EN | FR | 🟢 ROOT | companion of Modules-by-Profile

Find a module by what it does. Each family below lists its modules with one line each, and, in brackets, the profile that ships it (lite, isp or full; see Modules-by-Profile). Only modules listed in the dependencies of the three profile packages are shown here; the complete catalogue, with every optional module, is in MODULES-EN.

The family follows the theme field of each module's menu entry (menu.d/*.json); modules without a menu entry (such as core or aggregator) are placed by role. Names are shown without the secubox- prefix.

Core libraries, system, provisioning, secrets and certificates.

• core — shared Python library, JWT, TOML config, first-boot scripts (lite)
• aggregator — master API gateway that mounts module APIs under /api/v1/ (lite)
• system — system configuration and management (lite)
• hardening — kernel and system hardening (sysctl, AppArmor, kernel modules) (lite)
• premier-pas — prepare, export or push the first-boot profile of a future box (lite)
• autoload-agent — box-side Auto-Load provisioning agent (outgoing tunnel only) (lite)
• console — terminal dashboard (TUI) on tty1 (lite)
• health — health probers for vhosts and modules (lite)
• profiles — module inventory, memory cost and desired-state profiles (lite)
• appstore — install, enable and configure SecuBox modules (lite)
• backup — backup of system configs and LXC containers (lite)
• config-advisor — security configuration advisor (lite)
• vault — vault: sealed secrets, master key held in memory (lite)
• auth — authentication management (lite)
• certs — ACME SSL/TLS certificate management (lite)
• avatar — identity and avatar management (full)
• repo — APT repository manager (control plane of the package repository) (full)
• assist — consent-gated live assistance (full)

Dashboards, portal and the SBX OS desktop.

• hub — control center, overview and health monitor (lite)
• portal — authentication portal (lite)
• webos — normalized service registry that feeds the Hall (full)
• sbxos — the Hall as an installable PWA (full)
• surf — per-origin browsing relay (full)
• ephemeride — astronomy and calendar card of the Hall (full)
• sbxos-audio-mood — prosodic cues of the user's voice, analysed locally (full)

Topology, access control, DNS filtering, routing, VPN and operator networking.

• netmodes — network topology modes — see Network-Modes (lite)
• nac — network access control, zones, quarantine — see NAC (lite)
• ipv6guard — who is reachable over IPv6, in plain words (lite)
• wan-link-guard — watchdog for a marginal WAN link on a specific board (lite)
• dns — DNS master and zone management (lite)
• dns-guard — DNS anomaly detection, sinkhole and network-anomaly (lite)
• webfilter — content filtering by category — see Webfilter (lite)
• haproxy — TLS front end and load balancer (lite)
• wireguard — WireGuard VPN tunnel management (lite)
• routes — routing table viewer and manager (lite)
• qos — traffic shaping and bandwidth management (lite)
• freebox — Freebox connector: devices, connection, IPv6 firewall, redirections (lite)
• tor — Tor anonymity network and hidden services (lite)
• modem — LTE/5G modem management (isp)
• cdn — box caches and local APT repository — see Caches-and-Mirrors (isp)
• saas-relay — SaaS/API proxy relay (isp)
• reality — VLESS+Reality egress-point manager (isp)

WAF, traffic inspection, DNS ad blocking, threat detection and the SOC.

• waf-ng — sbxwaf engine and Actor Intelligence — see WAF (lite)
• ipblock — IP blocklist management from several sources (lite)
• ad-guard — ad and tracker blocking by device, Guardian dashboard — see DNS-Filtrage (lite)
• toolbox-ng — Go tools of the fleet (sbxmitm, sentinel, sbxdpi…) (lite)
• toolbox — digital booth: captive AP and MITM analyzer — see ToolBox (lite)
• dpi — deep packet inspection — see DPI-Vivant (lite)
• ndpid-engine — nDPId / nDPIsrvd flow classification daemons (lite)
• interceptor — supervision of the inspection chain — see Interceptor (lite)
• security-posture — posture score, compliance and findings (lite)
• threats — unified threats dashboard (lite)
• threatmesh — sovereign threat intelligence (feeds and mesh) — see ThreatMesh (lite)
• cookies — cookie tracking and privacy compliance (lite)
• soc — security operations center — see SOC (lite)

Trust between boxes and peer-to-peer networking.

• annuaire — federated trust directory, fleet view, delegated config scopes (lite)
• p2p — peer-to-peer network hub (isp)
• federation — SBX federation: certificates and membership (isp)
• mesh — 802.11s backhaul and Passpoint access point control (isp)

• metrics — system and traffic measurements — see Metrics (isp)

Hosted messaging, mail and micro-blogging.

• mail — mail server (Postfix/Dovecot) — see Messagerie (isp)
• matrix — federated encrypted chat server (isp)
• socialrelay — social network relay: fediverse, cached media, BBS threads (isp)
• billets — micro-blog gateway — see Billets (isp)
• messagerie — public wall and private messages for people and visitors (isp)

Hosted file, code and photo services.

• nextcloud — file sync and sharing (isp)
• gitea — Git server (isp)
• photoprism — photo management (full)

Sites, forums and news.

• metablogizer — static site publisher (isp)
• bbs — forums, library and publishing to billets (isp)
• metanews — news radar: several sources, one event, one discussion (isp)

The local assistant of the Hall.

• zia — local AI of the Hall: chat, object search, delegation (full)
• voice — local speech synthesis and recognition (full)

Radio, podcasts, video and music.

• radio — collaborative radio and television, shared programming (full)
• podcaster — subscribe, download and relay podcasts (full)
• peertube — federated video platform (full)
• jellyfin — media server running natively in an LXC container (full)
• ytsas — web-media gateway (full)
• media — detection, browsing and transfer between USB media (full)
• lyrion — music server and player control (full)

Home automation and AI.

• mqtt — MQTT broker (full)
• picobrew — homebrew fermentation controller (full)
• ai-gateway — AI data-sovereignty gateway (full)
• streamlit — Streamlit application platform (full)

A module absent from the three profiles stays installable by hand (apt install secubox-<module>).

• Optional: jitsi (video conferencing, needs an LXC container; only suggested by full), voicestudio (studio voice engine, recommended by full), sentinelle-gsm (recommended by lite; published for arm64 only).
• Specific hardware or use: eye-remote, rbs-sensor, led-heartbeat, meshtastic, daemon-c3box, voice-moteur, zia-llm, zkp, clamav, netboot, vm, soc-agent, ui-manager, daemon.
• Infrastructure, never on a client box: autoload (the Auto-Load workshop server); only its agent is in lite.

Modules-by-Profile · Profils · MODULES-EN · Architecture · Admin-Panels-Gallery · Cartes-du-Hall