First Boot Premier Pas

First Boot: Premier Pas

Français

🔴 BOOT — deployment and provisioning

What it is for. Take a brand-new box from "just powered on" to "configured": name, clock, administrator, network and domain, services profile, mesh, updates. One engine, one profile file, several faces (the screen you use): a console wizard on tty1, a web wizard in the kiosk, a master panel on another box, or no face at all (silent). The same package family also decides which local interface the box shows afterwards: the WebUI kiosk or the text console.

One engine, four faces

premier-pasctl validates a profile step by step, shows the exact plan, and applies it by driving the existing SecuBox tools. An incomplete profile is never half-applied: the wizard resumes at the missing step. No password is stored in clear (only an argon2 hash).

Face	Where	When
Console (TUI)	tty1, a 64-column curses screen that also works on a serial console	new box, no completion marker
Web wizard	premier-pas/ page, opened by the kiosk with a one-time start code	new box with a screen
Master panel	the administrator panel of another SecuBox	prepare a profile for a future box, export it, or push it to a box that displays its start code
Silent	secubox-premier-pas.service	a complete profile is found: applied with no screen

Where a ready profile is looked for

In order: /boot/secubox/profil.toml, /boot/firmware/secubox/profil.toml (Raspberry Pi), then a USB stick labelled SBXPROFIL (mounted read-only just long enough to read it). A profile may also be named on the kernel line with secubox.profil=<path>. If it is complete, the box applies itself; if not, the wizard opens at the first missing step.

Check a file beforehand: premier-pasctl examiner --profil <file>; see the plan: premier-pasctl plan --profil <file>.

The steps

#	Step	Drives	Notes
1	Welcome
2	Box name	hostnamectl, /etc/hosts, Avahi announce
3	Clock	timedatectl (time zone, NTP)	before the administrator: TOTP enrolment depends on the time
4	Administrator	secubox-auth user engine	password = argon2 hash or "ask on screen"; TOTP is enrolled on the box screen at first login
5	Network and domain	secubox-net-detect apply router|bridge|single	mode routeur, pont or lan; the domain is absent in lan mode
6	Services	secubox-profilectl apply <profile> --yes	a profile of Profils (lite, isp, full...) or "keep the current modules"
7	Mesh	sbx-mesh-join	rejoindre (join a master box with an invitation token), premiere, plus_tard
8	Updates	secubox-majauto timer	nightly, SecuBox packages only, from the signed repository
9	Apply		steps run in order and stop at the first error

Network detection

The network step applies the chosen mode through secubox-net-detect. In lan mode on an image that does not ship that tool, there is one network card and nothing to reconfigure: the existing network is kept, after checking that a default route exists (otherwise the step fails and says so, because the next steps, apt and tunnel, would go nowhere). routeur and pont need the tool and fail clearly without it.

Completion marker

The marker /var/lib/secubox/.premier-pas-fait is written only at the very end, after every step succeeded. While it is absent, the wizard units are allowed to start; once it exists they never start again. Progress is visible with premier-pasctl etat; the journal is /var/log/secubox/premier-pas.log.

Console keys

Key	Action
Tab	next field
Up / Down, Left / Right, + / -, space, digit	choose an option
Enter	continue
Esc	back
F10	quit (the box console gets tty1 back)

Web wizard and start code

A new box has no administrator yet, so there is no session to require. Instead root creates a start code in /run when the wizard starts; the kiosk launcher passes it to the page, and the console shows it on the box screen. Only someone in front of the box (or on its console) holds the code. Once the box is configured, writes are refused. A master box can push a proposal to a new box with that code; the new box shows it and the person at the screen accepts or refuses it.

Conditional faces

The wizard never competes with the other ways of setting a box up:

Situation	Behaviour
Marker present (box configured)	no wizard unit starts
A signed Auto-Load answers file is present	the manual wizard stays closed (it would overwrite the signed name and network), unless the Auto-Load agent gave up (marker abandon.json): the wizard then takes over
No answers file	wizard, start code and master proposals as usual

See Auto-Load for the unattended path.

Local interface after setup: kiosk or console

The package secubox-console ships the text console (TUI) and two systemd drop-ins that make the two local interfaces mutually exclusive, so they never fight for the screen:

Drop-in	Effect
kiosk-sentinelle.conf	the WebUI kiosk unit (secubox-kiosk) starts only if /var/lib/secubox/.kiosk-enabled exists. It is a unit condition, so on a headless box the unit is skipped cleanly instead of failing (a failing unit used to make the profile engine cancel a whole apply)
console-sans-kiosque.conf	the console TUI (secubox-console, tty1) starts only if that sentinel is absent

So: kiosk enabled = Chromium full screen on the WebUI; kiosk off or absent (no screen, serial port, no X) = text console on tty1. The kiosk and the console are part of every profile; their units simply do not start when their condition is not met.

Switching

secubox-kiosk-setup status       # current mode
secubox-kiosk-setup enable       # GUI kiosk (X11 by default, --wayland available)
secubox-kiosk-setup disable      # back to the console
secubox-kiosk-setup console      # console TUI on tty1 (turns the kiosk off)
secubox-kiosk-setup no-console   # no TUI: plain login on tty1

On the live image the boot menu offers "Kiosk GUI" (default) and "Console TUI" entries (kernel parameters secubox.kiosk=1 and secubox.mode=tui). If the kiosk fails three times in a row it disables itself to avoid a boot loop; re-enable it with touch /var/lib/secubox/.kiosk-enabled.

The console TUI

Screens: Dashboard (CPU, memory, disk, uptime, health), Services (start, stop, restart, enable, disable), Network (interfaces), Logs (per unit), Menu (system information, reboot, shutdown, kiosk toggle).

Key	Screen
d / s / n / l / m	Dashboard / Services / Network / Logs / Menu
r	refresh
j k h	down, up, back
q	quit

On the Services screen: Enter toggles, R restarts, e enables, D disables. The console talks to the modules over their Unix sockets and falls back to local commands when a socket is missing. It also has SOC fleet screens when a SOC gateway is configured. Board colours: MOCHAbin (sky blue, PRO), ESPRESSObin v7 (green, LITE), ESPRESSObin Ultra (teal), x64 VM (purple), x64 bare metal (orange), Raspberry Pi (pink).

Troubleshooting

Symptom	Cause	What to do
Wizard never appears on a box with a signed answers file	by design: Auto-Load owns the setup	follow autoload-agentctl etat; after 8 failures the wizard takes over
Black screen, no kiosk	no .kiosk-enabled sentinel, or kiosk disabled itself after 3 failures	secubox-kiosk-setup enable or use the console
"Network" step fails	no default route in lan mode, or secubox-net-detect missing for routeur/pont	plug the cable, fix the network, then resume: the wizard restarts at the failed step
Mesh join times out	master not reachable right after the network change	the step retries; check the master and the invitation token (valid 15 minutes)

See also

• Auto-Load - unattended provisioning
• Profils - what each services profile installs
• Installation, Live-USB - getting an image onto a machine
• Configuration - settings after first boot
• Troubleshooting