diff --git a/.github/workflows/build-secubox-cli.yml b/.github/workflows/build-secubox-cli.yml
new file mode 100644
index 00000000..56462dc9
--- /dev/null
+++ b/.github/workflows/build-secubox-cli.yml
@@ -0,0 +1,201 @@
+# SecuBox CLI — Build Go Binary
+# Builds the secubox meta-script generator for linux-amd64 and linux-arm64
+name: Build SecuBox CLI
+
+on:
+  push:
+    branches: [master, main]
+    paths:
+      - 'cmd/secubox/**'
+      - '.github/workflows/build-secubox-cli.yml'
+    tags: ['v*']
+  pull_request:
+    branches: [master, main]
+    paths:
+      - 'cmd/secubox/**'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version override (e.g., v2.8.0)'
+        required: false
+
+env:
+  GO_VERSION: '1.22'
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: cmd/secubox/go.sum
+
+      - name: Download dependencies
+        working-directory: cmd/secubox
+        run: go mod download
+
+      - name: Run tests
+        working-directory: cmd/secubox
+        run: go test -v -race -coverprofile=coverage.out ./...
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: cmd/secubox/coverage.out
+
+  build:
+    name: Build
+    needs: test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            suffix: linux-amd64
+          - goos: linux
+            goarch: arm64
+            suffix: linux-arm64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # For git describe
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: cmd/secubox/go.sum
+
+      - name: Determine version
+        id: version
+        run: |
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            VERSION="${{ github.event.inputs.version }}"
+          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            VERSION="${{ github.ref_name }}"
+          else
+            VERSION="$(git describe --tags --always --dirty 2>/dev/null || echo 'dev')"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Building version: $VERSION"
+
+      - name: Build binary
+        working-directory: cmd/secubox
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: 0
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+          COMMIT=$(git rev-parse --short HEAD)
+
+          go build -ldflags="-s -w \
+            -X main.Version=$VERSION \
+            -X main.BuildTime=$BUILD_TIME \
+            -X main.Commit=$COMMIT" \
+            -o secubox-${{ matrix.suffix }} .
+
+      - name: Compress binary
+        working-directory: cmd/secubox
+        run: |
+          tar -czvf secubox-${{ matrix.suffix }}.tar.gz secubox-${{ matrix.suffix }}
+          sha256sum secubox-${{ matrix.suffix }}.tar.gz > secubox-${{ matrix.suffix }}.tar.gz.sha256
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: secubox-${{ matrix.suffix }}
+          path: |
+            cmd/secubox/secubox-${{ matrix.suffix }}.tar.gz
+            cmd/secubox/secubox-${{ matrix.suffix }}.tar.gz.sha256
+
+  release:
+    name: Release
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Generate release notes
+        run: |
+          cat > RELEASE_NOTES.md << 'EOF'
+          # SecuBox CLI ${{ github.ref_name }}
+
+          Meta-script generator for SecuBox-DEB image building.
+
+          ## Features
+          - Profile-based image generation
+          - Board detection and auto-configuration
+          - A/B partition OTA updates
+          - GitHub releases integration
+
+          ## Downloads
+
+          | Platform | File | SHA256 |
+          |----------|------|--------|
+          | Linux x64 | `secubox-linux-amd64.tar.gz` | [checksum] |
+          | Linux ARM64 | `secubox-linux-arm64.tar.gz` | [checksum] |
+
+          ## Installation
+
+          ```bash
+          # Linux x64
+          curl -LO https://github.com/CyberMind-FR/secubox-deb/releases/download/${{ github.ref_name }}/secubox-linux-amd64.tar.gz
+          tar xzf secubox-linux-amd64.tar.gz
+          sudo mv secubox-linux-amd64 /usr/local/bin/secubox
+
+          # Linux ARM64
+          curl -LO https://github.com/CyberMind-FR/secubox-deb/releases/download/${{ github.ref_name }}/secubox-linux-arm64.tar.gz
+          tar xzf secubox-linux-arm64.tar.gz
+          sudo mv secubox-linux-arm64 /usr/local/bin/secubox
+          ```
+
+          ## Quick Start
+
+          ```bash
+          # Interactive wizard
+          secubox gen
+
+          # Generate for specific board
+          secubox gen --board mochabin --tier pro
+
+          # Build image
+          secubox build --board mochabin --output secubox.img
+
+          # Check hardware
+          secubox info
+
+          # OTA update
+          secubox ota update --url https://releases.secubox.in/v2.8.0/secubox-mochabin.img.gz
+          ```
+          EOF
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: SecuBox CLI ${{ github.ref_name }}
+          body_path: RELEASE_NOTES.md
+          files: |
+            artifacts/*.tar.gz
+            artifacts/*.sha256
+          draft: false
+          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
diff --git a/apt/README.md b/apt/README.md
new file mode 100644
index 00000000..53e063f2
--- /dev/null
+++ b/apt/README.md
@@ -0,0 +1,137 @@
+# SecuBox-DEB APT Repository
+
+Configuration files for the SecuBox APT package repository.
+
+## Repository Structure
+
+```
+/srv/apt/
+├── conf/
+│   ├── distributions    # Repository distributions config
+│   ├── options          # Global reprepro options
+│   └── incoming         # Incoming packages config
+├── db/                  # Reprepro database
+├── dists/               # Distribution metadata
+│   ├── bookworm/        # Stable releases
+│   └── bookworm-testing/ # Testing releases
+├── pool/                # Package files
+│   ├── main/            # Main component
+│   └── contrib/         # Contrib component
+├── incoming/            # Incoming packages drop
+└── tmp/                 # Temporary files
+```
+
+## Setup
+
+### Initialize Repository
+
+```bash
+# Create directory structure
+sudo mkdir -p /srv/apt/{conf,db,dists,pool,incoming,tmp}
+
+# Copy configuration
+sudo cp apt/conf/* /srv/apt/conf/
+
+# Set ownership
+sudo chown -R $(whoami) /srv/apt
+
+# Initialize
+cd /srv/apt
+reprepro export
+```
+
+### GPG Key Setup
+
+```bash
+# Generate signing key (if not exists)
+gpg --gen-key
+
+# Export public key for clients
+gpg --armor --export your@email.com > /srv/apt/secubox.gpg
+```
+
+## Usage
+
+### Publishing Packages
+
+```bash
+# Publish a single package
+./scripts/apt-publish.sh packages/secubox-core/*.deb
+
+# Publish to testing
+./scripts/apt-publish.sh -c bookworm-testing packages/*/*.deb
+
+# Skip lintian (not recommended)
+./scripts/apt-publish.sh --skip-lintian packages/*/*.deb
+
+# Dry run
+./scripts/apt-publish.sh -n packages/*/*.deb
+```
+
+### Syncing to Remote
+
+```bash
+# Preview sync
+./scripts/apt-sync.sh --dry-run
+
+# Full sync
+./scripts/apt-sync.sh
+
+# Verbose sync
+./scripts/apt-sync.sh --verbose
+```
+
+### Manual reprepro Commands
+
+```bash
+cd /srv/apt
+
+# Add package
+reprepro -C main includedeb bookworm /path/to/package.deb
+
+# Remove package
+reprepro remove bookworm package-name
+
+# List packages
+reprepro list bookworm
+
+# Check repository
+reprepro check
+```
+
+## Client Configuration
+
+### Adding Repository
+
+```bash
+# Add GPG key
+curl -fsSL https://apt.secubox.in/secubox.gpg | sudo gpg --dearmor -o /usr/share/keyrings/secubox.gpg
+
+# Add repository
+echo "deb [signed-by=/usr/share/keyrings/secubox.gpg] https://apt.secubox.in bookworm main" | \
+    sudo tee /etc/apt/sources.list.d/secubox.list
+
+# Update and install
+sudo apt update
+sudo apt install secubox-core
+```
+
+## Distributions
+
+| Codename | Description | Use Case |
+|----------|-------------|----------|
+| bookworm | Stable releases | Production |
+| bookworm-testing | Testing releases | Pre-release testing |
+
+## Components
+
+| Component | Description |
+|-----------|-------------|
+| main | Core SecuBox packages |
+| contrib | Community contributions |
+
+## Architectures
+
+- `arm64` - Primary target (MOCHAbin, ESPRESSObin, RPi)
+- `amd64` - VMs and x64 hardware
+- `all` - Architecture-independent packages
diff --git a/apt/conf/distributions b/apt/conf/distributions
new file mode 100644
index 00000000..a89e9ee0
--- /dev/null
+++ b/apt/conf/distributions
@@ -0,0 +1,27 @@
+# apt/conf/distributions
+# Reprepro configuration for SecuBox-DEB APT repository
+# Multi-arch support: arm64 + amd64
+
+Origin: SecuBox
+Label: SecuBox-DEB
+Suite: stable
+Codename: bookworm
+Version: 12
+Architectures: arm64 amd64 all source
+Components: main contrib
+Description: SecuBox-DEB packages for Debian Bookworm
+SignWith: default
+DebIndices: Packages Release . .gz .bz2
+DscIndices: Sources Release .gz .bz2
+
+Origin: SecuBox
+Label: SecuBox-DEB
+Suite: testing
+Codename: bookworm-testing
+Version: 12
+Architectures: arm64 amd64 all source
+Components: main contrib
+Description: SecuBox-DEB testing packages
+SignWith: default
+DebIndices: Packages Release . .gz .bz2
+DscIndices: Sources Release .gz .bz2
diff --git a/apt/conf/incoming b/apt/conf/incoming
new file mode 100644
index 00000000..325ea8c6
--- /dev/null
+++ b/apt/conf/incoming
@@ -0,0 +1,8 @@
+# apt/conf/incoming
+# Reprepro incoming configuration
+
+Name: default
+IncomingDir: incoming
+TempDir: tmp
+Allow: bookworm bookworm-testing
+Cleanup: on_deny on_error
diff --git a/apt/conf/options b/apt/conf/options
new file mode 100644
index 00000000..e0dc6ff2
--- /dev/null
+++ b/apt/conf/options
@@ -0,0 +1,6 @@
+# apt/conf/options
+# Reprepro global options
+
+verbose
+ask-passphrase
+basedir /srv/apt
diff --git a/apt/hooks/lintian-check b/apt/hooks/lintian-check
new file mode 100755
index 00000000..5d22b2ee
--- /dev/null
+++ b/apt/hooks/lintian-check
@@ -0,0 +1,32 @@
+#!/bin/bash
+# apt/hooks/lintian-check
+# Pre-publish hook to run lintian on packages before adding to repository
+# SecuBox-DEB - CyberMind
+
+set -euo pipefail
+
+DEB_FILE="$1"
+
+if [ ! -f "$DEB_FILE" ]; then
+    echo "ERROR: Package file not found: $DEB_FILE"
+    exit 1
+fi
+
+echo "=== Running lintian on $(basename "$DEB_FILE") ==="
+
+# Run lintian with appropriate checks
+# --fail-on error: Fail if there are errors
+# --suppress-tags: Suppress some common warnings for our use case
+LINTIAN_OPTS="--fail-on error"
+LINTIAN_OPTS="$LINTIAN_OPTS --suppress-tags debian-changelog-file-missing-or-wrong-name"
+LINTIAN_OPTS="$LINTIAN_OPTS --suppress-tags changelog-file-missing-in-native-package"
+LINTIAN_OPTS="$LINTIAN_OPTS --suppress-tags file-missing-in-root-dir"
+
+if lintian $LINTIAN_OPTS "$DEB_FILE"; then
+    echo "=== Lintian check PASSED ==="
+    exit 0
+else
+    echo "=== Lintian check FAILED ==="
+    echo "Package will not be added to repository."
+    exit 1
+fi
diff --git a/cmd/secubox/cmd/build.go b/cmd/secubox/cmd/build.go
index 7709ef63..01a0e6f5 100644
--- a/cmd/secubox/cmd/build.go
+++ b/cmd/secubox/cmd/build.go
@@ -92,7 +92,10 @@ func runBuild(cmd *cobra.Command, args []string) error {
 	// Resolve output directory
 	outputDir := buildOutput
 	if !filepath.IsAbs(outputDir) {
-		cwd, _ := os.Getwd()
+		cwd, err := os.Getwd()
+		if err != nil {
+			return fmt.Errorf("get working directory for output: %w", err)
+		}
 		outputDir = filepath.Join(cwd, outputDir)
 	}
 
diff --git a/cmd/secubox/cmd/fetch.go b/cmd/secubox/cmd/fetch.go
index 4a94cd41..563bd36e 100644
--- a/cmd/secubox/cmd/fetch.go
+++ b/cmd/secubox/cmd/fetch.go
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
 
@@ -33,6 +34,12 @@ const (
 	progressBarSize = 50
 )
 
+// Package-level HTTP client for connection reuse
+var httpClient = &http.Client{Timeout: defaultTimeout}
+
+// Version tag regex for validation
+var versionTagRe = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
+
 // supportedBoards lists boards that have pre-built images
 var supportedBoards = []string{
 	"mochabin",
@@ -161,6 +168,10 @@ func runFetch(cmd *cobra.Command, args []string) error {
 	if checksumAsset != nil {
 		fmt.Printf("\nVerifying checksum...\n")
 		if err := verifyChecksum(outputPath, checksumAsset, imageAsset.Name); err != nil {
+			// Clean up corrupted file
+			if rmErr := os.Remove(outputPath); rmErr != nil {
+				fmt.Fprintf(os.Stderr, "warning: could not remove corrupted file: %v\n", rmErr)
+			}
 			return fmt.Errorf("checksum verification failed: %w", err)
 		}
 		fmt.Printf("Checksum verified OK\n")
@@ -234,7 +245,6 @@ func listReleases() error {
 func getReleases() ([]GitHubRelease, error) {
 	url := fmt.Sprintf("%s/repos/%s/%s/releases", githubAPIBase, githubOwner, githubRepo)
 
-	client := &http.Client{Timeout: 30 * time.Second}
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {
 		return nil, err
@@ -242,7 +252,7 @@ func getReleases() ([]GitHubRelease, error) {
 	req.Header.Set("Accept", "application/vnd.github.v3+json")
 	req.Header.Set("User-Agent", "secubox-cli/"+version)
 
-	resp, err := client.Do(req)
+	resp, err := httpClient.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -261,20 +271,23 @@ func getReleases() ([]GitHubRelease, error) {
 	return releases, nil
 }
 
-func getRelease(version string) (*GitHubRelease, error) {
+func getRelease(ver string) (*GitHubRelease, error) {
 	var url string
-	if version == "" {
+	if ver == "" {
 		url = fmt.Sprintf("%s/repos/%s/%s/releases/latest", githubAPIBase, githubOwner, githubRepo)
 	} else {
 		// Normalize version tag
-		tag := version
+		tag := ver
 		if !strings.HasPrefix(tag, "v") {
 			tag = "v" + tag
 		}
+		// Validate version format to prevent URL injection
+		if !versionTagRe.MatchString(tag) {
+			return nil, fmt.Errorf("invalid version format: %s", ver)
+		}
 		url = fmt.Sprintf("%s/repos/%s/%s/releases/tags/%s", githubAPIBase, githubOwner, githubRepo, tag)
 	}
 
-	client := &http.Client{Timeout: 30 * time.Second}
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {
 		return nil, err
@@ -282,17 +295,17 @@ func getRelease(version string) (*GitHubRelease, error) {
 	req.Header.Set("Accept", "application/vnd.github.v3+json")
 	req.Header.Set("User-Agent", "secubox-cli/"+version)
 
-	resp, err := client.Do(req)
+	resp, err := httpClient.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusNotFound {
-		if version == "" {
+		if ver == "" {
 			return nil, fmt.Errorf("no releases found")
 		}
-		return nil, fmt.Errorf("release %s not found", version)
+		return nil, fmt.Errorf("release %s not found", ver)
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -347,8 +360,7 @@ func downloadWithProgress(url, destPath string, totalSize int64) error {
 	defer out.Close()
 
 	// Start download
-	client := &http.Client{Timeout: defaultTimeout}
-	resp, err := client.Get(url)
+	resp, err := httpClient.Get(url)
 	if err != nil {
 		return fmt.Errorf("download: %w", err)
 	}
@@ -445,8 +457,7 @@ func (pr *progressReader) printProgress() {
 
 func verifyChecksum(filePath string, checksumAsset *GitHubAsset, imageName string) error {
 	// Download checksum file
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Get(checksumAsset.BrowserDownloadURL)
+	resp, err := httpClient.Get(checksumAsset.BrowserDownloadURL)
 	if err != nil {
 		return fmt.Errorf("download checksum: %w", err)
 	}
diff --git a/cmd/secubox/cmd/fetch_test.go b/cmd/secubox/cmd/fetch_test.go
index a8652bce..79452570 100644
--- a/cmd/secubox/cmd/fetch_test.go
+++ b/cmd/secubox/cmd/fetch_test.go
@@ -3,6 +3,7 @@ package cmd
 
 import (
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -225,7 +226,7 @@ type mockReader struct {
 
 func (m *mockReader) Read(p []byte) (int, error) {
 	if m.pos >= len(m.data) {
-		return 0, fmt.Errorf("EOF")
+		return 0, io.EOF
 	}
 	n := copy(p, m.data[m.pos:])
 	m.pos += n
diff --git a/cmd/secubox/cmd/root.go b/cmd/secubox/cmd/root.go
index 0d61bb38..ac4b2961 100644
--- a/cmd/secubox/cmd/root.go
+++ b/cmd/secubox/cmd/root.go
@@ -10,18 +10,32 @@ import (
 )
 
 var (
-	cfgFile string
-	verbose bool
-	version = "2.8.0"
+	cfgFile   string
+	verbose   bool
+	version   = "2.8.0"
+	buildTime = "unknown"
+	commit    = "unknown"
 )
 
+// SetVersionInfo sets build-time version information
+func SetVersionInfo(v, bt, c string) {
+	if v != "" {
+		version = v
+	}
+	if bt != "" {
+		buildTime = bt
+	}
+	if c != "" {
+		commit = c
+	}
+}
+
 var rootCmd = &cobra.Command{
 	Use:   "secubox",
 	Short: "SecuBox Image Generator & Manager",
 	Long: `SecuBox CLI tool for profile-based image generation,
-building, fetching pre-built images, and OTA updates.
-
-Version: ` + version,
+building, fetching pre-built images, and OTA updates.`,
+	Version: version,
 }
 
 func Execute() error {
@@ -32,6 +46,9 @@ func init() {
 	cobra.OnInitialize(initConfig)
 	rootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default: /etc/secubox/secubox.yaml)")
 	rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "verbose output")
+
+	// Set version template
+	rootCmd.SetVersionTemplate(fmt.Sprintf("secubox version %s\nBuild: %s\nCommit: %s\n", version, buildTime, commit))
 }
 
 func initConfig() {
diff --git a/cmd/secubox/internal/builder/builder.go b/cmd/secubox/internal/builder/builder.go
index 0e83ef58..087aca0b 100644
--- a/cmd/secubox/internal/builder/builder.go
+++ b/cmd/secubox/internal/builder/builder.go
@@ -17,6 +17,9 @@ import (
 // ValidStages lists all valid build stages in order
 var ValidStages = []string{"rootfs", "partition", "boot", "compress", "checksums"}
 
+// Package-level compiled regex for partition size parsing
+var partitionSizeRe = regexp.MustCompile(`^(\d+)([KMGT])$`)
+
 // Options holds builder configuration
 type Options struct {
 	Manifest     *manifest.Manifest
@@ -82,8 +85,7 @@ func ParsePartitionSize(size string) (int64, error) {
 		return 0, fmt.Errorf("empty size string")
 	}
 
-	re := regexp.MustCompile(`^(\d+)([KMGT])$`)
-	matches := re.FindStringSubmatch(strings.ToUpper(size))
+	matches := partitionSizeRe.FindStringSubmatch(strings.ToUpper(size))
 	if len(matches) != 3 {
 		return 0, fmt.Errorf("invalid size format: %s", size)
 	}
@@ -166,9 +168,11 @@ func (b *Builder) RunStage(stage string) ([]string, error) {
 	return cmds, nil
 }
 
-// execCommand executes a shell command
+// execCommand executes a shell command with error handling
 func (b *Builder) execCommand(cmd string) error {
-	c := exec.Command("sh", "-c", cmd)
+	// Wrap command with 'set -e' for fail-fast behavior
+	wrappedCmd := fmt.Sprintf("set -e\n%s", cmd)
+	c := exec.Command("sh", "-c", wrappedCmd)
 	c.Stdout = os.Stdout
 	c.Stderr = os.Stderr
 	return c.Run()
diff --git a/cmd/secubox/internal/builder/stages.go b/cmd/secubox/internal/builder/stages.go
index 03eb0f2d..be4abf68 100644
--- a/cmd/secubox/internal/builder/stages.go
+++ b/cmd/secubox/internal/builder/stages.go
@@ -200,50 +200,62 @@ func (b *Builder) stagePartition() ([]string, error) {
 		imagePath, dataStart, dataEnd,
 	))
 
-	// Set up loop device
-	cmds = append(cmds, fmt.Sprintf(
-		"LOOPDEV=$(losetup --find --show --partscan %s)",
-		imagePath,
-	))
-
-	// Format partitions
-	cmds = append(cmds, "mkfs.vfat -F 32 -n ESP ${LOOPDEV}p1")
-	cmds = append(cmds, "mkfs.ext4 -L rootfs ${LOOPDEV}p2")
-	cmds = append(cmds, "mkfs.ext4 -L data ${LOOPDEV}p3")
-
-	// Mount partitions and copy rootfs
+	// Mount operations as single script with cleanup trap
 	rootfs := b.rootfsPath()
 	mntDir := filepath.Join(b.outputDir, "mnt")
 
-	cmds = append(cmds, fmt.Sprintf("mkdir -p %s", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mount ${LOOPDEV}p2 %s", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mkdir -p %s/boot/efi", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mount ${LOOPDEV}p1 %s/boot/efi", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mkdir -p %s/srv", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mount ${LOOPDEV}p3 %s/srv", mntDir))
-
-	// Copy rootfs to image
-	cmds = append(cmds, fmt.Sprintf(
-		"cp -a %s/* %s/",
-		rootfs, mntDir,
-	))
-
-	// Generate fstab
+	// Generate fstab content
 	fstab := `# /etc/fstab - SecuBox generated
 LABEL=rootfs    /           ext4    errors=remount-ro   0   1
 LABEL=ESP       /boot/efi   vfat    umask=0077          0   2
 LABEL=data      /srv        ext4    defaults            0   2
 `
-	cmds = append(cmds, fmt.Sprintf(
-		"echo '%s' > %s/etc/fstab",
-		fstab, mntDir,
-	))
 
-	// Unmount and cleanup
-	cmds = append(cmds, fmt.Sprintf("umount %s/srv", mntDir))
-	cmds = append(cmds, fmt.Sprintf("umount %s/boot/efi", mntDir))
-	cmds = append(cmds, fmt.Sprintf("umount %s", mntDir))
-	cmds = append(cmds, "losetup -d ${LOOPDEV}")
+	// Single script with trap for cleanup on failure
+	mountScript := fmt.Sprintf(`set -e
+
+# Set up loop device
+LOOPDEV=$(losetup --find --show --partscan %s)
+
+# Cleanup function
+cleanup() {
+    umount %s/srv 2>/dev/null || true
+    umount %s/boot/efi 2>/dev/null || true
+    umount %s 2>/dev/null || true
+    losetup -d $LOOPDEV 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# Format partitions
+mkfs.vfat -F 32 -n ESP ${LOOPDEV}p1
+mkfs.ext4 -L rootfs ${LOOPDEV}p2
+mkfs.ext4 -L data ${LOOPDEV}p3
+
+# Mount partitions
+mkdir -p %s
+mount ${LOOPDEV}p2 %s
+mkdir -p %s/boot/efi
+mount ${LOOPDEV}p1 %s/boot/efi
+mkdir -p %s/srv
+mount ${LOOPDEV}p3 %s/srv
+
+# Copy rootfs to image
+cp -a %s/* %s/
+
+# Generate fstab
+cat > %s/etc/fstab << 'FSTAB_EOF'
+%sFSTAB_EOF
+
+# Cleanup runs via trap on exit
+`,
+		imagePath,
+		mntDir, mntDir, mntDir,
+		mntDir, mntDir, mntDir, mntDir, mntDir, mntDir,
+		rootfs, mntDir,
+		mntDir, fstab,
+	)
+
+	cmds = append(cmds, mountScript)
 
 	return cmds, nil
 }
@@ -258,31 +270,51 @@ func (b *Builder) stageBoot() ([]string, error) {
 		bootMethod = "uboot" // Default for ARM
 	}
 
-	// Set up loop device again for boot installation
-	cmds = append(cmds, fmt.Sprintf(
-		"LOOPDEV=$(losetup --find --show --partscan %s)",
-		imagePath,
-	))
-
 	mntDir := filepath.Join(b.outputDir, "mnt")
-	cmds = append(cmds, fmt.Sprintf("mount ${LOOPDEV}p2 %s", mntDir))
-	cmds = append(cmds, fmt.Sprintf("mount ${LOOPDEV}p1 %s/boot/efi", mntDir))
 
+	// Get boot-specific commands
+	var bootCmds []string
 	switch bootMethod {
 	case "uboot":
-		cmds = append(cmds, b.installUBoot(mntDir)...)
+		bootCmds = b.installUBoot(mntDir)
 	case "grub":
-		cmds = append(cmds, b.installGrub(mntDir)...)
+		bootCmds = b.installGrub(mntDir)
 	case "extlinux":
-		cmds = append(cmds, b.installExtlinux(mntDir)...)
+		bootCmds = b.installExtlinux(mntDir)
 	default:
-		cmds = append(cmds, fmt.Sprintf("# Unknown boot method: %s", bootMethod))
+		bootCmds = []string{fmt.Sprintf("echo 'Unknown boot method: %s'", bootMethod)}
 	}
 
-	// Unmount
-	cmds = append(cmds, fmt.Sprintf("umount %s/boot/efi", mntDir))
-	cmds = append(cmds, fmt.Sprintf("umount %s", mntDir))
-	cmds = append(cmds, "losetup -d ${LOOPDEV}")
+	// Single script with trap for cleanup on failure
+	bootScript := fmt.Sprintf(`set -e
+
+# Set up loop device
+LOOPDEV=$(losetup --find --show --partscan %s)
+
+# Cleanup function
+cleanup() {
+    umount %s/boot/efi 2>/dev/null || true
+    umount %s 2>/dev/null || true
+    losetup -d $LOOPDEV 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# Mount partitions
+mount ${LOOPDEV}p2 %s
+mount ${LOOPDEV}p1 %s/boot/efi
+
+# Boot installation commands
+%s
+
+# Cleanup runs via trap on exit
+`,
+		imagePath,
+		mntDir, mntDir,
+		mntDir, mntDir,
+		strings.Join(bootCmds, "\n"),
+	)
+
+	cmds = append(cmds, bootScript)
 
 	return cmds, nil
 }
diff --git a/cmd/secubox/internal/hardware/detect.go b/cmd/secubox/internal/hardware/detect.go
index 972c1139..8334fbd7 100644
--- a/cmd/secubox/internal/hardware/detect.go
+++ b/cmd/secubox/internal/hardware/detect.go
@@ -11,6 +11,9 @@ import (
 	"strings"
 )
 
+// Package-level compiled regex for performance
+var memTotalRe = regexp.MustCompile(`MemTotal:\s+(\d+)\s+kB`)
+
 // Info holds detected hardware information
 type Info struct {
 	Board      string
@@ -102,6 +105,18 @@ func detectCPU() (string, int) {
 		}
 	}
 
+	// Check for scanner errors
+	if err := scanner.Err(); err != nil {
+		// Log error but continue with what we have
+		if cores == 0 {
+			cores = runtime.NumCPU()
+		}
+		if model == "" {
+			model = "unknown"
+		}
+		return model, cores
+	}
+
 	// Fallback to runtime if no cores found
 	if cores == 0 {
 		cores = runtime.NumCPU()
@@ -122,15 +137,23 @@ func detectRAM() uint64 {
 	defer file.Close()
 
 	scanner := bufio.NewScanner(file)
-	re := regexp.MustCompile(`MemTotal:\s+(\d+)\s+kB`)
 
 	for scanner.Scan() {
-		matches := re.FindStringSubmatch(scanner.Text())
+		matches := memTotalRe.FindStringSubmatch(scanner.Text())
 		if len(matches) == 2 {
-			kb, _ := strconv.ParseUint(matches[1], 10, 64)
+			kb, err := strconv.ParseUint(matches[1], 10, 64)
+			if err != nil {
+				return 0
+			}
 			return kb * 1024 // Convert to bytes
 		}
 	}
+
+	// Check for scanner errors
+	if err := scanner.Err(); err != nil {
+		return 0
+	}
+
 	return 0
 }
 
diff --git a/cmd/secubox/internal/hardware/detect_test.go b/cmd/secubox/internal/hardware/detect_test.go
new file mode 100644
index 00000000..30f819ff
--- /dev/null
+++ b/cmd/secubox/internal/hardware/detect_test.go
@@ -0,0 +1,160 @@
+package hardware
+
+import (
+	"testing"
+)
+
+func TestDetect(t *testing.T) {
+	info, err := Detect()
+	if err != nil {
+		t.Fatalf("Detect() error = %v", err)
+	}
+
+	if info == nil {
+		t.Fatal("Detect() returned nil")
+	}
+
+	// Arch should always be detected
+	if info.Arch == "" {
+		t.Error("Arch should not be empty")
+	}
+
+	// CPUCores should be at least 1
+	if info.CPUCores < 1 {
+		t.Errorf("CPUCores = %d, want >= 1", info.CPUCores)
+	}
+}
+
+func TestSuggestTier(t *testing.T) {
+	tests := []struct {
+		name       string
+		ramTotalMB uint64
+		want       string
+	}{
+		{"lite - 1GB", 1024, "tier-lite"},
+		{"lite - 2GB", 2048, "tier-lite"},
+		{"standard - 4GB", 4096, "tier-standard"},
+		{"standard - 6GB", 6144, "tier-standard"},
+		{"pro - 8GB", 8192, "tier-pro"},
+		{"pro - 16GB", 16384, "tier-pro"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info := &Info{RAMTotalMB: tt.ramTotalMB}
+			got := info.SuggestTier()
+			if got != tt.want {
+				t.Errorf("SuggestTier() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestInfoString(t *testing.T) {
+	info := &Info{
+		Board:      "mochabin",
+		Arch:       "arm64",
+		CPUModel:   "Test CPU",
+		CPUCores:   4,
+		RAMTotalMB: 8192,
+	}
+
+	s := info.String()
+	if s == "" {
+		t.Error("String() returned empty string")
+	}
+
+	// Check that key information is present
+	if !contains(s, "mochabin") {
+		t.Error("String() should contain board name")
+	}
+	if !contains(s, "arm64") {
+		t.Error("String() should contain arch")
+	}
+	if !contains(s, "8192") {
+		t.Error("String() should contain RAM")
+	}
+}
+
+func TestIdentifyBoardFromModel(t *testing.T) {
+	tests := []struct {
+		model string
+		want  string
+	}{
+		{"GlobalScale MOCHAbin", "mochabin"},
+		{"Globalscale ESPRESSObin", "espressobin-v7"},
+		{"ESPRESSObin Ultra", "espressobin-ultra"},
+		{"Raspberry Pi 4 Model B", "rpi4"},
+		{"Raspberry Pi 5", "rpi5"},
+		{"Raspberry Pi 400", "rpi400"},
+		{"Marvell Armada 7040", "mochabin"},
+		{"Marvell Armada 3720", "espressobin-v7"},
+		{"Unknown Board", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.model, func(t *testing.T) {
+			got := identifyBoardFromModel(tt.model)
+			if got != tt.want {
+				t.Errorf("identifyBoardFromModel(%q) = %q, want %q", tt.model, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIdentifyBoardFromCompatible(t *testing.T) {
+	tests := []struct {
+		compatible string
+		want       string
+	}{
+		{"globalscale,mochabin", "mochabin"},
+		{"globalscale,espressobin", "espressobin-v7"},
+		{"raspberrypi,4-model-b", "rpi4"},
+		{"raspberrypi,400", "rpi400"},
+		{"unknown,board", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.compatible, func(t *testing.T) {
+			got := identifyBoardFromCompatible(tt.compatible)
+			if got != tt.want {
+				t.Errorf("identifyBoardFromCompatible(%q) = %q, want %q", tt.compatible, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIdentifyBoardFromDMI(t *testing.T) {
+	tests := []struct {
+		product string
+		want    string
+	}{
+		{"VirtualBox", "vm-x64"},
+		{"VMware Virtual Machine", "vm-x64"},
+		{"QEMU KVM", "vm-x64"},
+		{"Dell PowerEdge", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.product, func(t *testing.T) {
+			got := identifyBoardFromDMI(tt.product)
+			if got != tt.want {
+				t.Errorf("identifyBoardFromDMI(%q) = %q, want %q", tt.product, got, tt.want)
+			}
+		})
+	}
+}
+
+// Helper function
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsSubstr(s, substr))
+}
+
+func containsSubstr(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cmd/secubox/internal/ota/partition.go b/cmd/secubox/internal/ota/partition.go
index a4352801..f1409de6 100644
--- a/cmd/secubox/internal/ota/partition.go
+++ b/cmd/secubox/internal/ota/partition.go
@@ -58,6 +58,57 @@ type BootState struct {
 	IsRecovery   bool
 }
 
+// atomicWriteFile writes data to a file atomically using temp file + rename.
+// This prevents partial writes and race conditions.
+func atomicWriteFile(path string, data []byte, perm os.FileMode) error {
+	dir := filepath.Dir(path)
+
+	// Create temp file in same directory (required for atomic rename)
+	tmpFile, err := os.CreateTemp(dir, ".tmp-*")
+	if err != nil {
+		return fmt.Errorf("create temp file: %w", err)
+	}
+	tmpPath := tmpFile.Name()
+
+	// Clean up temp file on any error
+	defer func() {
+		if tmpPath != "" {
+			os.Remove(tmpPath)
+		}
+	}()
+
+	// Set permissions before writing content
+	if err := tmpFile.Chmod(perm); err != nil {
+		tmpFile.Close()
+		return fmt.Errorf("chmod temp file: %w", err)
+	}
+
+	// Write data
+	if _, err := tmpFile.Write(data); err != nil {
+		tmpFile.Close()
+		return fmt.Errorf("write temp file: %w", err)
+	}
+
+	// Sync to disk
+	if err := tmpFile.Sync(); err != nil {
+		tmpFile.Close()
+		return fmt.Errorf("sync temp file: %w", err)
+	}
+
+	if err := tmpFile.Close(); err != nil {
+		return fmt.Errorf("close temp file: %w", err)
+	}
+
+	// Atomic rename
+	if err := os.Rename(tmpPath, path); err != nil {
+		return fmt.Errorf("rename temp file: %w", err)
+	}
+
+	// Clear tmpPath so defer doesn't try to remove
+	tmpPath = ""
+	return nil
+}
+
 // GetActiveSlot reads the active boot slot from the boot control file
 func GetActiveSlot() (Slot, error) {
 	data, err := os.ReadFile(ActiveSlotFile)
@@ -143,7 +194,7 @@ func GetBootState() (*BootState, error) {
 	}, nil
 }
 
-// SetActiveSlot writes the active slot to the boot control file
+// SetActiveSlot writes the active slot to the boot control file atomically
 func SetActiveSlot(slot Slot) error {
 	if slot != SlotA && slot != SlotB {
 		return fmt.Errorf("invalid slot: %s", slot)
@@ -154,14 +205,15 @@ func SetActiveSlot(slot Slot) error {
 		return fmt.Errorf("create boot control dir: %w", err)
 	}
 
-	if err := os.WriteFile(ActiveSlotFile, []byte(string(slot)+"\n"), 0644); err != nil {
+	// Use atomic write: write to temp file then rename
+	if err := atomicWriteFile(ActiveSlotFile, []byte(string(slot)+"\n"), 0600); err != nil {
 		return fmt.Errorf("write active slot: %w", err)
 	}
 
 	return nil
 }
 
-// SetFallbackSlot writes the fallback slot to the boot control file
+// SetFallbackSlot writes the fallback slot to the boot control file atomically
 func SetFallbackSlot(slot Slot) error {
 	if slot != SlotA && slot != SlotB {
 		return fmt.Errorf("invalid slot: %s", slot)
@@ -172,14 +224,15 @@ func SetFallbackSlot(slot Slot) error {
 		return fmt.Errorf("create boot control dir: %w", err)
 	}
 
-	if err := os.WriteFile(FallbackSlotFile, []byte(string(slot)+"\n"), 0644); err != nil {
+	// Use atomic write with restrictive permissions
+	if err := atomicWriteFile(FallbackSlotFile, []byte(string(slot)+"\n"), 0600); err != nil {
 		return fmt.Errorf("write fallback slot: %w", err)
 	}
 
 	return nil
 }
 
-// SetBootCount sets the boot count value
+// SetBootCount sets the boot count value atomically
 func SetBootCount(count int) error {
 	if count < 0 {
 		count = 0
@@ -190,7 +243,8 @@ func SetBootCount(count int) error {
 		return fmt.Errorf("create boot control dir: %w", err)
 	}
 
-	if err := os.WriteFile(BootCountFile, []byte(strconv.Itoa(count)+"\n"), 0644); err != nil {
+	// Use atomic write with restrictive permissions
+	if err := atomicWriteFile(BootCountFile, []byte(strconv.Itoa(count)+"\n"), 0600); err != nil {
 		return fmt.Errorf("write boot count: %w", err)
 	}
 
@@ -312,13 +366,29 @@ func findRootDevice() (string, error) {
 
 // extractBaseDevice extracts the base device from a partition device
 // e.g., /dev/mmcblk0p2 -> /dev/mmcblk0
+// e.g., /dev/nvme0n1p2 -> /dev/nvme0n1
 // e.g., /dev/sda2 -> /dev/sda
+// e.g., /dev/loop0p1 -> /dev/loop0
 func extractBaseDevice(partDev string) string {
-	// Handle mmcblk and nvme style (e.g., /dev/mmcblk0p2 -> /dev/mmcblk0)
-	if strings.Contains(partDev, "mmcblk") || strings.Contains(partDev, "nvme") {
-		idx := strings.LastIndex(partDev, "p")
-		if idx > 0 {
-			return partDev[:idx]
+	// Handle devices with 'p' separator before partition number
+	// This includes: mmcblk0p2, nvme0n1p2, loop0p1
+	if strings.Contains(partDev, "mmcblk") || strings.Contains(partDev, "nvme") || strings.Contains(partDev, "loop") {
+		// Find the last 'p' followed by digits only
+		for i := len(partDev) - 1; i >= 0; i-- {
+			if partDev[i] == 'p' {
+				// Check if everything after 'p' is digits
+				suffix := partDev[i+1:]
+				allDigits := len(suffix) > 0
+				for _, c := range suffix {
+					if c < '0' || c > '9' {
+						allDigits = false
+						break
+					}
+				}
+				if allDigits {
+					return partDev[:i]
+				}
+			}
 		}
 	}
 
diff --git a/cmd/secubox/internal/profile/merger.go b/cmd/secubox/internal/profile/merger.go
index 736b3f72..e8fbb1ae 100644
--- a/cmd/secubox/internal/profile/merger.go
+++ b/cmd/secubox/internal/profile/merger.go
@@ -3,6 +3,7 @@ package profile
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 )
 
@@ -38,6 +39,48 @@ func (m *Merger) Resolve(name string) (*Profile, error) {
 	return m.resolveWithPath(name, make(map[string]bool))
 }
 
+// ResolveWithArch resolves a tier profile with architecture layer inserted.
+// Chain: base → arch/<arch> → tier → (optional tweaks)
+// This is the recommended method for full profile resolution.
+func (m *Merger) ResolveWithArch(tierName, arch string) (*Profile, error) {
+	// First resolve base
+	base, err := m.Resolve("base")
+	if err != nil {
+		return nil, fmt.Errorf("resolve base: %w", err)
+	}
+
+	// Check if arch profile exists
+	archProfilePath := filepath.Join(m.profilesDir, "arch", arch+".yaml")
+	var archProfile *Profile
+	if _, statErr := os.Stat(archProfilePath); statErr == nil {
+		// Load arch profile directly (don't follow its inherits, we already have base)
+		archProfile, err = Load(archProfilePath)
+		if err != nil {
+			return nil, fmt.Errorf("load arch profile %s: %w", arch, err)
+		}
+	}
+
+	// Load tier profile directly (don't follow its inherits, we build chain manually)
+	tierProfilePath := filepath.Join(m.profilesDir, tierName+".yaml")
+	tierProfile, err := Load(tierProfilePath)
+	if err != nil {
+		return nil, fmt.Errorf("load tier profile %s: %w", tierName, err)
+	}
+
+	// Build merge chain: base → arch → tier
+	result := base
+	if archProfile != nil {
+		result = m.merge(result, archProfile)
+	}
+	result = m.merge(result, tierProfile)
+
+	// Set final name/description from tier
+	result.Name = tierProfile.Name
+	result.Description = tierProfile.Description
+
+	return result, nil
+}
+
 // resolveWithPath resolves with cycle detection via visited map
 func (m *Merger) resolveWithPath(name string, visited map[string]bool) (*Profile, error) {
 	// Check for circular inheritance
diff --git a/cmd/secubox/internal/profile/profile_test.go b/cmd/secubox/internal/profile/profile_test.go
index 23afbe4e..86a76c35 100644
--- a/cmd/secubox/internal/profile/profile_test.go
+++ b/cmd/secubox/internal/profile/profile_test.go
@@ -242,6 +242,154 @@ boot:
 	}
 }
 
+func TestResolveWithArch(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create base profile
+	base := `
+name: base
+packages:
+  required:
+    - secubox-core
+kernel:
+  version: "6.6"
+  modules:
+    enable:
+      - wireguard
+sysctl:
+  net.ipv4.ip_forward: 1
+`
+	if err := os.WriteFile(filepath.Join(dir, "base.yaml"), []byte(base), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Create arch/arm64 profile
+	archDir := filepath.Join(dir, "arch")
+	if err := os.MkdirAll(archDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	archProfile := `
+name: arch-arm64
+inherits: base
+packages:
+  required:
+    - qemu-user-static
+kernel:
+  modules:
+    enable:
+      - cpufreq_dt
+sysctl:
+  vm.nr_hugepages: 64
+`
+	if err := os.WriteFile(filepath.Join(archDir, "arm64.yaml"), []byte(archProfile), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Create tier profile
+	tier := `
+name: tier-pro
+inherits: base
+packages:
+  required:
+    - secubox-full
+features:
+  dpi: inline
+`
+	if err := os.WriteFile(filepath.Join(dir, "tier-pro.yaml"), []byte(tier), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	merger := NewMerger(dir)
+	result, err := merger.ResolveWithArch("tier-pro", "arm64")
+	if err != nil {
+		t.Fatalf("ResolveWithArch() error = %v", err)
+	}
+
+	// Should have base + arch + tier packages merged
+	required := result.Packages.Required
+	if !contains(required, "secubox-core") {
+		t.Errorf("missing secubox-core from base")
+	}
+	if !contains(required, "qemu-user-static") {
+		t.Errorf("missing qemu-user-static from arch/arm64")
+	}
+	if !contains(required, "secubox-full") {
+		t.Errorf("missing secubox-full from tier-pro")
+	}
+
+	// Should have merged kernel modules
+	modules := result.Kernel.Modules.Enable
+	if !contains(modules, "wireguard") {
+		t.Errorf("missing wireguard from base")
+	}
+	if !contains(modules, "cpufreq_dt") {
+		t.Errorf("missing cpufreq_dt from arch/arm64")
+	}
+
+	// Should have merged sysctl (arch overrides base for same key)
+	if result.Sysctl["net.ipv4.ip_forward"] != 1 {
+		t.Errorf("sysctl net.ipv4.ip_forward = %v, want 1", result.Sysctl["net.ipv4.ip_forward"])
+	}
+	if result.Sysctl["vm.nr_hugepages"] != 64 {
+		t.Errorf("sysctl vm.nr_hugepages = %v, want 64", result.Sysctl["vm.nr_hugepages"])
+	}
+
+	// Final name should be from tier
+	if result.Name != "tier-pro" {
+		t.Errorf("Name = %q, want tier-pro", result.Name)
+	}
+}
+
+func TestResolveWithArch_NoArchProfile(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create base profile
+	base := `
+name: base
+packages:
+  required:
+    - secubox-core
+`
+	if err := os.WriteFile(filepath.Join(dir, "base.yaml"), []byte(base), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Create tier profile (no arch/ directory)
+	tier := `
+name: tier-lite
+inherits: base
+packages:
+  required:
+    - secubox-crowdsec
+`
+	if err := os.WriteFile(filepath.Join(dir, "tier-lite.yaml"), []byte(tier), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	merger := NewMerger(dir)
+	result, err := merger.ResolveWithArch("tier-lite", "riscv64")
+	if err != nil {
+		t.Fatalf("ResolveWithArch() should succeed without arch profile, got error = %v", err)
+	}
+
+	// Should still merge base + tier
+	if !contains(result.Packages.Required, "secubox-core") {
+		t.Errorf("missing secubox-core from base")
+	}
+	if !contains(result.Packages.Required, "secubox-crowdsec") {
+		t.Errorf("missing secubox-crowdsec from tier-lite")
+	}
+}
+
+func contains(slice []string, item string) bool {
+	for _, s := range slice {
+		if s == item {
+			return true
+		}
+	}
+	return false
+}
+
 func TestLoadTweaks(t *testing.T) {
 	dir := t.TempDir()
 	boardDir := filepath.Join(dir, "test-board")
diff --git a/cmd/secubox/main.go b/cmd/secubox/main.go
index ebbd75ec..2dfaa54d 100644
--- a/cmd/secubox/main.go
+++ b/cmd/secubox/main.go
@@ -7,7 +7,17 @@ import (
 	"github.com/CyberMind-FR/secubox-deb/cmd/secubox/cmd"
 )
 
+// Build-time variables (set via -ldflags)
+var (
+	Version   = "dev"
+	BuildTime = "unknown"
+	Commit    = "unknown"
+)
+
 func main() {
+	// Pass version info to cmd package
+	cmd.SetVersionInfo(Version, BuildTime, Commit)
+
 	if err := cmd.Execute(); err != nil {
 		os.Exit(1)
 	}
diff --git a/packages/secubox-ad-guard/debian/secubox.yaml b/packages/secubox-ad-guard/debian/secubox.yaml
new file mode 100644
index 00000000..3332e56a
--- /dev/null
+++ b/packages/secubox-ad-guard/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ad-guard
+category: misc
+tier: lite
+description: "SecuBox Ad Guard Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ad-guard.sock
+  health: /api/v1/ad-guard/health
+
+ui:
+  path: /srv/secubox/www/ad-guard
diff --git a/packages/secubox-admin/debian/secubox.yaml b/packages/secubox-admin/debian/secubox.yaml
new file mode 100644
index 00000000..8993373a
--- /dev/null
+++ b/packages/secubox-admin/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-admin
+category: system
+tier: lite
+description: "SecuBox System Administration Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/admin.sock
+  health: /api/v1/admin/health
+
+ui:
+  path: /srv/secubox/www/admin
diff --git a/packages/secubox-ai-gateway/debian/secubox.yaml b/packages/secubox-ai-gateway/debian/secubox.yaml
new file mode 100644
index 00000000..f612f16d
--- /dev/null
+++ b/packages/secubox-ai-gateway/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ai-gateway
+category: ai
+tier: pro
+description: "SecuBox Ai-gateway Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ai-gateway.sock
+  health: /api/v1/ai-gateway/health
+
+ui:
+  path: /srv/secubox/www/ai-gateway
diff --git a/packages/secubox-ai-insights/debian/secubox.yaml b/packages/secubox-ai-insights/debian/secubox.yaml
new file mode 100644
index 00000000..a8ea7c27
--- /dev/null
+++ b/packages/secubox-ai-insights/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ai-insights
+category: ai
+tier: pro
+description: "SecuBox AI Insights - ML-based Threat Detection"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ai-insights.sock
+  health: /api/v1/ai-insights/health
+
+ui:
+  path: /srv/secubox/www/ai-insights
diff --git a/packages/secubox-auth/debian/secubox.yaml b/packages/secubox-auth/debian/secubox.yaml
new file mode 100644
index 00000000..94074a17
--- /dev/null
+++ b/packages/secubox-auth/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-auth
+category: security
+tier: lite
+description: "SecuBox Auth Guardian"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/auth.sock
+  health: /api/v1/auth/health
+
+ui:
+  path: /srv/secubox/www/auth
diff --git a/packages/secubox-avatar/debian/secubox.yaml b/packages/secubox-avatar/debian/secubox.yaml
new file mode 100644
index 00000000..ba4b196c
--- /dev/null
+++ b/packages/secubox-avatar/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-avatar
+category: misc
+tier: lite
+description: "SecuBox Identity and Avatar Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/avatar.sock
+  health: /api/v1/avatar/health
+
+ui:
+  path: /srv/secubox/www/avatar
diff --git a/packages/secubox-backup/debian/secubox.yaml b/packages/secubox-backup/debian/secubox.yaml
new file mode 100644
index 00000000..f5a1824f
--- /dev/null
+++ b/packages/secubox-backup/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-backup
+category: system
+tier: lite
+description: "SecuBox Backup Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/backup.sock
+  health: /api/v1/backup/health
+
+ui:
+  path: /srv/secubox/www/backup
diff --git a/packages/secubox-c3box/debian/secubox.yaml b/packages/secubox-c3box/debian/secubox.yaml
new file mode 100644
index 00000000..f9f7b0a3
--- /dev/null
+++ b/packages/secubox-c3box/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-c3box
+category: dashboard
+tier: lite
+description: "SecuBox C3box Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/c3box.sock
+  health: /api/v1/c3box/health
+
+ui:
+  path: /srv/secubox/www/c3box
diff --git a/packages/secubox-cdn/debian/secubox.yaml b/packages/secubox-cdn/debian/secubox.yaml
new file mode 100644
index 00000000..9cdc4f8f
--- /dev/null
+++ b/packages/secubox-cdn/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-cdn
+category: misc
+tier: standard
+description: "SecuBox CDN Cache"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/cdn.sock
+  health: /api/v1/cdn/health
+
+ui:
+  path: /srv/secubox/www/cdn
diff --git a/packages/secubox-cloner/debian/secubox.yaml b/packages/secubox-cloner/debian/secubox.yaml
new file mode 100644
index 00000000..b869e158
--- /dev/null
+++ b/packages/secubox-cloner/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-cloner
+category: misc
+tier: lite
+description: "SecuBox Cloner - System backup and restore"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/cloner.sock
+  health: /api/v1/cloner/health
+
+ui:
+  path: /srv/secubox/www/cloner
diff --git a/packages/secubox-config-advisor/debian/secubox.yaml b/packages/secubox-config-advisor/debian/secubox.yaml
new file mode 100644
index 00000000..1402e468
--- /dev/null
+++ b/packages/secubox-config-advisor/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-config-advisor
+category: system
+tier: lite
+description: "SecuBox Config-advisor Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/config-advisor.sock
+  health: /api/v1/config-advisor/health
+
+ui:
+  path: /srv/secubox/www/config-advisor
diff --git a/packages/secubox-console/debian/secubox.yaml b/packages/secubox-console/debian/secubox.yaml
new file mode 100644
index 00000000..4b889c54
--- /dev/null
+++ b/packages/secubox-console/debian/secubox.yaml
@@ -0,0 +1,7 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-console
+category: misc
+tier: lite
+description: "SecuBox Console TUI — Terminal Dashboard"
diff --git a/packages/secubox-cookies/debian/secubox.yaml b/packages/secubox-cookies/debian/secubox.yaml
new file mode 100644
index 00000000..9f3f26ac
--- /dev/null
+++ b/packages/secubox-cookies/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-cookies
+category: misc
+tier: lite
+description: "SecuBox Cookie Tracker"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/cookies.sock
+  health: /api/v1/cookies/health
+
+ui:
+  path: /srv/secubox/www/cookies
diff --git a/packages/secubox-core/debian/secubox.yaml b/packages/secubox-core/debian/secubox.yaml
index cefd19e1..d8b2b167 100644
--- a/packages/secubox-core/debian/secubox.yaml
+++ b/packages/secubox-core/debian/secubox.yaml
@@ -1,23 +1,10 @@
-# packages/secubox-core/debian/secubox.yaml
-# SecuBox package metadata for meta-script generator
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
 name: secubox-core
-category: core
-description:
-  en: SecuBox core libraries and utilities
-  fr: Bibliotheques et utilitaires SecuBox
+category: system
+tier: all
+description: "SecuBox-DEB — bibliothèque centrale et infrastructure"
 
-requirements:
-  min_ram: 128M
-  arch:
-    - arm64
-    - amd64
-
-tags:
-  - core
-  - essential
-  - required
-
-services:
-  - secubox-core.service
-
-ports: []
+ui:
+  path: /srv/secubox/www/core
diff --git a/packages/secubox-crowdsec/debian/secubox.yaml b/packages/secubox-crowdsec/debian/secubox.yaml
new file mode 100644
index 00000000..add2a0e1
--- /dev/null
+++ b/packages/secubox-crowdsec/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-crowdsec
+category: security
+tier: lite
+description: "SecuBox CrowdSec Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/crowdsec.sock
+  health: /api/v1/crowdsec/health
+
+ui:
+  path: /srv/secubox/www/crowdsec
diff --git a/packages/secubox-cve-triage/debian/secubox.yaml b/packages/secubox-cve-triage/debian/secubox.yaml
new file mode 100644
index 00000000..2aa327e2
--- /dev/null
+++ b/packages/secubox-cve-triage/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-cve-triage
+category: security
+tier: lite
+description: "SecuBox Cve-triage Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/cve-triage.sock
+  health: /api/v1/cve-triage/health
+
+ui:
+  path: /srv/secubox/www/cve-triage
diff --git a/packages/secubox-cyberfeed/debian/secubox.yaml b/packages/secubox-cyberfeed/debian/secubox.yaml
new file mode 100644
index 00000000..2425c0a3
--- /dev/null
+++ b/packages/secubox-cyberfeed/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-cyberfeed
+category: misc
+tier: lite
+description: "SecuBox CyberFeed - Threat Intelligence Feed Aggregator"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/cyberfeed.sock
+  health: /api/v1/cyberfeed/health
+
+ui:
+  path: /srv/secubox/www/cyberfeed
diff --git a/packages/secubox-daemon/debian/secubox.yaml b/packages/secubox-daemon/debian/secubox.yaml
new file mode 100644
index 00000000..09e84a19
--- /dev/null
+++ b/packages/secubox-daemon/debian/secubox.yaml
@@ -0,0 +1,7 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-daemon
+category: system
+tier: lite
+description: "SecuBox Mesh Daemon - WireGuard mesh with ZKP authentication"
diff --git a/packages/secubox-device-intel/debian/secubox.yaml b/packages/secubox-device-intel/debian/secubox.yaml
new file mode 100644
index 00000000..5e98ac8b
--- /dev/null
+++ b/packages/secubox-device-intel/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-device-intel
+category: misc
+tier: lite
+description: "SecuBox Device-intel Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/device-intel.sock
+  health: /api/v1/device-intel/health
+
+ui:
+  path: /srv/secubox/www/device-intel
diff --git a/packages/secubox-dns-guard/debian/secubox.yaml b/packages/secubox-dns-guard/debian/secubox.yaml
new file mode 100644
index 00000000..f23ffe50
--- /dev/null
+++ b/packages/secubox-dns-guard/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-dns-guard
+category: network
+tier: lite
+description: "SecuBox Dns-guard Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/dns-guard.sock
+  health: /api/v1/dns-guard/health
+
+ui:
+  path: /srv/secubox/www/dns-guard
diff --git a/packages/secubox-dns-provider/debian/secubox.yaml b/packages/secubox-dns-provider/debian/secubox.yaml
new file mode 100644
index 00000000..dc0ee5a6
--- /dev/null
+++ b/packages/secubox-dns-provider/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-dns-provider
+category: network
+tier: lite
+description: "SecuBox DNS Provider Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/dns-provider.sock
+  health: /api/v1/dns-provider/health
+
+ui:
+  path: /srv/secubox/www/dns-provider
diff --git a/packages/secubox-dns/debian/secubox.yaml b/packages/secubox-dns/debian/secubox.yaml
new file mode 100644
index 00000000..608e8e2d
--- /dev/null
+++ b/packages/secubox-dns/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-dns
+category: network
+tier: lite
+description: "SecuBox Dns Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/dns.sock
+  health: /api/v1/dns/health
+
+ui:
+  path: /srv/secubox/www/dns
diff --git a/packages/secubox-domoticz/debian/secubox.yaml b/packages/secubox-domoticz/debian/secubox.yaml
new file mode 100644
index 00000000..d3f78f6a
--- /dev/null
+++ b/packages/secubox-domoticz/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-domoticz
+category: misc
+tier: lite
+description: "Domoticz Home Automation for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/domoticz.sock
+  health: /api/v1/domoticz/health
+
+ui:
+  path: /srv/secubox/www/domoticz
diff --git a/packages/secubox-dpi/debian/secubox.yaml b/packages/secubox-dpi/debian/secubox.yaml
new file mode 100644
index 00000000..39da2f91
--- /dev/null
+++ b/packages/secubox-dpi/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-dpi
+category: misc
+tier: pro
+description: "SecuBox DPI — netifyd Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/dpi.sock
+  health: /api/v1/dpi/health
+
+ui:
+  path: /srv/secubox/www/dpi
diff --git a/packages/secubox-droplet/debian/secubox.yaml b/packages/secubox-droplet/debian/secubox.yaml
new file mode 100644
index 00000000..f57e877f
--- /dev/null
+++ b/packages/secubox-droplet/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-droplet
+category: misc
+tier: lite
+description: "SecuBox Droplet File Publisher"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/droplet.sock
+  health: /api/v1/droplet/health
+
+ui:
+  path: /srv/secubox/www/droplet
diff --git a/packages/secubox-exposure/debian/secubox.yaml b/packages/secubox-exposure/debian/secubox.yaml
new file mode 100644
index 00000000..864c147f
--- /dev/null
+++ b/packages/secubox-exposure/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-exposure
+category: misc
+tier: lite
+description: "SecuBox Exposure Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/exposure.sock
+  health: /api/v1/exposure/health
+
+ui:
+  path: /srv/secubox/www/exposure
diff --git a/packages/secubox-eye-remote/debian/secubox.yaml b/packages/secubox-eye-remote/debian/secubox.yaml
new file mode 100644
index 00000000..f5db0f57
--- /dev/null
+++ b/packages/secubox-eye-remote/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-eye-remote
+category: dashboard
+tier: lite
+description: "SecuBox Eye Remote USB Gadget Integration"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/eye-remote.sock
+  health: /api/v1/eye-remote/health
+
+ui:
+  path: /srv/secubox/www/eye-remote
diff --git a/packages/secubox-full/debian/secubox.yaml b/packages/secubox-full/debian/secubox.yaml
new file mode 100644
index 00000000..b0ed08fd
--- /dev/null
+++ b/packages/secubox-full/debian/secubox.yaml
@@ -0,0 +1,58 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-full
+category: misc
+tier: lite
+description: "SecuBox Full — All 49 modules"
+
+depends:
+  - secubox-core
+  - secubox-hub
+  - secubox-portal
+  - secubox-system
+  - secubox-crowdsec
+  - secubox-waf
+  - secubox-vortex-firewall
+  - secubox-auth
+  - secubox-nac
+  - secubox-wireguard
+  - secubox-mesh
+  - secubox-p2p
+  - secubox-netmodes
+  - secubox-dpi
+  - secubox-qos
+  - secubox-traffic
+  - secubox-vhost
+  - secubox-haproxy
+  - secubox-cdn
+  - secubox-dns
+  - secubox-vortex-dns
+  - secubox-meshname
+  - secubox-netdata
+  - secubox-mediaflow
+  - secubox-device-intel
+  - secubox-watchdog
+  - secubox-metrics
+  - secubox-soc
+  - secubox-roadmap
+  - secubox-mail
+  - secubox-mail-lxc
+  - secubox-webmail
+  - secubox-webmail-lxc
+  - secubox-users
+  - secubox-gitea
+  - secubox-nextcloud
+  - secubox-droplet
+  - secubox-streamlit
+  - secubox-streamforge
+  - secubox-metablogizer
+  - secubox-publish
+  - secubox-c3box
+  - secubox-backup
+  - secubox-tor
+  - secubox-exposure
+  - secubox-zkp
+  - secubox-mitmproxy
+  - secubox-repo
+  - secubox-hardening
diff --git a/packages/secubox-gitea/debian/secubox.yaml b/packages/secubox-gitea/debian/secubox.yaml
new file mode 100644
index 00000000..fc978a99
--- /dev/null
+++ b/packages/secubox-gitea/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-gitea
+category: publishing
+tier: pro
+description: "SecuBox Gitea Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/gitea.sock
+  health: /api/v1/gitea/health
+
+ui:
+  path: /srv/secubox/www/gitea
diff --git a/packages/secubox-glances/debian/secubox.yaml b/packages/secubox-glances/debian/secubox.yaml
new file mode 100644
index 00000000..3d7eb888
--- /dev/null
+++ b/packages/secubox-glances/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-glances
+category: misc
+tier: lite
+description: "SecuBox Glances Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/glances.sock
+  health: /api/v1/glances/health
+
+ui:
+  path: /srv/secubox/www/glances
diff --git a/packages/secubox-gotosocial/debian/secubox.yaml b/packages/secubox-gotosocial/debian/secubox.yaml
new file mode 100644
index 00000000..7ffb72dd
--- /dev/null
+++ b/packages/secubox-gotosocial/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-gotosocial
+category: dashboard
+tier: lite
+description: "GoToSocial Fediverse server management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/gotosocial.sock
+  health: /api/v1/gotosocial/health
+
+ui:
+  path: /srv/secubox/www/gotosocial
diff --git a/packages/secubox-haproxy/debian/secubox.yaml b/packages/secubox-haproxy/debian/secubox.yaml
new file mode 100644
index 00000000..c9dfbcf3
--- /dev/null
+++ b/packages/secubox-haproxy/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-haproxy
+category: network
+tier: standard
+description: "SecuBox HAProxy Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/haproxy.sock
+  health: /api/v1/haproxy/health
+
+ui:
+  path: /srv/secubox/www/haproxy
diff --git a/packages/secubox-hardening/debian/secubox.yaml b/packages/secubox-hardening/debian/secubox.yaml
new file mode 100644
index 00000000..254bf3ae
--- /dev/null
+++ b/packages/secubox-hardening/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-hardening
+category: security
+tier: lite
+description: "SecuBox Kernel and System Hardening"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/hardening.sock
+  health: /api/v1/hardening/health
+
+ui:
+  path: /srv/secubox/www/hardening
diff --git a/packages/secubox-hexo/debian/secubox.yaml b/packages/secubox-hexo/debian/secubox.yaml
new file mode 100644
index 00000000..a0c6a5d3
--- /dev/null
+++ b/packages/secubox-hexo/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-hexo
+category: misc
+tier: lite
+description: "Hexo static blog generator management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/hexo.sock
+  health: /api/v1/hexo/health
+
+ui:
+  path: /srv/secubox/www/hexo
diff --git a/packages/secubox-homeassistant/debian/secubox.yaml b/packages/secubox-homeassistant/debian/secubox.yaml
new file mode 100644
index 00000000..cbe9930d
--- /dev/null
+++ b/packages/secubox-homeassistant/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-homeassistant
+category: iot
+tier: lite
+description: "Home Assistant IoT Hub for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/homeassistant.sock
+  health: /api/v1/homeassistant/health
+
+ui:
+  path: /srv/secubox/www/homeassistant
diff --git a/packages/secubox-hub/debian/secubox.yaml b/packages/secubox-hub/debian/secubox.yaml
new file mode 100644
index 00000000..46ff8570
--- /dev/null
+++ b/packages/secubox-hub/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-hub
+category: system
+tier: all
+description: "SecuBox Hub — Tableau de bord central"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/hub.sock
+  health: /api/v1/hub/health
+
+ui:
+  path: /srv/secubox/www/hub
diff --git a/packages/secubox-identity/debian/secubox.yaml b/packages/secubox-identity/debian/secubox.yaml
new file mode 100644
index 00000000..1c5c5309
--- /dev/null
+++ b/packages/secubox-identity/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-identity
+category: misc
+tier: lite
+description: "SecuBox Identity Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/identity.sock
+  health: /api/v1/identity/health
+
+ui:
+  path: /srv/secubox/www/identity
diff --git a/packages/secubox-interceptor/debian/secubox.yaml b/packages/secubox-interceptor/debian/secubox.yaml
new file mode 100644
index 00000000..313d3e18
--- /dev/null
+++ b/packages/secubox-interceptor/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-interceptor
+category: misc
+tier: lite
+description: "SecuBox Traffic Interceptor"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/interceptor.sock
+  health: /api/v1/interceptor/health
+
+ui:
+  path: /srv/secubox/www/interceptor
diff --git a/packages/secubox-iot-guard/debian/secubox.yaml b/packages/secubox-iot-guard/debian/secubox.yaml
new file mode 100644
index 00000000..93f8deb4
--- /dev/null
+++ b/packages/secubox-iot-guard/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-iot-guard
+category: iot
+tier: lite
+description: "SecuBox Iot-guard Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/iot-guard.sock
+  health: /api/v1/iot-guard/health
+
+ui:
+  path: /srv/secubox/www/iot-guard
diff --git a/packages/secubox-ipblock/debian/secubox.yaml b/packages/secubox-ipblock/debian/secubox.yaml
new file mode 100644
index 00000000..e67aee96
--- /dev/null
+++ b/packages/secubox-ipblock/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ipblock
+category: misc
+tier: lite
+description: "SecuBox IP Blocklist Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ipblock.sock
+  health: /api/v1/ipblock/health
+
+ui:
+  path: /srv/secubox/www/ipblock
diff --git a/packages/secubox-jabber/debian/secubox.yaml b/packages/secubox-jabber/debian/secubox.yaml
new file mode 100644
index 00000000..600bd784
--- /dev/null
+++ b/packages/secubox-jabber/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-jabber
+category: misc
+tier: lite
+description: "SecuBox Jabber XMPP Server"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/jabber.sock
+  health: /api/v1/jabber/health
+
+ui:
+  path: /srv/secubox/www/jabber
diff --git a/packages/secubox-jellyfin/debian/secubox.yaml b/packages/secubox-jellyfin/debian/secubox.yaml
new file mode 100644
index 00000000..5de5848f
--- /dev/null
+++ b/packages/secubox-jellyfin/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-jellyfin
+category: media
+tier: pro
+description: "Jellyfin media server management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/jellyfin.sock
+  health: /api/v1/jellyfin/health
+
+ui:
+  path: /srv/secubox/www/jellyfin
diff --git a/packages/secubox-jitsi/debian/secubox.yaml b/packages/secubox-jitsi/debian/secubox.yaml
new file mode 100644
index 00000000..ebdcca41
--- /dev/null
+++ b/packages/secubox-jitsi/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-jitsi
+category: misc
+tier: lite
+description: "SecuBox Jitsi Meet - Video Conferencing"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/jitsi.sock
+  health: /api/v1/jitsi/health
+
+ui:
+  path: /srv/secubox/www/jitsi
diff --git a/packages/secubox-ksm/debian/secubox.yaml b/packages/secubox-ksm/debian/secubox.yaml
new file mode 100644
index 00000000..65e445d2
--- /dev/null
+++ b/packages/secubox-ksm/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ksm
+category: misc
+tier: lite
+description: "SecuBox KSM Memory Optimization Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ksm.sock
+  health: /api/v1/ksm/health
+
+ui:
+  path: /srv/secubox/www/ksm
diff --git a/packages/secubox-led-heartbeat/debian/secubox.yaml b/packages/secubox-led-heartbeat/debian/secubox.yaml
new file mode 100644
index 00000000..e419ba4e
--- /dev/null
+++ b/packages/secubox-led-heartbeat/debian/secubox.yaml
@@ -0,0 +1,10 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-led-heartbeat
+category: misc
+tier: lite
+description: "SecuBox LED heartbeat status indicator"
+
+depends:
+  - secubox-core
diff --git a/packages/secubox-lite/debian/secubox.yaml b/packages/secubox-lite/debian/secubox.yaml
new file mode 100644
index 00000000..ba61e444
--- /dev/null
+++ b/packages/secubox-lite/debian/secubox.yaml
@@ -0,0 +1,18 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-lite
+category: misc
+tier: lite
+description: "SecuBox Lite — Essential modules for low-RAM devices"
+
+depends:
+  - secubox-core
+  - secubox-hub
+  - secubox-portal
+  - secubox-crowdsec
+  - secubox-wireguard
+  - secubox-netmodes
+  - secubox-nac
+  - secubox-system
+  - secubox-hardening
diff --git a/packages/secubox-localai/debian/secubox.yaml b/packages/secubox-localai/debian/secubox.yaml
new file mode 100644
index 00000000..bc7daabf
--- /dev/null
+++ b/packages/secubox-localai/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-localai
+category: misc
+tier: lite
+description: "SecuBox LocalAI - Self-hosted LLM inference"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/localai.sock
+  health: /api/v1/localai/health
+
+ui:
+  path: /srv/secubox/www/localai
diff --git a/packages/secubox-localrecall/debian/secubox.yaml b/packages/secubox-localrecall/debian/secubox.yaml
new file mode 100644
index 00000000..91844833
--- /dev/null
+++ b/packages/secubox-localrecall/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-localrecall
+category: misc
+tier: lite
+description: "SecuBox Localrecall Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/localrecall.sock
+  health: /api/v1/localrecall/health
+
+ui:
+  path: /srv/secubox/www/localrecall
diff --git a/packages/secubox-lyrion/debian/secubox.yaml b/packages/secubox-lyrion/debian/secubox.yaml
new file mode 100644
index 00000000..6ef4fd05
--- /dev/null
+++ b/packages/secubox-lyrion/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-lyrion
+category: misc
+tier: lite
+description: "Lyrion Music Server (LMS) for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/lyrion.sock
+  health: /api/v1/lyrion/health
+
+ui:
+  path: /srv/secubox/www/lyrion
diff --git a/packages/secubox-mac-guard/debian/secubox.yaml b/packages/secubox-mac-guard/debian/secubox.yaml
new file mode 100644
index 00000000..d9568e56
--- /dev/null
+++ b/packages/secubox-mac-guard/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mac-guard
+category: misc
+tier: lite
+description: "SecuBox MAC Guard - MAC Address Control"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mac-guard.sock
+  health: /api/v1/mac-guard/health
+
+ui:
+  path: /srv/secubox/www/mac-guard
diff --git a/packages/secubox-magicmirror/debian/secubox.yaml b/packages/secubox-magicmirror/debian/secubox.yaml
new file mode 100644
index 00000000..a978450d
--- /dev/null
+++ b/packages/secubox-magicmirror/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-magicmirror
+category: misc
+tier: lite
+description: "SecuBox MagicMirror management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/magicmirror.sock
+  health: /api/v1/magicmirror/health
+
+ui:
+  path: /srv/secubox/www/magicmirror
diff --git a/packages/secubox-mail-lxc/debian/secubox.yaml b/packages/secubox-mail-lxc/debian/secubox.yaml
new file mode 100644
index 00000000..af1280f2
--- /dev/null
+++ b/packages/secubox-mail-lxc/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mail-lxc
+category: email
+tier: lite
+description: "SecuBox Mail LXC Container (Backend)"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mail-lxc.sock
+  health: /api/v1/mail-lxc/health
+
+ui:
+  path: /srv/secubox/www/mail-lxc
diff --git a/packages/secubox-mail/debian/secubox.yaml b/packages/secubox-mail/debian/secubox.yaml
new file mode 100644
index 00000000..1aac0ced
--- /dev/null
+++ b/packages/secubox-mail/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mail
+category: email
+tier: lite
+description: "SecuBox Mail Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mail.sock
+  health: /api/v1/mail/health
+
+ui:
+  path: /srv/secubox/www/mail
diff --git a/packages/secubox-master-link/debian/secubox.yaml b/packages/secubox-master-link/debian/secubox.yaml
new file mode 100644
index 00000000..fd269b46
--- /dev/null
+++ b/packages/secubox-master-link/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-master-link
+category: misc
+tier: lite
+description: "SecuBox Master-link Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/master-link.sock
+  health: /api/v1/master-link/health
+
+ui:
+  path: /srv/secubox/www/master-link
diff --git a/packages/secubox-matrix/debian/secubox.yaml b/packages/secubox-matrix/debian/secubox.yaml
new file mode 100644
index 00000000..27d67cf5
--- /dev/null
+++ b/packages/secubox-matrix/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-matrix
+category: communication
+tier: pro
+description: "SecuBox Matrix Synapse - Federated Chat Server"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/matrix.sock
+  health: /api/v1/matrix/health
+
+ui:
+  path: /srv/secubox/www/matrix
diff --git a/packages/secubox-mcp-server/debian/secubox.yaml b/packages/secubox-mcp-server/debian/secubox.yaml
new file mode 100644
index 00000000..0445b8cd
--- /dev/null
+++ b/packages/secubox-mcp-server/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mcp-server
+category: misc
+tier: lite
+description: "SecuBox Mcp-server Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mcp-server.sock
+  health: /api/v1/mcp-server/health
+
+ui:
+  path: /srv/secubox/www/mcp-server
diff --git a/packages/secubox-mediaflow/debian/secubox.yaml b/packages/secubox-mediaflow/debian/secubox.yaml
new file mode 100644
index 00000000..f07cae1c
--- /dev/null
+++ b/packages/secubox-mediaflow/debian/secubox.yaml
@@ -0,0 +1,18 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mediaflow
+category: media
+tier: lite
+description: "SecuBox Media Flow"
+
+depends:
+  - secubox-core
+  - secubox-dpi
+
+api:
+  socket: /run/secubox/mediaflow.sock
+  health: /api/v1/mediaflow/health
+
+ui:
+  path: /srv/secubox/www/mediaflow
diff --git a/packages/secubox-mesh/debian/secubox.yaml b/packages/secubox-mesh/debian/secubox.yaml
new file mode 100644
index 00000000..09419a4f
--- /dev/null
+++ b/packages/secubox-mesh/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mesh
+category: vpn
+tier: lite
+description: "SecuBox Mesh DNS - Meshname DNS for mesh networks"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mesh.sock
+  health: /api/v1/mesh/health
+
+ui:
+  path: /srv/secubox/www/mesh
diff --git a/packages/secubox-meshname/debian/secubox.yaml b/packages/secubox-meshname/debian/secubox.yaml
new file mode 100644
index 00000000..9e5a92c3
--- /dev/null
+++ b/packages/secubox-meshname/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-meshname
+category: vpn
+tier: lite
+description: "SecuBox Meshname Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/meshname.sock
+  health: /api/v1/meshname/health
+
+ui:
+  path: /srv/secubox/www/meshname
diff --git a/packages/secubox-metablogizer/debian/secubox.yaml b/packages/secubox-metablogizer/debian/secubox.yaml
new file mode 100644
index 00000000..cfcc9dd0
--- /dev/null
+++ b/packages/secubox-metablogizer/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-metablogizer
+category: publishing
+tier: lite
+description: "SecuBox MetaBlogizer - Static Site Publisher"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/metablogizer.sock
+  health: /api/v1/metablogizer/health
+
+ui:
+  path: /srv/secubox/www/metablogizer
diff --git a/packages/secubox-metabolizer/debian/secubox.yaml b/packages/secubox-metabolizer/debian/secubox.yaml
new file mode 100644
index 00000000..2c7026d2
--- /dev/null
+++ b/packages/secubox-metabolizer/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-metabolizer
+category: misc
+tier: lite
+description: "SecuBox Metabolizer - Log processor and analyzer"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/metabolizer.sock
+  health: /api/v1/metabolizer/health
+
+ui:
+  path: /srv/secubox/www/metabolizer
diff --git a/packages/secubox-metacatalog/debian/secubox.yaml b/packages/secubox-metacatalog/debian/secubox.yaml
new file mode 100644
index 00000000..036f9678
--- /dev/null
+++ b/packages/secubox-metacatalog/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-metacatalog
+category: misc
+tier: lite
+description: "SecuBox Metacatalog - Service catalog and registry"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/metacatalog.sock
+  health: /api/v1/metacatalog/health
+
+ui:
+  path: /srv/secubox/www/metacatalog
diff --git a/packages/secubox-metoblizer/debian/secubox.yaml b/packages/secubox-metoblizer/debian/secubox.yaml
new file mode 100644
index 00000000..cab6cd1c
--- /dev/null
+++ b/packages/secubox-metoblizer/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-metoblizer
+category: misc
+tier: lite
+description: "SecuBox centralized log aggregator"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/metoblizer.sock
+  health: /api/v1/metoblizer/health
+
+ui:
+  path: /srv/secubox/www/metoblizer
diff --git a/packages/secubox-metrics/debian/secubox.yaml b/packages/secubox-metrics/debian/secubox.yaml
new file mode 100644
index 00000000..0d7ddc01
--- /dev/null
+++ b/packages/secubox-metrics/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-metrics
+category: monitoring
+tier: lite
+description: "SecuBox Metrics Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/metrics.sock
+  health: /api/v1/metrics/health
+
+ui:
+  path: /srv/secubox/www/metrics
diff --git a/packages/secubox-mirror/debian/secubox.yaml b/packages/secubox-mirror/debian/secubox.yaml
new file mode 100644
index 00000000..98e2ad72
--- /dev/null
+++ b/packages/secubox-mirror/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mirror
+category: misc
+tier: lite
+description: "SecuBox Mirror/CDN Cache"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mirror.sock
+  health: /api/v1/mirror/health
+
+ui:
+  path: /srv/secubox/www/mirror
diff --git a/packages/secubox-mitmproxy/debian/secubox.yaml b/packages/secubox-mitmproxy/debian/secubox.yaml
new file mode 100644
index 00000000..071987ce
--- /dev/null
+++ b/packages/secubox-mitmproxy/debian/secubox.yaml
@@ -0,0 +1,18 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mitmproxy
+category: misc
+tier: lite
+description: "SecuBox Mitmproxy WAF — Web Application Firewall"
+
+depends:
+  - secubox-core
+  - secubox-haproxy
+
+api:
+  socket: /run/secubox/mitmproxy.sock
+  health: /api/v1/mitmproxy/health
+
+ui:
+  path: /srv/secubox/www/mitmproxy
diff --git a/packages/secubox-mmpm/debian/secubox.yaml b/packages/secubox-mmpm/debian/secubox.yaml
new file mode 100644
index 00000000..8cfc2220
--- /dev/null
+++ b/packages/secubox-mmpm/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mmpm
+category: misc
+tier: lite
+description: "SecuBox MMPM - MagicMirror Package Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mmpm.sock
+  health: /api/v1/mmpm/health
+
+ui:
+  path: /srv/secubox/www/mmpm
diff --git a/packages/secubox-modem/debian/secubox.yaml b/packages/secubox-modem/debian/secubox.yaml
new file mode 100644
index 00000000..d565af0a
--- /dev/null
+++ b/packages/secubox-modem/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-modem
+category: misc
+tier: lite
+description: "SecuBox LTE/5G Modem Management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/modem.sock
+  health: /api/v1/modem/health
+
+ui:
+  path: /srv/secubox/www/modem
diff --git a/packages/secubox-mqtt/debian/secubox.yaml b/packages/secubox-mqtt/debian/secubox.yaml
new file mode 100644
index 00000000..8087c2c1
--- /dev/null
+++ b/packages/secubox-mqtt/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-mqtt
+category: iot
+tier: lite
+description: "SecuBox MQTT — Mosquitto Broker Management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/mqtt.sock
+  health: /api/v1/mqtt/health
+
+ui:
+  path: /srv/secubox/www/mqtt
diff --git a/packages/secubox-nac/debian/secubox.yaml b/packages/secubox-nac/debian/secubox.yaml
new file mode 100644
index 00000000..6d5106be
--- /dev/null
+++ b/packages/secubox-nac/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-nac
+category: security
+tier: lite
+description: "SecuBox NAC / Client Guardian"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/nac.sock
+  health: /api/v1/nac/health
+
+ui:
+  path: /srv/secubox/www/nac
diff --git a/packages/secubox-ndpid/debian/secubox.yaml b/packages/secubox-ndpid/debian/secubox.yaml
new file mode 100644
index 00000000..5ec47037
--- /dev/null
+++ b/packages/secubox-ndpid/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ndpid
+category: misc
+tier: lite
+description: "SecuBox nDPId Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ndpid.sock
+  health: /api/v1/ndpid/health
+
+ui:
+  path: /srv/secubox/www/ndpid
diff --git a/packages/secubox-netdata/debian/secubox.yaml b/packages/secubox-netdata/debian/secubox.yaml
new file mode 100644
index 00000000..b8a7b402
--- /dev/null
+++ b/packages/secubox-netdata/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-netdata
+category: monitoring
+tier: lite
+description: "SecuBox Netdata Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/netdata.sock
+  health: /api/v1/netdata/health
+
+ui:
+  path: /srv/secubox/www/netdata
diff --git a/packages/secubox-netdiag/debian/secubox.yaml b/packages/secubox-netdiag/debian/secubox.yaml
new file mode 100644
index 00000000..5bc22b91
--- /dev/null
+++ b/packages/secubox-netdiag/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-netdiag
+category: misc
+tier: lite
+description: "SecuBox Network Diagnostics — Troubleshooting Tools"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/netdiag.sock
+  health: /api/v1/netdiag/health
+
+ui:
+  path: /srv/secubox/www/netdiag
diff --git a/packages/secubox-netifyd/debian/secubox.yaml b/packages/secubox-netifyd/debian/secubox.yaml
new file mode 100644
index 00000000..1ba31c1f
--- /dev/null
+++ b/packages/secubox-netifyd/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-netifyd
+category: misc
+tier: lite
+description: "SecuBox Netifyd - Network Intelligence Daemon Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/netifyd.sock
+  health: /api/v1/netifyd/health
+
+ui:
+  path: /srv/secubox/www/netifyd
diff --git a/packages/secubox-netmodes/debian/secubox.yaml b/packages/secubox-netmodes/debian/secubox.yaml
new file mode 100644
index 00000000..59a5ec9e
--- /dev/null
+++ b/packages/secubox-netmodes/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-netmodes
+category: network
+tier: lite
+description: "SecuBox Network Modes"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/netmodes.sock
+  health: /api/v1/netmodes/health
+
+ui:
+  path: /srv/secubox/www/netmodes
diff --git a/packages/secubox-nettweak/debian/secubox.yaml b/packages/secubox-nettweak/debian/secubox.yaml
new file mode 100644
index 00000000..b6c60adc
--- /dev/null
+++ b/packages/secubox-nettweak/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-nettweak
+category: misc
+tier: lite
+description: "SecuBox Network Tuning Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/nettweak.sock
+  health: /api/v1/nettweak/health
+
+ui:
+  path: /srv/secubox/www/nettweak
diff --git a/packages/secubox-network-anomaly/debian/secubox.yaml b/packages/secubox-network-anomaly/debian/secubox.yaml
new file mode 100644
index 00000000..8b9fc521
--- /dev/null
+++ b/packages/secubox-network-anomaly/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-network-anomaly
+category: network
+tier: lite
+description: "SecuBox Network-anomaly Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/network-anomaly.sock
+  health: /api/v1/network-anomaly/health
+
+ui:
+  path: /srv/secubox/www/network-anomaly
diff --git a/packages/secubox-newsbin/debian/secubox.yaml b/packages/secubox-newsbin/debian/secubox.yaml
new file mode 100644
index 00000000..5b69041d
--- /dev/null
+++ b/packages/secubox-newsbin/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-newsbin
+category: misc
+tier: lite
+description: "Usenet downloader management for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/newsbin.sock
+  health: /api/v1/newsbin/health
+
+ui:
+  path: /srv/secubox/www/newsbin
diff --git a/packages/secubox-nextcloud/debian/secubox.yaml b/packages/secubox-nextcloud/debian/secubox.yaml
new file mode 100644
index 00000000..441e9211
--- /dev/null
+++ b/packages/secubox-nextcloud/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-nextcloud
+category: misc
+tier: pro
+description: "SecuBox Nextcloud Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/nextcloud.sock
+  health: /api/v1/nextcloud/health
+
+ui:
+  path: /srv/secubox/www/nextcloud
diff --git a/packages/secubox-ollama/debian/secubox.yaml b/packages/secubox-ollama/debian/secubox.yaml
new file mode 100644
index 00000000..0c0e9581
--- /dev/null
+++ b/packages/secubox-ollama/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ollama
+category: ai
+tier: pro
+description: "Local AI inference with Ollama"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ollama.sock
+  health: /api/v1/ollama/health
+
+ui:
+  path: /srv/secubox/www/ollama
diff --git a/packages/secubox-openclaw/debian/secubox.yaml b/packages/secubox-openclaw/debian/secubox.yaml
new file mode 100644
index 00000000..1fc3ddac
--- /dev/null
+++ b/packages/secubox-openclaw/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-openclaw
+category: misc
+tier: lite
+description: "SecuBox OpenClaw OSINT Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/openclaw.sock
+  health: /api/v1/openclaw/health
+
+ui:
+  path: /srv/secubox/www/openclaw
diff --git a/packages/secubox-ossec/debian/secubox.yaml b/packages/secubox-ossec/debian/secubox.yaml
new file mode 100644
index 00000000..34964ebd
--- /dev/null
+++ b/packages/secubox-ossec/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ossec
+category: misc
+tier: lite
+description: "SecuBox OSSEC HIDS integration"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/ossec.sock
+  health: /api/v1/ossec/health
+
+ui:
+  path: /srv/secubox/www/ossec
diff --git a/packages/secubox-p2p/debian/secubox.yaml b/packages/secubox-p2p/debian/secubox.yaml
new file mode 100644
index 00000000..20e4147a
--- /dev/null
+++ b/packages/secubox-p2p/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-p2p
+category: misc
+tier: lite
+description: "SecuBox P2P - Peer-to-Peer Network Hub"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/p2p.sock
+  health: /api/v1/p2p/health
+
+ui:
+  path: /srv/secubox/www/p2p
diff --git a/packages/secubox-peertube/debian/secubox.yaml b/packages/secubox-peertube/debian/secubox.yaml
new file mode 100644
index 00000000..693497a1
--- /dev/null
+++ b/packages/secubox-peertube/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-peertube
+category: misc
+tier: lite
+description: "PeerTube federated video platform management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/peertube.sock
+  health: /api/v1/peertube/health
+
+ui:
+  path: /srv/secubox/www/peertube
diff --git a/packages/secubox-photoprism/debian/secubox.yaml b/packages/secubox-photoprism/debian/secubox.yaml
new file mode 100644
index 00000000..ae418648
--- /dev/null
+++ b/packages/secubox-photoprism/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-photoprism
+category: misc
+tier: lite
+description: "PhotoPrism photo management for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/photoprism.sock
+  health: /api/v1/photoprism/health
+
+ui:
+  path: /srv/secubox/www/photoprism
diff --git a/packages/secubox-picobrew/debian/secubox.yaml b/packages/secubox-picobrew/debian/secubox.yaml
new file mode 100644
index 00000000..496286ea
--- /dev/null
+++ b/packages/secubox-picobrew/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-picobrew
+category: misc
+tier: lite
+description: "Homebrew/Fermentation Controller for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/picobrew.sock
+  health: /api/v1/picobrew/health
+
+ui:
+  path: /srv/secubox/www/picobrew
diff --git a/packages/secubox-portal/debian/secubox.yaml b/packages/secubox-portal/debian/secubox.yaml
new file mode 100644
index 00000000..dea42dbc
--- /dev/null
+++ b/packages/secubox-portal/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-portal
+category: system
+tier: all
+description: "SecuBox Portal - Web Authentication"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/portal.sock
+  health: /api/v1/portal/health
+
+ui:
+  path: /srv/secubox/www/portal
diff --git a/packages/secubox-publish/debian/secubox.yaml b/packages/secubox-publish/debian/secubox.yaml
new file mode 100644
index 00000000..a55d2a08
--- /dev/null
+++ b/packages/secubox-publish/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-publish
+category: publishing
+tier: lite
+description: "SecuBox Publishing Platform"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/publish.sock
+  health: /api/v1/publish/health
+
+ui:
+  path: /srv/secubox/www/publish
diff --git a/packages/secubox-qos/debian/secubox.yaml b/packages/secubox-qos/debian/secubox.yaml
new file mode 100644
index 00000000..a08841df
--- /dev/null
+++ b/packages/secubox-qos/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-qos
+category: misc
+tier: standard
+description: "SecuBox QoS / Bandwidth Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/qos.sock
+  health: /api/v1/qos/health
+
+ui:
+  path: /srv/secubox/www/qos
diff --git a/packages/secubox-redroid/debian/secubox.yaml b/packages/secubox-redroid/debian/secubox.yaml
new file mode 100644
index 00000000..96011b5f
--- /dev/null
+++ b/packages/secubox-redroid/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-redroid
+category: misc
+tier: lite
+description: "SecuBox Redroid - Android in container"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/redroid.sock
+  health: /api/v1/redroid/health
+
+ui:
+  path: /srv/secubox/www/redroid
diff --git a/packages/secubox-repo/debian/secubox.yaml b/packages/secubox-repo/debian/secubox.yaml
new file mode 100644
index 00000000..4298a106
--- /dev/null
+++ b/packages/secubox-repo/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-repo
+category: misc
+tier: lite
+description: "SecuBox APT Repository Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/repo.sock
+  health: /api/v1/repo/health
+
+ui:
+  path: /srv/secubox/www/repo
diff --git a/packages/secubox-reporter/debian/secubox.yaml b/packages/secubox-reporter/debian/secubox.yaml
new file mode 100644
index 00000000..e9ea5b1c
--- /dev/null
+++ b/packages/secubox-reporter/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-reporter
+category: misc
+tier: lite
+description: "SecuBox Reporter - System report generation"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/reporter.sock
+  health: /api/v1/reporter/health
+
+ui:
+  path: /srv/secubox/www/reporter
diff --git a/packages/secubox-rezapp/debian/secubox.yaml b/packages/secubox-rezapp/debian/secubox.yaml
new file mode 100644
index 00000000..4f13c853
--- /dev/null
+++ b/packages/secubox-rezapp/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-rezapp
+category: misc
+tier: lite
+description: "SecuBox RezApp - Application deployment and management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/rezapp.sock
+  health: /api/v1/rezapp/health
+
+ui:
+  path: /srv/secubox/www/rezapp
diff --git a/packages/secubox-roadmap/debian/secubox.yaml b/packages/secubox-roadmap/debian/secubox.yaml
new file mode 100644
index 00000000..4b28eeb7
--- /dev/null
+++ b/packages/secubox-roadmap/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-roadmap
+category: misc
+tier: lite
+description: "SecuBox Roadmap - Migration tracking dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/roadmap.sock
+  health: /api/v1/roadmap/health
+
+ui:
+  path: /srv/secubox/www/roadmap
diff --git a/packages/secubox-routes/debian/secubox.yaml b/packages/secubox-routes/debian/secubox.yaml
new file mode 100644
index 00000000..942baa07
--- /dev/null
+++ b/packages/secubox-routes/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-routes
+category: misc
+tier: lite
+description: "SecuBox Routes - Routing table viewer and manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/routes.sock
+  health: /api/v1/routes/health
+
+ui:
+  path: /srv/secubox/www/routes
diff --git a/packages/secubox-rtty/debian/secubox.yaml b/packages/secubox-rtty/debian/secubox.yaml
new file mode 100644
index 00000000..cb0c3110
--- /dev/null
+++ b/packages/secubox-rtty/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-rtty
+category: misc
+tier: lite
+description: "SecuBox Remote Terminal Access (rtty)"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/rtty.sock
+  health: /api/v1/rtty/health
+
+ui:
+  path: /srv/secubox/www/rtty
diff --git a/packages/secubox-saas-relay/debian/secubox.yaml b/packages/secubox-saas-relay/debian/secubox.yaml
new file mode 100644
index 00000000..11e69fd6
--- /dev/null
+++ b/packages/secubox-saas-relay/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-saas-relay
+category: misc
+tier: lite
+description: "SecuBox SaaS/API Proxy Relay"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/saas-relay.sock
+  health: /api/v1/saas-relay/health
+
+ui:
+  path: /srv/secubox/www/saas-relay
diff --git a/packages/secubox-simplex/debian/secubox.yaml b/packages/secubox-simplex/debian/secubox.yaml
new file mode 100644
index 00000000..1497ed1f
--- /dev/null
+++ b/packages/secubox-simplex/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-simplex
+category: media
+tier: lite
+description: "SecuBox SimpleX Chat Server"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/simplex.sock
+  health: /api/v1/simplex/health
+
+ui:
+  path: /srv/secubox/www/simplex
diff --git a/packages/secubox-smtp-relay/debian/secubox.yaml b/packages/secubox-smtp-relay/debian/secubox.yaml
new file mode 100644
index 00000000..2c369d83
--- /dev/null
+++ b/packages/secubox-smtp-relay/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-smtp-relay
+category: email
+tier: lite
+description: "SecuBox SMTP Relay — Email forwarding through smarthost"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/smtp-relay.sock
+  health: /api/v1/smtp-relay/health
+
+ui:
+  path: /srv/secubox/www/smtp-relay
diff --git a/packages/secubox-soc-agent/debian/secubox.yaml b/packages/secubox-soc-agent/debian/secubox.yaml
new file mode 100644
index 00000000..62579e27
--- /dev/null
+++ b/packages/secubox-soc-agent/debian/secubox.yaml
@@ -0,0 +1,14 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-soc-agent
+category: dashboard
+tier: lite
+description: "SecuBox SOC Agent — Edge Node Agent for SOC Integration"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/soc-agent.sock
+  health: /api/v1/soc-agent/health
diff --git a/packages/secubox-soc-gateway/debian/secubox.yaml b/packages/secubox-soc-gateway/debian/secubox.yaml
new file mode 100644
index 00000000..311ff331
--- /dev/null
+++ b/packages/secubox-soc-gateway/debian/secubox.yaml
@@ -0,0 +1,14 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-soc-gateway
+category: dashboard
+tier: lite
+description: "SecuBox SOC Gateway — Central Fleet Monitoring Hub"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/soc-gateway.sock
+  health: /api/v1/soc-gateway/health
diff --git a/packages/secubox-soc-web/debian/secubox.yaml b/packages/secubox-soc-web/debian/secubox.yaml
new file mode 100644
index 00000000..58e85a78
--- /dev/null
+++ b/packages/secubox-soc-web/debian/secubox.yaml
@@ -0,0 +1,7 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-soc-web
+category: dashboard
+tier: lite
+description: "SecuBox SOC Web Dashboard — Browser-based Fleet Monitoring"
diff --git a/packages/secubox-soc/debian/secubox.yaml b/packages/secubox-soc/debian/secubox.yaml
new file mode 100644
index 00000000..150a55de
--- /dev/null
+++ b/packages/secubox-soc/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-soc
+category: dashboard
+tier: lite
+description: "SecuBox Soc Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/soc.sock
+  health: /api/v1/soc/health
+
+ui:
+  path: /srv/secubox/www/soc
diff --git a/packages/secubox-streamforge/debian/secubox.yaml b/packages/secubox-streamforge/debian/secubox.yaml
new file mode 100644
index 00000000..29d93cc9
--- /dev/null
+++ b/packages/secubox-streamforge/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-streamforge
+category: media
+tier: lite
+description: "SecuBox Streamlit Forge"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/streamforge.sock
+  health: /api/v1/streamforge/health
+
+ui:
+  path: /srv/secubox/www/streamforge
diff --git a/packages/secubox-streamlit/debian/secubox.yaml b/packages/secubox-streamlit/debian/secubox.yaml
new file mode 100644
index 00000000..4a31bc28
--- /dev/null
+++ b/packages/secubox-streamlit/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-streamlit
+category: media
+tier: lite
+description: "SecuBox Streamlit Platform"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/streamlit.sock
+  health: /api/v1/streamlit/health
+
+ui:
+  path: /srv/secubox/www/streamlit
diff --git a/packages/secubox-system-hub/debian/secubox.yaml b/packages/secubox-system-hub/debian/secubox.yaml
new file mode 100644
index 00000000..2dcd4adf
--- /dev/null
+++ b/packages/secubox-system-hub/debian/secubox.yaml
@@ -0,0 +1,14 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-system-hub
+category: system
+tier: lite
+description: "SecuBox System Hub Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/system-hub.sock
+  health: /api/v1/system-hub/health
diff --git a/packages/secubox-system/debian/secubox.yaml b/packages/secubox-system/debian/secubox.yaml
new file mode 100644
index 00000000..9cb11587
--- /dev/null
+++ b/packages/secubox-system/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-system
+category: system
+tier: all
+description: "SecuBox System Hub"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/system.sock
+  health: /api/v1/system/health
+
+ui:
+  path: /srv/secubox/www/system
diff --git a/packages/secubox-threat-analyst/debian/secubox.yaml b/packages/secubox-threat-analyst/debian/secubox.yaml
new file mode 100644
index 00000000..bef34eab
--- /dev/null
+++ b/packages/secubox-threat-analyst/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-threat-analyst
+category: misc
+tier: lite
+description: "SecuBox Threat-analyst Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/threat-analyst.sock
+  health: /api/v1/threat-analyst/health
+
+ui:
+  path: /srv/secubox/www/threat-analyst
diff --git a/packages/secubox-threats/debian/secubox.yaml b/packages/secubox-threats/debian/secubox.yaml
new file mode 100644
index 00000000..df2618cc
--- /dev/null
+++ b/packages/secubox-threats/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-threats
+category: misc
+tier: lite
+description: "SecuBox Unified Threats Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/threats.sock
+  health: /api/v1/threats/health
+
+ui:
+  path: /srv/secubox/www/threats
diff --git a/packages/secubox-tor/debian/secubox.yaml b/packages/secubox-tor/debian/secubox.yaml
new file mode 100644
index 00000000..df030aff
--- /dev/null
+++ b/packages/secubox-tor/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-tor
+category: misc
+tier: lite
+description: "SecuBox Tor Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/tor.sock
+  health: /api/v1/tor/health
+
+ui:
+  path: /srv/secubox/www/tor
diff --git a/packages/secubox-torrent/debian/secubox.yaml b/packages/secubox-torrent/debian/secubox.yaml
new file mode 100644
index 00000000..f294ef00
--- /dev/null
+++ b/packages/secubox-torrent/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-torrent
+category: misc
+tier: lite
+description: "BitTorrent client management for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/torrent.sock
+  health: /api/v1/torrent/health
+
+ui:
+  path: /srv/secubox/www/torrent
diff --git a/packages/secubox-traffic/debian/secubox.yaml b/packages/secubox-traffic/debian/secubox.yaml
new file mode 100644
index 00000000..134ec5e7
--- /dev/null
+++ b/packages/secubox-traffic/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-traffic
+category: misc
+tier: lite
+description: "SecuBox Traffic Shaper"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/traffic.sock
+  health: /api/v1/traffic/health
+
+ui:
+  path: /srv/secubox/www/traffic
diff --git a/packages/secubox-turn/debian/secubox.yaml b/packages/secubox-turn/debian/secubox.yaml
new file mode 100644
index 00000000..93f9f544
--- /dev/null
+++ b/packages/secubox-turn/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-turn
+category: misc
+tier: lite
+description: "SecuBox TURN/STUN Server Management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/turn.sock
+  health: /api/v1/turn/health
+
+ui:
+  path: /srv/secubox/www/turn
diff --git a/packages/secubox-ui-manager/debian/secubox.yaml b/packages/secubox-ui-manager/debian/secubox.yaml
new file mode 100644
index 00000000..fbd5b11c
--- /dev/null
+++ b/packages/secubox-ui-manager/debian/secubox.yaml
@@ -0,0 +1,7 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-ui-manager
+category: misc
+tier: lite
+description: "SecuBox Unified UI Manager"
diff --git a/packages/secubox-users/debian/secubox.yaml b/packages/secubox-users/debian/secubox.yaml
new file mode 100644
index 00000000..1edc7c45
--- /dev/null
+++ b/packages/secubox-users/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-users
+category: misc
+tier: lite
+description: "SecuBox Users Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/users.sock
+  health: /api/v1/users/health
+
+ui:
+  path: /srv/secubox/www/users
diff --git a/packages/secubox-vault/debian/secubox.yaml b/packages/secubox-vault/debian/secubox.yaml
new file mode 100644
index 00000000..b8fc9cfb
--- /dev/null
+++ b/packages/secubox-vault/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-vault
+category: misc
+tier: lite
+description: "SecuBox Vault - Secrets management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/vault.sock
+  health: /api/v1/vault/health
+
+ui:
+  path: /srv/secubox/www/vault
diff --git a/packages/secubox-vhost/debian/secubox.yaml b/packages/secubox-vhost/debian/secubox.yaml
new file mode 100644
index 00000000..e7716204
--- /dev/null
+++ b/packages/secubox-vhost/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-vhost
+category: misc
+tier: lite
+description: "SecuBox Virtual Host Manager"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/vhost.sock
+  health: /api/v1/vhost/health
+
+ui:
+  path: /srv/secubox/www/vhost
diff --git a/packages/secubox-vm/debian/secubox.yaml b/packages/secubox-vm/debian/secubox.yaml
new file mode 100644
index 00000000..ebadad28
--- /dev/null
+++ b/packages/secubox-vm/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-vm
+category: misc
+tier: lite
+description: "SecuBox VM Manager - Virtualization management"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/vm.sock
+  health: /api/v1/vm/health
+
+ui:
+  path: /srv/secubox/www/vm
diff --git a/packages/secubox-voip/debian/secubox.yaml b/packages/secubox-voip/debian/secubox.yaml
new file mode 100644
index 00000000..8c4e4175
--- /dev/null
+++ b/packages/secubox-voip/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-voip
+category: misc
+tier: lite
+description: "VoIP/PBX management module for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/voip.sock
+  health: /api/v1/voip/health
+
+ui:
+  path: /srv/secubox/www/voip
diff --git a/packages/secubox-vortex-dns/debian/secubox.yaml b/packages/secubox-vortex-dns/debian/secubox.yaml
new file mode 100644
index 00000000..0bd53d43
--- /dev/null
+++ b/packages/secubox-vortex-dns/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-vortex-dns
+category: network
+tier: lite
+description: "SecuBox Vortex-dns Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/vortex-dns.sock
+  health: /api/v1/vortex-dns/health
+
+ui:
+  path: /srv/secubox/www/vortex-dns
diff --git a/packages/secubox-vortex-firewall/debian/secubox.yaml b/packages/secubox-vortex-firewall/debian/secubox.yaml
new file mode 100644
index 00000000..72e469ab
--- /dev/null
+++ b/packages/secubox-vortex-firewall/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-vortex-firewall
+category: security
+tier: lite
+description: "SecuBox Vortex-firewall Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/vortex-firewall.sock
+  health: /api/v1/vortex-firewall/health
+
+ui:
+  path: /srv/secubox/www/vortex-firewall
diff --git a/packages/secubox-waf/debian/secubox.yaml b/packages/secubox-waf/debian/secubox.yaml
new file mode 100644
index 00000000..d854ecf0
--- /dev/null
+++ b/packages/secubox-waf/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-waf
+category: security
+tier: standard
+description: "SecuBox Web Application Firewall (mitmproxy LXC)"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/waf.sock
+  health: /api/v1/waf/health
+
+ui:
+  path: /srv/secubox/www/waf
diff --git a/packages/secubox-watchdog/debian/secubox.yaml b/packages/secubox-watchdog/debian/secubox.yaml
new file mode 100644
index 00000000..8cbe7e94
--- /dev/null
+++ b/packages/secubox-watchdog/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-watchdog
+category: misc
+tier: lite
+description: "SecuBox Watchdog Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/watchdog.sock
+  health: /api/v1/watchdog/health
+
+ui:
+  path: /srv/secubox/www/watchdog
diff --git a/packages/secubox-wazuh/debian/secubox.yaml b/packages/secubox-wazuh/debian/secubox.yaml
new file mode 100644
index 00000000..d5a2e27f
--- /dev/null
+++ b/packages/secubox-wazuh/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-wazuh
+category: misc
+tier: lite
+description: "SecuBox Wazuh SIEM integration"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/wazuh.sock
+  health: /api/v1/wazuh/health
+
+ui:
+  path: /srv/secubox/www/wazuh
diff --git a/packages/secubox-webmail-lxc/debian/secubox.yaml b/packages/secubox-webmail-lxc/debian/secubox.yaml
new file mode 100644
index 00000000..a4e17250
--- /dev/null
+++ b/packages/secubox-webmail-lxc/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-webmail-lxc
+category: email
+tier: lite
+description: "SecuBox Webmail LXC Container (Backend)"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/webmail-lxc.sock
+  health: /api/v1/webmail-lxc/health
+
+ui:
+  path: /srv/secubox/www/webmail-lxc
diff --git a/packages/secubox-webmail/debian/secubox.yaml b/packages/secubox-webmail/debian/secubox.yaml
new file mode 100644
index 00000000..917e3a73
--- /dev/null
+++ b/packages/secubox-webmail/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-webmail
+category: email
+tier: lite
+description: "SecuBox Webmail Module"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/webmail.sock
+  health: /api/v1/webmail/health
+
+ui:
+  path: /srv/secubox/www/webmail
diff --git a/packages/secubox-webradio/debian/secubox.yaml b/packages/secubox-webradio/debian/secubox.yaml
new file mode 100644
index 00000000..d121d15c
--- /dev/null
+++ b/packages/secubox-webradio/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-webradio
+category: misc
+tier: lite
+description: "Internet Radio Streaming for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/webradio.sock
+  health: /api/v1/webradio/health
+
+ui:
+  path: /srv/secubox/www/webradio
diff --git a/packages/secubox-wireguard/debian/secubox.yaml b/packages/secubox-wireguard/debian/secubox.yaml
new file mode 100644
index 00000000..c3e0d462
--- /dev/null
+++ b/packages/secubox-wireguard/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-wireguard
+category: network
+tier: lite
+description: "SecuBox WireGuard VPN Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/wireguard.sock
+  health: /api/v1/wireguard/health
+
+ui:
+  path: /srv/secubox/www/wireguard
diff --git a/packages/secubox-zigbee/debian/secubox.yaml b/packages/secubox-zigbee/debian/secubox.yaml
new file mode 100644
index 00000000..29e2c627
--- /dev/null
+++ b/packages/secubox-zigbee/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-zigbee
+category: iot
+tier: lite
+description: "Zigbee2MQTT Gateway for SecuBox"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/zigbee.sock
+  health: /api/v1/zigbee/health
+
+ui:
+  path: /srv/secubox/www/zigbee
diff --git a/packages/secubox-zkp/debian/secubox.yaml b/packages/secubox-zkp/debian/secubox.yaml
new file mode 100644
index 00000000..18842da8
--- /dev/null
+++ b/packages/secubox-zkp/debian/secubox.yaml
@@ -0,0 +1,17 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: secubox-zkp
+category: misc
+tier: lite
+description: "SecuBox ZKP - Zero-Knowledge Proof Dashboard"
+
+depends:
+  - secubox-core
+
+api:
+  socket: /run/secubox/zkp.sock
+  health: /api/v1/zkp/health
+
+ui:
+  path: /srv/secubox/www/zkp
diff --git a/packages/zkp-hamiltonian/debian/secubox.yaml b/packages/zkp-hamiltonian/debian/secubox.yaml
new file mode 100644
index 00000000..a2a5255a
--- /dev/null
+++ b/packages/zkp-hamiltonian/debian/secubox.yaml
@@ -0,0 +1,7 @@
+# debian/secubox.yaml
+# Auto-generated from debian/control
+
+name: libzkp-hamiltonian1
+category: misc
+tier: lite
+description: "Zero-Knowledge Proof library based on Hamiltonian Cycle"
diff --git a/profiles/arch/amd64.yaml b/profiles/arch/amd64.yaml
new file mode 100644
index 00000000..9433918c
--- /dev/null
+++ b/profiles/arch/amd64.yaml
@@ -0,0 +1,29 @@
+# profiles/arch/amd64.yaml
+# Architecture profile for AMD64 (x86_64) devices
+name: arch-amd64
+inherits: base
+description: AMD64 architecture base (VMs, x64 hardware)
+
+kernel:
+  modules:
+    enable:
+      - kvm
+      - kvm_intel
+      - kvm_amd
+      - virtio_net
+      - virtio_blk
+      - virtio_scsi
+      - vfio
+      - vfio_pci
+
+packages:
+  required:
+    - intel-microcode
+    - amd64-microcode
+
+# x86_64-specific sysctl
+sysctl:
+  # Enable huge pages
+  vm.nr_hugepages: 128
+  # KVM-specific tuning
+  kernel.sched_rt_runtime_us: 950000
diff --git a/profiles/arch/arm64.yaml b/profiles/arch/arm64.yaml
new file mode 100644
index 00000000..74c368a2
--- /dev/null
+++ b/profiles/arch/arm64.yaml
@@ -0,0 +1,22 @@
+# profiles/arch/arm64.yaml
+# Architecture profile for ARM64 (aarch64) devices
+name: arch-arm64
+inherits: base
+description: ARM64 architecture base (ESPRESSObin, MOCHAbin, RPi)
+
+kernel:
+  modules:
+    enable:
+      - arm_smccc
+      - cpufreq_dt
+      - panfrost   # Mali GPU on some boards
+      - tegra_smmu # For NVIDIA Jetson
+
+packages:
+  required:
+    - qemu-user-static  # For cross-arch container support
+
+# ARM64-specific sysctl
+sysctl:
+  # Enable huge pages for better performance on ARM
+  vm.nr_hugepages: 64
diff --git a/scripts/apt-publish.sh b/scripts/apt-publish.sh
new file mode 100755
index 00000000..fc636a3c
--- /dev/null
+++ b/scripts/apt-publish.sh
@@ -0,0 +1,178 @@
+#!/bin/bash
+# scripts/apt-publish.sh
+# Publish .deb packages to local APT repository with lintian validation
+# SecuBox-DEB - CyberMind
+
+set -euo pipefail
+
+readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+readonly APT_LOCAL="/srv/apt"
+readonly APT_CONF="$REPO_ROOT/apt/conf"
+readonly HOOKS_DIR="$REPO_ROOT/apt/hooks"
+readonly CODENAME="${CODENAME:-bookworm}"
+readonly COMPONENT="${COMPONENT:-main}"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+usage() {
+    cat << EOF
+Usage: $(basename "$0") [OPTIONS] <package.deb> [package2.deb ...]
+
+Publish .deb packages to the SecuBox APT repository.
+
+Options:
+    -c, --codename NAME    Distribution codename (default: bookworm)
+    -C, --component NAME   Component (default: main)
+    -s, --skip-lintian     Skip lintian validation
+    -n, --dry-run          Show what would be done
+    -h, --help             Show this help message
+
+Environment:
+    CODENAME    Distribution codename (default: bookworm)
+    COMPONENT   Component (default: main)
+
+Examples:
+    $(basename "$0") packages/secubox-core/*.deb
+    $(basename "$0") -c bookworm-testing *.deb
+    $(basename "$0") --skip-lintian packages/*/*.deb
+EOF
+}
+
+init_repo() {
+    if [ ! -d "$APT_LOCAL" ]; then
+        echo -e "${YELLOW}Initializing APT repository at $APT_LOCAL...${NC}"
+        sudo mkdir -p "$APT_LOCAL"/{conf,db,dists,pool,incoming,tmp}
+        sudo cp "$APT_CONF"/* "$APT_LOCAL/conf/"
+        sudo chown -R "$(whoami)" "$APT_LOCAL"
+
+        # Initialize reprepro
+        cd "$APT_LOCAL"
+        reprepro export
+        echo -e "${GREEN}Repository initialized.${NC}"
+    fi
+}
+
+run_lintian() {
+    local deb_file="$1"
+    if [ -x "$HOOKS_DIR/lintian-check" ]; then
+        "$HOOKS_DIR/lintian-check" "$deb_file"
+    else
+        echo -e "${YELLOW}Warning: lintian hook not found, skipping validation${NC}"
+    fi
+}
+
+publish_package() {
+    local deb_file="$1"
+    local skip_lintian="$2"
+    local dry_run="$3"
+    local codename="$4"
+    local component="$5"
+
+    local pkg_name=$(dpkg-deb -f "$deb_file" Package 2>/dev/null || echo "unknown")
+    local pkg_version=$(dpkg-deb -f "$deb_file" Version 2>/dev/null || echo "unknown")
+    local pkg_arch=$(dpkg-deb -f "$deb_file" Architecture 2>/dev/null || echo "unknown")
+
+    echo -e "Publishing: ${GREEN}${pkg_name}${NC} ${pkg_version} (${pkg_arch})"
+
+    # Run lintian if not skipped
+    if [ "$skip_lintian" != "true" ]; then
+        if ! run_lintian "$deb_file"; then
+            echo -e "${RED}Lintian validation failed for $deb_file${NC}"
+            return 1
+        fi
+    fi
+
+    if [ "$dry_run" = "true" ]; then
+        echo -e "${YELLOW}DRY RUN: Would add to $codename/$component${NC}"
+        return 0
+    fi
+
+    # Add to repository
+    cd "$APT_LOCAL"
+    reprepro -C "$component" includedeb "$codename" "$deb_file"
+
+    echo -e "${GREEN}Added to repository: $codename/$component${NC}"
+}
+
+# Parse arguments
+SKIP_LINTIAN=false
+DRY_RUN=false
+PACKAGES=()
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -c|--codename)
+            CODENAME="$2"
+            shift 2
+            ;;
+        -C|--component)
+            COMPONENT="$2"
+            shift 2
+            ;;
+        -s|--skip-lintian)
+            SKIP_LINTIAN=true
+            shift
+            ;;
+        -n|--dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            echo "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+        *)
+            PACKAGES+=("$1")
+            shift
+            ;;
+    esac
+done
+
+if [ ${#PACKAGES[@]} -eq 0 ]; then
+    echo "Error: No packages specified"
+    usage
+    exit 1
+fi
+
+# Initialize repository if needed
+init_repo
+
+# Publish packages
+success=0
+failed=0
+
+for pkg in "${PACKAGES[@]}"; do
+    if [ ! -f "$pkg" ]; then
+        echo -e "${RED}File not found: $pkg${NC}"
+        ((failed++))
+        continue
+    fi
+
+    if [[ "$pkg" != *.deb ]]; then
+        echo -e "${YELLOW}Skipping non-.deb file: $pkg${NC}"
+        continue
+    fi
+
+    if publish_package "$pkg" "$SKIP_LINTIAN" "$DRY_RUN" "$CODENAME" "$COMPONENT"; then
+        ((success++))
+    else
+        ((failed++))
+    fi
+done
+
+echo ""
+echo -e "Published: ${GREEN}$success${NC}  Failed: ${RED}$failed${NC}"
+
+if [ $failed -gt 0 ]; then
+    exit 1
+fi
diff --git a/scripts/apt-sync.sh b/scripts/apt-sync.sh
new file mode 100755
index 00000000..bf01ad03
--- /dev/null
+++ b/scripts/apt-sync.sh
@@ -0,0 +1,153 @@
+#!/bin/bash
+# scripts/apt-sync.sh
+# Sync local APT repository to apt.secubox.in
+# SecuBox-DEB - CyberMind
+
+set -euo pipefail
+
+readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+readonly APT_LOCAL="/srv/apt"
+readonly APT_REMOTE="apt.secubox.in:/srv/apt"
+readonly LOG_FILE="/var/log/secubox/apt-sync.log"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+log() {
+    local level="$1"
+    shift
+    local msg="$*"
+    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
+    echo -e "${timestamp} [${level}] ${msg}" | tee -a "$LOG_FILE"
+}
+
+usage() {
+    cat << EOF
+Usage: $(basename "$0") [OPTIONS]
+
+Sync local APT repository to apt.secubox.in
+
+Options:
+    -n, --dry-run     Show what would be synced without doing it
+    -f, --force       Force sync even if no changes detected
+    -v, --verbose     Verbose output
+    -h, --help        Show this help message
+
+Examples:
+    $(basename "$0")              # Normal sync
+    $(basename "$0") --dry-run    # Preview changes
+    $(basename "$0") --force      # Force full sync
+EOF
+}
+
+check_deps() {
+    local missing=()
+    for cmd in rsync reprepro ssh; do
+        if ! command -v "$cmd" &> /dev/null; then
+            missing+=("$cmd")
+        fi
+    done
+
+    if [ ${#missing[@]} -gt 0 ]; then
+        log "ERROR" "Missing dependencies: ${missing[*]}"
+        exit 1
+    fi
+}
+
+check_repo() {
+    if [ ! -d "$APT_LOCAL" ]; then
+        log "ERROR" "Local repository not found: $APT_LOCAL"
+        exit 1
+    fi
+
+    if [ ! -f "$APT_LOCAL/conf/distributions" ]; then
+        log "ERROR" "Repository not initialized. Run 'reprepro export' first."
+        exit 1
+    fi
+}
+
+sync_repo() {
+    local dry_run="${1:-false}"
+    local verbose="${2:-false}"
+
+    local rsync_opts="-avz --delete"
+    if [ "$dry_run" = "true" ]; then
+        rsync_opts="$rsync_opts --dry-run"
+    fi
+    if [ "$verbose" = "true" ]; then
+        rsync_opts="$rsync_opts --progress"
+    fi
+
+    log "INFO" "Syncing $APT_LOCAL to $APT_REMOTE..."
+
+    # Sync dists/ and pool/
+    rsync $rsync_opts \
+        --include='dists/***' \
+        --include='pool/***' \
+        --exclude='conf/' \
+        --exclude='db/' \
+        --exclude='incoming/' \
+        --exclude='tmp/' \
+        "$APT_LOCAL/" \
+        "$APT_REMOTE/"
+
+    local rc=$?
+    if [ $rc -eq 0 ]; then
+        log "INFO" "${GREEN}Sync completed successfully${NC}"
+    else
+        log "ERROR" "${RED}Sync failed with exit code $rc${NC}"
+        exit $rc
+    fi
+}
+
+# Parse arguments
+DRY_RUN=false
+FORCE=false
+VERBOSE=false
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -n|--dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        -f|--force)
+            FORCE=true
+            shift
+            ;;
+        -v|--verbose)
+            VERBOSE=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+# Main
+check_deps
+check_repo
+
+# Create log directory if needed
+mkdir -p "$(dirname "$LOG_FILE")"
+
+log "INFO" "Starting APT repository sync..."
+
+if [ "$DRY_RUN" = "true" ]; then
+    log "INFO" "${YELLOW}DRY RUN - no changes will be made${NC}"
+fi
+
+sync_repo "$DRY_RUN" "$VERBOSE"
+
+log "INFO" "Done."
diff --git a/scripts/generate-secubox-yaml.py b/scripts/generate-secubox-yaml.py
new file mode 100755
index 00000000..0c4e0c34
--- /dev/null
+++ b/scripts/generate-secubox-yaml.py
@@ -0,0 +1,279 @@
+#!/usr/bin/env python3
+"""
+SecuBox-Deb :: generate-secubox-yaml.py
+Generate debian/secubox.yaml files from existing debian/control files.
+
+Usage:
+    python3 scripts/generate-secubox-yaml.py
+    python3 scripts/generate-secubox-yaml.py packages/secubox-crowdsec
+
+CyberMind - Gerald Kerma
+"""
+
+import sys
+from typing import Optional
+import re
+from pathlib import Path
+
+# Category mapping based on package name patterns
+CATEGORY_MAP = {
+    # Security
+    r'crowdsec|waf|auth|firewall|nac|hardening|cve|guardian': 'security',
+    # Network
+    r'wireguard|vpn|netmodes|network|dns|vortex|ddns|haproxy': 'network',
+    # Monitoring
+    r'netdata|metrics|grafana|prometheus|health|doctor': 'monitoring',
+    # System
+    r'core|system|hub|portal|admin|backup|config|daemon': 'system',
+    # Media
+    r'jellyfin|media|stream|plex|dlna': 'media',
+    # AI
+    r'ollama|ai-|llm|copilot|insights': 'ai',
+    # Publishing
+    r'metablog|publish|blog|cms|gitea|wiki': 'publishing',
+    # Dashboard
+    r'dashboard|c3box|soc|eye-remote': 'dashboard',
+    # VPN
+    r'tailscale|zerotier|nebula|mesh': 'vpn',
+    # Email
+    r'email|mail|smtp|imap': 'email',
+    # IoT
+    r'iot|mqtt|zigbee|zwave|home': 'iot',
+    # Communication
+    r'matrix|signal|chat|voice': 'communication',
+}
+
+# Tier mapping: packages exclusive to certain tiers
+TIER_EXCLUSIVE = {
+    'pro': [
+        'secubox-dpi',
+        'secubox-ollama',
+        'secubox-jellyfin',
+        'secubox-matrix',
+        'secubox-nextcloud',
+        'secubox-gitea',
+        'secubox-ai-gateway',
+        'secubox-ai-insights',
+    ],
+    'standard': [
+        'secubox-qos',
+        'secubox-cdn',
+        'secubox-waf',
+        'secubox-haproxy',
+    ],
+}
+
+# Packages required for all tiers
+REQUIRED_ALL = [
+    'secubox-core',
+    'secubox-hub',
+    'secubox-portal',
+    'secubox-system',
+]
+
+
+def detect_category(pkg_name: str) -> str:
+    """Detect category from package name."""
+    name_lower = pkg_name.lower().replace('secubox-', '')
+    for pattern, category in CATEGORY_MAP.items():
+        if re.search(pattern, name_lower):
+            return category
+    return 'misc'
+
+
+def detect_tier(pkg_name: str) -> str:
+    """Detect minimum tier for package."""
+    if pkg_name in REQUIRED_ALL:
+        return 'all'
+    for tier, packages in TIER_EXCLUSIVE.items():
+        if pkg_name in packages:
+            return tier
+    return 'lite'  # Available on all tiers by default
+
+
+def parse_control(control_path: Path) -> dict:
+    """Parse debian/control file and extract metadata."""
+    content = control_path.read_text()
+
+    result = {
+        'source': '',
+        'package': '',
+        'section': 'misc',
+        'architecture': 'all',
+        'depends': [],
+        'recommends': [],
+        'description': '',
+        'description_long': '',
+    }
+
+    # Parse Source stanza
+    source_match = re.search(r'^Source:\s*(.+)$', content, re.MULTILINE)
+    if source_match:
+        result['source'] = source_match.group(1).strip()
+
+    # Parse Package stanza
+    pkg_match = re.search(r'^Package:\s*(.+)$', content, re.MULTILINE)
+    if pkg_match:
+        result['package'] = pkg_match.group(1).strip()
+
+    # Parse Section
+    section_match = re.search(r'^Section:\s*(.+)$', content, re.MULTILINE)
+    if section_match:
+        result['section'] = section_match.group(1).strip()
+
+    # Parse Architecture
+    arch_match = re.search(r'^Architecture:\s*(.+)$', content, re.MULTILINE)
+    if arch_match:
+        result['architecture'] = arch_match.group(1).strip()
+
+    # Parse Depends (multi-line capable)
+    depends_match = re.search(r'^Depends:\s*(.+?)(?=^[A-Z]|\Z)', content, re.MULTILINE | re.DOTALL)
+    if depends_match:
+        deps_raw = depends_match.group(1)
+        # Clean up and split
+        deps_clean = re.sub(r'\s+', ' ', deps_raw).strip()
+        deps_list = [d.strip() for d in deps_clean.split(',') if d.strip()]
+        # Extract just package names (remove version constraints, alternatives)
+        deps_names = []
+        for dep in deps_list:
+            # Skip ${misc:Depends} etc
+            if dep.startswith('$'):
+                continue
+            # Handle alternatives (a | b)
+            if '|' in dep:
+                parts = dep.split('|')
+                dep = parts[0].strip()
+            # Remove version constraints
+            dep = re.sub(r'\s*\([^)]+\)', '', dep).strip()
+            if dep and not dep.startswith('$'):
+                deps_names.append(dep)
+        result['depends'] = deps_names
+
+    # Parse Recommends
+    recommends_match = re.search(r'^Recommends:\s*(.+)$', content, re.MULTILINE)
+    if recommends_match:
+        recs_raw = recommends_match.group(1)
+        recs_clean = re.sub(r'\s+', ' ', recs_raw).strip()
+        recs_list = [r.strip() for r in recs_clean.split(',') if r.strip()]
+        result['recommends'] = recs_list
+
+    # Parse Description
+    desc_match = re.search(r'^Description:\s*(.+?)(?=^[A-Z]|\Z)', content, re.MULTILINE | re.DOTALL)
+    if desc_match:
+        desc_lines = desc_match.group(1).strip().split('\n')
+        result['description'] = desc_lines[0].strip()
+        if len(desc_lines) > 1:
+            # Long description is indented with space or dot
+            long_desc = []
+            for line in desc_lines[1:]:
+                line = line.strip()
+                if line.startswith('.'):
+                    long_desc.append('')
+                elif line:
+                    long_desc.append(line)
+            result['description_long'] = '\n'.join(long_desc)
+
+    return result
+
+
+def generate_secubox_yaml(pkg_dir: Path) -> Optional[str]:
+    """Generate secubox.yaml content for a package."""
+    control_path = pkg_dir / 'debian' / 'control'
+    if not control_path.exists():
+        return None
+
+    meta = parse_control(control_path)
+    pkg_name = meta['package'] or pkg_dir.name
+
+    category = detect_category(pkg_name)
+    tier = detect_tier(pkg_name)
+
+    # Filter secubox-* dependencies
+    secubox_deps = [d for d in meta['depends'] if d.startswith('secubox-')]
+
+    lines = [
+        f"# debian/secubox.yaml",
+        f"# Auto-generated from debian/control",
+        f"",
+        f"name: {pkg_name}",
+        f"category: {category}",
+        f"tier: {tier}",
+    ]
+
+    if meta['description']:
+        lines.append(f"description: \"{meta['description']}\"")
+
+    if secubox_deps:
+        lines.append(f"")
+        lines.append(f"depends:")
+        for dep in secubox_deps:
+            lines.append(f"  - {dep}")
+
+    # Check for API socket
+    api_path = pkg_dir / 'api' / 'main.py'
+    if api_path.exists():
+        lines.append(f"")
+        lines.append(f"api:")
+        lines.append(f"  socket: /run/secubox/{pkg_name.replace('secubox-', '')}.sock")
+        lines.append(f"  health: /api/v1/{pkg_name.replace('secubox-', '')}/health")
+
+    # Check for www/ directory
+    www_path = pkg_dir / 'www'
+    if www_path.exists():
+        lines.append(f"")
+        lines.append(f"ui:")
+        lines.append(f"  path: /srv/secubox/www/{pkg_name.replace('secubox-', '')}")
+
+    lines.append("")
+    return '\n'.join(lines)
+
+
+def process_package(pkg_dir: Path) -> bool:
+    """Process a single package directory."""
+    yaml_content = generate_secubox_yaml(pkg_dir)
+    if yaml_content is None:
+        print(f"  SKIP: {pkg_dir.name} (no debian/control)")
+        return False
+
+    yaml_path = pkg_dir / 'debian' / 'secubox.yaml'
+
+    # Don't overwrite if exists with custom content
+    if yaml_path.exists():
+        existing = yaml_path.read_text()
+        if '# Custom' in existing or '# Manual' in existing:
+            print(f"  SKIP: {pkg_dir.name} (custom secubox.yaml)")
+            return False
+
+    yaml_path.write_text(yaml_content)
+    print(f"  OK: {pkg_dir.name}")
+    return True
+
+
+def main():
+    script_dir = Path(__file__).parent
+    repo_root = script_dir.parent
+    packages_dir = repo_root / 'packages'
+
+    if len(sys.argv) > 1:
+        # Process specific package(s)
+        for pkg_path in sys.argv[1:]:
+            pkg_dir = Path(pkg_path)
+            if not pkg_dir.is_absolute():
+                pkg_dir = repo_root / pkg_path
+            if pkg_dir.exists():
+                process_package(pkg_dir)
+            else:
+                print(f"  ERROR: {pkg_path} not found")
+    else:
+        # Process all packages
+        print(f"Generating secubox.yaml for packages in {packages_dir}...")
+        count = 0
+        for pkg_dir in sorted(packages_dir.iterdir()):
+            if pkg_dir.is_dir() and (pkg_dir / 'debian').exists():
+                if process_package(pkg_dir):
+                    count += 1
+        print(f"\nGenerated {count} secubox.yaml files")
+
+
+if __name__ == '__main__':
+    main()