Portal

Portal — entry and session page 🟠

EN | FR | 🟠 AUTH | the box's front door: services, session, protection

What it is for. secubox-portal provides the login of the box and the /portal/ page: a read-only overview of the services, the identity and sessions of the person logged in, the protection state and the certificates. It decides nothing: it only displays.

• Package: secubox-portal · page /portal/ · API /api/v1/portal/ · config /etc/secubox/portal.toml
• Accounts are read from /etc/secubox/users.json (same store as secubox-auth).

---

The /portal/ page — Services et session

Read-only. Without a session the page says "Aucune mesure : session requise" with a link to the login form; a missing measurement shows "—", never a made-up zero. ?embed=1 embeds it (it announces its height), ?demo=1 shows fictitious data under an orange banner.

Block	Content
Tiles	health score and uptime, services online (WAF, HAProxy, nginx, system), active sessions and accounts, logins in 24 h, active bans, valid certificates and next renewal
Services	the four services tracked by the health report; a link is offered only when it exists
Quick access	links to the main panels, system resources
Session and identity	who is logged in (/portal/verify)
Open sessions	administrator sessions
Protection	today's WAF activity
Certificates	summary from the certificate monitor, see Certificates
Cookies · GDPR	cookie audit summary
Most visited sites / origin networks	last 60 minutes, by host and by AS
Latest events	the 5 latest portal events

A search box filters services, links and sites.

API

Method	Path	Guard	Purpose
GET	/health	none	liveness
GET	/status	read	version, number of sessions and accounts
GET	/summary	read	accounts, logins 24 h, recent events, webhooks
GET	/verify	read	validity and identity of the current session
GET	/theme, /branding	read	look of the login page
POST	/login, /logout, /recover	login	open and close a session; password recovery
GET/DELETE	/sessions, /sessions/{user}	session	list or close sessions
GET/POST/DELETE	/users, /users/create, /users/{user}, /users/change-password	session	accounts
GET	/history, /stats	session	events and counters
GET/POST/DELETE	/webhooks	session	notifications

---

Operations note — login.html is a shared path

The login form is the file /usr/share/secubox/www/login.html. It is shipped by secubox-portal alone (Replaces/Breaks: secubox-hub (<< 1.9.6~)). It handles the password step, the TOTP challenge for enrolled users, forced TOTP enrolment for the administrator, the one-minute elevation token handed over by the identity manager (#elevation=…) and ?deconnexion=1.

Why this matters. An old secubox-hub build used to ship its own bootstrap login.html (without TOTP) at the same path. Reinstalling it replaced the TOTP page: the administrator could no longer finish logging in, sessions.json stayed empty, and since sessions fail closed every module rejected every session — a box-wide lockout.

• Never ship login.html from another package, and never copy a stale one by hand.
• After reinstalling or downgrading secubox-hub or secubox-portal, check that the file is the portal's (it must contain the TOTP step).
• If a lockout happens, restore the portal's login.html from the secubox-portal package and log in again to recreate the sessions.
• The /portal/ page redesign (portal 2.4.0) does not touch login.html.

---

See also

• Certificates — the /certs/ page and renewal chain
• NAC — who is on the network
• WAF — the protection shown in the Protection block
• Admin-Panels-Gallery — the common Aurora panel style
• Architecture — the six-module stack