Français

🔴 BOOT — deployment and provisioning

What it is for. Take a brand-new box from "just powered on" to "configured": name, clock, administrator, network and domain, services profile, mesh, updates. One engine, one profile file, several faces (the screen you use): a console wizard on tty1, a web wizard in the kiosk, a master panel on another box, or no face at all (silent). The same package family also decides which local interface the box shows afterwards: the WebUI kiosk or the text console.

premier-pasctl validates a profile step by step, shows the exact plan, and applies it by driving the existing SecuBox tools. An incomplete profile is never half-applied: the wizard resumes at the missing step. No password is stored in clear (only an argon2 hash).

In order: /boot/secubox/profil.toml, /boot/firmware/secubox/profil.toml (Raspberry Pi), then a USB stick labelled SBXPROFIL (mounted read-only just long enough to read it). A profile may also be named on the kernel line with secubox.profil=<path>. If it is complete, the box applies itself; if not, the wizard opens at the first missing step.

Check a file beforehand: premier-pasctl examiner --profil <file>; see the plan: premier-pasctl plan --profil <file>.

The network step applies the chosen mode through secubox-net-detect. In lan mode on an image that does not ship that tool, there is one network card and nothing to reconfigure: the existing network is kept, after checking that a default route exists (otherwise the step fails and says so, because the next steps, apt and tunnel, would go nowhere). routeur and pont need the tool and fail clearly without it.

The marker /var/lib/secubox/.premier-pas-fait is written only at the very end, after every step succeeded. While it is absent, the wizard units are allowed to start; once it exists they never start again. Progress is visible with premier-pasctl etat; the journal is /var/log/secubox/premier-pas.log.

A new box has no administrator yet, so there is no session to require. Instead root creates a start code in /run when the wizard starts; the kiosk launcher passes it to the page, and the console shows it on the box screen. Only someone in front of the box (or on its console) holds the code. Once the box is configured, writes are refused. A master box can push a proposal to a new box with that code; the new box shows it and the person at the screen accepts or refuses it.

The wizard never competes with the other ways of setting a box up:

See Auto-Load for the unattended path.

The package secubox-console ships the text console (TUI) and two systemd drop-ins that make the two local interfaces mutually exclusive, so they never fight for the screen:

So: kiosk enabled = Chromium full screen on the WebUI; kiosk off or absent (no screen, serial port, no X) = text console on tty1. The kiosk and the console are part of every profile; their units simply do not start when their condition is not met.

secubox-kiosk-setup status       # current mode
secubox-kiosk-setup enable       # GUI kiosk (X11 by default, --wayland available)
secubox-kiosk-setup disable      # back to the console
secubox-kiosk-setup console      # console TUI on tty1 (turns the kiosk off)
secubox-kiosk-setup no-console   # no TUI: plain login on tty1

On the live image the boot menu offers "Kiosk GUI" (default) and "Console TUI" entries (kernel parameters secubox.kiosk=1 and secubox.mode=tui). If the kiosk fails three times in a row it disables itself to avoid a boot loop; re-enable it with touch /var/lib/secubox/.kiosk-enabled.

Screens: Dashboard (CPU, memory, disk, uptime, health), Services (start, stop, restart, enable, disable), Network (interfaces), Logs (per unit), Menu (system information, reboot, shutdown, kiosk toggle).

On the Services screen: Enter toggles, R restarts, e enables, D disables. The console talks to the modules over their Unix sockets and falls back to local commands when a socket is missing. It also has SOC fleet screens when a SOC gateway is configured. Board colours: MOCHAbin (sky blue, PRO), ESPRESSObin v7 (green, LITE), ESPRESSObin Ultra (teal), x64 VM (purple), x64 bare metal (orange), Raspberry Pi (pink).

• Auto-Load - unattended provisioning
• Profils - what each services profile installs
• Installation, Live-USB - getting an image onto a machine
• Configuration - settings after first boot
• Troubleshooting