Modules-by-Profile — what each profile installs 🟢

EN | FR | 🟢 ROOT | companion of Modules-by-Family

What it is for

Know exactly which modules come with secubox-lite, secubox-isp and secubox-full. A profile is a meta-package: it contains nothing itself and pulls other packages through its dependencies. The profiles nest: isp = lite + operator + hosting, full = isp + the Hall content. The lists below are read from the debian/control of the three profile packages (versions are not repeated); names are shown without the secubox- prefix. The reasoning behind the profiles and the memory levels is in Profils.

What distinguishes the profiles

	lite	isp	full
Role	all the protection modules, no hosted service: no mail, no sites, no applications	lite plus the operator network and every hosting module	isp plus everything the Hall presents
Inherits from	—	secubox-lite	secubox-isp
Modules added	44	18	22
Typical content	firewall, WAF, DPI and MITM interception, DNS filtering, detection, access control, VPN, vault, backup, SOC	modem, caches and repository, relays, mesh, metrics; mail, Matrix, files, Git, sites, BBS, billets, news	the Hall itself, assistant and voice, media, home automation, AI
Not included	hosted services, media, the Hall desktop (webos, sbxos)	media, home automation, AI, the Hall desktop	specific hardware (screens, sensors), which stays on demand
Recommends	wireguard-tools, sentinelle-gsm	wireguard-tools	wireguard-tools, voicestudio (suggests jitsi)

secubox-lite — protection

• Foundation: core, aggregator, system, hardening, premier-pas, autoload-agent, console, health, profiles, appstore, backup, config-advisor, vault, auth, certs
• The Hall: hub, portal
• Network and DNS: netmodes, nac, ipv6guard, wan-link-guard, dns, dns-guard, webfilter, haproxy, wireguard, routes, qos, freebox, tor
• Shield: firewall, inspection and detection: waf-ng, ipblock, ad-guard, toolbox-ng, toolbox, dpi, ndpid-engine, interceptor, security-posture, threats, threatmesh, cookies, soc
• Mesh and federation: annuaire

secubox-isp — adds the operator and hosting layers

Everything in lite, plus:

• Network and DNS: modem, cdn, saas-relay, reality
• Mesh and federation: p2p, federation, mesh
• Supervision: metrics
• Correspondence: mail, matrix, socialrelay, billets, messagerie
• Cloud and files: nextcloud, gitea
• Publishing and watch: metablogizer, bbs, metanews

secubox-full — adds the Hall content

Everything in isp (and so lite), plus:

• Foundation: avatar, repo, assist
• The Hall: webos, sbxos, surf, ephemeride, sbxos-audio-mood
• Cloud and files: photoprism
• Assistant and voice: zia, voice
• Media: radio, podcaster, peertube, jellyfin, ytsas, media, lyrion
• Home and AI: mqtt, picobrew, ai-gateway, streamlit

Good to know

• Each module belongs to one profile only (a composition test checks it) or is declared outside the profiles; see the last section of Modules-by-Family.
• secubox-soc pulls the pages of other modules through its dependencies (waf-ng, dpi, webos): lite therefore carries them, even though webos is listed directly only in full.
• Before an image is built, scripts/verify-profile.sh <lite|isp|full> refuses a profile that references a module missing from the buildable packages or from the working set.
• The local interface (kiosk WebUI and TUI console) is part of every profile.

See also

Profils · Modules-by-Family · MODULES-EN · Installation · Live-USB · Operations-Release-Process