secubox-openwrt/package/secubox/luci-app-service-registry

SecuBox Service Registry

Unified service aggregation dashboard with automatic publishing to HAProxy (clearnet) and Tor (hidden services), including health monitoring and QR code generation.

Features

• Service Discovery - Automatically detects running services from:
  • HAProxy vhosts
  • Tor hidden services
  • Direct listening ports (netstat)
  • LXC containers
• One-Click Publishing - Publish services to clearnet and/or Tor
• Health Monitoring - Real-time DNS, certificate, and firewall status
• URL Readiness Checker - Verify domain configuration before going live
• QR Codes - Generate QR codes for easy mobile access
• Landing Page - Auto-generated static HTML with all published services

Dashboard

Health Summary Bar

Shows overall system status at a glance:

• Firewall ports 80/443 status
• HAProxy container status
• Tor daemon status
• DNS resolution count
• Certificate health count

URL Readiness Checker

Before publishing a service, verify the domain is properly configured:

1. Enter a domain in the checker (e.g., example.com)
2. Click "Check" to verify:
   • DNS Resolution - Domain resolves to expected IP
   • Firewall Ports - Ports 80 and 443 open from WAN
   • SSL Certificate - Valid certificate with expiry status
   • HAProxy - Reverse proxy container running

The checker provides actionable recommendations when issues are found.

Service Health Indicators

Each published service shows inline health badges:

Badge	Meaning
🌐	DNS resolving correctly
❌	DNS resolution failed
🔒	Certificate valid (30+ days)
⚠️	Certificate expiring soon (7-30 days)
🔴	Certificate critical (<7 days)
💀	Certificate expired
⚪	No certificate configured
🧅	Tor hidden service enabled

Publishing a Service

Quick Publish (LuCI)

1. Go to Services > Service Registry
2. Find your service in "Discovered Services"
3. Click 📤 to quick publish
4. Optionally add:
   • Domain (creates HAProxy vhost + requests ACME cert)
   • Tor hidden service

CLI Publishing

# List discovered services
secubox-registry list

# Publish with domain (clearnet)
secubox-registry publish myapp 8080 --domain app.example.com

# Publish with Tor hidden service
secubox-registry publish myapp 8080 --tor

# Publish with both
secubox-registry publish myapp 8080 --domain app.example.com --tor

# Unpublish
secubox-registry unpublish myapp

What Happens on Publish

When you publish a service with a domain:

1. Backend Created - HAProxy backend pointing to local port
2. Vhost Created - HAProxy vhost for the domain
3. Firewall Opened - Ports 80/443 opened from WAN (auto)
4. Certificate Requested - ACME certificate via Let's Encrypt
5. Landing Page Updated - Static HTML regenerated

Health Check API

Check Single Domain

ubus call luci.service-registry check_service_health '{"domain":"example.com"}'

Response:

{
  "success": true,
  "domain": "example.com",
  "dns": {
    "status": "ok",
    "resolved_ip": "203.0.113.10"
  },
  "certificate": {
    "status": "ok",
    "days_left": 45
  },
  "firewall": {
    "status": "ok",
    "http_open": true,
    "https_open": true
  },
  "haproxy": {
    "status": "running"
  }
}

Check All Services

ubus call luci.service-registry check_all_health

Response includes aggregated health for all published domains.

Troubleshooting

DNS Not Resolving

1. Verify DNS A record points to your public IP
2. Check with: nslookup example.com
3. DNS propagation can take up to 48 hours

Firewall Ports Closed

1. Check firewall rules: uci show firewall | grep HAProxy
2. Ports should open automatically on publish
3. Manual fix:

   uci add firewall rule
   uci set firewall.@rule[-1].name='HAProxy-HTTP'
   uci set firewall.@rule[-1].src='wan'
   uci set firewall.@rule[-1].dest_port='80'
   uci set firewall.@rule[-1].proto='tcp'
   uci set firewall.@rule[-1].target='ACCEPT'
   uci commit firewall
   /etc/init.d/firewall reload
   

Certificate Missing

1. Ensure domain DNS is configured correctly
2. Ensure port 80 is accessible from internet
3. Request certificate via HAProxy:

   haproxyctl cert add example.com
   

503 Service Unavailable

Common causes:

1. Backend not running - Check if the service is actually listening
2. Wrong backend port - Verify HAProxy backend configuration
3. HAProxy not running - Check container status

# Check service is listening
netstat -tln | grep :8080

# Check HAProxy status
haproxyctl status

# Check HAProxy config
haproxyctl validate

Configuration

UCI Settings

# Main settings
uci set service-registry.main.enabled='1'
uci set service-registry.main.auto_tor='0'        # Auto-create Tor on publish
uci set service-registry.main.auto_haproxy='0'    # Auto-create HAProxy on publish
uci set service-registry.main.landing_auto_regen='1'

# Provider toggles
uci set service-registry.haproxy.enabled='1'
uci set service-registry.tor.enabled='1'
uci set service-registry.direct.enabled='1'
uci set service-registry.lxc.enabled='1'

uci commit service-registry

File Locations

Path	Description
/etc/config/service-registry	UCI configuration
/www/secubox-services.html	Generated landing page
/usr/sbin/secubox-registry	CLI tool
/usr/sbin/secubox-landing-gen	Landing page generator
/usr/libexec/rpcd/luci.service-registry	RPCD backend

RPCD Methods

Method	Description
list_services	List all services from all providers
publish_service	Publish a service to HAProxy/Tor
unpublish_service	Remove service from HAProxy/Tor
check_service_health	Check DNS/cert/firewall for domain
check_all_health	Batch health check all services
generate_landing_page	Regenerate static landing page

License

MIT License - Copyright (C) 2025 CyberMind.fr