From 1404d995510638968d20a9e45edb9607de045e4d Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Mon, 27 Apr 2026 11:36:43 +0200
Subject: [PATCH] Add Multiboot Live OS announcement and documentation

- Add v2.2.3 announcement banner on Home page
- Create Multiboot.md with full multiboot documentation
- Update sidebar with Multiboot and Eye Remote links
- Version bump to v2.2.3

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 Home.md      | 208 ++++++++++++++++++------------------------
 Multiboot.md | 253 +++++++++++++++++++++++++++++++++++++++++++++++++++
 _Sidebar.md  |  63 +++++--------
 3 files changed, 366 insertions(+), 158 deletions(-)
 create mode 100644 Multiboot.md

diff --git a/Home.md b/Home.md
index f186dcd..fafdbc9 100644
--- a/Home.md
+++ b/Home.md
@@ -1,175 +1,149 @@
-# SecuBox OS
+# SecuBox
 
 **CyberMind · Gondwana · Notre-Dame-du-Cruet · Savoie** | [FR](Home-FR) | [中文](Home-ZH)
 
-**SecuBox OS** — Appliance de cybersécurité complète portée depuis OpenWrt vers Debian bookworm.
-Conçue pour boards ARM64 GlobalScale (MOCHAbin, ESPRESSObin) et systèmes x86_64.
-
-**125 modules · 2000+ endpoints API · Candidat ANSSI CSPN**
+Complete security appliance solution ported from OpenWrt to Debian bookworm. Designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems. **125 packages** with **2000+ API endpoints**.
 
 ---
 
-## Qu'est-ce que SecuBox OS ?
-
-SecuBox OS est un système d'exploitation durci orienté sécurité réseau :
-
-| Fonction | Description |
-|----------|-------------|
-| **Firewall** | nftables DEFAULT DROP, règles automatiques |
-| **IDS/IPS** | CrowdSec + Suricata, threat intelligence temps réel |
-| **WAF** | HAProxy + mitmproxy, 300+ règles ModSecurity |
-| **VPN** | WireGuard natif, mesh P2P |
-| **DPI** | nDPId + netifyd, analyse trafic L7 |
-| **DNS** | Unbound Vortex, blocklists automatiques |
+> **NEW v2.2.3 — Multi-Boot Live OS with Eye Remote Integration**
+>
+> Dual-architecture bootable image (ARM64 + AMD64) with RAM-based execution and shared persistent storage. Boot from USB or use Pi Zero Eye Remote as USB gadget to boot ESPRESSObin/MOCHAbin.
+>
+> **Features:**
+> - Boot any ARM64 (U-Boot) or AMD64 (UEFI) system from one USB stick
+> - Pi Zero presents multiboot image as USB storage for ESPRESSObin boot
+> - RAM-based live execution — minimal I/O, perfect for USB gadgets
+> - Shared data partition accessible from both architectures
+>
+> See [[Multiboot]] for documentation | [Download v2.2.3](https://github.com/CyberMind-FR/secubox-deb/releases/tag/multiboot-v2.2.3)
 
 ---
 
-## 🔴 BOOT — Démarrage rapide
+## 🔴 BOOT — Quick Start
 
-### VirtualBox (Recommandé)
+### VirtualBox (2 Minutes) ⭐
+
+Test SecuBox instantly in VirtualBox — no USB drive needed:
+
+```bash
+# Download latest image
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
+gunzip secubox-live-amd64-bookworm.img.gz
+
+# Convert to VDI format
+VBoxManage convertfromraw secubox-live-amd64-bookworm.img secubox-live.vdi --format VDI
+
+# Create and start VM
+curl -sLO https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh
+chmod +x create-vbox-vm.sh
+./create-vbox-vm.sh secubox-live.vdi
+```
+
+**One-liner with auto-download:**
 
 ```bash
-# One-liner avec téléchargement auto
 curl -sL https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh | bash -s -- --download
 ```
 
-Voir [[Live-USB-VirtualBox]] pour les détails.
+See [[Live-USB-VirtualBox]] for full documentation.
 
-### Live USB
+### Live USB (Hardware) ⚡
+
+Boot directly from USB on physical hardware:
 
 ```bash
 wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
 zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
 ```
 
-Voir [[Live-USB]] pour le guide complet.
+See [[Live-USB]] for complete guide.
 
-### Installation APT
+### APT Installation (Existing Debian)
 
 ```bash
 curl -fsSL https://apt.secubox.in/install.sh | sudo bash
-sudo apt install secubox-full
+sudo apt install secubox-full   # or secubox-lite
 ```
 
----
-
-## 🟠 AUTH — Accès
-
-| Service | Utilisateur | Mot de passe | Port |
-|---------|-------------|--------------|------|
-| Web UI | admin | secubox | 9443 |
-| SSH | root | secubox | 2222 |
+See [[Installation]] for detailed instructions.
 
 ---
 
-## 🟢 ROOT — Matériel supporté
+## 🟠 AUTH — Access Credentials
 
-### ARM64 (Production)
-
-| Board | SoC | Profil | Usage |
-|-------|-----|--------|-------|
-| MOCHAbin | Armada 7040 | Full | Entreprise, datacenter |
-| ESPRESSObin v7 | Armada 3720 | Lite | PME, agences |
-| ESPRESSObin Ultra | Armada 3720 | Lite+ | PME étendu |
-
-### x86_64 (Dev/Test)
-
-| Plateforme | Profil | Usage |
-|------------|--------|-------|
-| VirtualBox | Full | Développement |
-| QEMU/KVM | Full | Test/CI |
-| Bare metal | Full | Production x86 |
+| Service | Username | Password |
+|---------|----------|----------|
+| **Web UI** | admin | secubox |
+| **SSH** | root | secubox |
+| **Access** | https://localhost:9443 | SSH port 2222 |
 
 ---
 
-## 🟣 MIND — Stack modulaire
+## 🟢 ROOT — System Requirements
 
-SecuBox OS est organisé en 6 stacks fonctionnelles :
+| Board | SoC | Profile | Use Case |
+|-------|-----|---------|----------|
+| MOCHAbin | Armada 7040 | Full | Enterprise Gateway |
+| ESPRESSObin v7 | Armada 3720 | Lite | Home/SMB Router |
+| ESPRESSObin Ultra | Armada 3720 | Lite+ | Home with Wi-Fi |
+| Raspberry Pi 400 | BCM2711 | Full | Maker Projects |
+| VM x86_64 | Any | Full | Testing/Development |
+| QEMU ARM64 | Emulated | Full | ARM testing on x86 |
 
-| Stack | Code couleur | Modules clés |
-|-------|--------------|--------------|
-| 🟠 **AUTH** | Orange | auth, portal, nac, users |
-| 🟡 **WALL** | Jaune | crowdsec, waf, ipblock, threats |
-| 🔴 **BOOT** | Rouge | cloner, vault, vm, backup |
-| 🟣 **MIND** | Violet | dpi, ai-insights, netdata |
-| 🟢 **ROOT** | Vert | core, hub, system, admin |
-| 🔵 **MESH** | Bleu | wireguard, haproxy, qos, mesh |
+---
 
-Voir [[Modules]] pour les 125 modules.
+## 🟣 MIND — Feature Overview
+
+| Stack | Description | Modules |
+|-------|-------------|---------|
+| 🟠 **AUTH** | Authentication, ZeroTrust, MFA | auth, portal, users, nac |
+| 🟡 **WALL** | Firewall, CrowdSec, WAF, IDS/IPS | crowdsec, waf, threats, ipblock |
+| 🔴 **BOOT** | Deployment, provisioning | cloner, vault, vm, rezapp |
+| 🟣 **MIND** | AI, behavioral analysis, DPI | dpi, netifyd, ai-insights, soc |
+| 🟢 **ROOT** | System, CLI, hardening | core, hub, system, console |
+| 🔵 **MESH** | Network, WireGuard, QoS | wireguard, haproxy, netmodes, turn |
+
+**Total: 125 packages**
+
+See [[MODULES-EN|Modules]] for complete module documentation.
 
 ---
 
 ## 🔵 MESH — Documentation
 
-### Démarrage
-- [[Live-USB-VirtualBox|VirtualBox]]
-- [[Live-USB|USB Boot]]
-- [[ARM-Installation|Boards ARM]]
-- [[QEMU-ARM64|Émulation QEMU]]
+### Getting Started
+- [[Live-USB-VirtualBox|VirtualBox Quick Start]] ⭐
+- [[Live-USB]] — Bootable USB guide
+- [[ARM-Installation]] — ARM boards & U-Boot ⚡
+- [[QEMU-ARM64]] — ARM emulation on x86 🖥️
 
 ### Configuration
-- [[Configuration]]
-- [[Configuration-Advanced]]
-- [[Troubleshooting]]
+- [[Configuration]] — System configuration
+- [[Troubleshooting]] — Common issues
 
-### Architecture
-- [[Architecture-Boot|Couches de boot]]
-- [[Architecture-Modules|Design modulaire]]
-- [[Architecture-Security|Modèle de sécurité]]
-
-### Développement
-- [[Developer-Guide]]
-- [[Design-System|UI/UX]]
-- [[API-Reference]]
+### Reference
+- [[MODULES-EN|Modules]] — All 125 modules
+- [[API-Reference]] — REST API (2000+ endpoints)
 
 ---
 
-## 🟡 WALL — Sécurité
+## 🟡 WALL — Security Features
 
-### Firewall & IDS
-- **nftables** — DEFAULT DROP, règles dynamiques
-- **CrowdSec** — IDS communautaire, bouncer automatique
-- **Suricata** — Signatures ET Open
-
-### WAF & Inspection
-- **HAProxy** — TLS 1.3, load balancing
-- **mitmproxy** — Inspection HTTPS transparente
-- **300+ règles** — OWASP ModSecurity CRS
-
-### AI & Threat Intel
-- **AI-Insights** — Détection ML anomalies
-- **Threat feeds** — AbuseIPDB, Emerging Threats
-- **Geo-blocking** — Blocage par pays
+- **CrowdSec** — Community-driven IDS/IPS
+- **WAF** — 300+ ModSecurity rules
+- **nftables** — Default DROP policy
+- **AI-Insights** — ML threat detection
+- **IPBlock** — Automated blocklist management
+- **MAC-Guard** — MAC address control
 
 ---
 
-## Addons
+## Links
 
-### 👁️ Eye Remote (Addon)
-
-Dashboard USB gadget compact pour monitoring SecuBox.
-
-| Composant | Description |
-|-----------|-------------|
-| Hardware | Pi Zero W + HyperPixel 2.1 Round (480×480) |
-| Connexion | USB OTG (10.55.0.0/30) ou WiFi |
-| Modes | Normal, Flash, Debug, TTY, Auth |
-
-**Documentation :** [[Eye-Remote|Eye Remote Addon]]
-
-```bash
-# Build image Pi Zero W
-cd remote-ui/round
-sudo ./build-eye-remote-image.sh -i raspios-lite.img.xz
-```
-
----
-
-## Liens
-
-- [GitHub](https://github.com/CyberMind-FR/secubox-deb)
+- [GitHub Repository](https://github.com/CyberMind-FR/secubox-deb)
 - [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
-- [APT Repository](https://apt.secubox.in)
+- [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)
 - [CyberMind](https://cybermind.fr)
 
 ---
diff --git a/Multiboot.md b/Multiboot.md
new file mode 100644
index 0000000..31eb60d
--- /dev/null
+++ b/Multiboot.md
@@ -0,0 +1,253 @@
+# Multi-Boot Live OS
+
+**SecuBox v2.2.3** — Dual-architecture bootable live system with RAM-based execution.
+
+---
+
+## Overview
+
+Multi-architecture bootable live operating system supporting both ARM64 (U-Boot) and AMD64 (UEFI) systems from a single image. Designed for:
+
+- **Live Demo/Recovery** — Boot from USB for demonstrations, repair, or factory reset
+- **Pi Zero Eye Remote** — USB mass storage gadget presenting bootable image to MOCHAbin/ESPRESSObin
+- **Portable Installation** — Boot on any ARM64 or AMD64 system with persistent data
+
+### Supported Architectures
+
+| Architecture | Boot Method | Target Boards |
+|--------------|-------------|---------------|
+| **ARM64** | U-Boot | ESPRESSObin, MOCHAbin, Armada boards |
+| **AMD64** | UEFI GRUB | Any x86_64 PC, laptop, server |
+| **Shared** | — | Cross-architecture persistent storage |
+
+---
+
+## Use Cases
+
+### 1. Eye Remote USB Boot (Pi Zero W)
+
+The Pi Zero runs Eye Remote firmware and presents the multiboot image as USB mass storage. ESPRESSObin/MOCHAbin boots directly from the USB storage.
+
+```
+┌─────────────┐     USB OTG      ┌─────────────────┐
+│  Pi Zero W  │◄────────────────►│  ESPRESSObin    │
+│ Eye Remote  │  mass_storage    │    U-Boot       │
+│ (32GB uSD)  │  16GB multiboot  │  boots from USB │
+└─────────────┘                  └─────────────────┘
+```
+
+**Setup:**
+1. Flash Eye Remote image to SD card (32GB recommended)
+2. Copy multiboot image to `/var/lib/secubox/eye-remote/storage.img`
+3. Connect Pi Zero to ESPRESSObin via USB OTG
+4. ESPRESSObin U-Boot detects USB storage and boots SecuBox
+
+### 2. Direct USB Boot
+
+Flash multiboot image to USB stick, boot any ARM64/AMD64 system directly.
+
+```bash
+# Flash to USB drive
+xzcat secubox-multiboot-2.2.3.img.xz | sudo dd of=/dev/sdX bs=4M status=progress
+```
+
+### 3. Demo/Recovery Mode
+
+Pre-configured SecuBox environment for:
+- Live demonstrations to customers
+- System recovery and repair
+- Factory reset and cloning
+- Installation to eMMC/NVMe
+
+---
+
+## Partition Layout
+
+| Part | Type | Size | Mount | Purpose |
+|------|------|------|-------|---------|
+| 1 | EFI (FAT32) | 512MB | /boot/efi | UEFI + U-Boot boot files |
+| 2 | ext4 | 3GB | / (ARM64) | SecuBox ARM64 live rootfs |
+| 3 | ext4 | 3GB | / (AMD64) | SecuBox AMD64 live rootfs |
+| 4 | ext4 | 8GB+ | /srv/data | Shared application data |
+
+### Boot Files (Partition 1)
+
+```
+/boot/efi/
+├── EFI/
+│   └── BOOT/
+│       ├── BOOTX64.EFI      # GRUB for AMD64
+│       └── grub.cfg         # GRUB config
+├── Image                    # ARM64 kernel
+├── initrd.img               # ARM64 initramfs
+├── dtbs/                    # ARM64 device trees
+├── boot.scr                 # U-Boot script (ARM64)
+├── grub/
+│   └── grub.cfg             # GRUB config (AMD64)
+├── vmlinuz                  # AMD64 kernel
+├── initrd-amd64.img         # AMD64 initramfs
+└── flash/
+    └── secubox-emmc.img.gz  # eMMC flasher image
+```
+
+---
+
+## Boot Flow
+
+### ARM64 (ESPRESSObin/MOCHAbin)
+
+1. U-Boot loads `boot.scr` from partition 1
+2. Kernel + initrd from partition 1
+3. Rootfs from partition 2
+4. Mounts partition 4 as /srv/data
+5. Bind-mounts shared paths
+
+### AMD64 (UEFI)
+
+1. UEFI loads GRUB from EFI/BOOT/BOOTX64.EFI
+2. GRUB loads vmlinuz + initrd from partition 1
+3. Rootfs from partition 3
+4. Mounts partition 4 as /srv/data
+5. Bind-mounts shared paths
+
+---
+
+## Shared Data Structure
+
+```
+/srv/data/
+├── etc/
+│   └── secubox/             # Shared configs
+│       ├── api.toml
+│       ├── users.json
+│       ├── tls/
+│       └── modules/
+├── var/
+│   └── lib/
+│       └── secubox/         # Application state
+│           ├── crowdsec/
+│           ├── haproxy/
+│           ├── wireguard/
+│           └── dpi/
+├── srv/
+│   └── secubox/             # Service data
+│       ├── mitmproxy/
+│       ├── nginx/
+│       └── certs/
+└── log/
+    └── secubox/             # Shared logs
+```
+
+---
+
+## Building
+
+### Build Multiboot Image
+
+```bash
+# Build complete multi-boot image (16GB default)
+sudo ./image/multiboot/build-multiboot.sh --size 16G --output secubox-multiboot.img
+
+# With desktop environment
+sudo ./image/multiboot/build-multiboot.sh --size 32G --desktop --output secubox-multiboot-desktop.img
+```
+
+### GitHub Actions CI
+
+Automated builds via `.github/workflows/build-multiboot.yml`:
+- Configurable image sizes (8/16/32GB)
+- Optional desktop environment
+- Automatic release publishing on tags
+
+---
+
+## Eye Remote Integration
+
+### Preparing SD Card for Pi Zero
+
+```bash
+# 1. Flash Eye Remote base image
+sudo dd if=output/secubox-eye-remote-*.img of=/dev/sdX bs=4M status=progress
+
+# 2. Expand root partition to fill card
+sudo parted /dev/sdX resizepart 2 100%
+sudo resize2fs /dev/sdXp2
+
+# 3. Copy multiboot image as storage
+sudo mount /dev/sdXp2 /mnt
+sudo cp output/secubox-multiboot.img /mnt/var/lib/secubox/eye-remote/storage.img
+sudo umount /mnt
+```
+
+### Gadget Configuration
+
+The USB mass_storage gadget presents `/var/lib/secubox/eye-remote/storage.img` to the connected host. ESPRESSObin U-Boot detects it as a USB drive and boots from it.
+
+---
+
+## Flash to eMMC
+
+From either architecture:
+
+```bash
+secubox-flash-emmc  # Interactive installer
+
+# Or manual:
+gunzip -c /boot/efi/flash/secubox-emmc.img.gz | dd of=/dev/mmcblk0 bs=4M status=progress
+```
+
+---
+
+## Default Credentials
+
+| Service | Username | Password |
+|---------|----------|----------|
+| Web UI | admin | secubox |
+| SSH | root | secubox |
+| User | secubox | secubox |
+
+---
+
+## Troubleshooting
+
+### Not Booting from Eye Remote
+
+1. Check storage.img exists: `ls -lh /var/lib/secubox/eye-remote/storage.img`
+2. Verify gadget status: `systemctl status secubox-eye-gadget`
+3. Check USB connection: `dmesg | grep usb`
+
+### ESPRESSObin U-Boot Commands
+
+```
+usb start
+usb dev 0
+ls usb 0:1
+load usb 0:1 $loadaddr boot.scr
+source $loadaddr
+```
+
+### AMD64 Not Booting
+
+1. Verify UEFI boot mode (not Legacy/CSM)
+2. Check Secure Boot is disabled
+3. Select USB drive in boot menu (F12/F2/ESC)
+
+---
+
+## Downloads
+
+- [Latest Release](https://github.com/CyberMind-FR/secubox-deb/releases/latest)
+- [v2.2.3 Multiboot](https://github.com/CyberMind-FR/secubox-deb/releases/tag/multiboot-v2.2.3)
+
+---
+
+## Version History
+
+| Version | Changes |
+|---------|---------|
+| **v2.2.3** | GitHub Actions CI, Eye Remote integration, wiki docs |
+| **v2.2.2** | Initial multiboot system with ARM64 + AMD64 support |
+
+---
+
+*See also: [[Eye-Remote]] | [[ARM-Installation]] | [[Live-USB]]*
diff --git a/_Sidebar.md b/_Sidebar.md
index 452428a..ed4dac6 100644
--- a/_Sidebar.md
+++ b/_Sidebar.md
@@ -1,49 +1,30 @@
-**[SecuBox OS](Home)** · [FR](Home-FR) · [中文](Home-ZH)
+**[SecuBox](Home)** | [FR](Home-FR) | [DE](Home-DE) | [中文](Home-ZH) | **v2.2.3**
 
----
-
-## SecuBox OS
-
-### 🔴 BOOT — Démarrage
-* [[Home|Overview]]
-* [[Live-USB-VirtualBox|VirtualBox]]
-* [[Live-USB|USB Boot]]
-* [[Installation|APT Install]]
-* [[ARM-Installation|Boards ARM]]
+### 🔴 BOOT — Getting Started
+* [[Multiboot|Multi-Boot Live OS]] ⭐ **NEW**
+* [[Live-USB-VirtualBox|VirtualBox]] `run-vbox.sh`
+* [[Live-USB-QEMU|QEMU]] 🖥️ `run-qemu.sh`
+* [[Live-USB]] | [FR](Live-USB-FR) | [DE](Live-USB-DE) | [中文](Live-USB-ZH)
+* [[Installation]] | [FR](Installation-FR) | [DE](Installation-DE) | [中文](Installation-ZH)
+* [[ARM-Installation|ARM / U-Boot]] | [FR](ARM-Installation-FR) | [DE](ARM-Installation-DE) | [中文](ARM-Installation-ZH) ⚡
+* [[ESPRESSObin]] | [FR](ESPRESSObin-FR) | [DE](ESPRESSObin-DE) | [中文](ESPRESSObin-ZH)
+* [[Eye-Remote|Eye Remote (Pi Zero)]] 📡
+* [[QEMU-ARM64]] 🖥️
 
 ### 🟢 ROOT — Configuration
-* [[Configuration]]
-* [[Configuration-Advanced]]
-* [[Troubleshooting]]
+* [[Configuration]] | [FR](Configuration-FR) | [DE](Configuration-DE) | [中文](Configuration-ZH)
+* [[Troubleshooting]] | [FR](Troubleshooting-FR) | [DE](Troubleshooting-DE) | [中文](Troubleshooting-ZH)
 
-### 🟣 MIND — Architecture
-* [[Architecture-Boot|Boot Layers]]
-* [[Architecture-Modules|Modules]]
-* [[Architecture-Security|Security]]
+### 🟣 MIND — Modules
+* [[MODULES-EN|Modules]] 🇬🇧
+* [[MODULES-FR|Modules FR]] 🇫🇷
+* [[MODULES-DE|Modules DE]] 🇩🇪
+* [[MODULES-ZH|Modules 中文]] 🇨🇳
 
-### 🟡 WALL — Modules
-* [[Modules|All Modules (125)]]
-* [[Modules-Security]]
-* [[Modules-Networking]]
-
-### 🔵 MESH — Dev
-* [[Developer-Guide]]
-* [[Design-System]]
-* [[API-Reference]]
-
----
-
-## Addons
-
-### 👁️ Eye Remote
-* [[Eye-Remote|Overview]]
-* [[Eye-Remote-Hardware|Hardware]]
-* [[Eye-Remote-Implementation|Implementation]]
-* [[Eye-Remote-Bootstrap|Boot Media]]
-
----
+### 🔵 MESH — Reference
+* [[API-Reference]] | [FR](API-Reference-FR) | [DE](API-Reference-DE) | [中文](API-Reference-ZH)
+* [[UI-COMPARISON|UI Comparison]]
 
 ### Links
-* [GitHub](https://github.com/CyberMind-FR/secubox-deb)
 * [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
-* [CyberMind](https://cybermind.fr)
+* [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)