Francais | Deutsch | 中文

🔴 BOOT — deployment and provisioning

What it is for. Pick the right way to put SecuBox on a machine: a live USB stick to try it, a headless installer to dedicate a PC, a ready-made image for a board, a virtual machine, or the APT repository on an existing Debian. SecuBox runs on Debian 13 (Trixie) since alpha 9 (see Trixie).

Pre-release. The current line is v3.0.0-alpha.12 (October 2026). Run it on a test box, not on the link your household depends on.

Image names follow secubox-<profile>-<board>-<suite>. Always check the release page for what a given release ships.

Large images are cut into parts of at most 1900 MB. Join them, then decompress:

cat secubox-full-vm-x64-trixie.img.gz.part* > secubox-full-vm-x64-trixie.img.gz
gunzip secubox-full-vm-x64-trixie.img.gz

sha256sum -c SHA256SUMS --ignore-missing

Works for any .img.gz (live, board images). Replace /dev/sdX by your USB stick or SD card, after checking with lsblk: everything on that device is erased.

lsblk
zcat secubox-live-amd64-trixie.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
sync

On Windows, extract the .img and write it with a tool such as Rufus or balenaEtcher. An .img.xz is read with xzcat instead of zcat. Details for the live stick: Live-USB.

secubox-installer-amd64-trixie boots, then installs SecuBox on the first suitable disk with no screen and no keyboard. Write the .img.gz to a USB stick with dd (above), or use the .iso.gz image file.

It erases that disk. The installer picks the first internal, non-removable disk in this order: /dev/nvme0n1, /dev/sda, /dev/vda, /dev/xvda, skipping the disk it booted from. With no terminal attached it waits 5 seconds and goes on without asking. Disconnect any disk you want to keep before booting it.

1. Boot the stick in UEFI or BIOS mode.
2. In the GRUB menu choose SecuBox Install (Headless Auto-Install). The other entries are the live system (default, 10 s timeout), no persistence, to RAM, safe mode and debug shells.
3. The machine partitions the disk (EFI, root, data), copies the system and reboots. Remove the stick when it restarts.
4. Reach the web UI (see "First boot").

An interactive run (with a confirmation prompt) is also possible from the live system: sudo secubox-installer. The live image has a disk installer too (boot entry "Install SecuBox to Disk", which lists the disks and lets you choose).

The fastest path, from a clone of the repository:

git clone https://github.com/CyberMind-FR/secubox-deb.git
cd secubox-deb
./image/create-vbox-vm.sh --download        # latest release, creates and boots the VM

Useful options: --download <tag> (for example v3.0.0-alpha.12), --name, --memory (default 4096 MB), --cpus (default 4), --bridge <host interface> (bridged instead of NAT), --headless, --no-start, --force. In NAT mode the host forwards 2222 -> 22 (SSH), 9443 -> 443 (HTTPS) and 8080 -> 80 (HTTP).

VirtualBox only runs amd64 images; ARM64 images go through QEMU (create-qemu-arm64-vm.sh, see QEMU-ARM64). Step-by-step pages: Live-USB-VirtualBox, Live-USB-QEMU, VirtualBox-Setup.

curl -fsSL https://apt.secubox.in/install.sh | sudo bash
sudo apt install secubox-lite      # or secubox-isp, secubox-full

Manual setup: put the repository key in a keyring and declare the trixie suite (arm64 and amd64 are published):

curl -fsSL https://apt.secubox.in/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/secubox-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/secubox-archive-keyring.gpg] https://apt.secubox.in trixie main" \
  | sudo tee /etc/apt/sources.list.d/secubox.list
sudo apt update
sudo apt install secubox-full

The bookworm suite no longer evolves.

Full composition: Profils. On an ESPRESSObin, secubox-install-emmc copies the running system from the microSD to the eMMC and refuses clearly if it does not fit.

1. Open https://<box address>/ (for a VirtualBox NAT VM: https://localhost:9443). The certificate is self-signed: check that the name or address is the one of the machine you just installed before accepting it.
2. Log in as admin. The bootstrap password is secubox, unless a /boot/admin_password file was supplied before the first boot; the account is marked to force a change at first login. Choose a long, unique passphrase.
3. A new box starts the first-boot wizard (name, clock, administrator, network, profile, mesh, updates): First-Boot-Premier-Pas.
4. Set the time zone and host name, replace the bootstrap certificate before any network exposure, and take a first snapshot.

If you lose access on the console: sudo secubox-passwd resets the portal account.

• Live-USB - try without installing
• Trixie - the Debian 13 base and the 12 to 13 upgrade
• Auto-Load - boxes that set themselves up
• First-Boot-Premier-Pas - the first-boot wizard
• Netboot-Install - install over the network
• ARM-Installation - boards and U-Boot
• Configuration - system setup
• Troubleshooting