132 lines
8.1 KiB
Markdown
132 lines
8.1 KiB
Markdown
# SecuBox TODOs (Claude Edition)
|
|
|
|
_Last updated: 2026-02-05_
|
|
|
|
## Resolved
|
|
|
|
- ~~Expose cyberpunk option inside SecuBox Settings~~ — Done: `THEME_CHOICES` now includes `cyberpunk` in `settings.js`.
|
|
- ~~Glances full system monitoring~~ — Done: LXC host bind mounts, Docker socket, fs plugin patch, hostname/OS identity (2026-02-04).
|
|
- ~~Zigbee2MQTT dongle connection~~ — Done: adapter `ezsp`→`ember`, `ZIGBEE2MQTT_DATA` env var, direct `/dev/ttyUSB0` passthrough (2026-02-04).
|
|
- ~~Metablogizer Upload Failures~~ — Done: Chunked upload to bypass uhttpd 64KB JSON limit (2026-02-04).
|
|
- ~~Chip Header Layout Migration~~ — Done: client-guardian and auth-guardian ported to `sh-page-header` + `renderHeaderChip()` (2026-02-05).
|
|
- ~~SMB/CIFS Shared Remote Directories~~ — Done: `secubox-app-smbfs` (client mount manager) + `secubox-app-ksmbd` (server for mesh sharing) (2026-02-04/05).
|
|
- ~~P2P App Store Emancipation~~ — Done: P2P package distribution, packages.js view, devstatus.js widget (2026-02-04/05).
|
|
- ~~Navigation Component~~ — Done: `SecuNav.renderTabs()` now auto-inits theme+CSS, `renderCompactTabs()` for nested modules (2026-02-05).
|
|
- ~~Monitoring UX~~ — Done: Empty-state loading animation for charts, dynamic bandwidth units in bits (Kbps/Mbps/Gbps) via `formatBits()` (2026-02-05).
|
|
|
|
## Open
|
|
|
|
1. ~~**Chip Header Layout Migration**~~ — Done (2026-02-05)
|
|
- ~~Port `sh-page-header` + `renderHeaderChip()` pattern to client-guardian and auth-guardian.~~
|
|
- ~~Both now use `sh-page-header` with chip stats.~~
|
|
|
|
2. ~~**Navigation Component**~~ — Done (2026-02-05)
|
|
- ~~Convert `SecuNav.renderTabs()` into a reusable LuCI widget (avoid duplicating `Theme.init` in each view).~~
|
|
- ~~Provide a compact variant for nested modules (e.g., CDN Cache, Network Modes).~~
|
|
|
|
3. ~~**Monitoring UX**~~ — Done (2026-02-05)
|
|
- ~~Add empty-state copy while charts warm up.~~
|
|
- ~~Display bandwidth units dynamically (Kbps/Mbps/Gbps) based on rate.~~
|
|
|
|
4. **MAC Guardian Feed Integration**
|
|
- Build and include mac-guardian IPK in bonus feed (new package from 2026-02-03, not yet in feed).
|
|
|
|
5. **Mesh Onboarding Testing**
|
|
- master-link dynamic join IPK generation needs end-to-end testing on multi-node mesh.
|
|
- P2P decentralized threat intelligence sharing needs validation with real CrowdSec alerts.
|
|
|
|
6. **WAF Auto-Ban Tuning**
|
|
- Sensitivity thresholds may need adjustment based on real traffic patterns.
|
|
- CVE detection patterns (including CVE-2025-15467) need false-positive analysis.
|
|
|
|
7. **Image Builder Validation**
|
|
- `secubox-tools/` image builder and sysupgrade scripts (added 2026-02-03) need testing on physical hardware.
|
|
|
|
8. **Docs & Tooling**
|
|
- Document deployment scripts in `README.md` (what each script copies).
|
|
- Add lint/upload pre-check (LuCI `lua -l luci.dispatcher`) to prevent syntax errors before SCP.
|
|
|
|
9. **Testing**
|
|
- Capture screenshot baselines for dark/light/cyberpunk themes.
|
|
- Automate browser cache busting (append `?v=<git sha>` to view URLs).
|
|
|
|
10. ~~**SMB/CIFS Shared Remote Directories**~~ — Done (2026-02-04/05)
|
|
- ~~`secubox-app-smbfs` for client-side mount management (`smbfsctl` CLI, UCI config, init script).~~
|
|
- ~~`secubox-app-ksmbd` for server-side mesh sharing (`ksmbdctl` CLI, pre-configured shares).~~
|
|
- ~~Integrates with Jellyfin, Lyrion media paths.~~
|
|
|
|
11. ~~**Metablogizer Upload Failures**~~ — Done (2026-02-04)
|
|
- ~~Investigate and fix failed file uploads in Metablogizer.~~
|
|
- ~~Fixed: Chunked upload to bypass uhttpd 64KB JSON limit (same pattern as Streamlit).~~
|
|
|
|
12. **SecuBox v2 Roadmap & Objectives**
|
|
- EnigmaBox integration evaluation (community vote?).
|
|
- VoIP integration (SIP/WebRTC).
|
|
- Domoticz home automation integration.
|
|
- SSMTP / mail host / MX record management.
|
|
- Reverse MWAN WireGuard peers (multi-WAN failover over mesh).
|
|
- Nextcloud self-hosted cloud storage.
|
|
- Version v2 release planning and feature prioritization.
|
|
|
|
**AI Management Layer** (ref: `SecuBox_LocalAI_Strategic_Analysis.html`):
|
|
- Phase 1 (v0.18): Upgrade LocalAI → 3.9, MCP Server, Threat Analyst agent, DNS Guard migration.
|
|
- Phase 2 (v0.19): CVE Triage + Network Anomaly agents, LocalRecall memory, AI Insights dashboard.
|
|
- Phase 3 (v1.0): Config Advisor (ANSSI prep), P2P Mesh Intelligence, Factory auto-provisioning.
|
|
- Hybrid approach: Ollama (inference) + LocalAI (orchestrator) + LocalAGI (agents) + LocalRecall (memory).
|
|
- MCP tools: crowdsec.alerts, waf.logs, dns.queries, network.flows, system.metrics, wireguard.status, uci.config.
|
|
|
|
**AI Gateway Hybrid Architecture** (ref: `SecuBox_AI_Gateway_Hybrid_Architecture.html`):
|
|
- `secubox-ai-gateway` package: LiteLLM Proxy (port 4000) + Data Classifier + MCP Server.
|
|
- Data classification: LOCAL ONLY (raw network data) / SANITIZED (IPs scrubbed) / CLOUD DIRECT (generic).
|
|
- Providers: Mistral (EU sovereign, priority 1) > Claude > GPT > Gemini > xAI (all opt-in).
|
|
- Offline resilience: Local tier always active, cloud is bonus not dependency.
|
|
- Budget cap: configurable monthly cloud spend limit via LiteLLM.
|
|
- ANSSI CSPN: Data Classifier + Mistral EU + offline mode = triple sovereignty proof.
|
|
|
|
13. ~~**Punk Exposure Multi-Domain DNS**~~ — DONE (2026-02-05)
|
|
- ~~Multi-domain DNS with P2P exposure and Tor endpoints.~~
|
|
- ~~Classical HTTPS endpoint (DNS provider API: OVH, Gandi, Cloudflare).~~
|
|
- ~~Administrable DNS provider API integration via `dnsctl`.~~
|
|
- ~~Mapped to local services, mesh-federated, locally tweakable.~~
|
|
- ~~Follows Peek / Poke / Emancipate model (see `PUNK-EXPOSURE.md`).~~
|
|
- Phase 1: `emancipate` and `revoke` CLI commands added to secubox-exposure.
|
|
- Phase 2-4: RPCD methods, API wrapper, Mesh column, Emancipate modal, CSS styles.
|
|
|
|
14. ~~**Jellyfin Post-Install**~~ — DONE (2026-02-05)
|
|
- ~~Complete startup wizard (media library configuration)~~ — 4-step modal wizard added.
|
|
- ~~README documentation~~ — Done (2026-02-04).
|
|
|
|
15. ~~**Domoticz IoT Integration & SecuBox Peering**~~ — Done (2026-02-04)
|
|
- ~~`luci-app-domoticz` created with RPCD handler, LuCI overview.~~
|
|
- ~~`domoticzctl configure-mqtt` auto-configures Mosquitto + Zigbee2MQTT bridge.~~
|
|
- ~~P2P mesh registration, HAProxy integration, backup/restore.~~
|
|
- ~~UCI config extended with mqtt/network/mesh sections.~~
|
|
|
|
16. ~~**App Store P2P Emancipation**~~ — Done (2026-02-04)
|
|
- ~~P2P package distribution via mesh peers (CGI API, RPCD, CLI).~~
|
|
- ~~`packages.js` view with LOCAL/PEER badges, fetch/install actions.~~
|
|
- ~~`devstatus.js` widget with v1.0 progress tracking.~~
|
|
- ~~`secubox-content-pkg` for Metablogizer/Streamlit IPK distribution.~~
|
|
|
|
17. **MirrorNetworking Stack** (ref: `SecuBox_MirrorNetworking_Paradigm_Reversal.html`)
|
|
- EnigmaBox paradigm reversal: zero central authority, each box is the network.
|
|
- Dual transport: WireGuard (tier 1, known peers) + Yggdrasil (tier 2, discovery/extended mesh, optional).
|
|
- New packages roadmap:
|
|
- `secubox-mirrornet` (v0.19): Core mesh orchestration, gossip protocol, peer management.
|
|
- `secubox-identity` (v0.19): did:plc generation, key rotation, trust scoring.
|
|
- `secubox-p2p-intel` (v0.19): IoC signed gossip, threat intelligence sharing.
|
|
- `luci-app-secubox-mirror` (v0.19): Dashboard for peers, trust, services, comms.
|
|
- `secubox-voip` (v1.0): Asterisk micro-PBX, SIP/SRTP direct over WireGuard mesh.
|
|
- `secubox-matrix` (v1.0): Conduit Matrix server (Rust, ~15MB RAM), federation on mesh.
|
|
- `secubox-factory` (v1.0): Auto-provisioning new box via mesh P2P.
|
|
- `yggdrasil-secubox` (v1.1+): Yggdrasil overlay + meshname DNS.
|
|
- Mirror concepts: Threat Intel sharing, AI Inference distribution, Reputation scoring, Config & Updates P2P.
|
|
- Communication: VoIP E2E (Asterisk/SRTP, no exit server), Matrix E2EE, optional mesh email.
|
|
- ANSSI CSPN: Zero central authority = verifiable sovereignty.
|
|
- Crowdfunding target: 2027.
|
|
|
|
18. **Tor Shield / opkg Bug** (deferred)
|
|
- opkg downloads fail (`wget returned 4`) when Tor Shield is active.
|
|
- Direct `wget` to full URL works — likely DNS/routing interference.
|
|
- Investigate: opkg proxy settings, Tor split-routing exclusions for package repos.
|