diff --git a/.claude/HISTORY.md b/.claude/HISTORY.md
index 04656db3..1c808455 100644
--- a/.claude/HISTORY.md
+++ b/.claude/HISTORY.md
@@ -5,6 +5,72 @@
 
 ## 2026-05-06
 
+### Session 101 — C3BOX Network Recovery + HAProxy LXC Routing
+
+**Goal:** Establish network connectivity between C3BOX and MOCHAbin for migration
+
+**Completed:**
+
+1. **C3BOX Network Recovery**
+   - Fixed eth2 NO-CARRIER issue (was on wrong interface)
+   - C3BOX lan0@eth1 connected to MOCHAbin lan0 (DSA switch)
+   - IP assigned on br-lan: 192.168.255.201 (original) + .10 (secondary)
+   - Connectivity established: C3BOX ↔ MOCHAbin via 192.168.255.x
+
+2. **Migration Archive Imported**
+   - 93 SSL certificates copied to /data/haproxy/certs/
+   - 99 nginx secubox.d configs available
+   - LXC container configs imported
+
+3. **HAProxy LXC Routing Added**
+   - Created backends: lxc_gitea, lxc_nextcloud, lxc_matrix
+   - ACL routing for gitea.gk2.secubox.in → 10.100.0.40:3000
+   - ACL routing for nextcloud.gk2.secubox.in → 10.100.0.20:80
+   - ACL routing for matrix.gk2.secubox.in → 10.100.0.30:8008
+
+4. **Routing Verified**
+   - gk2.secubox.in → 200 (WebUI)
+   - gitea.gk2.secubox.in → 200 (LXC)
+   - nextcloud.gk2.secubox.in → 302 (LXC redirect)
+   - blog.cybermind.fr → 200 (nginx_vhosts)
+   - Unknown domains → 503 (correct fallback)
+
+5. **Metablogizer Migration COMPLETE**
+   - 166 sites synced from C3BOX (/srv/metablogizer/sites/)
+   - 60 sites emancipated (published) with nginx + HAProxy routing
+   - UCI config converted to nginx server blocks (per-port)
+   - Fixed HAProxy ACL order (metablog backends vs nginx_vhosts)
+   - All sites accessible from internet with correct content
+
+**TODO (noted for later):**
+- Implement mitmproxy WAF container (like C3BOX architecture)
+- HAProxy cacert + vhost SSL verification
+- Metablogizer TOML config conversion
+
+### Session 101 continued — Source Package Sync
+
+**Goal:** Sync source packages with deployed working configurations
+
+**Completed:**
+
+1. **secubox-streamlit package updated:**
+   - API main.py: Added `sudo -n` for LXC commands (NoNewPrivileges workaround)
+   - Added systemd drop-in: `debian/secubox-streamlit.service.d/allow-lxc.conf`
+   - Added sudoers config: `sudoers.d/secubox-streamlit`
+   - Added example config: `config/streamlit.toml.example`
+   - Updated postinst: Creates config dir, example config, LXC symlink
+   - Updated debian/rules to install new files
+
+2. **secubox-metablogizer package updated:**
+   - Added example config: `config/metablogizer.toml.example`
+   - Updated debian/rules to install example config
+
+3. **TOML configs saved:**
+   - `.claude/configs/streamlit.toml` (35 apps, 29 instances)
+   - `.claude/configs/metablogizer.toml` (151 sites)
+
+---
+
 ### Session 100 — MOCHAbin Migration SUCCESS
 
 **Goal:** Complete C3BOX → SecuBox-DEB migration with proper WAF and routing
diff --git a/.claude/WIP.md b/.claude/WIP.md
index 890ea4e8..51414856 100644
--- a/.claude/WIP.md
+++ b/.claude/WIP.md
@@ -1,9 +1,113 @@
 # WIP — Work In Progress
-*Mis à jour : 2026-05-05 (Session 98)*
+*Mis à jour : 2026-05-06 (Session 101)*
 
 ---
 
-## 🔄 En cours — MOCHAbin Full Migration (HAProxy/WAF/Services)
+## 🔄 En cours — Session 101: MOCHAbin Migration COMPLETE
+
+### ✅ Fait cette session
+
+1. **Metablogizer migration complète**
+   - Config TOML: `.claude/configs/metablogizer.toml` (151 sites)
+   - Déployée: `/etc/secubox/metablogizer/config.toml`
+   - 59 sites publiés synchronisés avec HAProxy backends
+   - API: 165 sites total, 59 publiés
+   - Sites internet OK (gandalf.maegia.tv, etc.)
+
+2. **Streamlit migration complète**
+   - Container LXC: `/data/lxc/streamlit` (mSSD), symlink `/var/lib/lxc/streamlit`
+   - IP: 10.100.0.50 (br-lxc)
+   - Config TOML déployée: `/etc/secubox/streamlit.toml` (35 apps, 29 instances)
+   - 22+ instances running dans LXC
+   - HAProxy backends configurés pour tous les domaines emancipated
+   - WebUI: container status = running, 29 instances configurées
+   - Accès internet: https://pix.gk2.secubox.in/, etc.
+
+3. **Configs TOML sauvegardées**
+   - `.claude/configs/metablogizer.toml`
+   - `.claude/configs/streamlit.toml`
+
+### ✅ Corrections API appliquées
+- NoNewPrivileges=false pour permettre sudo lxc-*
+- Sudoers: secubox peut exécuter lxc-info, lxc-attach, streamlitctl
+- API utilise sudo pour les commandes LXC
+
+---
+
+## 📋 Guidelines de développement (Session 101)
+
+### Confinement LXC obligatoire
+Tous les services apportés par les modules SecuBox doivent être confinés dans des conteneurs LXC:
+- Chaque module a son propre LXC (`/data/lxc/<module>`)
+- Symlink vers `/var/lib/lxc/<module>` pour compatibilité lxc-*
+- Le module expose des ports IP vers le nginx/HAProxy du système hôte
+- Exemple: streamlit LXC expose ports 8501-8599, HAProxy route les vhosts
+
+### Pattern xxxctl
+Chaque module doit avoir un outil CLI `<module>ctl`:
+- `streamlitctl` - gestion container, apps, instances
+- `metablogizerctl` - gestion sites, publish, sync
+- Format de sortie JSON pour intégration API
+- Commandes: install, start, stop, status, list, etc.
+
+### Bundle system (à implémenter)
+Pour archivage, backup, mesh publish, migration:
+- Chaque service exportable en bundle autonome
+- Inclut: content, config, requirements, vhost, cert
+
+---
+
+### ⬜ À faire — Bundle system
+
+Voir section détaillée ci-dessous.
+
+---
+
+## 📦 Plan: Bundle System pour archivage/distribution
+
+Structure cible:
+```
+/srv/secubox/bundles/<service>/<name>/
+├── content/        # Fichiers
+├── config.toml     # Config
+├── requirements.txt
+├── vhost.conf
+├── cert/           # SSL si emancipated
+└── manifest.json   # Version, checksums
+```
+
+Objectifs: archivage, backup, mesh publish, migration simplifiée.
+
+---
+
+## 🔄 Previous — MOCHAbin Full Migration (HAProxy/WAF/Services)
+
+### Status (Session 99-100)
+**Export COMPLETE** - Archive ready at `/tmp/c3box-migration-20260506.tar.gz`
+
+✅ Step 1 Complete: Export from C3BOX
+- 93 SSL certificates exported
+- 99 nginx secubox.d configs exported
+- HAProxy config exported
+- 4 LXC container configs exported (gitea, mail, matrix, nextcloud)
+- Services content exported (metablogizer/streamlit dirs empty on source)
+
+⬜ Step 2: MOCHAbin network setup (MOCHAbin currently unreachable at 192.168.255.10)
+⬜ Step 3: Import migration archive
+⬜ Step 4: Run `haproxyctl migrate`
+⬜ Step 5-8: LXC, WAF, verification
+
+**To continue when MOCHAbin is online:**
+```bash
+# Transfer archive
+scp /tmp/c3box-migration-20260506.tar.gz root@192.168.255.10:/tmp/
+
+# On MOCHAbin
+tar xzf /tmp/c3box-migration-20260506.tar.gz -C /tmp/
+cp -a /tmp/c3box-export/secrets/certs/* /data/haproxy/certs/
+haproxyctl generate
+systemctl reload haproxy
+```
 
 ### Context
 Previous attempt (Session 97) failed due to incomplete HAProxy migration:
diff --git a/.claude/configs/metablogizer.toml b/.claude/configs/metablogizer.toml
new file mode 100644
index 00000000..9a1dc85f
--- /dev/null
+++ b/.claude/configs/metablogizer.toml
@@ -0,0 +1,1387 @@
+# Metablogizer TOML config
+# Converted from UCI: 151 sites
+[main]
+enabled = true
+runtime = "uhttpd"
+sites_root = "/srv/metablogizer/sites"
+gitea_url = "http://192.168.255.1:3001"
+port_base = "8900"
+gitea_user = "gandalf"
+# gitea_token = "..." # Configure in /etc/secubox/secrets/
+
+[sites.devel]
+name = "devel"
+domain = "devel.maegia.tv"
+port = "8900"
+runtime = "uhttpd"
+enabled = true
+emancipated = true
+emancipated_at = "2026-02-21T13:48:13+01:00"
+gitea_repo = "gandalf/metablog-devel"
+gitea_synced = "2026-02-10T07:19:08+01:00"
+
+[sites.gandalf]
+name = "gandalf"
+domain = "gandalf.maegia.tv"
+ssl = true
+enabled = true
+port = "8901"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:14:56+01:00"
+gitea_repo = "gandalf/metablog-gandalf"
+gitea_synced = "2026-02-10T07:01:29+01:00"
+
+[sites.secubox]
+name = "secubox"
+domain = "c3box.maegia.tv"
+ssl = true
+enabled = true
+port = "8902"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:15:43+01:00"
+gitea_repo = "gandalf/metablog-secubox"
+gitea_synced = "2026-02-10T07:01:30+01:00"
+
+[sites.cyberzine]
+name = "cyberzine"
+domain = "cyberzine.maegia.tv"
+ssl = true
+enabled = true
+port = "8903"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:16:11+01:00"
+gitea_repo = "gandalf/metablog-cyberzine"
+gitea_synced = "2026-02-10T14:55:58+01:00"
+
+[sites.slides]
+name = "slides"
+domain = "slides.maegia.tv"
+ssl = true
+enabled = true
+port = "8905"
+runtime = "uhttpd"
+tor_enabled = true
+emancipated = true
+emancipated_at = "2026-02-06T09:16:28+01:00"
+gitea_repo = "gandalf/metablog-slides"
+gitea_synced = "2026-02-10T07:01:33+01:00"
+
+[sites.sliders]
+name = "sliders"
+domain = "sliders.maegia.tv"
+ssl = true
+enabled = true
+port = "8904"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:16:44+01:00"
+gitea_repo = "gandalf/metablog-sliders"
+gitea_synced = "2026-02-10T07:01:35+01:00"
+
+[sites.live]
+name = "live"
+domain = "live.maegia.tv"
+ssl = true
+enabled = true
+description = "live why"
+port = "8906"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:17:00+01:00"
+gitea_repo = "gandalf/metablog-live"
+gitea_synced = "2026-04-03T11:27:59+02:00"
+
+[sites.dev]
+name = "dev"
+domain = "devel.cybermind.fr"
+ssl = true
+enabled = true
+description = "cv"
+port = "8907"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:17:33+01:00"
+gitea_repo = "gandalf/metablog-dev"
+gitea_synced = "2026-02-10T07:01:38+01:00"
+
+[sites.status]
+name = "status"
+domain = "status.maegia.tv"
+ssl = true
+enabled = true
+description = "fanzine status live"
+port = "8908"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:17:48+01:00"
+gitea_repo = "gandalf/metablog-status"
+gitea_synced = "2026-02-10T07:01:40+01:00"
+
+[sites.bazi-weekly]
+name = "bazi-weekly"
+domain = "bw.maegia.tv"
+ssl = true
+enabled = true
+port = "8909"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:19:53+01:00"
+gitea_repo = "gandalf/metablog-bazi-weekly"
+gitea_synced = "2026-02-10T07:12:23+01:00"
+
+[sites.gk2]
+name = "gk2"
+domain = "gk2.maegia.tv"
+ssl = false
+enabled = true
+description = "gk2"
+port = "8910"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:28:52+01:00"
+gitea_repo = "gandalf/metablog-gk2"
+gitea_synced = "2026-02-10T07:01:43+01:00"
+
+[sites.coin]
+name = "coin"
+domain = "coin.maegia.tv"
+ssl = true
+enabled = true
+port = "8911"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T08:44:28+01:00"
+gitea_repo = "gandalf/metablog-coin"
+gitea_synced = "2026-02-10T10:32:16+01:00"
+
+[sites.halt]
+name = "halt"
+domain = "halt.maegia.tv"
+ssl = true
+enabled = true
+port = "8912"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-06T09:18:18+01:00"
+gitea_repo = "gandalf/metablog-halt"
+gitea_synced = "2026-02-10T07:01:46+01:00"
+
+[sites.bday]
+name = "bday"
+domain = "bday.secubox.in"
+ssl = true
+enabled = true
+description = "birthday landing page"
+port = "8913"
+runtime = "uhttpd"
+emancipated = false
+emancipated_at = "2026-02-06T08:50:07+01:00"
+gitea_repo = "gandalf/metablog-bday"
+gitea_synced = "2026-02-10T07:01:48+01:00"
+auth_required = true
+
+[sites.lldh]
+name = "lldh"
+domain = "lldh.ganimed.fr"
+ssl = false
+enabled = false
+port = "8914"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-07T11:10:50+01:00"
+gitea_repo = "gandalf/metablog-lldh"
+gitea_synced = "2026-02-10T08:22:59+01:00"
+
+[sites.oracle]
+name = "oracle"
+domain = "oracle.ganimed.fr"
+ssl = true
+enabled = true
+port = "8915"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-07T17:16:20+01:00"
+gitea_repo = "gandalf/metablog-oracle"
+gitea_synced = "2026-02-10T07:02:19+01:00"
+
+[sites.press]
+name = "press"
+domain = "press.cybermood.eu"
+ssl = true
+enabled = true
+port = "8916"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-press"
+gitea_synced = "2026-02-10T07:02:22+01:00"
+
+[sites.presse]
+name = "presse"
+domain = "presse.cybermood.eu"
+ssl = false
+enabled = false
+port = "8917"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-08T10:56:25+01:00"
+gitea_repo = "gandalf/metablog-presse"
+gitea_synced = "2026-02-21T21:47:46+01:00"
+
+[sites.comic]
+name = "comic"
+domain = "comic.secubox.in"
+ssl = true
+enabled = true
+port = "8918"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-12T05:51:15+01:00"
+gitea_repo = "gandalf/metablog-comic"
+gitea_synced = "2026-02-10T07:02:27+01:00"
+user = "gandalf"
+url = "http://192.168.255.1:3001"
+token = "f9f7f8a616e36ce269939627529343aaa6def6cc"
+
+[sites.how2]
+name = "how2"
+domain = "how2.maegia.tv"
+ssl = false
+enabled = false
+port = "8919"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-12T05:50:23+01:00"
+gitea_repo = "gandalf/metablog-how2"
+gitea_synced = "2026-02-12T05:55:13+01:00"
+
+[sites.want]
+name = "want"
+domain = "wanted.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8920"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-12T10:17:53+01:00"
+
+[sites.eval]
+name = "eval"
+domain = "eval.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8921"
+runtime = "uhttpd"
+
+[sites.geo1000]
+name = "geo1000"
+domain = "geo.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8922"
+runtime = "uhttpd"
+
+[sites.gondwana]
+name = "gondwana"
+domain = "gondwana.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8923"
+runtime = "uhttpd"
+
+[sites.horloge]
+name = "horloge"
+domain = "clock.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8924"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-horloge"
+gitea_synced = "2026-02-14T06:58:59+01:00"
+emancipated = true
+emancipated_at = "2026-02-14T07:00:14+01:00"
+
+[sites.sdlc]
+name = "sdlc"
+domain = "sdlc.gk2.secubox.in"
+ssl = false
+enabled = true
+description = "seigneurs de la Chambre"
+port = "8925"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-sdlc"
+gitea_synced = "2026-04-14T08:04:09+02:00"
+emancipated = true
+emancipated_at = "2026-02-14T11:44:47+01:00"
+
+[sites.myhub]
+name = "myhub"
+domain = "gk2.eu"
+ssl = true
+enabled = true
+port = "8926"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-myhub"
+gitea_synced = "2026-02-14T12:18:10+01:00"
+
+[sites.money]
+name = "money"
+domain = "money.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8927"
+runtime = "uhttpd"
+
+[sites.apr]
+name = "apr"
+domain = "apr.gk2.secubox.in"
+ssl = true
+enabled = true
+description = "affaire pierre robert"
+port = "8928"
+runtime = "uhttpd"
+
+[sites.psy]
+name = "psy"
+domain = "psy.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8929"
+runtime = "uhttpd"
+
+[sites.confid]
+name = "confid"
+domain = "confid.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8930"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-confid"
+gitea_synced = "2026-02-15T06:16:38+01:00"
+emancipated = true
+emancipated_at = "2026-02-15T06:17:33+01:00"
+
+[sites.flash]
+name = "flash"
+domain = "flash.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8931"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-15T08:53:21+01:00"
+
+[sites.sa]
+name = "sa"
+domain = "sa.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8933"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-15T22:39:47+01:00"
+auth_required = false
+
+[sites.ab]
+name = "ab"
+domain = "ab.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8934"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-ab"
+gitea_synced = "2026-02-16T06:24:34+01:00"
+emancipated = true
+emancipated_at = "2026-02-16T06:25:18+01:00"
+auth_required = false
+
+[sites.fb]
+name = "fb"
+domain = "fb.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8935"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-fb"
+gitea_synced = "2026-02-16T06:25:48+01:00"
+
+[sites.fwhs]
+name = "fwhs"
+domain = "fwhs.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8936"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-fwhs"
+gitea_synced = "2026-02-16T06:53:51+01:00"
+emancipated = true
+emancipated_at = "2026-02-16T06:54:39+01:00"
+
+[sites.raid]
+name = "raid"
+domain = "raid.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8937"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-16T07:02:05+01:00"
+gitea_repo = "gandalf/metablog-raid"
+gitea_synced = "2026-02-16T07:12:12+01:00"
+
+[sites.mku]
+name = "mku"
+domain = "mku.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8932"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-mku"
+gitea_synced = "2026-02-17T08:32:03+01:00"
+emancipated = true
+emancipated_at = "2026-02-17T08:32:52+01:00"
+
+[sites.pub]
+name = "pub"
+domain = "pub.gk2.secbox.in"
+ssl = true
+enabled = true
+port = "8938"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-pub"
+gitea_synced = "2026-02-20T19:26:54+01:00"
+emancipated = true
+emancipated_at = "2026-02-20T19:29:04+01:00"
+
+[sites.lunaquar]
+name = "lunaquar"
+domain = "lunaquar.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8939"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-lunaquar"
+gitea_synced = "2026-02-21T08:48:35+01:00"
+
+[sites.equa]
+name = "equa"
+domain = "equa.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8940"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T08:36:08+01:00"
+
+[sites.game]
+name = "game"
+domain = "game.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8941"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T10:30:56+01:00"
+
+[sites.virus]
+name = "virus"
+domain = "virus.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8942"
+runtime = "uhttpd"
+
+[sites.survie]
+name = "survie"
+domain = "survie.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8943"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T10:55:58+01:00"
+
+[sites.bgp]
+name = "bgp"
+domain = "bgp.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8944"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T12:30:00+01:00"
+
+[sites.cgv]
+name = "cgv"
+domain = "cgv.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8945"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T13:43:42+01:00"
+
+[sites.cpi]
+name = "cpi"
+domain = "cpi.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8946"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-21T13:32:35+01:00"
+
+[sites.holo]
+name = "holo"
+domain = "holo.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8947"
+runtime = "uhttpd"
+
+[sites.dgse]
+name = "dgse"
+domain = "dgse.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8954"
+emancipated = true
+emancipated_at = "2026-02-22T03:58:50+01:00"
+auth_required = false
+
+[sites.camus]
+name = "camus"
+domain = "camus.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8951"
+runtime = "uhttpd"
+
+[sites.bdgse]
+name = "bdgse"
+domain = "bdgse.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8955"
+runtime = "uhttpd"
+
+[sites.lrh]
+name = "lrh"
+domain = "lrh.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8952"
+runtime = "uhttpd"
+
+[sites.bcf]
+name = "bcf"
+domain = "bcf.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8953"
+runtime = "uhttpd"
+
+[sites.fm]
+name = "fm"
+domain = "fm.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8956"
+runtime = "uhttpd"
+
+[sites.dcb]
+name = "dcb"
+domain = "dcb.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8957"
+runtime = "uhttpd"
+auth_required = false
+
+[sites.boom]
+name = "boom"
+domain = "boom.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8958"
+runtime = "uhttpd"
+auth_required = false
+
+[sites.punk]
+name = "punk"
+domain = "punk.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8948"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-23T08:21:26+01:00"
+
+[sites.ccom]
+name = "ccom"
+domain = "ccom.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8949"
+runtime = "uhttpd"
+auth_required = false
+
+[sites.tuto]
+name = "tuto"
+domain = "tuto.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8959"
+runtime = "uhttpd"
+
+[sites.tdah]
+name = "tdah"
+domain = "tdah.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8960"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-tdah"
+gitea_synced = "2026-02-23T13:14:50+01:00"
+
+[sites.zlib]
+name = "zlib"
+domain = "zlib.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8961"
+runtime = "uhttpd"
+
+[sites.zoom]
+name = "zoom"
+domain = "zoom.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8962"
+runtime = "uhttpd"
+
+[sites.rtdah]
+name = "rtdah"
+domain = "rtdah.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8963"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-rtdah"
+gitea_synced = "2026-02-24T07:04:26+01:00"
+
+[sites.srtc]
+name = "srtc"
+domain = "srtc.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8964"
+runtime = "uhttpd"
+
+[sites.zkp]
+name = "zkp"
+domain = "zkp.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8965"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-24T09:37:47+01:00"
+
+[sites.proofit]
+name = "proofit"
+domain = "proofit.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8966"
+runtime = "uhttpd"
+auth_required = false
+emancipated = true
+emancipated_at = "2026-02-24T09:56:46+01:00"
+gitea_repo = "gandalf/metablog-proofit"
+gitea_synced = "2026-02-24T09:57:20+01:00"
+
+[sites.rcve]
+name = "rcve"
+domain = "rcve.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8967"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-24T14:07:44+01:00"
+
+[sites.pent]
+name = "pent"
+domain = "pent.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8968"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-24T16:52:23+01:00"
+
+[sites.penbd]
+name = "penbd"
+domain = "penbd.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8969"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T07:22:11+01:00"
+
+[sites.rfg]
+name = "rfg"
+domain = "rfg.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8970"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T09:37:18+01:00"
+
+[sites.form]
+name = "form"
+domain = "form.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8971"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T09:42:03+01:00"
+
+[sites.facb]
+name = "facb"
+domain = "facb.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8972"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T09:43:50+01:00"
+
+[sites.plainte]
+name = "plainte"
+domain = "plainte.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8973"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T09:51:46+01:00"
+
+[sites.sosint]
+name = "sosint"
+domain = "sosint.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8974"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T14:43:48+01:00"
+
+[sites.aea]
+name = "aea"
+domain = "aea.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8975"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-25T11:02:57+01:00"
+
+[sites.siggk]
+name = "siggk"
+domain = "siggk.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8976"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-siggk"
+gitea_synced = "2026-02-25T12:48:00+01:00"
+emancipated = true
+
+[sites.arm]
+name = "arm"
+domain = "arm.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8977"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T14:43:13+01:00"
+
+[sites.armada]
+name = "armada"
+domain = "armada.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8978"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T14:46:36+01:00"
+
+[sites.aiaa]
+name = "aiaa"
+domain = "aiaa.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8979"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T14:49:26+01:00"
+
+[sites.pripho]
+name = "pripho"
+domain = "pripho.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8980"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T15:40:27+01:00"
+
+[sites.chili]
+name = "chili"
+domain = "chili.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8981"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-26T15:44:49+01:00"
+
+[sites.shroom]
+name = "shroom"
+domain = "shroom.maegia.tv"
+ssl = true
+enabled = true
+port = "8982"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-shroom"
+gitea_synced = "2026-02-27T07:03:44+01:00"
+emancipated = true
+emancipated_at = "2026-02-27T07:11:01+01:00"
+
+[sites.diyegg]
+name = "diyegg"
+domain = "diyegg.maegia.tv"
+ssl = true
+enabled = true
+port = "8983"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-27T08:05:52+01:00"
+
+[sites.sib]
+name = "sib"
+domain = "sib..gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8984"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-27T08:51:50+01:00"
+
+[sites.sibd]
+name = "sibd"
+domain = "sibd.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8985"
+runtime = "uhttpd"
+
+[sites.secbdp]
+name = "secbdp"
+domain = "secbdp.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8986"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-27T09:12:26+01:00"
+
+[sites.dehrsss]
+name = "dehrsss"
+domain = "dehrsss.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8987"
+runtime = "uhttpd"
+
+[sites.snap]
+name = "snap"
+domain = "snap.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8988"
+runtime = "uhttpd"
+
+[sites.tdahbdss]
+name = "tdahbdss"
+domain = "tdahbdss.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8991"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-02-27T13:59:49+01:00"
+
+[sites.shroombdss]
+name = "shroombdss"
+domain = "shroombdss.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8990"
+runtime = "uhttpd"
+
+[sites.santefr]
+name = "santefr"
+domain = "santefr.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9010"
+runtime = "uhttpd"
+emancipated = true
+emancipated_at = "2026-03-05T09:43:54+01:00"
+gitea_repo = "gandalf/metablog-santefr"
+gitea_synced = "2026-02-28T11:09:15+01:00"
+
+[sites.umemox]
+name = "umemox"
+domain = "umemox.maegia.tv"
+ssl = true
+enabled = true
+port = "8992"
+runtime = "uhttpd"
+
+[sites.wechat]
+name = "wechat"
+domain = "wechat.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8993"
+runtime = "uhttpd"
+
+[sites.starcomm]
+name = "starcomm"
+domain = "starcomm.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8994"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-starcomm"
+gitea_synced = "2026-02-28T12:05:08+01:00"
+
+[sites.chilicc]
+name = "chilicc"
+domain = "chilicc.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8995"
+runtime = "uhttpd"
+
+[sites.risotocc]
+name = "risotocc"
+domain = "risotocc.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8996"
+runtime = "uhttpd"
+
+[sites.astro]
+name = "astro"
+domain = "astro.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8997"
+runtime = "uhttpd"
+
+[sites.astrodynamique]
+name = "astrodynamique"
+domain = "astrodynamique.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8998"
+runtime = "uhttpd"
+
+[sites.zoo]
+name = "zoo"
+domain = "zoo.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "8999"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-zoo"
+gitea_synced = "2026-03-06T10:13:26+01:00"
+
+[sites.cybaxe]
+name = "cybaxe"
+domain = "cybaxe.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9004"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-cybaxe"
+gitea_synced = "2026-03-06T12:18:32+01:00"
+
+[sites.24x]
+name = "24x"
+domain = "24x.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9001"
+runtime = "uhttpd"
+
+[sites.tore]
+name = "tore"
+domain = "tore.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9002"
+runtime = "uhttpd"
+
+[sites.lldh360]
+name = "lldh360"
+domain = "lldh360.maegia.tv"
+ssl = true
+enabled = true
+port = "9003"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-lldh360"
+gitea_synced = "2026-03-08T07:20:00+01:00"
+emancipated = true
+emancipated_at = "2026-03-07T13:42:04+01:00"
+
+[sites.ganimed]
+name = "ganimed"
+domain = "ganimed.maegia.fr"
+ssl = true
+enabled = true
+port = "9011"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-mokup"
+gitea_synced = "2026-03-08T07:46:09+01:00"
+description = "mokup ganimed 2026"
+
+[sites.forensic]
+name = "forensic"
+domain = "forensic.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9005"
+runtime = "uhttpd"
+
+[sites.krypto]
+name = "krypto"
+domain = "krypto.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9006"
+runtime = "uhttpd"
+
+[sites.personal]
+name = "personal"
+domain = "personal.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9007"
+runtime = "uhttpd"
+
+[sites.chess]
+name = "chess"
+domain = "chess.maegia.tv"
+ssl = true
+enabled = true
+port = "9008"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-chess"
+gitea_synced = "2026-04-08T08:34:17+02:00"
+emancipated = true
+emancipated_at = "2026-04-08T09:29:00+02:00"
+
+[sites.wall]
+name = "wall"
+domain = "wall.maegia.tv"
+ssl = true
+enabled = true
+port = "9009"
+runtime = "uhttpd"
+gitea_repo = "gandalf/metablog-wall"
+gitea_synced = "2026-03-11T15:14:16+01:00"
+emancipated = true
+emancipated_at = "2026-03-11T12:51:21+01:00"
+
+[sites.magic]
+name = "magic"
+domain = "magic.maegia.tv"
+ssl = true
+enabled = true
+port = "9012"
+runtime = "uhttpd"
+
+[sites.gateaucc]
+name = "gateaucc"
+domain = "gateaucc.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9000"
+runtime = "uhttpd"
+
+[sites.srvi]
+name = "srvi"
+domain = "srvi.gk2.secubox.in"
+port = "9014"
+enabled = true
+
+[sites.quick-access]
+name = "quick-access"
+domain = "quick.secubox.in"
+port = "9013"
+enabled = true
+runtime = "uhttpd"
+
+[sites.sweedtest]
+name = "sweedtest"
+domain = "sweedtest.gk2.secubox.in"
+port = "9015"
+enabled = true
+gitea_repo = "gandalf/metablog-sweedtest"
+gitea_synced = "2026-03-17T07:30:10+01:00"
+
+[sites.qlicktest]
+name = "qlicktest"
+domain = "qlicktest.gk2.secubox.in"
+port = "9016"
+enabled = true
+
+[sites.injonction]
+name = "injonction"
+domain = "injonction.gk2.secubox.in"
+port = "9031"
+enabled = true
+gitea_repo = "gandalf/metablog-injonction"
+gitea_synced = "2026-03-17T09:44:29+01:00"
+
+[sites.lifinal]
+name = "lifinal"
+domain = "lifinal.gk2.secubox.in"
+port = "9020"
+enabled = true
+
+[sites.sweedsync]
+name = "sweedsync"
+domain = "sweedsync.gk2.secubox.in"
+port = "9022"
+enabled = true
+
+[sites.wrintftest]
+name = "wrintftest"
+domain = "wrintftest.gk2.secubox.in"
+port = "9023"
+enabled = true
+gitea_repo = "gandalf/metablog-wrintftest"
+gitea_synced = "2026-03-17T09:16:29+01:00"
+
+[sites.iinjonction]
+name = "iinjonction"
+domain = "iinjonction.gk2.secubox.in"
+port = "9024"
+enabled = true
+
+[sites.xtest]
+name = "xtest"
+domain = "xtest.gk2.secubox.in"
+port = "9025"
+enabled = true
+gitea_repo = "gandalf/metablog-xtest"
+gitea_synced = "2026-03-17T09:23:32+01:00"
+
+[sites.litest]
+name = "litest"
+domain = "litest.gk2.secubox.in"
+port = "9027"
+enabled = true
+gitea_repo = "gandalf/metablog-litest"
+gitea_synced = "2026-03-17T09:27:22+01:00"
+
+[sites.filetest]
+name = "filetest"
+domain = "filetest.gk2.secubox.in"
+port = "9028"
+enabled = true
+gitea_repo = "gandalf/metablog-filetest"
+gitea_synced = "2026-03-17T09:31:15+01:00"
+
+[sites.qwizz]
+name = "qwizz"
+domain = "qwizz.gk2.secubox.in"
+port = "9032"
+enabled = true
+
+[sites.42]
+name = "42"
+domain = "42.gk2.secubox.in"
+port = "9033"
+enabled = true
+
+[sites.q42]
+name = "q42"
+domain = "q42.gk2.secubox.in"
+port = "9034"
+enabled = true
+
+[sites.werdl]
+name = "werdl"
+domain = "werdl.gk2.secubox.in"
+port = "9036"
+enabled = true
+
+[sites.ziwtest]
+name = "ziwtest"
+domain = "ziwtest.gk2.secubox.in"
+port = "9038"
+enabled = true
+
+[sites.perdu]
+name = "perdu"
+domain = "perdu.gk2.secubox.in"
+port = "9039"
+enabled = true
+
+[sites.email]
+name = "email"
+domain = "email.gk2.secubox.in"
+port = "9040"
+enabled = true
+
+[sites.zifon]
+name = "zifon"
+domain = "zifon.gk2.secubox.in"
+port = "9041"
+enabled = true
+
+[sites.sid]
+name = "sid"
+domain = "sid.gk2.secubox.in"
+port = "9042"
+enabled = true
+
+[sites.c3deb]
+name = "c3deb"
+domain = "c3deb.gk2.secubox.in"
+port = "9043"
+enabled = true
+
+[sites.vortex]
+name = "vortex"
+domain = "vortex.gk2.secubox.in"
+port = "9044"
+enabled = true
+
+[sites.astrod]
+name = "astrod"
+domain = "astrod.gk2.secubox.in"
+port = "9045"
+enabled = true
+
+[sites.test]
+name = "test"
+domain = "test.gk2.secubox.in"
+port = "9046"
+enabled = true
+
+[sites.migrate]
+name = "migrate"
+domain = "migrate.gk2.secubox.in"
+ssl = true
+enabled = true
+port = "9014"
+runtime = "uhttpd"
+
+[sites.miroir]
+name = "miroir"
+domain = "miroir.gk2.secubox.in"
+port = "9048"
+enabled = true
+
+[sites.couvent]
+name = "couvent"
+domain = "couvent.gk2.secubox.in"
+port = "9051"
+enabled = true
+
+[sites.tsb]
+name = "tsb"
+domain = "tsb.gk2.secubox.in"
+port = "9052"
+enabled = true
+
+[sites.kre360]
+name = "kre360"
+domain = "kre360.gk2.secubox.in"
+port = "9053"
+enabled = true
+
+[sites.go]
+name = "go"
+domain = "go.gk2.secubox.in"
+port = "9054"
+enabled = true
+
+[sites.3d]
+name = "3d"
+domain = "3d.gk2.secubox.in"
+port = "9055"
+enabled = true
+
+[sites.qs]
+name = "qs"
+domain = "qs.gk2.secubox.in"
+port = "9056"
+enabled = true
+
+[sites.fin]
+name = "fin"
+domain = "fin.gk2.secubox.in"
+port = "9057"
+enabled = true
+
+[sites.bd]
+name = "bd"
+domain = "bd.gk2.secubox.in"
+port = "9058"
+enabled = true
+
+[sites.sirds]
+name = "sirds"
+domain = "sirds.gk2.secubox.in"
+port = "9059"
+enabled = true
+
+[sites.cv]
+name = "cv"
+domain = "cv.gk2.secubox.in"
+port = "9060"
+enabled = true
+
+[sites.fondation]
+name = "fondation"
+domain = "fondation.gk2.secubox.in"
+port = "9061"
+enabled = true
+
+[sites.entamoir]
+name = "entamoir"
+domain = "entamoir.gk2.secubox.in"
+port = "9062"
+enabled = true
+
+[sites.financer]
+name = "financer"
+domain = "financer.gk2.secubox.in"
+port = "9063"
+enabled = true
+
diff --git a/.claude/configs/streamlit.toml b/.claude/configs/streamlit.toml
new file mode 100644
index 00000000..66852d38
--- /dev/null
+++ b/.claude/configs/streamlit.toml
@@ -0,0 +1,547 @@
+# Streamlit TOML config
+# Converted from UCI: 35 apps, 29 instances
+[main]
+enabled = true
+http_port = "8501"
+http_host = "0.0.0.0"
+data_path = "/srv/streamlit"
+memory_limit = "4G"
+active_app = "secubox_control"
+
+[server]
+headless = "true"
+browser_gather_usage_stats = "false"
+theme_base = "dark"
+theme_primary_color = "#0ff"
+
+[gitea]
+enabled = true
+user = "gandalf"
+url = "http://192.168.255.1:3001"
+# token = "..." # Configure in /etc/secubox/secrets/
+
+[apps.metabolizer]
+name = "metabolizer"
+path = "metabolizer.py"
+enabled = true
+repo = "gandalf/streamlit-metabolizer"
+gitea_synced = "2026-02-10T07:00:53+01:00"
+
+[apps.bazi_webapp]
+name = "Bazi Web"
+path = "bazi_webapp.py"
+enabled = true
+
+[apps.bazi_calculator]
+name = "bazi_calculator"
+path = "bazi_calculator.py"
+enabled = true
+repo = "gandalf/streamlit-bazi_calculator"
+gitea_synced = "2026-02-10T07:12:30+01:00"
+
+[apps.sappix]
+name = "Sappix Test"
+path = "sappix.py"
+enabled = true
+
+[apps.tong_shu_app]
+name = "tong_shu_app"
+path = "tong_shu_app.py"
+enabled = true
+
+[apps.files_295]
+name = "bweek"
+path = "/srv/streamlit/apps/files_295/bazi_weekly_app.py"
+enabled = true
+repo = "gandalf/streamlit-files_295"
+gitea_synced = "2026-02-10T07:00:49+01:00"
+
+[apps.wuyun_liuqi]
+name = "wuyun_liuqi"
+path = "tong_shu_app.py"
+enabled = true
+repo = "gandalf/streamlit-wuyun_liuqi"
+gitea_synced = "2026-02-15T08:20:28+01:00"
+
+[apps.bazi_weekly_app]
+name = "bazi_weekly_app"
+path = "bazi_weekly_app.py"
+enabled = true
+
+[apps.bazi_calculator_1]
+name = "bazi_calculator_1"
+path = "bazi_calculator_1.py"
+enabled = true
+
+[apps.bazi_complete]
+name = "bazi_complete"
+path = "bazi_complete.py"
+enabled = true
+
+[apps.files_299]
+name = "dash"
+path = "/srv/streamlit/apps/files_299/app.py"
+enabled = true
+repo = "gandalf/streamlit-files_299"
+gitea_synced = "2026-02-10T07:00:50+01:00"
+
+[apps.yijing_oracle]
+name = "yijing_oracle"
+path = "/srv/streamlit/apps/yijing_oracle/yijing-oracle/app.py"
+enabled = true
+repo = "gandalf/streamlit-yijing_oracle"
+gitea_synced = "2026-02-10T07:01:16+01:00"
+
+[apps.test_upload]
+name = "test_upload"
+path = "test_upload.py"
+enabled = true
+
+[apps.yijing_generator_v2]
+name = "yijing_generator_v2"
+path = "/srv/streamlit/apps/yijing_generator_v2/yijing-oracle/generator.py"
+enabled = true
+repo = "gandalf/streamlit-yijing_generator_v2"
+gitea_synced = "2026-02-10T07:01:13+01:00"
+
+[apps.reupload_test]
+name = "reupload_test"
+path = "reupload_test.py"
+enabled = true
+
+[apps.test_app]
+name = "test_app"
+path = "test_app.py"
+enabled = true
+
+[apps.Francetv_magazine]
+name = "Francetv_magazine"
+path = "/srv/streamlit/apps/Francetv_magazine/francetv_magazine.py"
+enabled = true
+repo = "gandalf/streamlit-Francetv_magazine"
+gitea_synced = "2026-02-12T07:57:49+01:00"
+
+[apps.cineposter_fixed]
+name = "cineposter_fixed"
+path = "/srv/streamlit/apps/cineposter_fixed/app.py"
+enabled = true
+repo = "gandalf/streamlit-cineposter_fixed"
+gitea_synced = "2026-02-15T08:20:23+01:00"
+
+[apps.pdf_slideshow]
+name = "pdf_slideshow"
+path = "pdf_slideshow.py"
+enabled = true
+repo = "gandalf/streamlit-pdf_slideshow"
+gitea_synced = "2026-02-15T08:20:24+01:00"
+
+[apps.pharmacopoeia_secubox]
+name = "pharmacopoeia_secubox"
+path = "/srv/streamlit/apps/pharmacopoeia_secubox/app.py"
+enabled = true
+repo = "gandalf/streamlit-pharmacopoeia_secubox"
+gitea_synced = "2026-02-15T08:20:26+01:00"
+
+[apps.Photo_cloud_streamlit_main]
+name = "Photo_cloud_streamlit_main"
+path = "/srv/streamlit/apps/Photo_cloud_streamlit_main/photo_cloud_streamlit.py"
+enabled = true
+repo = "gandalf/streamlit-Photo_cloud_streamlit_main"
+gitea_synced = "2026-02-14T06:18:31+01:00"
+
+[apps.cc_osint]
+name = "cc_osint"
+path = "/srv/streamlit/apps/cc_osint/app.py"
+enabled = true
+repo = "gandalf/streamlit-cc_osint"
+gitea_synced = "2026-02-15T05:06:28+01:00"
+
+[apps.generix]
+name = "generix"
+path = "generix.py"
+enabled = true
+repo = "gandalf/streamlit-generix"
+gitea_synced = "2026-02-16T05:33:08+01:00"
+
+[apps.prompt_forge]
+name = "prompt_forge"
+path = "prompt_forge.py"
+enabled = true
+
+[apps.fanzine_gk2_lumiere_1]
+name = "fanzine_gk2_lumiere_1"
+path = "fanzine_gk2_lumiere_1.py"
+enabled = true
+
+[apps.gk2_lumiere]
+name = "gk2_lumiere"
+path = "gk2_lumiere.py"
+enabled = true
+
+[apps.cybermind_fanzine]
+name = "cybermind_fanzine"
+path = "cybermind_fanzine.py"
+enabled = true
+app = "cybermind_fanzine"
+port = "8529"
+emancipated = true
+emancipated_at = "2026-02-20T19:12:45+01:00"
+domain = "cybermind_fanzine.gk2.secubox.in"
+
+[apps.tamagochi_gol]
+name = "tamagochi_gol"
+path = "tamagochi_gol.py"
+enabled = true
+
+[apps.exit_test]
+name = "exit_test"
+path = "exit_test.py"
+enabled = true
+
+[apps.final_fix_test]
+name = "final_fix_test"
+path = "final_fix_test.py"
+enabled = true
+
+[apps.alerte_depot]
+name = "alerte_depot"
+path = "alerte_depot"
+enabled = true
+
+[apps.diapvid]
+name = "diapvid"
+path = "/srv/streamlit/apps/diapvid/diaporama_video_v2.py"
+enabled = true
+app = "diapvid"
+port = "8519"
+autostart = true
+repo = "gandalf/streamlit-diapvid"
+gitea_synced = "2026-03-02T11:09:32+01:00"
+emancipated = true
+domain = "diapvid.gk2.secubox.in"
+emancipated_at = "2026-03-04T07:30:04+01:00"
+
+[apps.files_51]
+name = "files_51"
+path = "files_51.py"
+enabled = true
+app = "files_51"
+port = "8530"
+autostart = true
+emancipated = true
+emancipated_at = "2026-03-02T11:12:27+01:00"
+domain = "files_51.gk2.secubox.in"
+waf_enabled = true
+
+[apps.enhance_app]
+name = "enhance_app"
+path = "enhance_app.py"
+enabled = true
+app = "enhance_app"
+port = "8531"
+autostart = true
+emancipated = true
+emancipated_at = "2026-03-02T18:22:52+01:00"
+domain = "enhance-app.gk2.secubox.in"
+waf_enabled = true
+
+[apps.yijing_360]
+name = "yijing_360"
+path = "/srv/streamlit/apps/yijing_360/mc360_component.py"
+enabled = true
+repo = "gandalf/streamlit-yijing_360"
+gitea_synced = "2026-03-31T12:15:43+02:00"
+
+[instances.pix]
+name = "bazi_calculator"
+app = "bazi_calculator"
+port = "8506"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T08:52:09+01:00"
+domain = "pix.gk2.secubox.in"
+
+[instances.wuyun]
+name = "wuyun"
+app = "wuyun_liuqi"
+port = "8503"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T08:53:16+01:00"
+domain = "wuyun.gk2.secubox.in"
+
+[instances.yling]
+name = "yling"
+app = "yijing"
+port = "8501"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T08:54:22+01:00"
+domain = "yling.gk2.secubox.in"
+
+[instances.BASIC]
+name = "BASIC"
+app = "bazi_complete"
+port = "8509"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T08:58:20+01:00"
+domain = "basic.gk2.secubox.in"
+
+[instances.secubox_evolution]
+enabled = true
+app = "secubox_evolution"
+port = "8510"
+emancipated = true
+emancipated_at = "2026-02-13T08:47:14+01:00"
+domain = "secubox_evolution.gk2.secubox.in"
+name = "secubox_evolution"
+path = "/srv/streamlit/apps/secubox_evolution/app.py"
+repo = "gandalf/streamlit-secubox_evolution"
+gitea_synced = "2026-02-15T10:43:54+01:00"
+
+[instances.secubox_control]
+app = "secubox_control"
+port = "8511"
+enabled = true
+emancipated = true
+emancipated_at = "2026-02-13T08:48:20+01:00"
+domain = "secubox_control.gk2.secubox.in"
+
+[instances.console]
+name = "console"
+app = "secubox_console"
+port = "8515"
+enabled = true
+emancipated = true
+emancipated_at = "2026-02-13T08:59:48+01:00"
+domain = "console.gk2.secubox.in"
+
+[instances.hermes]
+name = "hermes"
+app = "yijing_generator_v2"
+port = "8512"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T09:01:01+01:00"
+domain = "hermes.gk2.secubox.in"
+
+[instances.fabricator]
+name = "fabricator"
+app = "fabricator"
+port = "8520"
+enabled = true
+emancipated = true
+emancipated_at = "2026-02-07T09:37:57+01:00"
+domain = "fabricator.gk2.secubox.in"
+repo = "gandalf/streamlit-fabricator"
+gitea_synced = "2026-02-10T07:00:47+01:00"
+
+[instances.yijing360]
+name = "yijing360"
+app = "yijing-360"
+port = "8521"
+enabled = true
+emancipated = true
+emancipated_at = "2026-02-13T09:02:06+01:00"
+domain = "yijing360.gk2.secubox.in"
+
+[instances.ftvm]
+name = "ftvm"
+app = "Francetv_magazine"
+port = "8522"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T09:03:05+01:00"
+domain = "ftvm.gk2.secubox.in"
+
+[instances.cpf]
+name = "cpf"
+app = "cineposter_fixed"
+port = "8523"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T09:04:14+01:00"
+domain = "cpf.gk2.secubox.in"
+
+[instances.pdf]
+name = "pdf"
+app = "pdf_slideshow"
+port = "8524"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T09:05:41+01:00"
+domain = "pdf.gk2.secubox.in"
+
+[instances.papyrus]
+name = "papyrus"
+app = "pharmacopoeia_secubox"
+port = "8525"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-13T09:07:15+01:00"
+domain = "papyrus.gk2.secubox.in"
+
+[instances.pc]
+name = "pc"
+app = "Photo_cloud_streamlit_main"
+port = "8526"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-25T09:35:17+01:00"
+domain = "pc.gk2.secubox.in"
+
+[instances.osint]
+name = "osint"
+app = "cc_osint"
+port = "8527"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-25T11:12:09+01:00"
+domain = "osint.gk2.secubox.in"
+
+[instances.swg]
+name = "swg"
+app = "generix"
+port = "8513"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-16T05:34:52+01:00"
+domain = "swg.gk2.secubox.in"
+
+[instances.generik]
+name = "generik"
+app = "files_19"
+port = "8528"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-25T09:38:33+01:00"
+domain = "generik.gk2.secubox.in"
+
+[instances.prompt]
+name = "prompt"
+app = "prompt_forge"
+port = "8502"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-19T07:57:15+01:00"
+domain = "pf.gk2.secubox.in"
+
+[instances.fanzine]
+name = "fanzine"
+app = "fanzine_gk2_lumiere_1"
+port = "8504"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-20T15:18:55+01:00"
+domain = "fan.gk2.secubox.in"
+
+[instances.gk2]
+name = "gk2"
+app = "gk2_lumiere"
+port = "8505"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-20T15:18:44+01:00"
+domain = "gk2.gk2.secubox.in"
+
+[instances.cybfan]
+name = "cybfan"
+app = "cybermind_fanzine"
+port = "8529"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-20T18:29:24+01:00"
+domain = "cybfan.gk2.secubox.in"
+
+[instances.tam]
+name = "tam"
+app = "tamagochi_gol"
+port = "8514"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-21T09:29:18+01:00"
+domain = "tam.gk2.secubox.in"
+
+[instances.files_40]
+name = "files_40"
+path = "files_40.py"
+enabled = true
+app = "files_40"
+port = "8516"
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-25T09:43:35+01:00"
+domain = "files_40.gk2.secubox.in"
+
+[instances.files_42]
+name = "files_42"
+app = "files_42"
+port = "8517"
+enabled = true
+path = "files_42/app.py"
+emancipated = true
+emancipated_at = "2026-02-21T14:19:50+01:00"
+domain = "files.gk2.secubox.in"
+
+[instances.test2]
+name = "Test2"
+app = "bazi_calculator"
+port = "8598"
+enabled = true
+autostart = true
+emancipated = true
+emancipated_at = "2026-02-25T11:29:48+01:00"
+domain = "test2new.gk2.secubox.in"
+waf_enabled = true
+
+[instances.alerte_depot_inst]
+name = "alerte_depot"
+app = "alerte_depot"
+port = "8518"
+enabled = true
+autostart = true
+domain = "alerte.gk2.secubox.in"
+emancipated = true
+
+[instances.entamoir_1]
+name = "entamoir_1"
+path = "entamoir_1.py"
+enabled = true
+app = "entamoir_1"
+port = "8507"
+autostart = true
+
+[instances.secubox_report_streamlit]
+name = "secubox_report_streamlit"
+path = "secubox_report_streamlit.py"
+enabled = true
+app = "secubox_report_streamlit"
+port = "8508"
+autostart = true
+
+[api]
+# Secrets removed - configure in /etc/secubox/secrets/streamlit.env
+# google_client_id = "..."
+# google_client_secret = "..."
+redirect_base = "https://files.gk2.secubox.in"
+# anthropic_key = "..."
+
diff --git a/packages/secubox-metablogizer/config/metablogizer.toml.example b/packages/secubox-metablogizer/config/metablogizer.toml.example
new file mode 100644
index 00000000..0b8b15ad
--- /dev/null
+++ b/packages/secubox-metablogizer/config/metablogizer.toml.example
@@ -0,0 +1,24 @@
+# SecuBox MetaBlogizer Configuration
+# Location: /etc/secubox/metablogizer/config.toml
+
+[main]
+enabled = true
+runtime = "nginx"
+sites_root = "/srv/metablogizer/sites"
+port_base = "8900"
+
+# Gitea integration (optional)
+[gitea]
+enabled = false
+url = "http://localhost:3001"
+user = "admin"
+# token = "your_gitea_token"
+
+# Site definitions
+# [sites.mysite]
+# name = "mysite"
+# domain = "mysite.example.com"
+# port = "8900"
+# enabled = true
+# emancipated = true
+# ssl = true
diff --git a/packages/secubox-metablogizer/debian/rules b/packages/secubox-metablogizer/debian/rules
index 627c8767..988cd35e 100755
--- a/packages/secubox-metablogizer/debian/rules
+++ b/packages/secubox-metablogizer/debian/rules
@@ -11,3 +11,6 @@ override_dh_auto_install:
 	[ -d menu.d ] && cp -r menu.d/. debian/secubox-metablogizer/usr/share/secubox/menu.d/ || true
 	install -d debian/secubox-metablogizer/usr/sbin
 	[ -d sbin ] && install -m 755 sbin/* debian/secubox-metablogizer/usr/sbin/ || true
+	# Example config
+	install -d debian/secubox-metablogizer/usr/share/doc/secubox-metablogizer/examples
+	[ -f config/metablogizer.toml.example ] && install -m 644 config/metablogizer.toml.example debian/secubox-metablogizer/usr/share/doc/secubox-metablogizer/examples/ || true
diff --git a/packages/secubox-streamlit/api/main.py b/packages/secubox-streamlit/api/main.py
index 539ef530..57e2c8c0 100644
--- a/packages/secubox-streamlit/api/main.py
+++ b/packages/secubox-streamlit/api/main.py
@@ -32,10 +32,13 @@ def _cfg():
 
 
 def _run_ctl(*args, timeout: int = 30) -> dict:
-    """Run streamlitctl and return parsed JSON or error."""
+    """Run streamlitctl and return parsed JSON or error.
+
+    Uses sudo -n for non-interactive sudo (requires sudoers config).
+    """
     try:
         result = subprocess.run(
-            [CTL, *args],
+            ["sudo", "-n", CTL, *args],
             capture_output=True, text=True, timeout=timeout
         )
         if result.stdout.strip().startswith("{"):
@@ -48,9 +51,12 @@ def _run_ctl(*args, timeout: int = 30) -> dict:
 
 
 def _lxc_running() -> bool:
-    """Check if LXC container is running."""
+    """Check if LXC container is running.
+
+    Uses sudo -n for non-interactive sudo (requires sudoers config).
+    """
     result = subprocess.run(
-        ["lxc-info", "-n", LXC_NAME, "-s"],
+        ["sudo", "-n", "lxc-info", "-n", LXC_NAME, "-s"],
         capture_output=True, text=True
     )
     return "RUNNING" in result.stdout
diff --git a/packages/secubox-streamlit/config/streamlit.toml.example b/packages/secubox-streamlit/config/streamlit.toml.example
new file mode 100644
index 00000000..42f640c4
--- /dev/null
+++ b/packages/secubox-streamlit/config/streamlit.toml.example
@@ -0,0 +1,39 @@
+# SecuBox Streamlit Platform Configuration
+# Location: /etc/secubox/streamlit.toml
+
+[main]
+enabled = true
+http_port = "8501"
+http_host = "0.0.0.0"
+data_path = "/srv/streamlit"
+memory_limit = "4G"
+
+[server]
+headless = "true"
+browser_gather_usage_stats = "false"
+theme_base = "dark"
+theme_primary_color = "#0ff"
+
+# Gitea integration (optional)
+[gitea]
+enabled = false
+user = "admin"
+url = "http://localhost:3001"
+# token = "your_gitea_token"
+
+# App definitions
+# [apps.myapp]
+# name = "My App"
+# path = "myapp.py"
+# enabled = true
+# repo = "user/repo"
+
+# Instance definitions (running instances with domain routing)
+# [instances.myinstance]
+# name = "myinstance"
+# app = "myapp"
+# port = "8501"
+# enabled = true
+# autostart = true
+# emancipated = true
+# domain = "myapp.example.com"
diff --git a/packages/secubox-streamlit/debian/postinst b/packages/secubox-streamlit/debian/postinst
index 1cb92805..e2ce1ae7 100755
--- a/packages/secubox-streamlit/debian/postinst
+++ b/packages/secubox-streamlit/debian/postinst
@@ -7,6 +7,22 @@ case "$1" in
     install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox
     install -d -o secubox -g secubox -m 755 /srv/streamlit/apps /srv/streamlit/logs
     install -d -o secubox -g secubox -m 755 /var/log/secubox
+    install -d -o root -g root -m 755 /etc/secubox
+
+    # Create example config if none exists
+    if [ ! -f /etc/secubox/streamlit.toml ]; then
+      if [ -f /usr/share/doc/secubox-streamlit/examples/streamlit.toml.example ]; then
+        cp /usr/share/doc/secubox-streamlit/examples/streamlit.toml.example /etc/secubox/streamlit.toml
+        chown root:secubox /etc/secubox/streamlit.toml
+        chmod 640 /etc/secubox/streamlit.toml
+      fi
+    fi
+
+    # Create LXC symlink if container exists on /data (mSSD)
+    if [ -d /data/lxc/streamlit ] && [ ! -e /var/lib/lxc/streamlit ]; then
+      ln -sf /data/lxc/streamlit /var/lib/lxc/streamlit
+    fi
+
     systemctl daemon-reload
     systemctl enable secubox-streamlit.service
     systemctl start secubox-streamlit.service || true
diff --git a/packages/secubox-streamlit/debian/rules b/packages/secubox-streamlit/debian/rules
index c3cf282f..100ae28c 100755
--- a/packages/secubox-streamlit/debian/rules
+++ b/packages/secubox-streamlit/debian/rules
@@ -16,3 +16,12 @@ override_dh_auto_install:
 	install -d debian/secubox-streamlit/usr/sbin
 	[ -d sbin ] && install -m 755 sbin/* debian/secubox-streamlit/usr/sbin/ || true
 	[ -d scripts ] && install -m 755 scripts/* debian/secubox-streamlit/usr/sbin/ || true
+	# Sudoers config for LXC access
+	install -d debian/secubox-streamlit/etc/sudoers.d
+	[ -f sudoers.d/secubox-streamlit ] && install -m 440 sudoers.d/secubox-streamlit debian/secubox-streamlit/etc/sudoers.d/ || true
+	# Systemd service drop-in for NoNewPrivileges
+	install -d debian/secubox-streamlit/usr/lib/systemd/system/secubox-streamlit.service.d
+	[ -f debian/secubox-streamlit.service.d/allow-lxc.conf ] && install -m 644 debian/secubox-streamlit.service.d/allow-lxc.conf debian/secubox-streamlit/usr/lib/systemd/system/secubox-streamlit.service.d/ || true
+	# Example config
+	install -d debian/secubox-streamlit/usr/share/doc/secubox-streamlit/examples
+	[ -f config/streamlit.toml.example ] && install -m 644 config/streamlit.toml.example debian/secubox-streamlit/usr/share/doc/secubox-streamlit/examples/ || true
diff --git a/packages/secubox-streamlit/debian/secubox-streamlit.service.d/allow-lxc.conf b/packages/secubox-streamlit/debian/secubox-streamlit.service.d/allow-lxc.conf
new file mode 100644
index 00000000..8511359e
--- /dev/null
+++ b/packages/secubox-streamlit/debian/secubox-streamlit.service.d/allow-lxc.conf
@@ -0,0 +1,4 @@
+# Allow sudo for LXC commands
+# Required because NoNewPrivileges=true prevents setuid binaries (like sudo)
+[Service]
+NoNewPrivileges=false
diff --git a/packages/secubox-streamlit/sudoers.d/secubox-streamlit b/packages/secubox-streamlit/sudoers.d/secubox-streamlit
new file mode 100644
index 00000000..ca60d1cd
--- /dev/null
+++ b/packages/secubox-streamlit/sudoers.d/secubox-streamlit
@@ -0,0 +1,7 @@
+# SecuBox Streamlit - Allow secubox user to manage LXC containers
+# Required for API to control streamlit LXC container
+secubox ALL=(root) NOPASSWD: /usr/bin/lxc-info
+secubox ALL=(root) NOPASSWD: /usr/bin/lxc-attach
+secubox ALL=(root) NOPASSWD: /usr/bin/lxc-start
+secubox ALL=(root) NOPASSWD: /usr/bin/lxc-stop
+secubox ALL=(root) NOPASSWD: /usr/sbin/streamlitctl