CyberMind-FR dd9594d52b docs: Update tracking files for WAF VoIP/XMPP filters and Jitsi Meet

- Added 4 new WAF categories: voip (12), xmpp (10), cve_voip (9), cve_xmpp (8)
- Self-hosted Jitsi Meet deployed at meet.gk2.secubox.in
- Full LXC container with Prosody/Jicofo/JVB/Nginx
- Webchat updated to use self-hosted Jitsi

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-19 12:08:20 +01:00

133 KiB

Raw Blame History

SecuBox UI & Theme History

Last updated: 2026-02-19

Unified Dashboard Refresh (2025-12-20)
- Dashboard received the "sh-page-header" layout, hero stats, and SecuNav top tabs.
- Introduced shared secubox/common.css design tokens.
Modules & Monitoring Modernization (2025-12-24)
- Modules view adopted the same header/tabs plus live chip counters.
- Monitoring cards switched to SVG sparkline charts with auto-refresh.
Alerts + Settings Overhaul (2025-12-27)
- Alerts page now mirrors the dashboard style, dynamic header chips, and filtering controls.
- Settings view gained the SecuNav tabs, chips, and shared design language.
Theme Synchronisation & Deployment (2025-12-28)
- All SecuBox views call Theme.init() to respect dark/light/system preferences.
- Navigation bar now darkens automatically for dark/cyberpunk themes.
- Monitoring menu entry simplified (no /overview shim) to prevent LuCI tab duplication.
Router Deployment Notes
- Use secubox-tools/deploy-secubox-dashboard.sh for view-only pushes.
- Use secubox-tools/deploy-secubox-v0.1.2.sh for RPCD/config updates.
- Always clear /tmp/luci-* after copying UI assets.
SecuBox v0.5.0-A Polish (2025-12-29)
- Monitoring and Modules views drop legacy hero/filter UIs; all tabs now use SecuNav styling.
- Help/Bonus page adopts the shared header, navbar entry, and chips.
- Alerts buttons use sh-btn components; nav + title chips inherit theme colors.
Multi-Instance Support (2026-01-20)
- CrowdSec LAPI port configuration fix for multi-instance deployments.
- Streamlit and HexoJS gain multi-instance management support.
- HAProxy enhanced with instance-specific configuration.
HexoJS Build & Publish Integration (2026-01-21)
- Added LuCI interface for Gitea-based Hexo build and publish workflows.
- Automated Git operations for static site generation.
ARM64 Toolchain Build Requirement (2026-01-27)
- Discovered SIGILL crashes on ARM64 (MochaBin) due to LSE atomics in SDK-built Go binaries.
- Documented requirement: Go/CGO packages (crowdsec, netifyd) MUST use full OpenWrt toolchain.
- SDK produces binaries with LSE atomic instructions that crash on some Cortex-A72 CPUs.
- Updated CLAUDE.md, secubox-tools/README.md with toolchain build rules.
Documentation Regeneration (2026-01-27)
- README.md updated to v0.16.0 with all 38 modules categorized.
- Added build requirement table distinguishing SDK vs toolchain builds.
- secubox-tools/README.md updated to v1.1.0 with SDK vs toolchain guidance.
Service Registry & HAProxy ACME v0.15.0 (2026-01-28)
- service-registry: Unified service aggregation dashboard with dynamic health checks, URL readiness wizard, public IP detection, and external port checks.
- haproxy: Webroot ACME mode (no HAProxy restart), async cert workflow, auto-open firewall when publishing.
- Menu reorganization: CrowdSec, Threat Monitor, Network Diagnostics, WireGuard all moved to LuCI Services menu.
- tor-shield: Exit node hostname (reverse DNS), presets with immediate activation, excluded destinations for CDN/direct, master protection switch.
- network-tweaks: AdGuard Home DNS control, CDN cache and WPAD proxy controls, cumulative impact counters for HAProxy vhosts/LXC/firewall.
- client-guardian: Safe defaults, emergency clear, and safety limits.
- metablogizer: Improved site creation and HAProxy integration.
- Portal: HTTP health checks and speedtest integration.
- CrowdSec: Dynamic LAPI port detection.
- 30 commits, 15 feat / 12 fix / 3 refactor.
App Store KISS Evolution & Dependency Cleanup (2026-01-29)
- Renamed luci-app-secubox-bonus to secubox-app-bonus (feeds-based architecture).
- Implemented KISS Evolution for app store: feeds, profiles, skills, feedback system.
- Stripped all libc/libubox/libubus/libuci dependencies from SecuBox packages.
- Added PKG_FLAGS:=nonshared to prevent automatic libc dependency injection.
P2P Hub & SecuBox Console (2026-01-30)
- secubox-p2p: Full P2P Hub with globe peer visualization, Hub Registry, Services Registry, parallel component sources, auto-self mesh, master deployment, DNS bridge, WireGuard mirror, Gitea repository creation, mesh backup, test cloning, gigogne distribution mode, and mDNS service publishing.
- secubox-console: Linux host TUI frontend with CLI tools lexical reference.
- cdn-cache: Added MITM SSL bump support for HTTPS caching.
- metablogizer: Tor hidden service integration, DNS resolution fixes, permissions fixes.
- streamlit: ZIP upload with selective tree extraction.
- crowdsec-dashboard: Extensible theming system (later removed), UCI ubus permissions.
- secubox-core: P2P Hub API and wizard-first menu.
- secubox-app-bonus: Added secubox-feed install all command.
- 40+ commits — largest single-day effort in project history.
P2P MirrorBox & Factory Dashboard (2026-01-31)
- secubox-p2p v0.6.0: MirrorBox NetMesh Catalog with DNS federation, distributed mesh services panel, WAN IP and WireGuard tunnel redundancy, mDNS service publishing, REST API for mesh visibility.
- secubox-factory: Unified dashboard with signed Merkle snapshots and HMAC-style signing for OpenWrt compatibility.
- portal: KISS redesign with service categorization.
- crowdsec-dashboard: KISS rewrite, console enrollment, CrowdSec theme integration, dynamic port/path detection.
- secubox-swiss: Unified CLI tool for SecuBox operations.
- jitsi: Jitsi Meet video conferencing integration.
- mitmproxy: HAProxy backend inspection, token auth, enhanced threat detection analytics v2.0.
- secubox-core: P2P mesh API endpoints for console discovery.
KISS UI Rewrites & DNS Guard (2026-02-01)
- streamlit: KISS UI redesign with instances management, Gitea integration, and multiple upload bug fixes.
- metablogizer: KISS UI redesign with backend status display.
- ollama: KISS UI rewrite with model suggestions and thermal monitoring.
- netdiag: Thermal monitoring integration.
- dnsguard: New DNS Guard app with provider lookup methods.
- haproxy: AdGuard Home detection, improved service discovery, reserved ports with listening verification.
- p2p: Distributed catalog with Gitea sync and health probing.
- mitmproxy: Enhanced threat patterns; moved to Security menu.
- network-tweaks: Moved to Network menu.
- crowdsec-dashboard: Nav path fixes, alerts/countries display fixes.
- wireguard-dashboard: QR code generation fix.
- exposure: Reserved ports with listening verification.
WAF Auto-Ban & Security Hardening (2026-02-02)
- waf: Sensitivity-based auto-ban system with CrowdSec integration and comprehensive CVE detection patterns (including CVE-2025-15467).
- mitmproxy: WAN protection mode for incoming traffic inspection; LAN transparent proxy disabled by default.
- simplex: SimpleX Chat self-hosted messaging servers.
- crowdsec: KISS setup simplification, CAPI enrollment status, restored working setup page.
- local-build: Added missing toolchain package shorthands and feeds path fix.
- WAF auto-ban statistics added to dashboards.
Mesh Security & MAC Guardian (2026-02-03)
- mac-guardian: New WiFi MAC security monitor with DHCP lease protection for odhcpd.
- master-link: Secure mesh onboarding with dynamic join IPK generation.
- security-threats: KISS rewrite with mesh threat intelligence, LXC mitmproxy detection.
- p2p: Decentralized threat intelligence sharing via mesh.
- tor-shield: Server mode for split-routing with public IP preservation.
- wireguard-dashboard: jshn bypass for QR code (argument size limit), peer private key persistence in UCI, server endpoint persistence.
- localai: gte-small preset, RPC expect unwrapping and chat JSON escaping fixes.
- lyrion: WAN access checkbox for firewall rules, networking fixes for device discovery.
- tools: SecuBox image builder and sysupgrade scripts.
- RPCD/LuCI frontend guidelines added to CLAUDE.md.
- KISS READMEs added for all 46 remaining packages.
New Packages & Exposure Redesign (2026-02-04)
- jellyfin: New media server package with LXC container, uninstall/update/backup, HAProxy integration, and LuCI actions.
- zigbee2mqtt: Complete rewrite from Docker to LXC Alpine container.
- device-intel: New device intelligence package with OUI emoji display (BusyBox compatibility fixes, SDK build pattern alignment).
- dns-provider: New DNS provider management package.
- exposure: KISS redesign with enriched service names, vhost integration, DNS domain sorting; toggle switch fix.
- streamlit: Chunked upload to bypass uhttpd 64KB JSON limit, UTF-8 .py file upload fix, auto-install requirements from ZIP, non-standard filename support.
- crowdsec-dashboard: Decisions list fix (wrong RPC expect key).
- RPCD: BusyBox ash local keyword compatibility fix (wrap call handlers in function).
- glances: Full host system visibility — LXC bind mounts for /rom, /overlay, /boot, /srv, Docker socket at /run/docker.sock (symlink loop fix), @exit_after fs plugin patch (multiprocessing fails in LXC), host hostname via lxc.uts.name, OpenWrt OS identity from /etc/openwrt_release, pre-generated /etc/mtab from host /proc/mounts.
- zigbee2mqtt: Direct /dev/ttyUSB0 passthrough (socat TCP bridge fails ASH protocol), adapter ezsp→ember (z2m 2.x), ZIGBEE2MQTT_DATA env var, mosquitto-nossl dependency.
- smbfs: New SMB/CIFS remote mount manager package — UCI config, smbfsctl CLI (add/remove/mount/umount/test/status), auto-mount init script, credentials storage, Jellyfin+Lyrion integration, catalog entry.
- jellyfin: KISS READMEs for both backend and LuCI packages.
- domoticz: Rewrite from Docker to LXC Debian container with native binary from GitHub releases. LuCI dashboard with IoT integration status (Mosquitto, Zigbee2MQTT, MQTT bridge), service lifecycle, HAProxy, mesh P2P, logs. domoticzctl with configure-mqtt (auto Mosquitto+Z2M bridge), configure-haproxy, backup/restore, mesh-register, uninstall. UCI extended with mqtt/network/mesh sections. Catalog updated.
- LXC cgroup2 fix: Added lxc.tty.max, lxc.pty.max, lxc.cgroup2.devices.allow for standard character devices, and lxc.seccomp.profile disable to fix terminal allocation failures on cgroup v2 systems. Applied to streamlit and domoticz.
- metablogizer: Chunked upload to bypass uhttpd 64KB JSON limit (same pattern as Streamlit). Added upload_chunk and upload_finalize RPCD methods, binary file support via ArrayBuffer read.
- p2p: P2P App Store Emancipation — decentralized package distribution across mesh peers. CGI API: /api/factory/packages (local catalog JSON), /api/factory/packages-sync (aggregated mesh catalog). RPCD: 7 new methods for peer packages, fetch, sync, feed settings. CLI: secubox-feed peers/search/fetch-peer/fetch-any/sync-peers commands. LuCI: packages.js view under MirrorBox > App Store with LOCAL/PEER badges, unified catalog, one-click fetch/install. UCI: config p2p_feed section with share_feed, auto_sync, sync_interval, prefer_local, cache_ttl.
- rustdesk: New self-hosted RustDesk relay server package — pre-built ARM64 binaries from GitHub releases (hbbs/hbbr), auto-key generation, rustdeskctl CLI with install/status/keygen/logs/configure-firewall/mesh-register.
- guacamole: New Apache Guacamole clientless remote desktop gateway — LXC Debian container with guacd + Tomcat, UCI-based connection management (SSH/VNC/RDP), guacamolectl CLI with install/add-ssh/add-vnc/add-rdp/list-connections/configure-haproxy.
- services.js: Fixed RPC expect unwrapping bug causing empty local services list.
- content-pkg: New content distribution system — secubox-content-pkg CLI packages Metablogizer sites and Streamlit apps as IPKs for P2P mesh distribution. Auto-publish hooks in metablogizerctl/streamlitctl. secubox-feed sync-content auto-installs content packages from peers. Sites get HAProxy vhosts, Streamlit apps run as service instances.
- devstatus.js: New Development Status widget under MirrorBox > Dev Status — generative/dynamic dashboard with real-time polling, Gitea commit activity (15 recent commits), repository stats, MirrorBox App Store package counts (local/peer/unique), v1.0 progress bar (0-100%) with 8 milestone categories, color-coded completion indicators.
ksmbd & UI Consistency (2026-02-05)
- ksmbd: New secubox-app-ksmbd mesh media server package — ksmbdctl CLI with enable/disable/status/add-share/remove-share/list-shares/add-user/mesh-register, UCI config with pre-configured shares (Media, Jellyfin, Lyrion, Backup), Avahi mDNS announcement, P2P mesh registration.
- client-guardian: Ported to sh-page-header chip layout with 6 status chips (Online, Approved, Quarantine, Banned, Threats, Zones).
- auth-guardian: Ported to sh-page-header chip layout with 4 status chips (Status, Sessions, Portal, Method), sessions table, quick actions card.
Navigation Component Refactoring (2026-02-05)
- secubox/nav.js: Unified navigation widget with auto-theme initialization.
  - renderTabs(active): Main SecuBox tabs with automatic Theme.init() and CSS loading.
  - renderCompactTabs(active, tabs, options): Compact variant for nested modules.
  - renderBreadcrumb(moduleName, icon): Back-navigation to SecuBox dashboard.
- Eliminated ~1000 lines of duplicate CSS from module nav files.
- Updated modules: cdn-cache, client-guardian, crowdsec-dashboard, media-flow, mqtt-bridge, system-hub.
- Views no longer need to require Theme separately or manually load CSS.
Monitoring UX Improvements (2026-02-05)
- Empty-state loading animation for charts during 5-second data collection warmup.
  - Animated "Collecting data..." overlay with pulsing dots.
  - Chart legend shows "Waiting" → "Live" transition.
  - Cyberpunk theme support for empty state styling.
- Dynamic bandwidth units via new formatBits() helper.
  - Network rates now display in bits (Kbps/Mbps/Gbps) instead of bytes.
  - Uses SI units (1000 base) for industry-standard notation.
  - Dash placeholder ("— ↓ · — ↑") before first data point.
Punk Exposure Emancipate CLI (2026-02-05)
- secubox-exposure emancipate <service> <port> <domain> [--tor] [--dns] [--mesh] [--all]
  - Unified multi-channel exposure: Tor + DNS/SSL + Mesh in single command.
  - Creates DNS A record via dnsctl, HAProxy vhost, requests certificate.
  - Publishes to mesh via secubox-p2p publish.
  - Stores emancipation state in UCI for status tracking.
- secubox-exposure revoke <service> [--tor] [--dns] [--mesh] [--all]
  - Inverse of emancipate: removes exposure from selected channels.
  - Cleans up DNS records, HAProxy vhosts, certificates, mesh publishing.
- Enhanced status command shows emancipated services with active channels.
Punk Exposure LuCI Dashboard (2026-02-05)
- RPCD handler extended with three new methods:
  - emancipate - orchestrates multi-channel exposure via CLI
  - revoke - removes exposure from selected channels
  - get_emancipated - returns list of emancipated services with channel status
- API wrapper (exposure/api.js) exports emancipate(), revoke(), getEmancipated().
- ACL updated in luci-app-exposure.json for new methods.
- Dashboard UI enhancements:
  - New Mesh column with toggle switch (blue theme)
  - Emancipate button in header with rocket emoji
  - Multi-channel modal with Tor/DNS/Mesh checkboxes
  - Mesh badge count in header stats
- CSS additions: .exp-badge-mesh, .mesh-slider, .exp-btn-action.
Jellyfin Post-Install Setup Wizard (2026-02-05)
- 4-step modal wizard for first-time Jellyfin configuration.
- RPCD methods added to luci.jellyfin:
  - get_wizard_status - checks container state and wizard completion
  - set_wizard_complete - marks wizard as finished in UCI
  - add_media_path / remove_media_path - manage media library entries
  - get_media_paths - returns configured media libraries
- Wizard auto-triggers when installed but wizard_complete=0.
- Steps: Welcome (Docker/container checks), Media (add paths), Network (domain/HAProxy), Complete.
- New CSS file jellyfin/wizard.css with step indicators and form styling.
- Makefile updated to install CSS resources.
MAC Guardian Feed Integration (2026-02-05)
- Built and added secubox-app-mac-guardian and luci-app-mac-guardian IPKs to bonus feed.
- Synced luci-app-mac-guardian to local-feed (backend was already synced).
- Updated apps-local.json catalog with proper metadata:
  - luci-app-mac-guardian: category "security", icon "wifi", description "WiFi MAC address security monitor with spoofing detection"
  - secubox-app-mac-guardian: icon "wifi", description "WiFi MAC security backend with CrowdSec integration"
- Package features: MAC spoofing detection, OUI anomaly detection, MAC floods, CrowdSec scenarios integration.
Fanzine v3 Roadmap Alignment (2026-02-06)
- Restructured TODO.md and WIP.md to align with SecuBox Fanzine v3 4-layer architecture:
  - Couche 1 — Core Mesh: 35+ modules, v0.18 priorities, testing/validation, CVE Layer 7
  - Couche 2 — AI Gateway: Data Classifier, 6 Autonomous Agents, MCP Server, provider hierarchy
  - Couche 3 — MirrorNetworking: EnigmaBox → MirrorNet, dual transport, Services Mirrors, VoIP/Matrix
  - Couche 4 — Roadmap: v0.18/v0.19/v1.0/v1.1+ milestones, certifications (ANSSI, ISO, NIS2)
- Added strategic reference to Fanzine v3 document.
- Consolidated completed items under "Resolved" section.
- Created version milestone checklists for tracking progress.
LocalAI Upgrade to v3.9.0 (2026-02-06)
- Upgraded secubox-app-localai from v2.25.0 to v3.9.0.
- New features in v3.9.0:
  - Agent Jobs Panel: Schedule and manage background agentic tasks via web UI and API
  - Memory Reclaimer: LRU eviction for loaded models, automatic VRAM cleanup
  - VibeVoice backend: New voice synthesis support
- Updated README with complete CLI reference, model presets table, API endpoints.
- Part of v0.18 AI Gateway roadmap (Couche 2).
MCP Server Implementation (2026-02-06)
- Created secubox-mcp-server package — Model Context Protocol server for AI integration.
- Protocol: JSON-RPC 2.0 over stdio, MCP version 2024-11-05.
- Core tools (9 total):
  - crowdsec.alerts, crowdsec.decisions — CrowdSec threat intelligence
  - waf.logs — WAF/mitmproxy threat events
  - dns.queries — DNS statistics from AdGuard Home/dnsmasq
  - network.flows — Network traffic summary with interface stats
  - system.metrics — CPU, memory, disk, temperature monitoring
  - wireguard.status — VPN tunnel status with peer details
  - uci.get, uci.set — OpenWrt configuration access (set disabled by default)
- AI-powered tools (5 total, require LocalAI):
  - ai.analyze_threats — AI analysis of CrowdSec alerts with recommendations
  - ai.cve_lookup — CVE vulnerability analysis with mitigation advice
  - ai.suggest_waf_rules — AI-suggested mitmproxy/WAF filter patterns
  - ai.explain_ban — Explain CrowdSec ban decisions in plain language
  - ai.security_posture — Full security assessment with scoring
- Security features:
  - UCI-based tool whitelist — only allowed tools can be invoked
  - Sensitive data blocked in uci.get (password, secret, key, token)
  - uci.set disabled by default, requires explicit enable
  - Data classification support (local_only, sanitized, cloud_direct)
- Claude Desktop integration via SSH:
```
{"mcpServers":{"secubox":{"command":"ssh","args":["root@192.168.255.1","/usr/bin/secubox-mcp"]}}}
```
- Files: secubox-mcp main server, protocol.sh JSON-RPC handler, 8 tool modules.
- Part of v0.18 AI Gateway roadmap (Couche 2).
Threat Analyst Agent Implementation (2026-02-05)
- Created secubox-threat-analyst — AI-powered autonomous threat analysis and filter generation agent.
- Architecture:
  - Collector: Gathers threats from CrowdSec, mitmproxy, netifyd DPI
  - Analyzer: LocalAI-powered intelligent analysis and pattern recognition
  - Generators: Rule creation for three targets
  - Appliers: Auto-apply or queue for approval
- Generated rule types:
  - mitmproxy: Python filter class with IP blocklist, URL patterns, User-Agent detection
  - CrowdSec: YAML scenarios for AI-detected attack patterns
  - WAF: JSON rules for SQLi, XSS, path traversal, scanner detection
- CLI commands: status, run, daemon, analyze, generate, gen-mitmproxy, gen-crowdsec, gen-waf, list-pending, approve, reject
- UCI configuration: interval, LocalAI URL/model, auto-apply per target (mitmproxy auto, CrowdSec/WAF queued), min_confidence, max_rules_per_cycle
- Created luci-app-threat-analyst — LuCI dashboard with AI chatbot.
- Dashboard features:
  - Status panel: daemon state, LocalAI connectivity, threat counts
  - AI Chat: real-time conversation with threat analyst AI
  - Pending rules: approve/reject queue for generated rules
  - Threats table: recent security events with severity badges
- RPCD methods: status, get_threats, get_alerts, get_pending, chat, analyze, generate_rules, approve_rule, reject_rule, run_cycle
- Part of v0.18 AI Gateway roadmap (Couche 2).
DNS Guard AI Migration (2026-02-06)
- Created secubox-dns-guard — AI-powered DNS anomaly detection daemon.
- Detection modules (5 total):
  - dga: Domain Generation Algorithm detection via Shannon entropy analysis (threshold 3.2)
  - tunneling: DNS tunneling/exfiltration detection (subdomain length, base64/hex patterns, TXT rate)
  - rate_anomaly: Unusual query rate detection (queries/min, unique domains/min thresholds)
  - known_bad: Known malicious domain matching against external blocklists
  - tld_anomaly: Suspicious TLD detection (xyz, top, club, etc.) and punycode/IDN homograph detection
- LocalAI integration:
  - Intelligent threat analysis and domain classification (BLOCK/MONITOR/SAFE)
  - Pattern analysis and malware family identification
  - Single domain analysis via CLI
- Approval workflow:
  - Auto-apply mode for trusted detections
  - Queue mode for human approval (configurable per confidence threshold)
  - Pending blocks approval via CLI or LuCI
- CLI commands: status, run, daemon, analyze, detect, check , stats, top-domains, top-clients, list-pending, approve/reject/approve-all
- UCI configuration: interval, LocalAI URL/model, auto_apply_blocks, min_confidence (80%), max_blocks_per_cycle, per-detector settings
- Updated luci-app-dnsguard to v1.1.0:
  - New "AI Guard" tab with daemon toggle, alert/pending/blocked counts
  - Pending blocks approval panel with approve/reject actions
  - Real-time alerts panel with type-colored badges
  - "Analyze" tab with domain checker and detection module status
  - RPCD extended with 11 new methods: guard_status, get_alerts, get_pending, approve_block, reject_block, approve_all, ai_check, get_blocklist, unblock, get_stats, toggle_guard
- Part of v0.18 AI Gateway roadmap (Couche 2).
LocalAI Multi-Channel Emancipation (2026-02-06)
- Exposed LocalAI (port 8091) via Punk Exposure system with 3 channels:
  - Tor: b7lmlfs3b55jhgqdwbn6unhjhlfflq6ch235xa2gsdvxe7toxcf7qyad.onion
  - DNS/SSL: localai.secubox.local via HAProxy with ACME certificate
  - mDNS: _secubox._tcp.local mesh advertisement via Avahi
- Command: secubox-exposure emancipate localai 8091 localai.secubox.local --all
- Documented MirrorNetworking vision for v0.19:
  - Master/slave hierarchical domain delegation (*.sb → xxx.sb)
  - Service mirroring via reverse proxy chaining
  - Gossip-based exposure config sync
  - Submastering/multimixslaving architecture
Threat Analyst KISS Dashboard v0.1.0 (2026-02-05)
- Regenerated luci-app-threat-analyst following CrowdSec dashboard KISS template pattern.
- Architectural changes:
  - api.js: Migrated from plain object to baseclass.extend() pattern
  - dashboard.css: External CSS file (loaded dynamically in view)
  - dashboard.js: View-only JS following CrowdSec pattern with view.extend()
- CVE integration:
  - System Health: New "CVE Alerts" indicator with warning icon (yellow) when CVEs detected
  - Threats table: New CVE column with hyperlinks to NVD (https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX)
  - CVE extraction: extractCVE() function in API parses CVE-YYYY-NNNNN patterns from scenarios
  - CVE row styling: Red-tinted background for CVE-related threats
- RPCD updates:
  - Status method now returns cve_alerts count from CrowdSec alerts
  - Fixed output bug (grep || echo 0 causing double output)
- CSS additions:
  - .ta-health-icon.warning for CVE alerts in health section
  - .ta-cve-link for NVD hyperlinks (red badge style)
  - .ta-cve-row for highlighted CVE threat rows
- Following LuCI UI Generation Model Template v0.1.0 for future KISS modules.
Unified Backup Manager & Custom Mail Server (2026-02-05)
- Created secubox-app-backup — unified backup system for LXC containers, UCI config, service data.
  - CLI commands: create (full/config/containers/services), list, restore, status, cleanup
  - Container ops: container list/backup/restore/backups
  - Profile ops: profile list/create/apply/share (delegates to secubox-profile)
  - Remote sync: sync --push/--pull (Gitea integration)
  - Libraries: containers.sh, config.sh, remote.sh
  - Storage structure: /srv/backups/{config,containers,services,profiles}
- Created luci-app-backup — LuCI dashboard for backup management.
  - Status panel: storage path, usage, last backup times
  - Quick actions: Full/Config/Containers backup buttons
  - Container table: name, state, size, backup count, backup button
  - Backup history: file, type, size, date (sorted by timestamp)
  - RPCD methods: status, list, container_list, create, restore, cleanup, container_backup, container_restore
- Created secubox-app-mailserver — custom Postfix + Dovecot mail server in LXC container.
  - mailctl CLI: install, start/stop/restart, status
  - User management: user add/del/list/passwd, alias add/list
  - SSL: ssl-setup (ACME DNS-01), ssl-status
  - DNS integration: dns-setup (creates MX, SPF, DMARC via dnsctl)
  - Mesh backup: mesh backup/restore/sync/add-peer/peers/enable/disable
  - Webmail integration: webmail status/configure (Roundcube container)
  - Libraries: container.sh, users.sh, mesh.sh
- Enhanced dnsctl with subdomain generation and mail DNS:
  - generate <service> [prefix] — auto-create subdomain A record with public IP
  - suggest [category] — subdomain name suggestions (web, mail, dev, media, iot, security)
  - mail-setup [host] [priority] — create MX, SPF, DMARC records
  - dkim-add [selector] <pubkey> — add DKIM TXT record
- Renamed secbx-webmail Docker container to secubox-webmail for consistency.
HAProxy/Mailserver LXC cgroup Fixes & Documentation (2026-02-06)
- Fixed HAProxy LXC container cgroup mount failure:
  - Removed lxc.mount.auto = proc:mixed sys:ro cgroup:mixed which fails on cgroup v2 hosts
  - Simplified to explicit lxc.mount.entry bind mounts only
  - Updated haproxyctl lxc_create_config() function with working config
- Fixed Docker-to-LXC mailserver connectivity:
  - Added socat TCP proxies on ports 10143/10025 in mailserver init.d script
  - Configured Dovecot with disable_plaintext_auth = no for local connections
  - Roundcube can now reach LXC mailserver via host-bridged ports
- Documentation updates:
  - Added "LXC container fails with cgroup:mixed" section to FAQ-TROUBLESHOOTING.md
  - Updated CLAUDE.md Session Startup section to include FAQ-TROUBLESHOOTING.md consultation
  - Key recommendation: avoid lxc.mount.auto entirely, use explicit bind mounts
Vortex DNS - Meshed Subdomain Delegation (2026-02-05)
- Created secubox-vortex-dns — meshed multi-dynamic subdomain delegation system.
- Modes:
  - Master: Owns wildcard domain (*.secubox.io), delegates subzones to slaves
  - Slave: Receives delegated subdomain from master (node1.secubox.io)
  - Submaster: Hierarchical delegation (master → submaster → slaves)
  - Standalone: Default mode, mesh-only participation
- CLI commands (vortexctl):
  - Master: master init <domain>, master delegate <node> <zone>, master revoke <zone>, master list-slaves
  - Slave: slave join <master> <token>, slave leave, slave status
  - Mesh: mesh sync, mesh publish <service> <domain>, mesh unpublish, mesh status
  - Submaster: submaster promote, submaster demote
  - General: status, daemon
- Mesh integration:
  - First Peek: Auto-registers new services in mesh DNS
  - Gossip-based exposure config sync via secubox-p2p
  - Published services tracked in /var/lib/vortex-dns/published.json
- DNS provider integration:
  - Uses dnsctl from secubox-app-dns-provider for programmatic DNS record management
  - Auto-creates wildcard A record on master init
  - NS/A records for zone delegation
- Created luci-app-vortex-dns — LuCI dashboard.
  - Status panel: mode badge, enabled state, sync interval, last sync time
  - Master section: wildcard domain, DNS provider, delegated slave count, zones table
  - Slave section: parent master, delegated zone
  - Mesh section: gossip state, First Peek, peer count, published services
  - Actions: Sync Mesh, Initialize as Master, Join as Slave, Delegate Zone
- RPCD methods: status, get_slaves, get_peers, get_published, master_init, delegate, revoke, slave_join, mesh_sync, mesh_publish
- Part of v0.19 MirrorNetworking roadmap (Couche 3).
Network Anomaly Detection Agent (2026-02-06)
- Created secubox-network-anomaly — AI-powered network traffic anomaly detection.
- Detection modules (5 total):
  - bandwidth_anomaly: Traffic spike detection via EMA baseline comparison
  - connection_flood: Connection count threshold monitoring
  - port_scan: Unique destination port enumeration detection
  - dns_anomaly: DNS query volume anomaly detection
  - protocol_anomaly: TCP/UDP ratio deviation (flags >50% UDP as suspicious)
- Data collection:
  - Interface bandwidth from /sys/class/net/*/statistics/
  - Connection tracking from /proc/net/nf_conntrack
  - DNS queries from dnsmasq/AdGuard logs
- CLI commands (network-anomalyctl):
  - status, run, daemon — service control
  - analyze — LocalAI-powered threat assessment
  - list-alerts, ack <id>, clear-alerts — alert management
  - baseline [reset] — EMA baseline control
- UCI configuration:
  - Thresholds: bandwidth_spike_percent (200%), new_connections_per_min (50), unique_ports_per_host (20), dns_queries_per_min (100)
  - Detection flags: per-detector enable/disable
  - LocalAI integration: url, model, min_confidence (75%)
  - Auto-block: optional CrowdSec integration
- Created luci-app-network-anomaly — LuCI dashboard.
  - Status panel: daemon state, LocalAI, alert count, connection count
  - Health checks: daemon, LocalAI, auto-block, interval, last run
  - Network stats: real-time RX/TX, connections, unique ports
  - Actions: Run Detection, AI Analysis, Reset Baseline, Clear Alerts
  - Alerts table: time, type, severity, message, ack button
- RPCD methods: status, get_alerts, get_stats, run, ack_alert, clear_alerts, reset_baseline, analyze
- Part of v0.19 AI Gateway roadmap (Couche 2).
LocalRecall AI Memory System (2026-02-06)
- Created secubox-localrecall — persistent memory for AI agents.
- Memory categories:
  - threats: Security threat patterns and detections
  - decisions: Agent decisions with outcomes (approved/rejected/auto)
  - patterns: Learned behavioral patterns
  - configs: Configuration snapshots and changes
  - conversations: AI conversation context
- Memory storage:
  - JSON-based storage in /var/lib/localrecall/memories.json
  - EMA-based importance scoring (1-10)
  - Access tracking with timestamps and counts
  - Category-based indexing
- CLI commands (localrecallctl):
  - status, add, get, search, list, recent, important
  - delete, cleanup, export, import
  - summarize, context, stats
- LocalAI integration:
  - summarize_memories() — AI-powered memory summarization
  - auto_memorize() — Extract key facts from text
  - get_agent_context() — Build context for agent tasks
  - record_decision(), record_threat() — Structured memory helpers
- UCI configuration:
  - Retention: max_memories (1000), retention_days (90)
  - Categories: enable/disable per category
  - Agents: enable/disable per agent
  - Cleanup: auto_cleanup, cleanup_hour, keep_important
- Created luci-app-localrecall — LuCI dashboard.
  - Stats: total/threats/decisions/patterns counts
  - Categories panel with icons and counts
  - Agent breakdown panel
  - Actions: AI Summary, Search, Cleanup, Export
  - Add memory form with category, importance, content
  - Recent memories table with delete
- RPCD methods: status, get_memories, search, stats, add, delete, cleanup, summarize, export, import
- Part of v0.19 AI Gateway roadmap (Couche 2).
AI Insights Dashboard (2026-02-06)
- Created luci-app-ai-insights — unified AI security insights dashboard.
- Security Posture Score:
  - 0-100 score with color-coded display (Excellent/Good/Fair/Poor/Critical)
  - Dynamic factor calculation: LocalAI status, agent online counts, CrowdSec alerts, CVE severity
  - Real-time score updates via polling
- Agent Status Grid:
  - Visual cards for 4 agents: Threat Analyst, DNS Guard, Network Anomaly, CVE Triage
  - Online/offline status with color indicators
  - Alert count badges per agent
- Aggregated Alerts:
  - Unified view of alerts from all agents
  - Source-colored badges (rule/alert/cve)
  - Relative timestamps
- Actions:
  - Run All Agents — triggers detection cycles on all agents
  - AI Analysis — LocalAI-powered security assessment with recommendations
  - View Timeline — security events from system log (24h)
  - Link to LocalRecall memory dashboard
- RPCD methods: status, get_alerts, get_posture, get_timeline, run_all, analyze
- Part of v0.19 AI Gateway roadmap (Couche 2).
MirrorNet Core Packages (2026-02-07)
- Created secubox-mirrornet — mesh orchestration core with 5 library modules.
- Identity module (identity.sh):
  - DID generation: did:plc:<16-char-fingerprint> (AT Protocol compatible)
  - HMAC-SHA256 keypair management with Ed25519 fallback
  - Key rotation with backup, identity document export/import
  - Peer identity storage and resolution
- Reputation module (reputation.sh):
  - Trust scoring (0-100) with decay and ban thresholds
  - Event logging: sync_success/failed, valid/invalid_ioc, fast/slow_response, offline/online
  - Trust levels: excellent (80+), good (60+), moderate (40+), low (20+), untrusted
  - Ban threshold (default 10), min_trust threshold (default 20)
- Mirror module (mirror.sh):
  - Service mirroring via reverse proxy chaining
  - Upstream management with priority-based failover
  - HAProxy backend configuration generation
  - Health check integration with automatic failover
- Gossip module (gossip.sh):
  - Enhanced gossip protocol with priority routing (critical > high > normal > low > background)
  - TTL-based message forwarding with configurable max_hops (default 5)
  - Deduplication with 5-minute window
  - Message types: ioc, peer_status, config_sync, service_announce, mirror_update, reputation_update
- Health module (health.sh):
  - Per-peer latency and packet loss monitoring
  - HTTP health checks with configurable endpoints
  - Anomaly detection against EMA baselines
  - Alert generation with acknowledgment workflow
- CLI (mirrorctl): 30+ commands for identity, reputation, mirror, gossip, health, daemon
- UCI configuration: roles (master/submaster/peer), gossip interval, health thresholds, mirror settings
- Created luci-app-secubox-mirror — LuCI dashboard.
  - Identity card: DID, hostname, role, version
  - Status grid: peers, messages, services, alerts
  - Peer reputation table with trust levels and reset action
  - Gossip stats: sent/received/forwarded/dropped
  - Health alerts with acknowledgment
  - Mirrored services table
- RPCD methods: status, get_identity, get_peers, get_reputation, get_health, get_mirrors, get_gossip_stats, get_alerts, reset_reputation, ack_alert, add_mirror, trigger_failover, broadcast
- Part of v0.19 MirrorNetworking roadmap (Couche 3).
SecuBox Identity Package (2026-02-07)
- Created secubox-identity — standalone DID identity management.
- Core module (core.sh):
  - DID generation: did:plc:<fingerprint> from machine-id + MAC
  - Identity document creation (DID Document format with @context)
  - Peer identity import/export
  - Identity backup and restore
- Keys module (keys.sh):
  - HMAC-SHA256 keypair generation (Ed25519 fallback if available)
  - Key rotation with configurable backup
  - Sign/verify operations
  - Key rotation check (configurable rotation_days: default 90)
- Trust module (trust.sh):
  - Peer trust scoring (0-100)
  - Trust events: valid/invalid_signature, successful/failed_exchange, verified_identity, referred_by_trusted
  - Trust levels: verified, trusted, neutral, suspicious, untrusted
  - Ban functionality
- CLI (identityctl): 25+ commands for DID, keys, peers, trust, backup
- UCI configuration: did_method, key algorithm, rotation settings, trust thresholds
P2P Intel Package (2026-02-07)
- Created secubox-p2p-intel — signed IOC sharing for mesh.
- Collector module (collector.sh):
  - Source integrations: CrowdSec, mitmproxy, WAF, DNS Guard
  - Severity classification: critical, high, medium, low
  - Scenario-based severity mapping
- Signer module (signer.sh):
  - Cryptographic signing of individual IOCs and batches
  - Batch hash verification (SHA256)
  - Identity integration for signer DID
- Validator module (validator.sh):
  - Source trust verification (min_source_trust threshold)
  - Age validation (max_age_hours: default 168)
  - Format validation (IP, domain, URL, hash)
  - Local IP whitelist protection
- Applier module (applier.sh):
  - Application methods: nftables (ipset), iptables, CrowdSec
  - Ban duration configuration (default 24h)
  - Approval workflow: auto-apply or queue for manual review
  - Pending queue management (approve/reject)
- CLI (p2p-intelctl): 20+ commands for collect, sign, share, validate, apply, approve
- UCI configuration: sources enable/disable, signing, validation settings, application method, auto-apply
- Daemon: Configurable collect_interval (default 300s), auto_collect, auto_share, auto_apply
- Part of v0.19 MirrorNetworking roadmap (Couche 3).
Config Advisor - ANSSI CSPN Compliance (2026-02-07)
- Created secubox-config-advisor — security configuration analysis and hardening tool.
- ANSSI CSPN compliance framework:
  - 7 check categories: network, firewall, authentication, encryption, services, logging, updates
  - 25+ security check rules with severity levels (critical, high, medium, low, info)
  - JSON rules database in /usr/share/config-advisor/anssi-rules.json
- Security check modules (checks.sh):
  - Network: IPv6, management access restriction, SYN flood protection
  - Firewall: default deny policy, drop invalid packets, WAN port exposure
  - Authentication: root password, SSH key auth, SSH password auth
  - Encryption: HTTPS enabled, WireGuard configured, DNS encryption
  - Services: CrowdSec running, services bound to localhost
  - Logging: syslog enabled, log rotation configured
- Risk scoring module (scoring.sh):
  - 0-100 score with severity weights (critical=40, high=25, medium=20, low=10, info=5)
  - Grade calculation (A-F) based on thresholds (90/80/70/60)
  - Risk level classification: critical, high, medium, low, minimal
  - Score history tracking and trend analysis
- ANSSI compliance module (anssi.sh):
  - Compliance rate calculation (percentage of passing rules)
  - Report generation in text, JSON, and Markdown formats
  - Category filtering and strict mode
- Remediation module (remediate.sh):
  - Auto-remediation for 7 checks: NET-002, NET-004, FW-001, FW-002, AUTH-003, CRYPT-001, LOG-002
  - Safe vs manual remediation separation
  - Dry-run mode for preview
  - LocalAI integration for AI-powered suggestions
  - Pending approvals queue
- CLI (config-advisorctl):
  - Check commands: check, check-category, results
  - Compliance commands: compliance, compliance-status, compliance-report, is-compliant
  - Scoring commands: score, score-history, score-trend, risk-summary
  - Remediation commands: remediate, remediate-dry, remediate-safe, remediate-pending, suggest
  - Daemon mode with configurable check interval
- Created luci-app-config-advisor — LuCI dashboard.
  - Dashboard: score circle, grade, risk level, compliance rate, last check time
  - Check results table with status icons
  - Score history table
  - Compliance view: summary cards, progress bar, results by category
  - Remediation view: quick actions, failed checks with apply buttons, pending approvals
  - Settings: framework selection, scoring weights, category toggles, LocalAI config
- RPCD methods: status, results, score, compliance, check, pending, history, suggest, remediate, remediate_safe, set_config
- UCI configuration: main (enabled, check_interval, auto_remediate), compliance (framework, strict_mode), scoring (passing_score, weights), categories (enable/disable), localai (url, model)
- Part of v1.0.0 certification roadmap (ANSSI CSPN compliance tooling).
Mail Server Port Fixes & Password Reset (2026-02-07)
- Fixed mail ports 587 (Submission), 465 (SMTPS), and 995 (POP3S) not listening.
- Root causes identified:
  - Postfix master.cf missing submission and smtps service entries
  - Dovecot 10-master.conf had pop3s listener commented out
  - dovecot-pop3d package not installed in Alpine LXC container
- mailctl fix-ports command:
  - Adds submission (587) service to Postfix master.cf with SASL auth
  - Adds smtps (465) service with TLS wrapper mode
  - Installs dovecot-pop3d if missing
  - Uncomments pop3/pop3s listeners in Dovecot 10-master.conf
  - Enables SSL on pop3s (995) and imaps (993) listeners
  - Restarts Postfix and Dovecot to apply changes
- LuCI password reset feature:
  - Added "Reset Password" button in mail users table
  - Modal dialog with password and confirmation fields
  - RPCD user_passwd method with stdin JSON fallback
  - callUserPasswd RPC declaration in overview.js
- LuCI Fix Ports button:
  - Added to Quick Actions section
  - RPCD fix_ports method wrapping CLI command
  - Visual feedback with modal spinner
- Updated container.sh to include dovecot-pop3d in initial package list.
MetaBlogizer KISS ULTIME MODE (2026-02-07)
- Added metablogizerctl emancipate <name> — one-command full exposure workflow.
- Workflow steps (automated in sequence):
  - DNS Registration: Creates A record via dnsctl (Gandi/OVH based on availability)
  - Vortex Mesh: Publishes to mesh via vortexctl mesh publish
  - HAProxy: Creates backend, server, and vhost with SSL/ACME enabled
  - SSL Certificate: Requests ACME cert via haproxyctl cert add (webroot mode)
  - Zero-downtime Reload: Applies HAProxy config via SIGUSR2
- Helper functions:
  - _emancipate_dns(): Public IP detection, subdomain extraction, dnsctl integration
  - _emancipate_vortex(): Mesh publication if vortex-dns enabled
  - _emancipate_haproxy(): UCI backend/server/vhost creation, haproxyctl generate
  - _emancipate_ssl(): ACME certificate request with status feedback
  - _emancipate_reload(): Graceful HAProxy reload with restart fallback
- Usage: metablogizerctl create myblog blog.example.com && metablogizerctl emancipate myblog
- Tracking: Stores emancipated=1 and emancipated_at timestamp in UCI
- Part of Punk Exposure architecture (multi-channel emancipation).
LED Heartbeat & Vortex Dashboard Services (2026-02-06)
- Added LED heartbeat to secubox-core daemon for MochaBin RGB LEDs (led1).
- LED status indicators:
  - Green flash: System healthy
  - Double red flash: Warning state (services down, high resource usage)
  - Long red flash: Error state
  - Blue flash: Boot/startup
- Configuration:
  - uci set secubox.main.led_heartbeat='1' (enabled by default)
  - uci set secubox.main.watchdog_interval='60' (pulse every 60s)
- LED auto-detection: Only activates if /sys/class/leds/green:led1 exists.
- Vortex DNS dashboard enhancement:
  - Added "Node Services" section showing published services
  - Displays domain links and vortex node URLs
  - Deduplicated service list with clickable links
- Bumped secubox-core version to 0.10.0-r12.
4-LED Status Dashboard (2026-02-06)
- Enhanced secubox-core with dedicated 4-LED status dashboard for MochaBin.
- LED assignments:
  - led1 (RGB): Global health status — green (healthy), yellow (warning), red (critical)
  - led2 (RGB): Security threat level — green (safe), blue (activity), red (threats)
  - led3 (RGB): Global capacity meter — color varies by CPU + network combined load
  - mmc0: Classic heartbeat — steady when stable, rapid blink on state changes
- Fast reactive loop: 1.5-second heartbeat interval (down from 60s)
- Health scoring: Combines services status, memory, disk usage
- Threat detection: CrowdSec alerts + mitmproxy threat events
- Capacity monitoring: Real-time CPU load + network throughput from /proc
- Bumped secubox-core version to 0.10.0-r14.
File Integrity Monitoring (2026-02-06)
- Created secubox-integrity — SHA256-based file integrity monitor.
- Monitored files:
  - /srv/haproxy/config/haproxy.cfg
  - /etc/config/haproxy, /etc/config/firewall, /etc/config/network
  - /etc/config/wireless, /etc/config/dropbear
  - /etc/passwd, /etc/shadow
- CLI commands: init, check, status, clear
- Cron integration: Runs every 5 minutes via /etc/cron.d/secubox-integrity
- LED alert: Triggers LED event pulse on file changes
- Logging: System log and /var/log/secubox/integrity.log
- Added to secubox-core Makefile with install rules.
Custom Error Pages (2026-02-06)
- Created "End of the Internet" custom error page for HAProxy backend failures.
- Error pages generated: 502, 503, 504 HTTP responses
- Design: Full-page artistic "End of the Internet" message
- Location: /srv/haproxy/errors/{502,503,504}.http
- Integration: HAProxy serves custom pages for backend errors
CrowdSec Dashboard Cache & Control Panel Fixes (2026-02-06)
- CrowdSec Overview Collector v4: Created /usr/sbin/secubox-crowdsec-collector for background stats collection.
  - Generates comprehensive JSON cache at /tmp/secubox/crowdsec-overview.json
  - Collects: service status, decisions (local + CAPI), alerts, bouncers, scenarios, GeoIP, LAPI/CAPI status
  - WAF stats: autoban status, sensitivity, bans today, threats today
  - Countries breakdown from alerts (top 10)
  - Uses jshn for valid JSON generation with subshell-safe array collection
  - Atomic writes with temp file + mv pattern
  - Cron entry: runs every minute
- RPCD Fast Path: Patched luci.crowdsec-dashboard to read from cache first.
  - Cache freshness check (5 minute TTL)
  - Falls back to original slow cscli calls if cache stale/missing
- mitmproxy Local IP "Green Known": Patched /data/addons/secubox_analytics.py in mitmproxy container.
  - Skip threat logging for trusted local IPs (192.168.x.x, 10.x.x.x, 172.16-18.x.x, 127.x.x.x)
  - Local network traffic no longer pollutes threats.log
  - Autoban still correctly targets only external IPs
- Control Panel File Compatibility: Fixed file naming mismatch.
  - Control Panel expected: health.json, crowdsec.json, mitmproxy.json
  - Collectors created: health-status.json, crowdsec-stats.json, mitmproxy-stats.json
  - Created symlinks for compatibility
  - Created missing files: threat.json, netifyd.json with proper structure
  - Updated stats collector to maintain symlinks on each run
Local Mesh Domain Configuration (2026-02-07)
- Configured .sblocal as local mesh domain suffix for internal service discovery.
- DNS setup: Added to dnsmasq local zones
- Host entries: c3box.sblocal, evolution.sblocal, gk2.sblocal, gitea.sblocal, bazi.sblocal
- HAProxy vhosts: HTTP vhosts for sblocal domains (no SSL, internal only)
- Purpose: Local network service discovery without external DNS dependency
- Enables LAN clients to access services via <service>.sblocal
Evolution Streamlit Local Mirror (2026-02-07)
- Migrated Evolution dashboard from GitHub to local Gitea mirror.
- Source change: raw.githubusercontent.com → localhost:3001/gandalf/secubox-openwrt
- Benefits: Instant loading, no external dependency, works offline
- Cache TTL: Reduced from 5 minutes to 1 minute for faster updates
- Gitea raw URL format: /raw/branch/master/<path>
LXC Container Stability & HAProxy Recovery (2026-02-07)
- Root cause identified: cgroup v2 incompatibility with lxc.mount.auto = cgroup:mixed
- Fix applied to ALL containers: Removed cgroup:mixed, added cgroup v2 device permissions
- HAProxy fix: Added lxc.mount.auto = proc:mixed sys:ro for /proc mount
- Containers fixed: haproxy, streamlit, gitea, domoticz, glances, hexojs, lyrion, magicmirror2, mailserver, mitmproxy, picobrew, zigbee2mqtt
- HAProxy config regeneration: Config was truncated to global/defaults only — regenerated full config with frontends/backends
- Streamlit apps restored: Added secubox_control:8511 to instances.conf, all 9 apps running
- Services confirmed operational:
  - HAProxy: RUNNING with full SSL termination
  - Streamlit: 9 apps on ports 8501-8511
  - Gitea: RUNNING
  - CrowdSec: RUNNING
  - DNS (named): RUNNING
- External URLs verified: gk2.secubox.in, evolution.gk2.secubox.in, control.gk2.secubox.in all returning HTTP 200
Mailserver Postfix/Dovecot Maildir Path Alignment (2026-02-07)
- Fixed emails delivered but invisible in Roundcube webmail.
- Root cause: Path mismatch between Postfix delivery and Dovecot mail_location.
  - Postfix delivered to: /home/vmail/$domain/$user/new/
  - Dovecot expected: /home/vmail/$domain/$user/Maildir/new/
- container.sh fixes:
  - Changed mount point from var/mail to home/vmail
  - Changed virtual_mailbox_base from /var/mail to /home/vmail
  - Changed vmail user home from /var/mail to /home/vmail
- users.sh fixes:
  - Create $domain/$user/Maildir/{cur,new,tmp} structure (was $domain/$user/{cur,new,tmp})
  - Updated vmailbox entries to use $domain/$user/Maildir/ suffix
- Bumped secubox-app-mailserver version to 1.0.0-r2.
- New mail verified delivering correctly to Maildir location.
LED Fix & Double-Buffer Status Cache (2026-02-07)
- LED mmc0 removed: The 4th LED (mmc0) was causing the heartbeat loop to hang.
  - Removed LED_MMC0 variable, led_mmc0_heartbeat() function, and mmc0 calls from loop
  - Now only 3 RGB LEDs controlled: led1 (health), led2 (threat), led3 (capacity)
- Double-buffer status caching: Prevents blocking when multiple dashboards/APIs call status functions.
  - New status_collector_loop() runs in background, updates cache files atomically
  - Cache files: /tmp/secubox/{health,threat,capacity}.json with staggered intervals (15s/9s/3s)
  - Fast readers get_health_score(), get_threat_level(), get_capacity() — no subprocess calls
  - LED loop and dashboards/APIs now read from cache instantly
  - Uses atomic mv pattern for consistent reads during writes
- Daemon starts status collector before LED loop for cache warmup.
Triple-Pulse LED Heartbeat & Streamlit Emancipate (2026-02-06)
- Triple-pulse LED heartbeat: Organic "bump-bump-bump (pause)" pattern across RGB LEDs.
  - LED1 (health) leads, LED2 (threat) follows décalé, LED3 (capacity) trails
  - BusyBox-compatible: no fractional sleep, uses rapid burst + 3s rest
  - Intensity transitions (30-100%) create smooth cascade effect
- Avahi-publish fix: Prevent duplicate processes via PID file tracking.
- Streamlit emancipate command: KISS ULTIME MODE for full exposure workflow.
  - DNS A record (Gandi/OVH via dnsctl)
  - Vortex DNS mesh publication
  - HAProxy vhost with SSL + backend creation
  - ACME certificate request
  - Zero-downtime reload
  - Usage: streamlitctl emancipate <app> [domain]
- Evolution dashboard real-time upgrade:
  - Auto-refresh with configurable intervals (30s/1m/2m/5m)
  - Real-time system metrics from double-buffer cache
  - Live console with debug level emojis (🔴🟠🟢🔵🟣)
  - Multiple log sources: SecuBox, Kernel, CrowdSec, System
- SecuBox Console app (secubox_console.py):
  - Dedicated real-time console with 5s auto-refresh
  - Cyberpunk theme with metric cards
  - Live at: https://console.gk2.secubox.in/
- Commits: 301dccec, a47ae965, 22caf0c9, aab58a2b, 7b77f839
Vortex DNS Firewall Phase 1 (2026-02-11)
- Created secubox-vortex-firewall package — DNS-level threat blocking with ×47 multiplier.
- Threat intel aggregator downloading from 3 feeds:
  - URLhaus (abuse.ch) — ~500 malware domains
  - OpenPhish — ~266 phishing domains
  - Malware Domains — additional malware list
- SQLite-based blocklist database with domain deduplication.
- dnsmasq integration via sinkhole hosts file (/etc/dnsmasq.d/vortex-firewall.conf).
- ×47 vitality multiplier concept: each DNS block prevents ~47 malicious connections (C2 beacon rate × infection window).
- CLI tool (vortex-firewall): intel update/status/search/add/remove, stats, start/stop/status.
- RPCD handler with 8 methods: status, get_stats, get_feeds, get_blocked, search, update_feeds, block_domain, unblock_domain.
- Fixed subshell issue with pipe | while by using temp files for jshn output.
- Tested with 765 blocked domains across 3 threat feeds.
Streamlit LuCI Dashboard Edit & Emancipate (2026-02-06)
- Added Edit button to Streamlit Apps table for editing app source code:
  - RPCD methods: get_source, save_source with base64 encoding
  - Modal code editor with syntax highlighting (monospace textarea)
  - Backup creation before save
- Added Emancipate button for KISS ULTIME MODE exposure:
  - RPCD methods: emancipate, get_emancipation
  - Multi-channel modal showing DNS + Vortex + HAProxy + SSL workflow
  - Pre-check for existing instance (requires port for exposure)
  - Tracks emancipation status in UCI
- Updated streamlit/api.js with 4 new API methods
- Updated ACL permissions in luci-app-streamlit.json
Fabricator Embedder & Service Profile Watchdog (2026-02-06)
- Fabricator Embedder Tab: Added 7th tab "🪟 Embedder" for creating unified portal pages.
  - Embeds Streamlit apps, MetaBlogizer sites, and custom URLs in single page
  - Three layouts: Grid (iframe grid), Tabs (tab-switching), Sidebar (navigation panel)
  - Auto-fetches available services from JSON endpoints
  - Deploys HTML portal to /www
- Service Profile Snapshot (/usr/sbin/secubox-profile-snapshot):
  - snapshot: Captures current enabled/running services to UCI config
  - check: Returns JSON status comparing current vs expected
  - watchdog: Attempts to restart failed services
  - list: Displays profile with current status
  - Monitors: Core services (5), LXC containers (3), Streamlit apps (11), MetaBlogizer sites (14)
- Heartbeat Status (/usr/sbin/secubox-heartbeat-status):
  - Returns JSON health score (0-100) with level (healthy/warning/critical)
  - Resource metrics: CPU load, memory %, disk %
  - Service counts: up/down
  - Exported to /tmp/secubox/heartbeat.json and /www/heartbeat.json
- Cron Integration:
  - Watchdog runs every 5 minutes to auto-restart failed services
  - Heartbeat updates every minute for LED/dashboard status
- Fabricator Emancipation: Published at https://fabric.gk2.secubox.in
SecuBox Vhost Manager (2026-02-06)
- Created secubox-vhost CLI for subdomain management in secubox-core:
  - Manages external (*.gk2.secubox.in) and local (*.gk2.sb.local) domains
  - Commands: init, set-domain, list, enable, disable, add, sync, landing, dnsmasq
  - Generates dnsmasq config for local wildcard resolution
  - Creates HAProxy vhosts for both external and local domains
  - Generates default landing page at /www/secubox-landing.html
- Added UCI config section for domain and vhost management:
  - config domain 'external' - base domain, wildcard settings
  - config domain 'local' - local domain suffix (default: sb.local)
  - config vhost sections for: console, control, metrics, crowdsec, factory, glances, play
- Integrated into secubox-core daemon startup (vhost init after 5s delay)
- Added to uci-defaults for firstboot initialization
- Updated Makefile to install secubox-vhost script
HAProxy "End of Internet" Default Page & http-request Support (2026-02-07)
- End of Internet Page (/www/end-of-internet.html):
  - Cyberpunk-style fallback page for unknown/unmatched domains
  - Animated matrix rain effect, glitch text, ASCII art logo
  - Real-time packet counter animation
  - Displays "REALITY NOT FOUND" error for unregistered domains
  - Fetches live stats from /secubox-status.json if available
- HAProxy Generator Enhancements (haproxyctl):
  - Added http-request UCI option support for backends
  - Supports both single value and list of http-request directives
  - Static backends (http-request return) skip server config
  - Path-rewriting backends (http-request set-path) include servers
  - Backend validation: rejects IP:port format in backend names
- Default Backend Configuration:
  - Set end_of_internet as default_backend for both HTTP and HTTPS frontends
  - Uses http-request set-path to serve /end-of-internet.html via uhttpd
  - Deployed page to /srv/haproxy for container access
- Commits: e25509cb (backend validation), this session (http-request support)
CrowdSec Dashboard Threat Origins Fix (2026-02-07)
- Fixed [object Object] display bug in Threat Origins widget
- parseCountries() now correctly handles countries as array of objects
- Data format: [{country: "US", count: 67}, ...] vs plain {US: 67}
- Commit: 58b6dc1d
Stats Evolution & Fabricator (2026-02-07)
- Silenced CrowdSec kernel log spam (deny_log=0 in bouncer config)
- Added metablogizer-json to cron for blog site status updates
- Created Widget Fabricator Streamlit app (port 8520): Collectors, Apps, Blogs, Services, Widgets
- Added bot whitelist to mitmproxy WAF (Facebook, Google, Bing, etc.) to prevent false positive SSRF alerts
- Fixed Streamlit ZIP upload with extract_zip_flatten() for nested root directories
- Emancipated yijing-360 and fabricator apps with DNS + SSL
- Fabricator Live Data Update: All pages now use actual UCI configs and JSON cache files
  - Collectors: shows real scripts, JSON cache with run/view buttons
  - Apps: live UCI streamlit instances with test/restart/open
  - Blogs: reads metablogizer sites from UCI with test/rebuild/expose
  - Services: real HAProxy vhosts/backends from UCI
  - Widgets: reads /tmp/secubox/*.json with live stats display
- Commit: bfd2ed7c
La Livrée d'Hermès Gallery (2026-02-07)
- Deployed lldh.gk2.secubox.in with full 82-image gallery
- Added YouTube background music embed with autoplay/loop
- Toggle button (🎵) for mute/unmute control
- Multi-domain SSL: added lldh.ganimed.fr (OVH DNS) as secondary domain
- Both domains share same backend (metablog_lldh on port 8914)
Stats Evolution Plan Complete (2026-02-07)
- Phase 1: Stats infrastructure with 17 JSON cache files, cron collectors
- Phase 2: Landing page JSON symlinks for gk2.secubox.in access
- Phase 3: Widget Fabricator with live UCI/JSON data on all pages
- Phase 4: Full integration - Fabricator in landing page instances
- All JSON endpoints verified: streamlit-instances, metablogizer-sites, secubox-status, heartbeat
yijing360 Deployment (2026-02-07)
- Fixed port conflict: console (8515), yijing360 (8521)
- Deployed yijing-360.zip with generator.py
- Emancipated: yijing360.gk2.secubox.in with SSL
HAProxy Multi-Certificate SNI Fix (2026-02-07)
- Fixed multi-domain SSL certificate handling using crt-list instead of directory mode
- Added generate_certs_list() function in haproxyctl to create certs.list from .pem files
- Updated haproxy-sync-certs to regenerate certs.list after syncing ACME certs
- HTTPS frontend now uses crt-list /opt/haproxy/certs/certs.list for reliable SNI matching
- Each certificate's SANs and CN are extracted to create explicit domain-to-cert mappings
- Fallback to directory mode if certs.list doesn't exist (backwards compatible)
HAProxy Backend IP Fix (2026-02-07)
- Fixed localhost (127.0.0.1) usage in HAProxy backends - must use 192.168.255.1 (host bridge IP)
- HAProxy runs in LXC container, cannot reach host services via 127.0.0.1
- Added auto-conversion in RPCD handler: 127.0.0.1/localhost → 192.168.255.1
- Fixed CLI tools: secubox-exposure, jellyfinctl, jitsctl, simplexctl, secubox-subdomain
- Fixed Fabricator Streamlit Services page backend creation
- Fixed HAProxy config templates for jitsi
Station Cloner/Deployer Implementation (2026-02-08)
- Created secubox-tools/secubox-clone-station.sh — host-side cloning orchestrator for dual USB serial.
  - Commands: detect, pull, flash, verify, clone (full workflow), console, uboot, env-backup
  - Integrates with MOKATOOL (mochabin_tool.py) for serial console automation
  - Uses ASU API (firmware-selector.openwrt.org) for building clone images
  - TFTP serving for network boot with auto-generated U-Boot commands
- Created secubox-core/root/usr/sbin/secubox-cloner — on-device clone manager CLI.
  - Commands: build, serve, token, status, list, export
  - Builds ext4 images for same device type (required for partition resize)
  - Generates clone provision scripts for TFTP download
  - Integrates with master-link for mesh join tokens
- Created secubox-core/root/etc/uci-defaults/50-secubox-clone-provision — first-boot provisioning.
  - Step 1: Resize root partition to full disk (parted + resize2fs)
  - Step 2: Discover master via mDNS or network scan
  - Step 3: Configure as mesh peer (master-link UCI)
  - Step 4: Join mesh with token or request approval
- Enhanced secubox-master-link:
  - Added ml_clone_token_generate() for auto-approve clone tokens (24h TTL)
  - Added ml_token_is_auto_approve() for token type detection
  - Updated ml_join_request() to auto-approve clone tokens
  - New CLI commands: clone-token, register-token
- Updated secubox CLI:
  - Added secubox clone command group (build, serve, token, status, list, export)
  - Added secubox master-link command group (status, peers, token, clone-token, join, approve, pending)
- Clone workflow:
  1. Master: secubox clone build && secubox clone serve --start
  2. Host: ./secubox-clone-station.sh clone (detects, pulls, flashes target)
  3. Target boots, resizes root, auto-joins mesh with pre-approved token
- Part of v0.19 mesh deployment automation.
Evolution Dashboard Real-Time Commits (2026-02-08)
- Enhanced secubox-app-streamlit-evolution with live GitHub commits display.
- New "🚀 Devel" tab (first tab) showing real-time development activity:
  - Commits Today / This Week / Contributors / Stars metrics
  - Commit type distribution (feat/fix/docs/refactor/chore)
  - Recent commits list with:
    - Short hash (7 chars) with link to GitHub
    - Commit message (80 char truncated)
    - Author name
    - Relative time (e.g., "2h ago", "just now")
  - Commit type color-coding (green=feat, red=fix, orange=docs, purple=refactor)
  - Repository stats (forks, watchers, open issues)
- GitHub API integration:
  - fetch_commits(limit=30) with 1-minute cache TTL for near real-time updates
  - fetch_repo_info() for repository statistics
  - parse_commit_type() for conventional commit parsing
  - format_time_ago() for human-readable timestamps
  - get_commit_stats() for daily/weekly aggregation
- Cyberpunk theme styling for commits (matching existing dashboard theme)
- Live indicator animation (pulsing green dot)
SecuBox Metrics Dashboard (2026-02-09)
- Added new SecuBox Metrics view under Status menu.
- Features web traffic country statistics panel.
- Integrated with luci.secubox-security-threats RPCD backend.
- Visit stats include: requests by country, by host, by type, bots vs humans.
- Tag: v0.19.14
CrowdSec Dashboard Decision Count Fix (2026-02-09)
- Fixed Active Bans showing 0 when 100+ decisions existed.
- Root cause: --no-api flag returned empty, jsonfilter couldn't count arrays.
- Fix: Use cscli decisions list -o json | jq 'length' with grep fallback.
- Tag: v0.19.15
Active Sessions Panel (2026-02-10)
- Added active sessions panel to SecuBox Metrics.
- Tracks: Tor circuits, HTTPS visitors, Streamlit sessions, Mitmproxy connections, SSH sessions.
- New RPCD method get_active_sessions in dashboard.sh.
- Uses netstat/who for session counting.
- Tag: v0.19.15
Live Real-Time Metrics Dashboard (2026-02-10)
- Rewrote secubox-metrics.js for continuous live updates.
- 3-second polling interval with poll.add().
- Data-attributes for efficient DOM targeting (no page rebuilds).
- CSS pulse animation on value changes.
- Live indicator with timestamp display.
- Efficient updateValue/updateBar/updateList methods.
- Tag: v0.19.16
Cloning Station LuCI Dashboard (2026-02-11)
- Created luci-app-cloner package for station cloning management.
- Dashboard shows: device type, TFTP status, image info, tokens, clones.
- Quick actions: Build Image, Start/Stop TFTP, New Token, Auto-Approve Token.
- Clone images table with TFTP-ready status.
- Token management with create/delete functionality.
- U-Boot flash commands display when TFTP is running.
- RPCD handler with 10 methods for status, images, tokens, clones.
- Tag: v0.19.20
System Hub KISS Rewrite (2026-02-11)
- Rewrote luci-app-system-hub/overview.js to KISS style.
- Self-contained inline CSS, no external dependencies.
- 6 status cards: Hostname/Model, Uptime, Services, CPU Load, Temperature, Health Score.
- 3 resource bars: Memory, Storage, CPU Usage with color-coded progress.
- Quick Actions panel: System Settings, Reboot, Backup/Flash.
- Services table showing top 10 with running/stopped badges.
- 5-second live polling with efficient data-stat DOM updates.
- Full dark mode support via prefers-color-scheme media query.
- Uses luci.system-hub RPC: status, get_health, list_services.
SecuBox Dashboard KISS Rewrite (2026-02-11)
- Rewrote luci-app-secubox/dashboard.js to KISS style.
- Removed all external dependencies (secubox/api, secubox-theme, secubox/nav, secubox-portal/header).
- Self-contained with inline CSS and direct RPC calls.
- Header with status chips: Version, Modules, Running, Alerts, Health Score.
- Stats cards: Total Modules, Installed, Active, Health Score, Alerts.
- System Health panel with 4 metric bars: CPU, Memory, Storage, Network.
- Public IPs panel with IPv4/IPv6 display.
- Modules table with top 8 modules, status badges, version info.
- Quick Actions: Restart Services, Update Packages, View Logs, Export Config.
- Alert Timeline with severity-colored items.
- 15-second live polling for health, alerts, IPs.
- Full dark mode support.
IoT Guard Implementation (2026-02-11)
- Created secubox-iot-guard package — IoT device isolation, classification, and security monitoring.
- Device Classification:
  - OUI-based classification with 100+ IoT manufacturer prefixes
  - 10 device classes: camera, thermostat, lighting, plug, assistant, media, lock, sensor, diy, mixed
  - Traffic-based classification from cloud dependency tracking
  - Hostname-based classification fallback
- Risk Scoring:
  - 0-100 risk score with vendor risk, anomaly penalty, cloud dependency penalty
  - Risk levels: low (20), medium (50), high (80)
  - Auto-isolation threshold configurable (default 80)
- Anomaly Detection:
  - Bandwidth spike detection (Nx above baseline)
  - New destination tracking
  - Port scan behavior detection
  - Time-based anomaly (unusual activity hours)
- Integration Points:
  - Client Guardian: Zone assignment (IoT zone)
  - MAC Guardian: L2 blocking/trust
  - Vortex Firewall: DNS filtering for IoT malware feeds
  - Bandwidth Manager: Rate limiting
- CLI (iot-guardctl): status, list, show, scan, isolate, trust, block, anomalies, cloud-map, daemon
- UCI Configuration: main settings, zone policy, vendor rules, allowlist, blocklist
- Baseline Profiles: JSON profiles for camera, thermostat, plug, assistant device classes
- Created luci-app-iot-guard — LuCI dashboard with KISS-style views.
- Dashboard Views:
  - Overview: Security score, device counts, risk distribution, anomaly timeline
  - Devices: Filterable table with device details, isolate/trust/block actions
  - Policies: Vendor classification rules management
  - Settings: UCI form for configuration
- RPCD Handler: 11 methods (status, get_devices, get_device, get_anomalies, scan, isolate/trust/block_device, get_vendor_rules, add/delete_vendor_rule, get_cloud_map)
- ACL: Public access for status and device list via unauthenticated group
InterceptoR "Gandalf Proxy" Implementation (2026-02-11)
- Created luci-app-interceptor — unified dashboard for 5-pillar transparent traffic interception.
- Dashboard Features:
  - Health Score (0-100%) with color-coded display
  - 5 Pillar Status Cards: WPAD Redirector, MITM Proxy, CDN Cache, Cookie Tracker, API Failover
  - Per-pillar stats: threats, connections, hit ratio, trackers, stale serves
  - Quick links to individual module dashboards
- RPCD Handler (luci.interceptor):
  - status: Aggregates status from all 5 pillars
  - getPillarStatus: Individual pillar details
  - Health score calculation: 20 points per active pillar
  - Checks: WPAD PAC file, mitmproxy LXC, Squid process, Cookie Tracker UCI, API Failover UCI
- Created secubox-cookie-tracker package — Cookie classification database + mitmproxy addon.
  - SQLite database (/var/lib/cookie-tracker/cookies.db): domain, name, category, seen times, blocked status
  - Categories: essential, functional, analytics, advertising, tracking
  - mitmproxy addon (mitmproxy-addon.py): Real-time cookie extraction from Set-Cookie headers
  - Known trackers (known-trackers.tsv): 100+ tracker domains (Google Analytics, Facebook, DoubleClick, etc.)
  - CLI (cookie-trackerctl): status, list, classify, block, report --json
  - Init script: procd service with SQLite database initialization
- Enhanced luci-app-network-tweaks with WPAD safety net:
  - Added setWpadEnforce/getWpadEnforce RPCD methods
  - Added setup_wpad_enforce() iptables function for non-compliant clients
  - Redirect TCP 80/443 to Squid proxy for WPAD-ignoring clients
- Enhanced luci-app-cdn-cache with API failover config:
  - Added api_failover UCI section: stale_if_error, offline_mode, collapsed_forwarding
  - Modified init.d to generate API failover Squid config (refresh_pattern with stale-if-error)
  - Created /etc/hotplug.d/iface/99-cdn-offline for WAN up/down detection
  - Automatic offline mode on WAN down, disable on WAN up
- Configured .sblocal mesh domain via BIND zone file:
  - Created /etc/bind/zones/sblocal.zone for internal service discovery
  - Added c3box.sblocal A record pointing to 192.168.255.1
- Part of InterceptoR transparent proxy architecture (Peek/Poke/Emancipate model).
3-Tier Stats Persistence & Evolution (2026-02-11)
- Created secubox-stats-persist — 3-tier caching for never-trashed stats.
- 3-Tier Cache Architecture:
  - Tier 1: RAM cache (/tmp/secubox/*.json) — 3-30 second updates
  - Tier 2: Volatile buffer — atomic writes with tmp+mv pattern
  - Tier 3: Persistent storage (/srv/secubox/stats/) — survives reboot
- Time-Series Evolution:
  - Hourly snapshots (24h retention) per collector
  - Daily aggregates (30d retention) with min/max/avg
  - Combined timeline JSON with all collectors
- Heartbeat Line:
  - Real-time 60-sample buffer (3min window)
  - Combined "influence" score: (health×40 + inv_threat×30 + inv_capacity×30)/100
  - Updated every 3 seconds via daemon loop
- Evolution View:
  - 48-hour combined metrics graph
  - Health, Threat, Capacity, and Influence scores per hour
  - JSON output for dashboard sparklines
- Boot Recovery:
  - On daemon start, recovers cache from persistent storage
  - Ensures stats continuity across reboots
- RPCD Methods:
  - get_timeline: 24h evolution for all collectors
  - get_evolution: Combined influence score timeline
  - get_heartbeat_line: Real-time 3min buffer
  - get_stats_status: Persistence status and current values
  - get_history: Historical data for specific collector
  - get_collector_cache: Current cache value for collector
- Cron Jobs:
  - Every 5min: Persist cache to /srv (backup)
  - Every hour: Generate timeline and evolution
  - Daily: Aggregate hourly to daily, cleanup old data
- Integrated into secubox-core daemon startup (r16).
- Bumped secubox-core version to 0.10.0-r16.
InterceptoR Services Dashboard (2026-02-11)
- Created luci.services-registry RPCD handler with 4 methods:
  - getServices: All init.d services with enable/running status
  - getPublished: HAProxy vhosts and Tor onion URLs
  - getMetrics: System metrics (uptime, load, memory, CrowdSec stats)
  - getAll: Combined aggregation of all service data
- Created services.js KISS-style dashboard with 5 tabs:
  - Published: HAProxy vhosts, Tor onions with live URLs
  - Proxies: mitmproxy instances with web UI links
  - Services: Running daemons with enable/running badges
  - Dashboards: LuCI app links for navigation
  - Metrics: System health, CrowdSec alerts/bans
- Service emoji registry for visual identification (30+ mappings)
- 10-second live polling via poll.add()
- Fixed kiss-theme.js singleton pattern (baseclass.singleton(KissThemeClass))
- Updated ACL with luci.services-registry methods
mitmproxy Multi-Instance Support (2026-02-11)
- Updated init.d script with config_foreach start_instance instance
- Updated mitmproxyctl with new commands:
  - list-instances: Show all configured instances with status
  - service-run <instance>: Start specific instance
  - service-stop <instance>: Stop specific instance
- UCI configuration for dual instances:
  - out: LAN→Internet transparent proxy (port 8888/8089)
  - in: WAF/services upstream proxy (port 8889/8090)
- README updated with multi-instance documentation
InterceptoR Plan Verification Complete (2026-02-12)
- Verified all 5 phases of InterceptoR "Gandalf Proxy" plan are fully implemented:
  - Phase 1: WPAD Safety Net — setup_wpad_enforce() in network-tweaks-sync
  - Phase 2: Cookie Tracker — secubox-cookie-tracker + luci-app-cookie-tracker
  - Phase 3: API Failover — cdn-cache UCI config + 99-cdn-offline hotplug
  - Phase 4: CrowdSec Scenarios — 8 scenarios in secubox-mitmproxy-threats.yaml
  - Phase 5: Unified Dashboard — luci-app-interceptor with 5-pillar status
- CrowdSec scenarios include: SQLi, XSS, command injection, SSRF, CVE exploitation, bot scanners, shell hunters
- Plan file updated to reflect completion status
InterceptoR Insider WAF - 6th Pillar (2026-02-12)
- Added Insider WAF as 6th pillar to InterceptoR for LAN client threat detection.
- RPCD handler updates (luci.interceptor):
  - New get_insider_waf_status() function tracking insider threats, blocked clients, exfil attempts, DNS anomalies
  - Health score recalculated for 6 pillars (17 points each)
  - Detects threats from internal IPs (192.168.x.x, 10.x.x.x, 172.16-31.x.x)
- LuCI dashboard updates (overview.js):
  - New "Insider WAF" pillar card with 🔒 icon
  - Stats: insider threats, blocked clients, exfil attempts, DNS anomalies
  - Description: "LAN threat detection"
- CrowdSec insider threat scenarios (secubox-insider-threats.yaml):
  - secubox/insider-c2-beacon — C2 beacon detection from LAN hosts
  - secubox/insider-exfiltration — Data exfiltration attempts (large uploads, base64, DNS)
  - secubox/insider-dns-tunnel — DNS tunneling/DGA from internal hosts
  - secubox/insider-lateral-movement — Lateral movement within LAN
  - secubox/insider-cryptominer — Cryptominer activity detection
  - secubox/insider-iot-botnet — IoT botnet C2 (Mirai, Gafgyt, Mozi)
  - secubox/insider-bad-tld — Suspicious outbound to high-risk TLDs
  - secubox/insider-high-volume — Unusual high-volume outbound traffic
- Updated secubox-app-crowdsec-custom Makefile to install new scenarios
DDoS Protection Hardening Profile (2026-02-12)
- Config Advisor DDoS checks (checks.sh):
  - DDOS-001: SYN cookies enabled
  - DDOS-002: Connection tracking limit (65536+)
  - DDOS-003: CrowdSec http-dos collection installed
  - DDOS-004: ICMP rate limiting
  - DDOS-005: Reverse path filtering (anti-spoofing)
  - DDOS-006: HAProxy connection limits (maxconn)
  - DDOS-007: mitmproxy WAF active (L7 flood detection)
  - DDOS-008: Vortex DNS firewall (botnet C2 blocking)
- ANSSI rules JSON (anssi-rules.json):
  - New "ddos" category with 8 rules and remediation steps
- Documentation (DOCS/DDOS-PROTECTION.md):
  - Complete DDoS protection guide
  - Layer-by-layer explanation (L3/L4/L7/DNS)
  - Configuration examples for all components
  - Quick hardening checklist
  - Monitoring commands during attacks
  - Limitations and upstream protection options (Cloudflare, etc.)
HAProxy vhosts.js KISS Migration (2026-02-12)
- Rewrote HAProxy Virtual Hosts dashboard to use KissTheme.
- Self-contained inline CSS using KISS variables.
- Removed external dashboard.css dependency.
- Add vhost form with domain/backend/SSL inputs.
- Vhosts table with status badges and actions (edit/toggle/delete).
- Edit modal and delete confirmation dialogs.
- Toast notifications for user feedback.
InterceptoR LXC Detection Fix (2026-02-12)
- Changed LXC container status detection from lxc-ls to lxc-info.
- lxc-info -n mitmproxy -s provides direct state query (more reliable).
- Fixed container name from secbx-mitmproxy to mitmproxy.
- Applied to all pillar status checks in luci.interceptor RPCD handler.
HAProxy backends.js KISS Migration (2026-02-12)
- Rewrote HAProxy Backends dashboard to use KissTheme.
- Removed external dashboard.css dependency.
- Replaced all hp- classes with kiss- classes and inline styles.
- Backend cards with server lists, health check info.
- Add backend form with mode, balance algorithm, health check options.
- Add/edit server modals with quick service selector for auto-fill.
- Delete confirmations and toast notifications.
- Consistent styling with vhosts.js KISS migration.
HAProxy stats.js KISS Migration (2026-02-12)
- Rewrote HAProxy Statistics dashboard to use KissTheme.
- Removed CSS import via style element.
- Stats iframe with KISS-styled border.
- Logs viewer with line count selector and refresh button.
- Empty state for disabled stats or stopped service.
Cloning Station Dashboard Enhancements (2026-02-13)
- Major enhancement to luci-app-cloner with 5-tab dashboard and 10 new RPCD methods.
- Build Progress UI:
  - Real-time log streaming from /tmp/cloner-build.log via base64 encoding
  - Progress bar with stage indicators (initializing, downloading, building, packaging, complete, failed)
  - Color-coded stage icons and animated progress fill
  - RPCD method: build_log with lines/offset params
- Serial Console Tab:
  - Port detection and selection via serial_ports method
  - Live serial output display with Start/Stop/Clear controls
  - Command input with Enter-to-send support
  - Polling-based serial read with 500ms interval
  - RPCD methods: serial_ports, serial_read, serial_write
- Clone History Tab:
  - JSON-based history tracking in /var/run/secubox/clone-history.json
  - Records: timestamp, device, image, status, token
  - Relative time display (e.g., "2h ago")
  - Clear history functionality
  - RPCD methods: history_list, history_add, history_clear
- Image Manager Tab:
  - Storage overview with clone/TFTP directory sizes
  - Usage progress bar with available space display
  - Image cards with details button (size, checksum, modified, valid)
  - Delete image functionality
  - RPCD methods: storage_info, image_details, image_rename
- Overview Tab Improvements:
  - 4-column stats grid with live polling
  - Storage info card with dual-directory display
  - Token management with copy-to-clipboard
  - U-Boot flash commands with copy button
- Tab navigation with 5-second refresh polling
- Updated ACL with 13 read and 9 write methods
Cloning Station Remote Device Management (2026-02-13)
- Added 6th "Remotes" tab for managing remote SecuBox devices.
- SSH Key Authentication:
  - Generates dropbear Ed25519 keypair on master
  - Uses dbclient (dropbear SSH client) instead of OpenSSH for OpenWrt compatibility
  - Auto-copies public key to remote devices' authorized_keys
- Remote Device Features:
  - Add/remove remote devices by IP and name
  - Network scan discovers SecuBox devices on subnet
  - Remote status retrieves: hostname, model, version, uptime, LuCI accessibility
- Remote Flash Workflow:
  - Select image from local TFTP/clone directory
  - Optional token injection for mesh join
  - Image upload via dbclient (pipe-based SCP alternative)
  - Token, master hostname, and master IP embedded in image
  - Triggers sysupgrade with keep_settings option
- RPCD Methods (7 new):
  - list_remotes, add_remote, remove_remote: Remote device management
  - remote_status: SSH-based device info retrieval
  - remote_upload: Image upload via dbclient
  - remote_flash: Complete flash workflow with token injection
  - scan_network: Discover SecuBox devices on LAN
- BusyBox Compatibility Fixes:
  - Replaced grep -P (Perl regex) with grep -oE for IP extraction
  - Uses dropbear's dbclient with -i key and -y auto-accept
- Updated ACL with 4 read methods and 4 write methods for remotes
- Tested with moka1 (192.168.255.125) - MOCHAbin running OpenWrt 24.10.5
GoToSocial Fediverse Server Deployment (2026-02-13)
- Deployed GoToSocial v0.17.0 ActivityPub server on C3BOX.
- Installation:
  - Direct execution mode (no LXC - v0.18.0 has cgroup panics)
  - Binary at /srv/gotosocial/gotosocial (ARM64)
  - Data at /srv/gotosocial/ (database, storage, web assets)
  - Downloaded from Codeberg releases (GitHub redirects fail on wget)
- Configuration:
  - Domain: social.gk2.secubox.in
  - Port: 8484 (internal)
  - SQLite database with WAL mode
  - Web templates and assets from release tarball
- Admin User Created:
  - Username: admin
  - Email: admin@secubox.in
  - Promoted to admin + moderator role
- HAProxy Exposure:
  - Backend: gotosocial → 192.168.255.1:8484
  - Vhost: social_gk2_secubox_in with SSL redirect
  - Uses wildcard certificate *.gk2.secubox.in (Let's Encrypt)
  - Added domain to certs.list for SNI matching
- UCI Configuration:
  - haproxy.gotosocial backend
  - haproxy.gotosocial_srv server entry
  - haproxy.social_gk2_secubox_in vhost
  - haproxy.cert_social_gk2_secubox_in certificate
  - gotosocial.main.host, gotosocial.proxy.* settings
- Key Fixes:
  - Config.yaml paths: /data/ → /srv/gotosocial/
  - Backend address: HAProxy in LXC cannot reach 127.0.0.1, must use LAN IP
  - WASM compilation: ~90 seconds on ARM64 at startup
- Live at: https://social.gk2.secubox.in
GoToSocial LXC Migration + Pinafore Client Hub (2026-02-14)
- GoToSocial Architecture Change:
  - Migrated from direct host execution to LXC container
  - Using Alpine 3.21 rootfs with gcompat for glibc compatibility
  - GoToSocial v0.17.0 statically linked binary
  - Data bind-mounted at /data inside container
  - Container runs with lxc.net.0.type = none (host networking)
- LXC Container Benefits:
  - Isolated environment with proper cgroup limits
  - Easier upgrades (replace rootfs or binary only)
  - Consistent execution environment
- gotosocialctl Updates:
  - install: Creates Alpine LXC rootfs + installs GoToSocial
  - start/stop: Uses lxc-start -d / lxc-stop
  - user create/password: Works via chroot or lxc-attach
  - shell: Opens interactive shell in container
- Pinafore Client Hub Added:
  - New package: secubox-app-pinafore
  - Landing page with links to Pinafore, Elk, Semaphore
  - All clients pre-configured with instance domain
  - pinaforectl emancipate for HAProxy exposure
- Login Issue Resolution:
  - Form field is username not email (GoToSocial quirk)
  - Admin user: admin@secubox.in / TestAdmin123!

2026-02-14: Fixed Streamlit apps + WAF compatibility

Problem

Streamlit apps showing blank page with loading spinner when accessed via public URLs
Direct access to backends (192.168.255.1:xxxx) worked fine
Issue was mitmproxy WAF not handling WebSocket connections properly

Root Cause

HAProxy waf_enabled=1 routed ALL vhosts through mitmproxy_inspector backend
mitmproxy's haproxy_router addon wasn't properly handling WebSocket upgrade connections
WebSocket connections disconnected immediately, breaking Streamlit's real-time UI

Solution

Added waf_bypass option to /usr/sbin/haproxyctl:
- Vhosts with waf_bypass=1 route directly to their backends
- Other vhosts still go through mitmproxy WAF
Set waf_bypass=1 for Streamlit vhosts (yling, bazi, bweep, bweek, wuyun, pix, hermes, evolution, control)
Updated haproxy_router.py addon with WebSocket event handlers (for future improvement)

Files Modified

/usr/sbin/haproxyctl - Added waf_bypass option check
/srv/mitmproxy-in/addons/haproxy_router.py - Added WebSocket handlers
/srv/lxc/mitmproxy-in/config - Enabled HAPROXY_ROUTER_ENABLED=1

Result

Streamlit apps work with full WebSocket support
Other services still protected by mitmproxy WAF
Hybrid approach balances security and functionality

2026-02-14: Docker to LXC Migration - Mail Services

Converted Services

Mailserver (Docker secubox-mailserver → LXC mailserver)
- Alpine Linux with Postfix + Dovecot
- IP: 192.168.255.30
- Ports: SMTP (25), SMTPS (465), Submission (587), IMAP (143), IMAPS (993)
- User: admin@secubox.in / NDdC73130
Roundcube Webmail (Docker secubox-webmail → LXC roundcube)
- Alpine Linux with nginx + PHP-FPM + Roundcube 1.6.12
- Host networking, port 8027
- Connected to mailserver at ssl://192.168.255.30:993

LXC Configurations

/srv/lxc/mailserver/config - Mail server container
/srv/lxc/roundcube/config - Webmail container
/srv/lxc/mailserver/rootfs/opt/start-mail.sh - Startup script
/srv/lxc/roundcube/rootfs/opt/start-roundcube.sh - Startup script

Result

Docker containers removed
Services accessible via https://webmail.gk2.secubox.in
Auto-start via /etc/init.d/secubox-lxc

2026-02-14: Docker to LXC Migration - Jellyfin

Converted Service

Jellyfin (Docker secbx-jellyfin → LXC jellyfin)
- Debian-based (exported from Docker image)
- IP: 192.168.255.31
- Port: 8096
- Jellyfin 10.11.6

LXC Configuration

/srv/lxc/jellyfin/config - Container config with bind mounts
/srv/lxc/jellyfin/rootfs/opt/start-jellyfin.sh - Startup script
Mounts: /srv/SHARE (media, ro), /srv/jellyfin/config, /srv/jellyfin/cache

HAProxy Updates

Updated haproxy.cfg5726ed_media.address to 192.168.255.31
Added waf_bypass=1 for media.maegia.tv
Disabled Docker jellyfin init script (/etc/init.d/jellyfin)

Auto-start Script

Updated /etc/init.d/secubox-lxc to manage all LXC containers:

haproxy, mailserver, roundcube, jellyfin

Result

All Docker containers removed
Jellyfin accessible via https://media.maegia.tv
Full LXC-based infrastructure

2026-02-14: Domoticz Exposure & WAF Redirect Fix

Domoticz Exposed via HAProxy

Domain: https://home.maegia.tv
Backend: 127.0.0.1:8084 (LXC with host networking)
DNS: A record added via Gandi API
SSL: Let's Encrypt certificate issued

HAProxy Configuration

Created domoticz_web backend
Created home_maegia_tv vhost with waf_bypass=1
SSL certificate: /srv/haproxy/certs/home.maegia.tv.pem

WAF Redirect Loop Fix

Issue: mitmproxy causing 301 redirect loops for multiple vhosts
Root cause: mitmproxy-in in "reverse" mode without proper HAProxy router addon
Fix: Added waf_bypass=1 to affected vhosts (gk2.secubox.in, home.maegia.tv)
Additional fix: Updated mitmproxy-in LXC config to enable HAProxy router mode

Domoticz Configuration

Reset admin password via SQLite
Added local network bypass for HAProxy access
LXC container: /srv/lxc/domoticz/ with USB passthrough for Zigbee

Result

https://home.maegia.tv → Domoticz (200 OK)
https://gk2.secubox.in → GK2 Hub (200 OK, redirect loop fixed)

2026-02-14: Vhost Routing Fixes & Glances Installation

Mitmproxy Routes Duplicate Fix

Issue: Multiple vhosts showing mixed/wrong content (sdlc, console, control)
Root cause: Duplicate entries in /srv/mitmproxy-in/haproxy-routes.json
- console.gk2.secubox.in appeared twice (8501 then 8081 - second wins)
- control.gk2.secubox.in appeared twice (8511 then 8081 - second wins)
Fix: Removed duplicate entries, kept correct Streamlit ports

Service Backend Fixes

play.maegia.tv: Changed backend from mitmproxy_inspector to streamlit_yijing (port 8501)
client.gk2.secubox.in: Enabled pinafore_srv server with health check
social.gk2.secubox.in: Started GoToSocial LXC container

Pinafore Static Server

Added uhttpd instance on port 4002 for Mastodon client landing page
Serves /srv/pinafore/index.html with links to Mastodon web clients

Glances Installation

Installed python3-pip via opkg
Installed Glances 4.5.0.4 via pip3 with dependencies:
- bottle, fastapi, uvicorn, psutil, jinja2, pydantic
Created dummy /usr/lib/python3.11/webbrowser.py for headless operation
Started Glances web server on port 61208

Verified Services

Service	URL	Status
sdlc.gk2.secubox.in	MetaBlog SDLC	✓ HTTP 200
console.gk2.secubox.in	Streamlit Console	✓ HTTP 200
control.gk2.secubox.in	Streamlit Control	✓ HTTP 200
play.maegia.tv	Streamlit Yijing	✓ HTTP 200
glances.gk2.secubox.in	Glances Monitor	✓ HTTP 200
social.gk2.secubox.in	GoToSocial	✓ Working
client.gk2.secubox.in	Pinafore Landing	✓ HTTP 200

Total Operational

70+ vhosts verified working
55 SSL certificates active
WAF/mitmproxy routing stable

2026-02-14: C3BOX SDLC Full Service Verification

All 70 Services Verified Operational

Comprehensive verification of all services listed on C3BOX SDLC dashboard (https://sdlc.gk2.secubox.in/).

Services by Zone

Zone	Count	Status
*.cybermind.fr	2	✓ All 200
*.cybermood.eu	2	✓ All 200
*.ganimed.fr	2	✓ All 200
*.maegia.tv	19	✓ All OK
*.secubox.in	29	✓ All OK
*.sb.local	4	Local access
*.secubox.local	2	Local access

Streamlit Apps (20 verified)

basic, bazi, bweek, bweep, console, control, cpf, evolution, fabric, fabricator, ftvm, hermes, papyrus, pdf, photocloud, pix, play, wuyun, yijing360, yling

MetaBlog Sites (15 verified)

bday, clock, comic, eval, geo, gondwana, lldh, sdlc, wanted, devel, gandalf, gk2, how2, press, presse

Infrastructure Services

Glances monitoring (port 61208)
GoToSocial federation (port 8484)
Jellyfin media (port 8096)
Mail server (Postfix/Dovecot)
Webmail (Roundcube)
LocalAI (port 8091)

Mesh Statistics

Total Vhosts: 77 configured
SSL Certificates: 52 active
LXC Containers: 5 running (haproxy, mitmproxy-in, jellyfin, gotosocial, domoticz)
Public IP: 82.67.100.75

2026-02-14: WAF Architecture Configuration

WAF Routing Strategy

Configured mitmproxy WAF filtering with selective bypass:

Through WAF (mitmproxy filtering enabled):

All Streamlit apps (20+) - security analysis active
All MetaBlogizer sites (15+) - security analysis active
Standard web vhosts for logging and threat detection

WAF Bypass (direct HAProxy → backend):

Service	Reason
media.maegia.tv	Jellyfin streaming incompatible
localai.secubox.in	AI API performance
mail.secubox.in	Mail protocols
glances.gk2.secubox.in	Monitoring API
social.gk2.secubox.in	ActivityPub federation
webmail.gk2.secubox.in	Roundcube webmail
client.gk2.secubox.in	Mastodon client
All path ACLs (/gk2/*)	mitmproxy routes by host only

Path ACL Fix

Path-based routing (secubox.in/gk2/*) requires waf_bypass=1
mitmproxy haproxy_router.py routes by hostname, not path
38 path ACLs configured with waf_bypass for direct routing

Architecture

Client → HAProxy → mitmproxy (WAF) → Backend (Streamlit/MetaBlog)
Client → HAProxy → Backend (Infrastructure - bypass WAF)
Client → HAProxy → Backend (Path ACLs - bypass WAF)

2026-02-14: Streamlit WebSocket WAF Bypass

Issue

Streamlit apps stopped displaying correctly after enabling WAF.

Root Cause

Streamlit uses WebSockets (_stcore/stream) for real-time communication. mitmproxy MITM interception breaks WebSocket connections due to:

Certificate validation issues (self-signed MITM cert)
Connection upgrade handling incompatibility
Stream state corruption

Fix

Re-enabled waf_bypass=1 for all 20 Streamlit apps. Trade-off: Streamlit apps bypass WAF filtering in favor of functionality.

Affected Apps

basic, bazi, bweek, bweep, console, control, cpf, evolution, fabric, fabricator, ftvm, hermes, papyrus, pdf, photocloud, pix, play, wuyun, yijing360, yling

2026-02-14: MetaBlogizer SDLC Content Restoration

Issue

sdlc.gk2.secubox.in displayed GK2 Hub landing page template instead of original content.

Root Cause

GK2 Hub generator script had overwritten the local index.html with auto-generated service catalog page. Original content ("Les Seigneurs de La Chambre - Présentation Cinématique") was preserved in git history.

Fix

cd /srv/metablogizer/sites/sdlc
git checkout HEAD -- index.html

Verification

Site now displays medieval/renaissance cinematic presentation
Title: "Les Seigneurs de La Chambre - Présentation Cinématique"
Description: "seigneurs de la Chambre" (from UCI config)

2026-02-14: Wazuh SIEM LuCI Dashboard Integration

Created luci-app-wazuh package - unified Wazuh SIEM monitoring dashboard
- 4 views: Overview, Alerts, FIM (File Integrity), Agents
- SysWarden-inspired 4-layer security visualization:
  - Layer 1: Vortex Firewall + nftables (kernel-level)
  - Layer 2: CrowdSec + Bouncer (IPS)
  - Layer 3: Wazuh Manager (SIEM/XDR)
  - Layer 4: mitmproxy + HAProxy (WAF)
RPCD handler (luci.wazuh) with 12 API methods:
- get_overview, get_agent_status, get_manager_status
- get_alerts, get_alert_summary
- get_fim_events, get_fim_config
- list_agents, get_crowdsec_correlation
- start_agent, stop_agent, restart_agent
API wrapper (wazuh/api.js) with helper functions for alert levels and timestamps
Fixed jshn segfault issue - simplified to printf-based JSON output
Tested all RPCD methods via ubus calls

2026-02-14: mitmproxy WAF Wildcard Route Priority Fix

Fixed wildcard route matching in haproxy_router.py
- Issue: .gk2.secubox.in wildcard (port 4000) matched before specific routes like apr.gk2.secubox.in (port 8928)
- Root cause: Python code expected *.domain format but HAProxy generates .domain format
- Fix: Support both *.domain and .domain wildcard formats
- Fix: Sort wildcards by length (longest/most specific first) to ensure proper priority
Added auto-reload capability
- Routes file mtime checked every 10 requests
- Automatically reloads routes.json if file modified
- No container restart needed for route updates
Updated metablogizerctl integration
- _emancipate_mitmproxy() now uses mitmproxyctl sync-routes instead of direct file manipulation
- Ensures HAProxy and mitmproxy routes stay in sync
- MetaBlogizer sites now properly routed through WAF

2026-02-15: PeerTube Video Platform Package

Created secubox-app-peertube package - federated video streaming platform
- LXC container with Debian Bookworm base image
- Stack: PostgreSQL 15, Redis 7, Node.js 18 LTS, FFmpeg
- peertubectl CLI with 15+ commands:
  - Container: install, uninstall, update, start, stop, status, logs, shell
  - User mgmt: admin create-user, admin reset-password, admin list-users
  - Live: live enable, live disable, live status (RTMP on port 1935)
  - Exposure: configure-haproxy, emancipate
  - Backup: backup, restore (PostgreSQL dump)
- HAProxy integration with extended timeouts (3600s) for streaming/WebSocket
- Full emancipation workflow: DNS → Vortex → HAProxy → ACL → SSL → Mesh → Mitmproxy → Reload
UCI config sections:
- main: enabled, data_path, videos_path, memory_limit, timezone
- server: hostname, port, https, webserver_hostname
- live: enabled, rtmp_port, max_duration, allow_replay, transcoding_enabled
- transcoding: enabled, threads, allow_audio_files, hls_enabled, resolutions
- storage: external_enabled, s3_endpoint, s3_region, s3_bucket, s3_access_key, s3_secret_key
- network: domain, haproxy, haproxy_ssl, firewall_wan
- admin: email, initial_password

2026-02-15: PeerTube LuCI Dashboard

Created luci-app-peertube package
- RPCD handler (luci.peertube) with 11 methods:
  - status, start, stop, install, uninstall, update, logs
  - emancipate, live_enable, live_disable, configure_haproxy
- ACL permissions: read (status, logs), write (all actions)
- Menu entry: Admin → Services → PeerTube
Dashboard features:
- Install wizard with features list and requirements
- Status badge (Running/Stopped) with access URL
- Service info: hostname, port, admin email
- Live streaming toggle with enable/disable buttons
- HAProxy configuration status with configure button
- Emancipate form for public exposure
- Logs viewer with refresh button

Created luci.secubox-portal RPCD backend for dynamic component discovery
- get_tree: Auto-discovers all luci-app-* packages, groups by category
- get_containers: Lists LXC containers from /srv/lxc/ with running state
- get_vhosts: Lists HAProxy vhosts from UCI with domain/backend/ssl info
- Categories: SecuBox Core, Security, Media & Streaming, Network & Proxy, Development & CMS, IoT & Home, AI & Communication, System & Management, Other SecuBox Apps
Updated luci-tree.js with dynamic RPC-based interface
- Three tabs: LuCI Apps, Containers, Vhosts
- Refresh button for live updates without page reload
- Stats row showing categories, links, packages, containers, vhosts counts
- Search functionality for filtering modules
- Cyberpunk dark theme with green/cyan accents
ACL permissions for unauthenticated portal access to tree methods

2026-02-15: PeerTube Configuration Fixes

Redis ARM64-COW-BUG: Added ignore-warnings ARM64-COW-BUG to redis.conf
Redis sentinel: Disabled (using standalone Redis, not sentinel cluster)
RTMPS: Disabled (no SSL key file needed for live streaming)
HAProxy WAF bypass: Added waf_bypass=1 to tube.gk2.secubox.in vhost
- Without bypass, mitmproxy WAF stripped Host header causing OAuth errors
- PeerTube validates requests against configured webserver.hostname
Listen hostname: Set to 0.0.0.0 (not domain name) for proper binding
Webserver hostname: Set to tube.gk2.secubox.in for OAuth validation

2026-02-15: HAProxy & Mitmproxy WAF Fixes

HAProxy reload fix in haproxyctl
- HAProxy reads from /etc/haproxy/haproxy.cfg inside container
- Config was generated at /opt/haproxy/config/haproxy.cfg but not copied
- Added lxc_exec cp /opt/haproxy/config/haproxy.cfg /etc/haproxy/haproxy.cfg before reload signal
Mitmproxy Host header preservation in haproxy_router.py
- Fixed PeerTube OAuth "Invalid client" error when WAF enabled
- Issue: flow.request.host = backend[0] was modifying the Host header
- Fix: Save original Host header, set backend destination, restore Host header
- Backends that validate Host (PeerTube OAuth, etc.) now work through WAF
WAF global reset
- Removed waf_bypass=1 from 70 vhosts and path ACLs
- All traffic now routes through mitmproxy for inspection
- Streamlit apps, infrastructure services all WAF-enabled
Committed: f3f6eb4e - fix(haproxy,mitmproxy): Fix config reload and preserve Host header

2026-02-15: PeerTube Email Configuration

Configured SMTP for local mailserver (192.168.255.30)
- Port 25, no TLS, disable_starttls=true (internal network)
- Auth: admin@secubox.in
- From: peertube@secubox.in
Fixed self-signed certificate error
- Mailserver STARTTLS was enabled with self-signed cert
- Set disable_starttls: true in production.yaml
Added peertube@secubox.in alias to mailserver virtual aliases
PeerTube now sends registration confirmations and password resets

2026-02-15: Wazuh Agent Watchdog

Added watchdog to wazuh-agent startup script
- Checks every 60 seconds if wazuh-agentd is running
- Automatically restarts Wazuh service if process dies
- Logs restart events to /var/log/wazuh-watchdog.log
Root cause: wazuh-agentd process had stopped, agent showed disconnected
Committed: 851910e1 - feat(wazuh): Add watchdog to wazuh-agent startup script

2026-02-15: Service Fixes

Roundcube webmail: Container was stopped, started it
Wazuh dashboard: Added waf_bypass (HTTPS backend incompatible with HTTP WAF)
Streamlit evolution: Instance was not running, added on port 8510
Streamlit Gitea sync: Pushed 4 missing apps (cineposter_fixed, pdf_slideshow, pharmacopoeia_secubox, wuyun_liuqi)
RTMP firewall: Opened port 1935 for PeerTube live streaming

2026-02-15: Mailserver gk2 Account Restoration

Restored gk2@secubox.in user from backup
- Container was reinstalled on Feb 14, only admin@ was recreated
- Found gk2 credentials in /srv/backups/mailserver/config-20260206-171132.tar.gz
- Extracted password hash and added to /etc/dovecot/users in container
- Created maildir at /var/mail/secubox.in/gk2/{cur,new,tmp}
Data loss: Maildir was already empty in Feb 6 backup (emails lost before backup)
Root cause: mailserver container reinstallation did not restore all users

2026-02-15: Gitea Repository Privacy Fix

Verified streamlitctl creates repos with private:true by default
Fixed secubox-evolution repo which was public → now private
API call: PATCH /api/v1/repos/gandalf/secubox-evolution with {"private":true}
All 30 Gitea repos now private

2026-02-15: Mitmproxy WAF Dashboard Data Path Fix

Fixed RPCD handler reading from wrong data path
- Was reading from /srv/mitmproxy (outbound instance, no threats)
- Now reads from /srv/mitmproxy-in (WAF input instance)
Added WAF_DATA_PATH constant for clarity
Updated methods: get_status, get_alerts, get_threat_stats, get_subdomain_metrics, clear_alerts
Fixed container running check to detect mitmproxy-in and mitmproxy-out
Result: Dashboard now shows 997 threats today, 29 pending autobans
Committed: 42d85c4d

2026-02-15: PeerTube Transcoding Jobs Fix

Root cause: Videos stuck with waitTranscoding=true not showing in public listing
Investigation: Found runnerJob table with 6 jobs stuck in state=1 (pending)
Problem: Admin enabled "remote runners" for transcoding but no runners registered

Fix: Set waitTranscoding=false directly in PostgreSQL database

UPDATE video SET "waitTranscoding" = false WHERE "waitTranscoding" = true;

Result: 2 videos now visible in public listing
Future fix: Disable remote runners in admin panel, use local ffmpeg transcoding

2026-02-15: GK2 Hub Landing Page Subdomain URLs

Updated gk2hub-generate script to use direct subdomain URLs
Previous: Used redirect paths like https://secubox.in/gk2/jellyfin
New: Uses subdomain URLs like https://media.gk2.secubox.in
Changes:
- Infrastructure section: media, localai, webmail, feed, tube, social, wazuh
- MetaBlogizer: HAProxy vhost lookup for automatic subdomain detection
- Added more icons for new service types
Result: 67 services with proper subdomain URLs

2026-02-16: Nextcloud LXC Enhancement

Migrated secubox-app-nextcloud from Docker to LXC (Debian 12 based)
Complete rewrite of nextcloudctl CLI (1018 lines):
- Commands: install, uninstall, update, status, logs, shell, occ, backup, restore, ssl-enable, ssl-disable
- Downloads Debian 12 rootfs from LXC image server
- Installs full stack: Nginx, MariaDB, Redis, PHP 8.2-FPM, Nextcloud
- Automated database setup and configuration
New UCI config schema with sections: main, db, redis, ssl, backup
Enhanced RPCD backend (366 lines) with 15 methods:
- status, get_config, save_config, install, start, stop, restart
- update, backup, restore, list_backups, ssl_enable, ssl_disable, occ, logs
KISS Dashboard (725 lines) with:
- Install view with feature cards
- Overview tab with stats grid (Status, Version, Users, Storage)
- Backups tab with create/restore functionality
- SSL tab for HAProxy/ACME integration
- Logs tab for operation monitoring
Updated dependencies:
- secubox-app-nextcloud: +lxc +lxc-common +tar +wget-ssl +jsonfilter +openssl-util +unzip +xz
- luci-app-nextcloud: +luci-lib-secubox +secubox-app-nextcloud
Updated ACL with all new RPCD methods
Updated menu to SecuBox path (admin/secubox/services/nextcloud)

2026-02-16: Nextcloud SSL, WAF Rules & Mail Autoconfig

Nextcloud Production Deploy:

Fixed nginx port conflict (80→8080) to avoid HAProxy collision
Fixed PHP-FPM socket path to use php8.2-fpm.sock
Fixed nginx routing with rewrite rule for /apps/* URLs
Configured HAProxy SSL: https://cloud.gk2.secubox.in
Updated mitmproxy routes for direct backend access (port 8080)
Commits: 5b6bf856, 2bc2eac9

WAF Rules for Nextcloud & Roundcube:

Added 20 CVE-based rules to /srv/mitmproxy/waf-rules.json
Nextcloud patterns: CVE-2023-49791 (Text SSE RCE), CVE-2024-22403 (Dashboard XSS), CVE-2024-37315 (User Enum), CVE-2024-22212 (Federation SQLi)
Roundcube patterns: CVE-2024-37383 (Skin RCE), CVE-2023-5631 (Stored XSS), CVE-2020-35730 (Upload RCE), CVE-2023-43770 (Link XSS)
Common patterns: path traversal, config file access, script injection

Mail Client Autoconfig:

DNS records added to secubox.in.zone:
- autoconfig.gk2.secubox.in, autodiscover.gk2.secubox.in (A/AAAA)
- _imaps._tcp.gk2.secubox.in SRV 0 0 993 mail.gk2.secubox.in
- _submission._tcp.gk2.secubox.in SRV 0 0 587 mail.gk2.secubox.in
Autoconfig XML at /.well-known/autoconfig/mail/config-v1.1.xml
Mozilla/Thunderbird format with IMAP (993/143) and SMTP (587/465)
HAProxy vhosts and mitmproxy routes configured

2026-02-16: Mailserver LuCI KISS Enhancement

IMAP Connectivity Fix:

Fixed hairpin NAT issue for internal clients (Nextcloud container)
Added /etc/hosts override in Nextcloud container: mail.gk2.secubox.in → 192.168.255.30
Added firewall rules for mail ports (IMAP 993, SMTP 587/465)

LuCI Dashboard KISS Regeneration:

Complete rewrite of overview.js (672 lines) with full KISS theme styling:
- Header with server FQDN
- 4-column stats grid (Status, Users, Storage, SSL)
- Control buttons (Start/Stop, DNS Setup, SSL Setup, Fix Ports, Backup)
- Port status cards with visual indicators (SMTP, Submission, SMTPS, IMAPS, IMAP)
- Two-column layout: Users table + Aliases table
- Webmail (Roundcube) card with status badge and quick actions
- Connection info panel with IMAP/SMTP server details
- Live polling with 10s refresh
Updated ACL with fix_ports, alias_del methods
Added Mail Server + Nextcloud to KISS theme navigation sidebar

Files Modified:

luci-app-mailserver/htdocs/.../overview.js (rewritten)
luci-app-mailserver/root/usr/share/rpcd/acl.d/luci-app-mailserver.json
luci-app-secubox-portal/htdocs/.../kiss-theme.js (nav update)

2026-02-16: DNS Master LuCI App

New Package: secubox-app-dns-master

BIND DNS zone management CLI tool (dnsmaster)
Commands: status, zone-list, zone-show, zone-add, records-json, record-add, record-del, reload, check, logs, backup
JSON output support for LuCI integration
Auto serial bump on zone modifications
Zone validation via named-checkzone
UCI config: /etc/config/dns-master

New Package: luci-app-dns-master

KISS-themed dashboard with:
- 4-column stats grid (Status, Zones, Records, TTL)
- Control buttons (Reload BIND, Check Zones, Backup All, Add Zone)
- Interactive zones table with Edit/Check/Backup actions
- Inline records editor with type-colored badges
- Add Zone modal for creating new DNS zones
- Add Record modal with type dropdown (A, AAAA, MX, TXT, CNAME, SRV, NS, PTR)
- Delete record with confirmation
- Live polling with 10s refresh
RPCD backend: 10 methods (status, zones, records, add_record, del_record, add_zone, reload, check, logs, backup)
Added DNS Master to KISS theme Network category

Files Created:

secubox-app-dns-master/Makefile
secubox-app-dns-master/files/etc/config/dns-master
secubox-app-dns-master/files/usr/sbin/dnsmaster
luci-app-dns-master/Makefile
luci-app-dns-master/root/usr/libexec/rpcd/luci.dns-master
luci-app-dns-master/root/usr/share/luci/menu.d/luci-app-dns-master.json
luci-app-dns-master/root/usr/share/rpcd/acl.d/luci-app-dns-master.json
luci-app-dns-master/htdocs/luci-static/resources/view/dns-master/overview.js

2026-02-16: HexoCMS Multi-Instance Enhancement

Backend Enhancement: secubox-app-hexojs

Added backup/restore commands:
- hexoctl backup [instance] [name] - Create full backup
- hexoctl backup list - List all backups with size/timestamp
- hexoctl backup delete <name> - Delete backup
- hexoctl restore <name> [instance] - Restore from backup
Added GitHub clone support:
- hexoctl github clone <repo_url> [instance] [branch] - Clone from GitHub
- Supports full Hexo sites with auto npm install
Added Gitea push support:
- hexoctl gitea push [instance] [message] - Push changes to Gitea
Added quick-publish command:
- hexoctl quick-publish [instance] - Clean + build + publish in one step
Added JSON status commands:
- hexoctl status-json - Full container and instance status
- hexoctl instance-list-json - Instance list for RPCD

RPCD Enhancement: luci.hexojs

Added 15 new methods:
- Instance management: list_instances, create_instance, delete_instance, start_instance, stop_instance
- Backup/restore: list_backups, create_backup, restore_backup, delete_backup
- Git integration: github_clone, gitea_push, quick_publish
Updated ACL with new permissions (read + write)

Frontend Enhancement: luci-app-hexojs

Rewrote overview.js with KISS theme:
- 4-column stats grid (Instances, Posts, Drafts, Backups)
- Quick actions bar: New Instance, Clone from GitHub/Gitea, New Post, Settings
- Instance cards with status indicators:
  - Controls: Start/Stop, Quick Publish, Backup, Editor, Preview, Delete
  - Port and domain display
  - Running status badge
- Backup table with restore/delete actions
- Create Instance modal (name, title, port)
- Delete Instance modal with data deletion option
- GitHub/Gitea clone modal (repo URL, instance, branch)
- Gitea push modal (commit message)
- Quick Publish modal with progress
Updated API with 12 new RPC declarations

Files Modified:

secubox-app-hexojs/files/usr/sbin/hexoctl (new commands)
luci-app-hexojs/root/usr/libexec/rpcd/luci.hexojs (new methods)
luci-app-hexojs/htdocs/luci-static/resources/hexojs/api.js (new declarations)
luci-app-hexojs/htdocs/luci-static/resources/view/hexojs/overview.js (KISS rewrite)
luci-app-hexojs/root/usr/share/rpcd/acl.d/luci-app-hexojs.json (new permissions)

2026-02-16: Mail Server Alias Management

Backend Enhancement: secubox-app-mailserver

Added alias_del function to users.sh:
- Removes alias from valias file
- Updates Postfix maps
Added alias del <alias> command to mailctl

RPCD Enhancement: luci.mailserver

Fixed alias_add to read JSON from stdin (ubus compatibility)
Added alias_del method for deleting aliases
Both methods now work via ubus call

Files Modified:

secubox-app-mailserver/files/usr/lib/mailserver/users.sh
secubox-app-mailserver/files/usr/sbin/mailctl
luci-app-mailserver/root/usr/libexec/rpcd/luci.mailserver

2026-02-16: Mail Autoconfig & Repair Features

Mail Autoconfig Setup

Created autoconfig files for automatic mail client configuration:
- config-v1.1.xml - Mozilla Thunderbird format
- autodiscover.xml - Microsoft Outlook format
- email.mobileconfig - Apple iOS/macOS format
Set up uhttpd instance on port 8025 to serve autoconfig files
Added HAProxy backends with waf_bypass for autoconfig.secubox.in and autoconfig.gk2.secubox.in
Created mailctl autoconfig-setup and autoconfig-status commands

LuCI Enhancement: luci-app-mailserver

Added user_repair method for mailbox repair (doveadm force-resync)
Added repair button (🔧) to user actions in overview
Updated ACL with new permission

LuCI Enhancement: luci-app-nextcloud

Added list_users method to list Nextcloud users
Added reset_password method for password reset via OCC
Updated ACL with new permissions

Files Modified:

luci-app-mailserver/root/usr/libexec/rpcd/luci.mailserver
luci-app-mailserver/htdocs/luci-static/resources/view/mailserver/overview.js
luci-app-mailserver/root/usr/share/rpcd/acl.d/luci-app-mailserver.json
luci-app-nextcloud/root/usr/libexec/rpcd/luci.nextcloud
luci-app-nextcloud/root/usr/share/rpcd/acl.d/luci-app-nextcloud.json

2026-02-16: Mailserver Password Reset Fix

Bug Fix: secubox-app-mailserver

Fixed SHA512-CRYPT hash corruption in user_passwd and user_add functions
Root cause: $6$ prefix was being interpreted as shell variable when passed through nested shell commands
Fix: Use printf instead of echo, write to temp file before piping to container
Corrected dovecot passwd format: uid:gid 102:105 (vmail user) with userdb_mail=maildir:/var/mail/domain/user

Files Modified:

secubox-app-mailserver/files/usr/lib/mailserver/users.sh

2026-02-16: Nextcloud User Management & WAF Fixes

LuCI Enhancement: luci-app-nextcloud

Added Users tab with user list from OCC
Added password reset modal for user password changes
Fixed list_users JSON parsing for Nextcloud user:displayname format

Nextcloud Mail Integration Fix

Set app.mail.verify-tls-peer=false to allow self-signed certs
Set allow_local_remote_servers=true for local IMAP access
Added mailserver certificate to Nextcloud trusted CA store

WAF/Mitmproxy Route Sync Fix

Fixed mitmproxy routes sync between host (/srv/mitmproxy) and container (/srv/mitmproxy-in)
Enabled WAF for cloud.gk2.secubox.in
Routes file must be copied to /srv/mitmproxy-in/haproxy-routes.json for mitmproxy-in container

Files Modified:

luci-app-nextcloud/htdocs/luci-static/resources/view/nextcloud/overview.js
luci-app-nextcloud/root/usr/libexec/rpcd/luci.nextcloud

Dovecot Permission Fix (Permanent)

Fixed anvil-auth-penalty socket permission issues that caused authentication failures
Added /run/dovecot permission setup to container startup script (start-mail.sh)
Ensures correct ownership (dovecot:dovecot) before and after dovecot starts

Files Modified:

secubox-app-mailserver/files/usr/sbin/mailserverctl (create_startup_script function)

2026-02-16: Mail Reception Fix

nftables Rules Missing:

Port 25 missing from input_wan accept rules
Mail ports missing from forward_wan chain (blocked by drop_to_wan)
Fix: Added accept rules for ports 25, 143, 465, 587, 993 in both chains

Postfix LMDB Fix:

Alpine Linux uses LMDB, not Berkeley DB hash
virtual_mailbox_maps = hash: caused "unsupported dictionary type" error
Fix: Changed to lmdb:/etc/postfix/vmailbox

vmailbox Sync:

gk2@secubox.in was missing from vmailbox file
Added user and rebuilt postmap

Files Modified:

secubox-app-mailserver/files/usr/sbin/mailserverctl
UCI firewall rules persisted for mail port forwarding

2026-02-16: Mailctl Firewall & Nextcloud Upgrade

mailctl Firewall Rules Enhancement:

Updated cmd_firewall_setup() to add UCI firewall rules for mail ports
Added input rules for WAN acceptance (ports 25, 143, 465, 587, 993)
Added forward rules for WAN-to-LAN mailserver forwarding
Rules now persist across firewall restarts via UCI config

Nextcloud Upgrade to 31.0.14:

Upgraded from 30.0.17 → 31.0.14 using OCC updater
All apps updated (mail, tasks, external, spreed/Talk)
Database schema migrations completed successfully
System running with maintenance mode disabled

Files Modified:

secubox-app-mailserver/files/usr/sbin/mailctl (cmd_firewall_setup function)

2026-02-17: v0.20.6 Release - Mailserver, Nextcloud & DNS Master Fixes

Mailserver Dovecot Permissions:

Fixed startup script: create login/token-login/empty directories with correct ownership
Set root:dovenull ownership on login directories (mode 0750)
Remove stale auth-token-secret.dat on startup (prevents "compromised token" errors)
Fixed users.sh: user_add and user_passwd now set correct permissions (644 root:dovecot)
Password reset no longer breaks authentication

Nextcloud Nginx Fix:

Removed overly aggressive /apps/ location block that was breaking SVG icons
Static files (.svg, .css, .js) now served correctly
Added cron job setup for background tasks (every 5 minutes)

DNS Master POSIX Compatibility:

Fixed bump_serial() function for busybox ash compatibility
Replaced bash-specific ${var:0:8} with POSIX cut -c1-8
Replaced $((10#$var + 1)) with expr
del_record now works via RPCD

LXC Container Auto-Start:

Enabled lxc.start.auto = 1 for mailserver, roundcube, nextcloud
Containers now survive reboots

Files Modified:

secubox-app-mailserver/files/usr/sbin/mailserverctl
secubox-app-mailserver/files/usr/lib/mailserver/users.sh
secubox-app-nextcloud/files/usr/sbin/nextcloudctl
secubox-app-dns-master/files/usr/sbin/dnsmaster

Release: v0.20.6

2026-02-17: WebRadio LuCI App

luci-app-webradio Package:

Added complete WebRadio management interface for OpenWrt
Dashboard with server status, listeners, now playing info
Icecast/Ezstream server configuration
Playlist management with shuffle and upload
Programming grid scheduler with jingle support
Live audio input via DarkIce (ALSA)
Security: SSL/TLS configuration, rate limiting, CrowdSec integration

Components:

7 LuCI JS views: overview, server, playlist, schedule, jingles, live, security
RPCD backend (luci.webradio) with 15+ methods
Scheduler script for cron-based programming grid
CrowdSec parser and scenarios for Icecast abuse detection
UCI config for webradio scheduling

Files Added:

package/secubox/luci-app-webradio/ (17 files, 3337 lines)

Source Repository:

https://github.com/gkerma/webradio-openwrt

2026-02-17: Nextcloud LXC Package Enhancement

nextcloudctl Enhancements:

Updated Nextcloud version to 31.0.5
Added LXC auto-start (lxc.start.auto = 1) for boot persistence
Added memory limit cgroup configuration (lxc.cgroup2.memory.max)
Fixed nginx /apps/ path for static assets (CSS, JS, SVG icons)

RPCD Backend (luci.nextcloud):

Added uninstall method
Added get_storage method for disk usage stats
Added delete_backup method
Total: 20 RPCD methods

LuCI Dashboard:

Added Storage tab with disk usage visualization
Added disk usage progress bar
Added storage breakdown (user data, backups, total)
Added delete button for backups
Enhanced backup management UX

Files Modified:

secubox-app-nextcloud/files/usr/sbin/nextcloudctl
luci-app-nextcloud/root/usr/libexec/rpcd/luci.nextcloud
luci-app-nextcloud/htdocs/.../overview.js
luci-app-nextcloud/root/usr/share/rpcd/acl.d/luci-app-nextcloud.json
secubox-app-nextcloud/README.md (full rewrite)

2026-02-17: Security KISS Dashboard Enhancements

Service Monitoring Extensions:

Added ndpid (nDPI daemon) to security-threats RPCD status method
Added Wazuh SIEM to security services monitoring
Dashboard now shows 6 services: CrowdSec, Wazuh, netifyd, ndpid, mitmproxy, Threat Intel

Files Modified:

luci-app-secubox-security-threats/root/usr/libexec/rpcd/luci.secubox-security-threats
luci-app-secubox-security-threats/htdocs/.../dashboard.js

2026-02-17: APPS Portal Extensions

Services Category:

Added Streamlit to portal apps (Python data apps and dashboards)
Added MetaBlogizer to portal apps (AI-powered blog generation)

Files Modified:

luci-app-secubox-portal/htdocs/.../apps.js

2026-02-17: Container Maintenance

Fixes:

Jellyfin: Started stopped container, enabled auto-start
Webmail: Restarted dead PHP-FPM process in roundcube container
Both services now operational

2026-02-17: Mailserver Migration Alpine → Debian

Problem:

Alpine Linux mailserver had persistent Dovecot permission issues
imap-login process couldn't access auth sockets due to UID/GID mismatches
Webmail logins timing out repeatedly

Solution:

Created new Debian 12 (Bookworm) LXC container
Installed Postfix + Dovecot with proper Debian packages
Migrated mail data, users, SSL certificates
Fixed passwd-file format for Debian Dovecot

Configuration:

Container: /srv/lxc/mailserver/ (Debian 12)
IP: 192.168.255.30 (unchanged)
Ports: 25, 143, 587, 993
Mail storage: /var/mail/ with vmail user (uid 5000)
Old Alpine backup: /srv/lxc/mailserver-alpine-backup/

2026-02-17: mitmproxy WAF Filters UI

New LuCI View:

Added "WAF Filters" tab to mitmproxy security interface
Displays all 10 WAF detection categories with enable/disable toggles
Categories: sqli, xss, lfi, rce, cve_2024, scanners, webmail, api_abuse, nextcloud, roundcube
Summary stats: total categories, active filters, rule count
Expandable rules tables showing patterns, descriptions, CVE links

RPCD Methods:

get_waf_rules - Returns WAF rules JSON from /srv/mitmproxy/waf-rules.json
toggle_waf_category - Enable/disable category in rules file

Files Created/Modified:

luci-app-mitmproxy/htdocs/.../view/mitmproxy/waf-filters.js (new)
luci-app-mitmproxy/root/usr/libexec/rpcd/luci.mitmproxy (added methods)
luci-app-mitmproxy/root/usr/share/luci/menu.d/luci-app-mitmproxy.json (menu entry)
luci-app-mitmproxy/root/usr/share/rpcd/acl.d/luci-app-mitmproxy.json (ACL permissions)

2026-02-19: Jabber/XMPP Server Packages (Prosody)

New Packages:

secubox-app-jabber - LXC-based Prosody XMPP server
luci-app-jabber - LuCI dashboard for Jabber management

Features:

Debian 12 (Bookworm) LXC container with Prosody XMPP server
Full XMPP support: C2S (5222), S2S (5269), HTTP/BOSH (5280)
Multi-User Chat (MUC) rooms with message archiving
HTTP upload for file sharing (10MB default)
BOSH and WebSocket support for web clients
SSL/TLS encryption with auto-generated certificates
Server-to-server federation capability

CLI Commands (jabberctl):

install/uninstall - Container lifecycle
start/stop/restart/status - Service control
user add/del/passwd/list - User management
room create/delete/list - MUC room management
emancipate <domain> - Public exposure with HAProxy + SSL + DNS

LuCI Dashboard:

Status overview with service state and user count
Service controls (start/stop/update/uninstall)
User management (add/delete users)
Emancipate workflow for public exposure
Connection info display (XMPP, BOSH, WebSocket URLs)
Log viewer with refresh

2026-02-19: Jabber/XMPP Deployment and Fixes

Deployment:

Installed Jabber at xchat.gk2.secubox.in
Created admin user: admin@xchat.gk2.secubox.in
Fixed pf.gk2.secubox.in routing (was pointing to jabber, now streamlit_prompt)

Fixes Applied:

Fixed Prosody process detection (lua.*prosody pattern instead of prosody)
Fixed startup script to run Prosody as prosody user (not root)
Fixed SSL certificate generation (openssl instead of prosodyctl)
Added xchat.gk2.secubox.in route to mitmproxy-in haproxy-routes.json
Fixed route IP from 127.0.0.1 to 192.168.255.1 for container accessibility

2026-02-19: VoIP + Jabber Integration (Asterisk PBX)

New Packages:

secubox-app-voip - LXC-based Asterisk PBX server
luci-app-voip - LuCI dashboard for VoIP management

Features:

Debian 12 (Bookworm) LXC container with Asterisk PBX
OVH Telephony API integration for SIP trunk auto-provisioning
SIP extension management with PJSIP
Asterisk ARI/AMI support for call control
Click-to-call web interface
HAProxy integration with WebRTC support
Procd service management

CLI Commands (voipctl):

install/uninstall - Container lifecycle
start/stop/restart/status - Service control
ext add/del/passwd/list - Extension management
trunk add ovh/manual - SIP trunk configuration
trunk test/status - Trunk connectivity testing
call/hangup/calls - Call origination and control
vm list/play/delete - Voicemail management
configure-haproxy - WebRTC proxy setup
emancipate <domain> - Public exposure

OVH Telephony Integration (ovh-telephony.sh):

API signature generation (HMAC-SHA1)
Billing accounts and SIP lines discovery
SIP credentials retrieval and password reset
SMS sending via OVH SMS API
Auto-provisioning flow for trunk configuration

LuCI Dashboard (luci-app-voip):

Overview with container/Asterisk/trunk status
Extensions management (add/delete)
Trunks configuration (OVH auto-provision, manual)
Click-to-call dialer with extension selector
Active calls display with live polling
Quick dial buttons for extensions
Logs viewer

Jabber VoIP Integration (Phase 3):

Jingle VoIP support via mod_external_services
STUN/TURN server configuration
SMS relay via OVH (messages to sms@domain)
Voicemail notifications via Asterisk AMI → XMPP
New jabberctl commands: jingle enable/disable/status, sms config/send, voicemail-notify
New RPCD methods: jingle_status/enable/disable, sms_status/config/send, voicemail_status/config
Updated UCI config with jingle, sms, and voicemail sections

Files Created:

package/secubox/secubox-app-voip/Makefile
package/secubox/secubox-app-voip/files/etc/config/voip
package/secubox/secubox-app-voip/files/etc/init.d/voip
package/secubox/secubox-app-voip/files/usr/sbin/voipctl
package/secubox/secubox-app-voip/files/usr/lib/secubox/voip/ovh-telephony.sh
package/secubox/luci-app-voip/Makefile
package/secubox/luci-app-voip/root/usr/libexec/rpcd/luci.voip
package/secubox/luci-app-voip/root/usr/share/luci/menu.d/luci-app-voip.json
package/secubox/luci-app-voip/root/usr/share/rpcd/acl.d/luci-app-voip.json
package/secubox/luci-app-voip/htdocs/.../voip/api.js
package/secubox/luci-app-voip/htdocs/.../view/voip/overview.js
package/secubox/luci-app-voip/htdocs/.../view/voip/extensions.js
package/secubox/luci-app-voip/htdocs/.../view/voip/trunks.js
package/secubox/luci-app-voip/htdocs/.../view/voip/click-to-call.js

Files Modified:

package/secubox/secubox-app-jabber/files/usr/sbin/jabberctl (added VoIP integration)
package/secubox/secubox-app-jabber/files/etc/config/jabber (jingle/sms/voicemail sections)
package/secubox/luci-app-jabber/root/usr/libexec/rpcd/luci.jabber (VoIP methods)
package/secubox/luci-app-jabber/root/usr/share/rpcd/acl.d/luci-app-jabber.json (VoIP ACL)

WAF VoIP/XMPP Protection & Jitsi Meet (2026-02-19)
- Added 4 new WAF categories to mitmproxy for VoIP/Jabber protection:
  - voip: 12 SIP/VoIP security patterns (header injection, ARI abuse, AMI injection)
  - xmpp: 10 XMPP/Jabber patterns (XSS, XXE, BOSH hijack, OOB file access)
  - cve_voip: 9 CVE patterns for Asterisk/FreePBX/Kamailio/OpenSIPS
  - cve_xmpp: 8 CVE patterns for Prosody/ejabberd/Tigase/Strophe
- Updated waf-rules.json to version 1.1.0 with comprehensive attack detection
- Added autoban options ban_voip and ban_xmpp for automatic IP blocking
- Updated mitmproxy-waf-sync to include new categories in JSON sync
- Self-Hosted Jitsi Meet: Full deployment in LXC container
  - Prosody XMPP server on port 5380 (internal only)
  - Jicofo conference focus component
  - JVB (Jitsi Videobridge) for WebRTC media
  - Nginx reverse proxy on port 9088
  - HAProxy vhost at meet.gk2.secubox.in with Let's Encrypt SSL
  - WAF bypass enabled for WebRTC compatibility
  - Webchat updated to use self-hosted Jitsi instead of meet.jit.si
  - Full video conferencing capability without external dependencies

133 KiB Raw Blame History Unescape Escape

SecuBox UI & Theme History

2026-02-14: Fixed Streamlit apps + WAF compatibility

Problem

Root Cause

Solution

Files Modified

Result

2026-02-14: Docker to LXC Migration - Mail Services

Converted Services

LXC Configurations

Result

2026-02-14: Docker to LXC Migration - Jellyfin

Converted Service

LXC Configuration

HAProxy Updates

Auto-start Script

Result

2026-02-14: Domoticz Exposure & WAF Redirect Fix

Domoticz Exposed via HAProxy

HAProxy Configuration

WAF Redirect Loop Fix

Domoticz Configuration

Result

2026-02-14: Vhost Routing Fixes & Glances Installation

Mitmproxy Routes Duplicate Fix

Service Backend Fixes

Pinafore Static Server

Glances Installation

Verified Services

Total Operational

2026-02-14: C3BOX SDLC Full Service Verification

All 70 Services Verified Operational

Services by Zone

Streamlit Apps (20 verified)

MetaBlog Sites (15 verified)

Infrastructure Services

Mesh Statistics

2026-02-14: WAF Architecture Configuration

WAF Routing Strategy

Path ACL Fix

Architecture

2026-02-14: Streamlit WebSocket WAF Bypass

Issue

Root Cause

Fix

Affected Apps

2026-02-14: MetaBlogizer SDLC Content Restoration

Issue

Root Cause

Fix

Verification

2026-02-14: Wazuh SIEM LuCI Dashboard Integration

2026-02-14: mitmproxy WAF Wildcard Route Priority Fix

2026-02-15: PeerTube Video Platform Package

2026-02-15: PeerTube LuCI Dashboard

2026-02-15: Generative LuCI Navigation Tree

2026-02-15: PeerTube Configuration Fixes

2026-02-15: HAProxy & Mitmproxy WAF Fixes

2026-02-15: PeerTube Email Configuration

2026-02-15: Wazuh Agent Watchdog

2026-02-15: Service Fixes

2026-02-15: Mailserver gk2 Account Restoration

2026-02-15: Gitea Repository Privacy Fix

2026-02-15: Mitmproxy WAF Dashboard Data Path Fix

2026-02-15: PeerTube Transcoding Jobs Fix

2026-02-15: GK2 Hub Landing Page Subdomain URLs

2026-02-16: Nextcloud LXC Enhancement

2026-02-16: Nextcloud SSL, WAF Rules & Mail Autoconfig

2026-02-16: Mailserver LuCI KISS Enhancement

2026-02-16: DNS Master LuCI App

2026-02-16: HexoCMS Multi-Instance Enhancement

2026-02-16: Mail Server Alias Management

2026-02-16: Mail Autoconfig & Repair Features

2026-02-16: Mailserver Password Reset Fix

2026-02-16: Nextcloud User Management & WAF Fixes

2026-02-16: Mail Reception Fix

2026-02-16: Mailctl Firewall & Nextcloud Upgrade

2026-02-17: v0.20.6 Release - Mailserver, Nextcloud & DNS Master Fixes

2026-02-17: WebRadio LuCI App

133 KiB

Raw Blame History