Trixie

Debian 13 (Trixie)

Français

🟢 ROOT — Debian system

What it is for. Know what the Debian 13 (Trixie) base changes for SecuBox, what the current release ships, how to upgrade a Debian 12 box in place, and which traps were met.

Debian 13 (Trixie) is the base of SecuBox from alpha 9. Packages are built as ~trixie1 and published in the trixie suite of apt.secubox.in, for arm64 and amd64. The bookworm suite no longer evolves.

What the current release ships

The v3.0.0-alpha.12 line (October 2026, pre-release) is entirely Trixie:

Target	Image
x86-64 live USB (UEFI and BIOS)	secubox-live-amd64-trixie.img.gz
x86-64 headless installer (erases the first disk)	secubox-installer-amd64-trixie.iso.gz / .img.gz
VM x64 (VirtualBox, QEMU)	secubox-full-vm-x64-trixie.img.gz, secubox-isp-vm-x64-trixie.img.gz
Raspberry Pi 4 / 400	secubox-full-rpi-arm64-trixie.img.gz, secubox-isp-rpi-arm64-trixie.img.gz
MOCHAbin	secubox-lite-mochabin-trixie.img.gz, secubox-isp-mochabin-trixie.img.gz
ESPRESSObin v7	secubox-lite-espressobin-v7-trixie.img.xz

How to use them: Installation, Live-USB.

What changes

	bookworm (12)	trixie (13)
Kernel	6.6 LTS	6.12
Python	3.11	3.13
nginx	1.22	1.26
HAProxy	2.6	3.0
Unbound	1.17	1.26
LXC	5.0	6.0

In-place upgrade (tested on two machines)

A Debian 12 box was upgraded to Debian 13 and validated on an amd64 PC and on a MOCHAbin (about 10 and 45 minutes, no SecuBox package removed). Steps:

1. Save the reference state (active services, listening ports, containers, /etc/apt).
2. Point the apt sources to trixie, trixie-updates and trixie-security.
3. Block unwanted packages with an apt preference: exim4* (mail lives in a container) and, on the MOCHAbin, the Debian kernels.
4. Simulate (apt-get -s full-upgrade), then apt upgrade --without-new-pkgs and apt full-upgrade, in a detached systemd unit, with the apt cache on a data volume if the root is small.
5. Install python3-python-multipart, recreate the remaining Python virtual environments, reboot, then compare with the reference state.

Traps met

Symptom	Cause	Remedy
Several modules in a restart loop	python-multipart installed by pip for Python 3.11	python3-python-multipart (not python3-multipart, a different library)
A virtual-environment module no longer starts	Venv built for Python 3.11	Recreate the venv (the billets package now does it by itself)
nftables fails, and the mesh too	Interfaces become end0 and end1	net.ifnames=0 on the kernel command line
421 on every public site in a browser	HAProxy 3.0 negotiates HTTP/2; the URI rewrite used %[url]	%[pathq] (fixed in secubox-haproxy 1.8.26)
systemctl is-active fails during the upgrade	systemd upgrades itself	Follow an end message in the journal, not the unit state
The surfer answers 502 on a .onion	It forced https	http for .onion (fixed in secubox-surf 1.0.30)
LAN DNS stays down ~4 min after a reboot	Unbound loads hundreds of thousands of zones and exceeded the 90 s start timeout	600 s start timeout (secubox-dns-lan 0.1.1)
A module fails at first start then recovers alone	The socket chmod waited 15 s; under boot load that was too short	Wait 120 s; uvicorn forces the socket to 666, the chmod 660 stays essential
A container stays stopped after a reboot	lxc.service is masked on some machines (autostart inoperative)	VoiceStudio starts its container itself in permanent mode (0.5.4)
The radio rejects every track (403)	A cookies file refused by YouTube	ytsas retries without cookies for public videos (0.2.13)

MOCHAbin: kernel

The MOCHAbin now boots on the standard Debian 6.12 kernel, with a SecuBox configuration fragment (board/mochabin/kernel/config-6.12-stock-wan.fragment) that builds into the kernel what the WAN port (eth2) needs: I2C controller, SFP cages, PHYLINK, MVPP2, Marvell PHY, and the DSA switch with its bridge. The board boots through extlinux, not boot.scr, and the previous SecuBox-built kernel is no longer kept.

Why the DSA switch must be built in: loaded as a module, it arrived after the network opened eth2; the network driver then switched its buffers again, reopened all ports, and the eth2 PHY never came back up (no link). Built in, it is ready before services start and the link comes up in seconds. NET_DSA also depends on HSR: an HSR left as a module capped it at module, so it is built in too.

Replacing a kernel of the same version: /boot is vfat and dpkg makes no backup link there. Remove System.map-<version> and config-<version> first, then install, then regenerate the initrd.

Next

Application containers stay on bookworm and move to Trixie one by one. Tracking: #1294 and #1997.

See also

• Installation - choose an installation path
• Live-USB - the Trixie live stick
• ARM-Installation - ARM boards and U-Boot
• Profils - lite, isp, full
• Troubleshooting