- **Comparison**: Uses `opkg compare-versions` for semantic versioning

## Storage Layout

```
/etc/config/secubox-appstore              # UCI configuration
/var/cache/secubox/catalogs/              # Downloaded catalogs (755/644)
  ├── github.json
  ├── local_web.json
  └── usb.json
/var/lib/secubox/                         # Runtime metadata (700/600)
  └── catalog-metadata.json
/usr/share/secubox/catalog.json           # Embedded fallback (ROM)
```

## Key Features

✅ **Multi-source support**: GitHub + Web + USB + Embedded
✅ **Automatic fallback**: Priority-based with retry logic
✅ **HTTP optimization**: ETag caching, 304 Not Modified
✅ **Version management**: PKG + App versions, changelog tracking
✅ **Update notifications**: Badges, filters, dedicated updates page
✅ **Offline capable**: USB and embedded sources work without internet
✅ **Live status**: Auto-refresh, real-time source health
✅ **User control**: Manual sync, force specific source, enable/disable sources

## Files Modified (8)
- package/secubox/secubox-core/Makefile
- package/secubox/secubox-core/root/usr/libexec/rpcd/luci.secubox
- package/secubox/secubox-core/root/usr/sbin/secubox-appstore
- package/secubox/luci-app-secubox-admin/htdocs/luci-static/resources/secubox-admin/api.js
- package/secubox/luci-app-secubox-admin/htdocs/luci-static/resources/view/secubox-admin/apps.js
- package/secubox/luci-app-secubox-admin/root/usr/share/luci/menu.d/luci-app-secubox-admin.json

## Files Created (4)
- package/secubox/secubox-core/root/etc/config/secubox-appstore
- package/secubox/secubox-core/root/usr/sbin/secubox-catalog-sync
- package/secubox/secubox-core/root/usr/share/secubox/catalog-metadata.json.example
- package/secubox/luci-app-secubox-admin/htdocs/luci-static/resources/view/secubox-admin/catalog-sources.js
- package/secubox/luci-app-secubox-admin/htdocs/luci-static/resources/view/secubox-admin/updates.js

## Next Steps (Phase 4-5)

- Phase 4: Enrich catalog.json with changelog sections
- Phase 5: Widget system (renderer + templates for security/network/monitoring)
- Phase 6: Auto-sync service with cron
- Phase 7: Optimizations (signature validation, compression, CDN)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-04 10:53:57 +01:00
CyberMind-FR
d2f56e0aab feat(secubox-core): implement modular framework foundation v0.8.0 
Add comprehensive SecuBox Core Framework - production-ready modular
infrastructure for OpenWrt-based security appliances.

## Core Components

### Service Infrastructure
- procd-managed secubox-core daemon
- UCI configuration schema (/etc/config/secubox)
- First-boot provisioning system
- Automatic directory structure creation
- Device ID generation

### CLI Interface (secubox)
Complete command-line interface with 6 main commands:
- app: Module/AppStore management
- profile: Profile and template engine
- device: Device operations and info
- net: Network management tools
- diag: Diagnostics and health checks
- ai: AI copilot stub (experimental)

### Module Management (AppStore)
- Catalog-based module discovery (22 modules)
- Installation/removal workflows
- Dependency resolution via opkg
- Lifecycle hooks (pre/post install/remove)
- Module health monitoring
- JSON and table output formats

### Profile Engine
- Declarative configuration (YAML/JSON)
- Module orchestration
- UCI override system
- Dry-run validation
- Configuration export

### Diagnostics System
- CPU, memory, storage monitoring
- Network connectivity tests
- Service health checks
- Configurable thresholds
- Color-coded output
- Diagnostic report generation

### Recovery System
- Automatic snapshot creation
- Configuration backup/restore
- Rollback capability
- Interactive recovery mode
- Snapshot management (keep last 5)

### ubus RPC API (luci.secubox)
Complete RPC interface with 20+ methods:
- getStatus, getVersion, reload
- getModules, installModule, removeModule
- listProfiles, applyProfile, validateProfile
- runDiagnostics, getHealth, getLogs
- createSnapshot, restoreSnapshot, listSnapshots

### Supporting Tools
- secubox-verify: Module signature verification
- common.sh: Shared helper functions
- Example profiles

## Technical Details

**Package**: secubox-core v0.8.0
**Dependencies**: bash, libubox, libubus, libuci, rpcd, jsonfilter
**Size**: ~85KB (source)
**Memory**: ~16MB footprint
**Files**: 16 files total

## Architecture

Native OpenWrt integration:
- procd for service management
- ubus for RPC communication
- UCI for configuration
- opkg for package management
- BusyBox-compatible scripts

## Module Discovery

Automatically discovers 22 existing SecuBox modules:
- adguardhome, auth-guardian, bandwidth-manager
- cdn-cache, client-guardian, crowdsec-dashboard
- domoticz, ksm-manager, lyrion, magicmirror
- media-flow, mqtt-bridge, netdata-dashboard
- netifyd-dashboard, network-modes, nextcloud
- secubox-hub, system-hub, traffic-shaper
- vhost-manager, wireguard-dashboard, zigbee2mqtt

## Deployment Status

✅ Tested on router (root@192.168.8.191)
✅ All core functionality verified
✅ Module discovery working (22/22)
✅ ubus API operational
✅ Health checks passing
✅ Recovery system functional

## Documentation

- README.md: Comprehensive user documentation (11KB)
- IMPLEMENTATION.md: Technical implementation details (16KB)
- Example profile: home-basic.json

## Next Phase (v0.9.0)

- LuCI WebUI integration
- Enhanced profile templating
- Module installation workflows
- Dashboard views

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-01 16:21:45 +01:00