Fix build-image permission issue for checksums

- Add chown after sudo build to fix file ownership - Ensures checksum step can write SHA256SUMS Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-07-29 12:34:38 +00:00 · 2026-03-24 19:06:33 +01:00 · 2026-03-24 19:06:33 +01:00 · b4438d539a
commit b4438d539a
parent 7a290be88f
17 changed files with 2295 additions and 86 deletions
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@ -79,17 +79,17 @@ jobs:
            --suite ${{ env.DEBIAN_SUITE }} \
            --out output/ \
            --size ${{ github.event.inputs.size || '8G' }}
+          sudo chown -R $(id -u):$(id -g) output/
        timeout-minutes: 90

      - name: List output
        run: |
-          cd output/
-          ls -lh
+          ls -lh output/

      - name: Generate checksums
        run: |
          cd output/
-          sha256sum *.img.gz 2>/dev/null > SHA256SUMS || echo "No images found" > SHA256SUMS
+          sha256sum *.img.gz > SHA256SUMS 2>/dev/null || echo "No images found" > SHA256SUMS
          cat SHA256SUMS

      - name: Upload image artifact
--- a/wiki/API-Reference-FR.md
+++ b/wiki/API-Reference-FR.md
@ -0,0 +1,122 @@
+# Reference API
+
+[English](API-Reference) | [中文](API-Reference-ZH)
+
+Tous les modules SecuBox exposent des APIs REST via sockets Unix, proxies par nginx a `/api/v1/<module>/`.
+
+## Authentification
+
+### Connexion
+
+```bash
+curl -X POST https://localhost/api/v1/portal/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"admin","password":"admin"}'
+```
+
+Reponse :
+```json
+{
+  "success": true,
+  "token": "eyJ...",
+  "username": "admin",
+  "role": "admin"
+}
+```
+
+### Utilisation du Token
+
+```bash
+curl https://localhost/api/v1/hub/status \
+  -H 'Authorization: Bearer <token>'
+```
+
+## Endpoints Communs
+
+Tous les modules implementent :
+
+| Endpoint | Methode | Auth | Description |
+|----------|---------|------|-------------|
+| `/status` | GET | Non | Statut du module |
+| `/health` | GET | Non | Verification sante |
+
+## API Hub (`/api/v1/hub/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/dashboard` | GET | Donnees tableau de bord |
+| `/menu` | GET | Menu lateral dynamique |
+| `/modules` | GET | Liste statut modules |
+| `/alerts` | GET | Alertes actives |
+| `/system_health` | GET | Score sante systeme |
+| `/network_summary` | GET | Statut reseau |
+
+## API CrowdSec (`/api/v1/crowdsec/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/metrics` | GET | Metriques CrowdSec |
+| `/decisions` | GET | Decisions actives |
+| `/alerts` | GET | Alertes securite |
+| `/bouncers` | GET | Statut bouncers |
+| `/ban` | POST | Bannir IP |
+| `/unban` | POST | Debannir IP |
+
+## API WireGuard (`/api/v1/wireguard/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/interfaces` | GET | Interfaces WG |
+| `/peers` | GET | Liste peers |
+| `/peer` | POST | Ajouter peer |
+| `/peer/{id}` | DELETE | Supprimer peer |
+| `/qrcode/{peer}` | GET | QR code peer |
+
+## API HAProxy (`/api/v1/haproxy/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/stats` | GET | Statistiques HAProxy |
+| `/backends` | GET | Serveurs backend |
+| `/frontends` | GET | Listeners frontend |
+
+## API DPI (`/api/v1/dpi/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/flows` | GET | Flux actifs |
+| `/applications` | GET | Apps detectees |
+| `/protocols` | GET | Stats protocoles |
+
+## API QoS (`/api/v1/qos/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/status` | GET | Statut QoS |
+| `/classes` | GET | Classes trafic |
+| `/rules` | GET | Regles shaping |
+
+## API Systeme (`/api/v1/system/`)
+
+| Endpoint | Methode | Description |
+|----------|---------|-------------|
+| `/info` | GET | Informations systeme |
+| `/services` | GET | Statut services |
+| `/logs` | GET | Journaux systeme |
+| `/reboot` | POST | Redemarrer |
+| `/update` | POST | Mettre a jour |
+
+## Reponses Erreur
+
+| Code | Description |
+|------|-------------|
+| 400 | Requete invalide |
+| 401 | Non autorise |
+| 403 | Interdit |
+| 404 | Non trouve |
+| 500 | Erreur serveur |
+
+## Voir Aussi
+
+- [[Configuration-FR]] - Configuration API
+- [[Modules-FR]] - Details modules
--- a/wiki/API-Reference-ZH.md
+++ b/wiki/API-Reference-ZH.md
@ -0,0 +1,122 @@
+# API 参考
+
+[English](API-Reference) | [Francais](API-Reference-FR)
+
+所有 SecuBox 模块通过 Unix 套接字暴露 REST API，由 nginx 代理到 `/api/v1/<module>/`。
+
+## 认证
+
+### 登录
+
+```bash
+curl -X POST https://localhost/api/v1/portal/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"admin","password":"admin"}'
+```
+
+响应：
+```json
+{
+  "success": true,
+  "token": "eyJ...",
+  "username": "admin",
+  "role": "admin"
+}
+```
+
+### 使用令牌
+
+```bash
+curl https://localhost/api/v1/hub/status \
+  -H 'Authorization: Bearer <token>'
+```
+
+## 通用端点
+
+所有模块实现：
+
+| 端点 | 方法 | 认证 | 描述 |
+|------|------|------|------|
+| `/status` | GET | 否 | 模块状态 |
+| `/health` | GET | 否 | 健康检查 |
+
+## Hub API (`/api/v1/hub/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/dashboard` | GET | 仪表板数据 |
+| `/menu` | GET | 动态侧边栏菜单 |
+| `/modules` | GET | 模块状态列表 |
+| `/alerts` | GET | 活跃告警 |
+| `/system_health` | GET | 系统健康评分 |
+| `/network_summary` | GET | 网络状态 |
+
+## CrowdSec API (`/api/v1/crowdsec/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/metrics` | GET | CrowdSec 指标 |
+| `/decisions` | GET | 活跃决策 |
+| `/alerts` | GET | 安全告警 |
+| `/bouncers` | GET | Bouncer 状态 |
+| `/ban` | POST | 封禁 IP |
+| `/unban` | POST | 解封 IP |
+
+## WireGuard API (`/api/v1/wireguard/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/interfaces` | GET | WG 接口 |
+| `/peers` | GET | 对等节点列表 |
+| `/peer` | POST | 添加对等节点 |
+| `/peer/{id}` | DELETE | 删除对等节点 |
+| `/qrcode/{peer}` | GET | 对等节点二维码 |
+
+## HAProxy API (`/api/v1/haproxy/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/stats` | GET | HAProxy 统计 |
+| `/backends` | GET | 后端服务器 |
+| `/frontends` | GET | 前端监听器 |
+
+## DPI API (`/api/v1/dpi/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/flows` | GET | 活跃流量 |
+| `/applications` | GET | 检测到的应用 |
+| `/protocols` | GET | 协议统计 |
+
+## QoS API (`/api/v1/qos/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/status` | GET | QoS 状态 |
+| `/classes` | GET | 流量类别 |
+| `/rules` | GET | 整形规则 |
+
+## 系统 API (`/api/v1/system/`)
+
+| 端点 | 方法 | 描述 |
+|------|------|------|
+| `/info` | GET | 系统信息 |
+| `/services` | GET | 服务状态 |
+| `/logs` | GET | 系统日志 |
+| `/reboot` | POST | 重启系统 |
+| `/update` | POST | 更新软件包 |
+
+## 错误响应
+
+| 代码 | 描述 |
+|------|------|
+| 400 | 请求无效 |
+| 401 | 未授权 |
+| 403 | 禁止访问 |
+| 404 | 未找到 |
+| 500 | 服务器错误 |
+
+## 另请参阅
+
+- [[Configuration-ZH]] - API 配置
+- [[Modules-ZH]] - 模块详情
--- a/wiki/API-Reference.md
+++ b/wiki/API-Reference.md
@ -0,0 +1,169 @@
+# API Reference
+
+[Francais](API-Reference-FR) | [中文](API-Reference-ZH)
+
+All SecuBox modules expose REST APIs via Unix sockets, proxied by nginx at `/api/v1/<module>/`.
+
+## Authentication
+
+### Login
+
+```bash
+curl -X POST https://localhost/api/v1/portal/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"admin","password":"admin"}'
+```
+
+Response:
+```json
+{
+  "success": true,
+  "token": "eyJ...",
+  "username": "admin",
+  "role": "admin"
+}
+```
+
+### Using Token
+
+```bash
+curl https://localhost/api/v1/hub/status \
+  -H 'Authorization: Bearer <token>'
+```
+
+## Common Endpoints
+
+All modules implement:
+
+| Endpoint | Method | Auth | Description |
+|----------|--------|------|-------------|
+| `/status` | GET | No | Module status |
+| `/health` | GET | No | Health check |
+
+## Hub API (`/api/v1/hub/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/dashboard` | GET | Full dashboard data |
+| `/menu` | GET | Dynamic sidebar menu |
+| `/modules` | GET | Module status list |
+| `/alerts` | GET | Active alerts |
+| `/roadmap` | GET | Migration progress |
+| `/system_health` | GET | System health score |
+| `/network_summary` | GET | Network status |
+
+## CrowdSec API (`/api/v1/crowdsec/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/metrics` | GET | CrowdSec metrics |
+| `/decisions` | GET | Active decisions |
+| `/alerts` | GET | Security alerts |
+| `/bouncers` | GET | Bouncer status |
+| `/ban` | POST | Ban IP address |
+| `/unban` | POST | Unban IP address |
+
+### Ban IP
+
+```bash
+curl -X POST https://localhost/api/v1/crowdsec/ban \
+  -H 'Authorization: Bearer <token>' \
+  -H 'Content-Type: application/json' \
+  -d '{"ip":"192.168.1.100","duration":"24h","reason":"manual"}'
+```
+
+## WireGuard API (`/api/v1/wireguard/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/interfaces` | GET | WG interfaces |
+| `/peers` | GET | Peer list |
+| `/peer` | POST | Add peer |
+| `/peer/{id}` | DELETE | Remove peer |
+| `/qrcode/{peer}` | GET | Peer QR code |
+
+### Add Peer
+
+```bash
+curl -X POST https://localhost/api/v1/wireguard/peer \
+  -H 'Authorization: Bearer <token>' \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"mobile","allowed_ips":"10.0.0.2/32"}'
+```
+
+## HAProxy API (`/api/v1/haproxy/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/stats` | GET | HAProxy statistics |
+| `/backends` | GET | Backend servers |
+| `/frontends` | GET | Frontend listeners |
+| `/acls` | GET | Access control lists |
+
+## DPI API (`/api/v1/dpi/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/flows` | GET | Active flows |
+| `/applications` | GET | Detected apps |
+| `/protocols` | GET | Protocol stats |
+| `/top_hosts` | GET | Top talkers |
+
+## QoS API (`/api/v1/qos/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/status` | GET | QoS status |
+| `/classes` | GET | Traffic classes |
+| `/rules` | GET | Shaping rules |
+| `/stats` | GET | Bandwidth stats |
+
+## System API (`/api/v1/system/`)
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/info` | GET | System information |
+| `/services` | GET | Service status |
+| `/logs` | GET | System logs |
+| `/reboot` | POST | Reboot system |
+| `/update` | POST | Update packages |
+
+## Error Responses
+
+```json
+{
+  "success": false,
+  "error": "Unauthorized",
+  "code": 401
+}
+```
+
+| Code | Description |
+|------|-------------|
+| 400 | Bad request |
+| 401 | Unauthorized |
+| 403 | Forbidden |
+| 404 | Not found |
+| 500 | Server error |
+
+## Rate Limiting
+
+- 100 requests/minute per IP
+- 1000 requests/minute authenticated
+
+## WebSocket
+
+Real-time updates available at `wss://localhost/api/v1/ws/`:
+
+```javascript
+const ws = new WebSocket('wss://localhost/api/v1/ws/');
+ws.onmessage = (event) => {
+  const data = JSON.parse(event.data);
+  console.log('Update:', data);
+};
+```
+
+## See Also
+
+- [[Configuration]] - API configuration
+- [[Modules]] - Module details
--- a/wiki/Home-FR.md
+++ b/wiki/Home-FR.md
@ -0,0 +1,68 @@
+# SecuBox-DEB
+
+**Appliance de Securite pour Debian** | [English](Home) | [中文](Home-ZH)
+
+SecuBox est une solution d'appliance de securite complete portee d'OpenWrt vers Debian bookworm, concue pour les cartes ARM64 GlobalScale (MOCHAbin, ESPRESSObin) et les systemes x86_64.
+
+## Demarrage Rapide
+
+### Live USB (Le plus rapide)
+
+Demarrez directement depuis USB - aucune installation requise :
+
+```bash
+# Telecharger
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
+
+# Flasher sur cle USB
+zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+```
+
+Voir [[Live-USB-FR]] pour le guide complet.
+
+### Installation APT
+
+```bash
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+sudo apt install secubox-full
+```
+
+## Fonctionnalites
+
+| Categorie | Modules |
+|-----------|---------|
+| **Securite** | CrowdSec IDS/IPS, WAF, NAC, Auth |
+| **Reseau** | WireGuard VPN, HAProxy, DPI, QoS |
+| **Supervision** | Netdata, MediaFlow, Metrics |
+| **Email** | Postfix/Dovecot, Webmail |
+| **Publication** | Droplet, Streamlit, MetaBlogizer |
+
+## Materiel Supporte
+
+| Carte | SoC | Utilisation |
+|-------|-----|-------------|
+| MOCHAbin | Armada 7040 | SecuBox Pro |
+| ESPRESSObin v7 | Armada 3720 | SecuBox Lite |
+| ESPRESSObin Ultra | Armada 3720 | SecuBox Lite+ |
+| VM x86_64 | Tous | Test/Developpement |
+
+## Documentation
+
+- [[Live-USB-FR]] - Guide USB bootable
+- [[Installation-FR]] - Installation complete
+- [[Configuration-FR]] - Configuration systeme
+- [[API-Reference-FR]] - Documentation API REST
+- [[Troubleshooting-FR]] - Problemes courants
+
+## Identifiants par Defaut
+
+| Service | Utilisateur | Mot de passe |
+|---------|-------------|--------------|
+| Interface Web | admin | admin |
+| SSH | root | secubox |
+
+## Liens
+
+- [Depot GitHub](https://github.com/CyberMind-FR/secubox-deb)
+- [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
+- [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)
--- a/wiki/Home-ZH.md
+++ b/wiki/Home-ZH.md
@ -0,0 +1,68 @@
+# SecuBox-DEB
+
+**Debian 安全设备** | [English](Home) | [Francais](Home-FR)
+
+SecuBox 是一个完整的安全设备解决方案，从 OpenWrt 移植到 Debian bookworm，专为 GlobalScale ARM64 开发板（MOCHAbin、ESPRESSObin）和 x86_64 系统设计。
+
+## 快速开始
+
+### Live USB（最快方式）
+
+直接从 USB 启动 - 无需安装：
+
+```bash
+# 下载
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
+
+# 写入 USB 驱动器
+zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+```
+
+完整指南请参阅 [[Live-USB-ZH]]。
+
+### APT 安装
+
+```bash
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+sudo apt install secubox-full
+```
+
+## 功能特性
+
+| 类别 | 模块 |
+|------|------|
+| **安全** | CrowdSec IDS/IPS、WAF、NAC、Auth |
+| **网络** | WireGuard VPN、HAProxy、DPI、QoS |
+| **监控** | Netdata、MediaFlow、Metrics |
+| **邮件** | Postfix/Dovecot、Webmail |
+| **发布** | Droplet、Streamlit、MetaBlogizer |
+
+## 支持的硬件
+
+| 开发板 | SoC | 用途 |
+|--------|-----|------|
+| MOCHAbin | Armada 7040 | SecuBox Pro |
+| ESPRESSObin v7 | Armada 3720 | SecuBox Lite |
+| ESPRESSObin Ultra | Armada 3720 | SecuBox Lite+ |
+| VM x86_64 | 任意 | 测试/开发 |
+
+## 文档
+
+- [[Live-USB-ZH]] - USB 启动盘指南
+- [[Installation-ZH]] - 完整安装
+- [[Configuration-ZH]] - 系统配置
+- [[API-Reference-ZH]] - REST API 文档
+- [[Troubleshooting-ZH]] - 常见问题
+
+## 默认凭据
+
+| 服务 | 用户名 | 密码 |
+|------|--------|------|
+| Web 界面 | admin | admin |
+| SSH | root | secubox |
+
+## 链接
+
+- [GitHub 仓库](https://github.com/CyberMind-FR/secubox-deb)
+- [发布版本](https://github.com/CyberMind-FR/secubox-deb/releases)
+- [问题反馈](https://github.com/CyberMind-FR/secubox-deb/issues)
--- a/wiki/Home.md
+++ b/wiki/Home.md
@ -1,37 +1,68 @@
-# SecuBox Wiki
+# SecuBox-DEB

-Welcome to the SecuBox documentation wiki.
+**Security Appliance for Debian** | [Francais](Home-FR) | [中文](Home-ZH)

-## Getting Started
+SecuBox is a complete security appliance solution ported from OpenWrt to Debian bookworm, designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems.

- [[Live USB]] - Boot SecuBox directly from USB (recommended for testing)
- [[Installation]] - Install on dedicated hardware or VM
- [[First Boot]] - Initial configuration guide
+## Quick Start

-## User Guides
+### Live USB (Fastest)

- [[Dashboard]] - Using the web dashboard
- [[Security]] - CrowdSec, WAF, NAC configuration
- [[Networking]] - Network modes, VPN, QoS setup
- [[Email]] - Mail server configuration
+Boot directly from USB - no installation required:

-## Administration
+```bash
+# Download
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz

- [[API Reference]] - REST API documentation
- [[Configuration]] - TOML configuration files
- [[Troubleshooting]] - Common issues and solutions
+# Flash to USB drive
+zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+```

-## Development
+See [[Live-USB]] for complete guide.

- [[Building Packages]] - How to build .deb packages
- [[Building Images]] - Creating system images
- [[Contributing]] - How to contribute to SecuBox
+### APT Installation

-## Quick Links
+```bash
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+sudo apt install secubox-full
+```

-| Resource | Link |
-|----------|------|
-| GitHub | https://github.com/CyberMind-FR/secubox-deb |
-| Releases | https://github.com/CyberMind-FR/secubox-deb/releases |
-| Issues | https://github.com/CyberMind-FR/secubox-deb/issues |
-| APT Repo | https://apt.secubox.in |
+## Features
+
+| Category | Modules |
+|----------|---------|
+| **Security** | CrowdSec IDS/IPS, WAF, NAC, Auth |
+| **Networking** | WireGuard VPN, HAProxy, DPI, QoS |
+| **Monitoring** | Netdata, MediaFlow, Metrics |
+| **Email** | Postfix/Dovecot, Webmail |
+| **Publishing** | Droplet, Streamlit, MetaBlogizer |
+
+## Supported Hardware
+
+| Board | SoC | Use Case |
+|-------|-----|----------|
+| MOCHAbin | Armada 7040 | SecuBox Pro |
+| ESPRESSObin v7 | Armada 3720 | SecuBox Lite |
+| ESPRESSObin Ultra | Armada 3720 | SecuBox Lite+ |
+| VM x86_64 | Any | Testing/Development |
+
+## Documentation
+
+- [[Live-USB]] - Bootable USB guide
+- [[Installation]] - Full installation
+- [[Configuration]] - System configuration
+- [[API-Reference]] - REST API documentation
+- [[Troubleshooting]] - Common issues
+
+## Default Credentials
+
+| Service | Username | Password |
+|---------|----------|----------|
+| Web UI | admin | admin |
+| SSH | root | secubox |
+
+## Links
+
+- [GitHub Repository](https://github.com/CyberMind-FR/secubox-deb)
+- [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
+- [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)
--- a/wiki/Installation-FR.md
+++ b/wiki/Installation-FR.md
@ -0,0 +1,164 @@
+# Guide d'Installation
+
+[English](Installation) | [中文](Installation-ZH)
+
+## Installation Rapide (APT)
+
+```bash
+# Ajouter le depot SecuBox
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+
+# Installer la suite complete
+sudo apt install secubox-full
+
+# Ou installation minimale
+sudo apt install secubox-lite
+```
+
+## Configuration Manuelle APT
+
+```bash
+# Importer la cle GPG
+curl -fsSL https://apt.secubox.in/gpg.key | gpg --dearmor -o /etc/apt/keyrings/secubox.gpg
+
+# Ajouter le depot
+echo "deb [signed-by=/etc/apt/keyrings/secubox.gpg] https://apt.secubox.in bookworm main" \
+  | sudo tee /etc/apt/sources.list.d/secubox.list
+
+# Mettre a jour et installer
+sudo apt update
+sudo apt install secubox-full
+```
+
+## Installation Image Systeme
+
+### Telecharger les Images
+
+| Carte | Image |
+|-------|-------|
+| MOCHAbin | `secubox-mochabin-bookworm.img.gz` |
+| ESPRESSObin v7 | `secubox-espressobin-v7-bookworm.img.gz` |
+| ESPRESSObin Ultra | `secubox-espressobin-ultra-bookworm.img.gz` |
+| VM x64 | `secubox-vm-x64-bookworm.img.gz` |
+
+### Flasher sur Carte SD / eMMC
+
+```bash
+# Telecharger
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-mochabin-bookworm.img.gz
+
+# Flasher sur carte SD
+gunzip -c secubox-mochabin-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+sync
+```
+
+### Configuration VirtualBox
+
+```bash
+# Decompresser
+gunzip secubox-vm-x64-bookworm.img.gz
+
+# Convertir en VDI
+VBoxManage convertfromraw secubox-vm-x64-bookworm.img secubox.vdi --format VDI
+
+# Creer la VM
+VBoxManage createvm --name SecuBox --ostype Debian_64 --register
+VBoxManage modifyvm SecuBox --memory 2048 --cpus 2 --nic1 nat --firmware efi
+VBoxManage storagectl SecuBox --name SATA --add sata
+VBoxManage storageattach SecuBox --storagectl SATA --port 0 --device 0 --type hdd --medium secubox.vdi
+
+# Demarrer
+VBoxManage startvm SecuBox
+```
+
+### Configuration QEMU
+
+```bash
+gunzip secubox-vm-x64-bookworm.img.gz
+qemu-system-x86_64 \
+  -drive file=secubox-vm-x64-bookworm.img,format=raw \
+  -enable-kvm \
+  -m 2048 \
+  -smp 2 \
+  -bios /usr/share/ovmf/OVMF.fd
+```
+
+## Selection des Paquets
+
+### Metapaquets
+
+| Paquet | Description |
+|--------|-------------|
+| `secubox-full` | Tous les modules (recommande pour MOCHAbin/VM) |
+| `secubox-lite` | Modules essentiels (pour ESPRESSObin) |
+
+### Paquets Individuels
+
+**Coeur :**
+- `secubox-core` - Bibliotheques partagees, framework auth
+- `secubox-hub` - Tableau de bord central
+- `secubox-portal` - Authentification web
+
+**Securite :**
+- `secubox-crowdsec` - IDS/IPS avec CrowdSec
+- `secubox-waf` - Pare-feu applicatif web
+- `secubox-auth` - OAuth2, portail captif
+- `secubox-nac` - Controle d'acces reseau
+
+**Reseau :**
+- `secubox-wireguard` - Tableau de bord VPN
+- `secubox-haproxy` - Repartiteur de charge
+- `secubox-dpi` - Inspection approfondie des paquets
+- `secubox-qos` - Gestion de bande passante
+- `secubox-netmodes` - Modes reseau
+
+**Applications :**
+- `secubox-mail` - Serveur email
+- `secubox-dns` - Serveur DNS
+- `secubox-netdata` - Supervision
+
+## Post-Installation
+
+### Premier Demarrage
+
+1. Acceder a l'interface Web : `https://<IP>:8443`
+2. Connexion : admin / admin
+3. Changer le mot de passe immediatement
+4. Configurer les parametres reseau
+5. Activer les modules requis
+
+### Renforcement Securite
+
+```bash
+# Changer les mots de passe par defaut
+passwd root
+passwd secubox
+
+# Mettre a jour le systeme
+apt update && apt upgrade
+
+# Activer le pare-feu
+systemctl enable --now nftables
+```
+
+## Configuration Requise
+
+### Materiel
+
+| Spec | Minimum | Recommande |
+|------|---------|------------|
+| RAM | 1 Go | 2+ Go |
+| Stockage | 4 Go | 16+ Go |
+| CPU | ARM64/x86_64 | 2+ coeurs |
+
+### Logiciel
+
+- Debian 12 (bookworm)
+- systemd
+- Python 3.11+
+
+## Voir Aussi
+
+- [[Live-USB-FR]] - Essayer sans installer
+- [[Configuration-FR]] - Configuration systeme
+- [[Modules-FR]] - Details des modules
--- a/wiki/Installation-ZH.md
+++ b/wiki/Installation-ZH.md
@ -0,0 +1,164 @@
+# 安装指南
+
+[English](Installation) | [Francais](Installation-FR)
+
+## 快速安装（APT）
+
+```bash
+# 添加 SecuBox 软件源
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+
+# 安装完整套件
+sudo apt install secubox-full
+
+# 或最小安装
+sudo apt install secubox-lite
+```
+
+## 手动配置 APT
+
+```bash
+# 导入 GPG 密钥
+curl -fsSL https://apt.secubox.in/gpg.key | gpg --dearmor -o /etc/apt/keyrings/secubox.gpg
+
+# 添加软件源
+echo "deb [signed-by=/etc/apt/keyrings/secubox.gpg] https://apt.secubox.in bookworm main" \
+  | sudo tee /etc/apt/sources.list.d/secubox.list
+
+# 更新并安装
+sudo apt update
+sudo apt install secubox-full
+```
+
+## 系统镜像安装
+
+### 下载镜像
+
+| 开发板 | 镜像 |
+|--------|------|
+| MOCHAbin | `secubox-mochabin-bookworm.img.gz` |
+| ESPRESSObin v7 | `secubox-espressobin-v7-bookworm.img.gz` |
+| ESPRESSObin Ultra | `secubox-espressobin-ultra-bookworm.img.gz` |
+| VM x64 | `secubox-vm-x64-bookworm.img.gz` |
+
+### 写入 SD 卡 / eMMC
+
+```bash
+# 下载
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-mochabin-bookworm.img.gz
+
+# 写入 SD 卡
+gunzip -c secubox-mochabin-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+sync
+```
+
+### VirtualBox 设置
+
+```bash
+# 解压
+gunzip secubox-vm-x64-bookworm.img.gz
+
+# 转换为 VDI
+VBoxManage convertfromraw secubox-vm-x64-bookworm.img secubox.vdi --format VDI
+
+# 创建虚拟机
+VBoxManage createvm --name SecuBox --ostype Debian_64 --register
+VBoxManage modifyvm SecuBox --memory 2048 --cpus 2 --nic1 nat --firmware efi
+VBoxManage storagectl SecuBox --name SATA --add sata
+VBoxManage storageattach SecuBox --storagectl SATA --port 0 --device 0 --type hdd --medium secubox.vdi
+
+# 启动
+VBoxManage startvm SecuBox
+```
+
+### QEMU 设置
+
+```bash
+gunzip secubox-vm-x64-bookworm.img.gz
+qemu-system-x86_64 \
+  -drive file=secubox-vm-x64-bookworm.img,format=raw \
+  -enable-kvm \
+  -m 2048 \
+  -smp 2 \
+  -bios /usr/share/ovmf/OVMF.fd
+```
+
+## 软件包选择
+
+### 元软件包
+
+| 软件包 | 描述 |
+|--------|------|
+| `secubox-full` | 全部模块（推荐用于 MOCHAbin/VM） |
+| `secubox-lite` | 核心模块（用于 ESPRESSObin） |
+
+### 单独软件包
+
+**核心：**
+- `secubox-core` - 共享库、认证框架
+- `secubox-hub` - 中央仪表板
+- `secubox-portal` - Web 认证
+
+**安全：**
+- `secubox-crowdsec` - IDS/IPS（CrowdSec）
+- `secubox-waf` - Web 应用防火墙
+- `secubox-auth` - OAuth2、强制门户
+- `secubox-nac` - 网络访问控制
+
+**网络：**
+- `secubox-wireguard` - VPN 仪表板
+- `secubox-haproxy` - 负载均衡器
+- `secubox-dpi` - 深度包检测
+- `secubox-qos` - 带宽管理
+- `secubox-netmodes` - 网络模式
+
+**应用：**
+- `secubox-mail` - 邮件服务器
+- `secubox-dns` - DNS 服务器
+- `secubox-netdata` - 监控
+
+## 安装后配置
+
+### 首次启动
+
+1. 访问 Web 界面：`https://<IP>:8443`
+2. 登录：admin / admin
+3. 立即更改密码
+4. 配置网络设置
+5. 启用所需模块
+
+### 安全加固
+
+```bash
+# 更改默认密码
+passwd root
+passwd secubox
+
+# 更新系统
+apt update && apt upgrade
+
+# 启用防火墙
+systemctl enable --now nftables
+```
+
+## 系统要求
+
+### 硬件
+
+| 规格 | 最低 | 推荐 |
+|------|------|------|
+| 内存 | 1 GB | 2+ GB |
+| 存储 | 4 GB | 16+ GB |
+| CPU | ARM64/x86_64 | 2+ 核心 |
+
+### 软件
+
+- Debian 12 (bookworm)
+- systemd
+- Python 3.11+
+
+## 另请参阅
+
+- [[Live-USB-ZH]] - 免安装试用
+- [[Configuration-ZH]] - 系统配置
+- [[Modules-ZH]] - 模块详情
--- a/wiki/Installation.md
+++ b/wiki/Installation.md
@ -0,0 +1,164 @@
+# Installation Guide
+
+[Francais](Installation-FR) | [中文](Installation-ZH)
+
+## Quick Install (APT)
+
+```bash
+# Add SecuBox repository
+curl -fsSL https://apt.secubox.in/install.sh | sudo bash
+
+# Install full suite
+sudo apt install secubox-full
+
+# Or minimal installation
+sudo apt install secubox-lite
+```
+
+## Manual APT Setup
+
+```bash
+# Import GPG key
+curl -fsSL https://apt.secubox.in/gpg.key | gpg --dearmor -o /etc/apt/keyrings/secubox.gpg
+
+# Add repository
+echo "deb [signed-by=/etc/apt/keyrings/secubox.gpg] https://apt.secubox.in bookworm main" \
+  | sudo tee /etc/apt/sources.list.d/secubox.list
+
+# Update and install
+sudo apt update
+sudo apt install secubox-full
+```
+
+## System Image Installation
+
+### Download Images
+
+| Board | Image |
+|-------|-------|
+| MOCHAbin | `secubox-mochabin-bookworm.img.gz` |
+| ESPRESSObin v7 | `secubox-espressobin-v7-bookworm.img.gz` |
+| ESPRESSObin Ultra | `secubox-espressobin-ultra-bookworm.img.gz` |
+| VM x64 | `secubox-vm-x64-bookworm.img.gz` |
+
+### Flash to SD Card / eMMC
+
+```bash
+# Download
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-mochabin-bookworm.img.gz
+
+# Flash to SD card
+gunzip -c secubox-mochabin-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+sync
+```
+
+### VirtualBox Setup
+
+```bash
+# Decompress
+gunzip secubox-vm-x64-bookworm.img.gz
+
+# Convert to VDI
+VBoxManage convertfromraw secubox-vm-x64-bookworm.img secubox.vdi --format VDI
+
+# Create VM
+VBoxManage createvm --name SecuBox --ostype Debian_64 --register
+VBoxManage modifyvm SecuBox --memory 2048 --cpus 2 --nic1 nat --firmware efi
+VBoxManage storagectl SecuBox --name SATA --add sata
+VBoxManage storageattach SecuBox --storagectl SATA --port 0 --device 0 --type hdd --medium secubox.vdi
+
+# Start
+VBoxManage startvm SecuBox
+```
+
+### QEMU Setup
+
+```bash
+gunzip secubox-vm-x64-bookworm.img.gz
+qemu-system-x86_64 \
+  -drive file=secubox-vm-x64-bookworm.img,format=raw \
+  -enable-kvm \
+  -m 2048 \
+  -smp 2 \
+  -bios /usr/share/ovmf/OVMF.fd
+```
+
+## Package Selection
+
+### Metapackages
+
+| Package | Description |
+|---------|-------------|
+| `secubox-full` | All modules (recommended for MOCHAbin/VM) |
+| `secubox-lite` | Core modules (for ESPRESSObin) |
+
+### Individual Packages
+
+**Core:**
+- `secubox-core` - Shared libraries, auth framework
+- `secubox-hub` - Central dashboard
+- `secubox-portal` - Web authentication
+
+**Security:**
+- `secubox-crowdsec` - IDS/IPS with CrowdSec
+- `secubox-waf` - Web Application Firewall
+- `secubox-auth` - OAuth2, captive portal
+- `secubox-nac` - Network Access Control
+
+**Networking:**
+- `secubox-wireguard` - VPN dashboard
+- `secubox-haproxy` - Load balancer
+- `secubox-dpi` - Deep Packet Inspection
+- `secubox-qos` - Bandwidth management
+- `secubox-netmodes` - Network modes
+
+**Applications:**
+- `secubox-mail` - Email server
+- `secubox-dns` - DNS server
+- `secubox-netdata` - Monitoring
+
+## Post-Installation
+
+### First Boot
+
+1. Access Web UI: `https://<IP>:8443`
+2. Login: admin / admin
+3. Change password immediately
+4. Configure network settings
+5. Enable required modules
+
+### Security Hardening
+
+```bash
+# Change default passwords
+passwd root
+passwd secubox
+
+# Update system
+apt update && apt upgrade
+
+# Enable firewall
+systemctl enable --now nftables
+```
+
+## Requirements
+
+### Hardware
+
+| Spec | Minimum | Recommended |
+|------|---------|-------------|
+| RAM | 1 GB | 2+ GB |
+| Storage | 4 GB | 16+ GB |
+| CPU | ARM64/x86_64 | 2+ cores |
+
+### Software
+
+- Debian 12 (bookworm)
+- systemd
+- Python 3.11+
+
+## See Also
+
+- [[Live-USB]] - Try without installing
+- [[Configuration]] - System setup
+- [[Modules]] - Module details
--- a/wiki/Live-USB-FR.md
+++ b/wiki/Live-USB-FR.md
@ -0,0 +1,142 @@
+# Guide Live USB
+
+[English](Live-USB) | [中文](Live-USB-ZH)
+
+Demarrez SecuBox directement depuis une cle USB avec tous les paquets pre-installes.
+
+## Telechargement
+
+**Derniere version :** [secubox-live-amd64-bookworm.img.gz](https://github.com/CyberMind-FR/secubox-deb/releases/latest)
+
+## Fonctionnalites
+
+| Fonctionnalite | Description |
+|----------------|-------------|
+| Demarrage UEFI | Chargeur GRUB moderne |
+| SquashFS | Racine compressee (~250Mo) |
+| Persistance | Sauvegarde des modifications entre redemarrages |
+| Slipstream | Plus de 30 paquets SecuBox inclus |
+
+## Flasher sur USB
+
+### Linux / macOS
+
+```bash
+# Trouver votre peripherique USB
+lsblk
+
+# Flasher (remplacez /dev/sdX par votre peripherique !)
+zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+sync
+```
+
+### Windows
+
+1. Telechargez [Rufus](https://rufus.ie/) ou [balenaEtcher](https://etcher.balena.io/)
+2. Extrayez le fichier `.img.gz` pour obtenir `.img`
+3. Selectionnez le fichier `.img`
+4. Selectionnez votre cle USB
+5. Cliquez sur Ecrire/Flasher
+
+## Options du Menu de Demarrage
+
+| Option | Description |
+|--------|-------------|
+| **SecuBox Live** | Demarrage normal avec persistance |
+| **Mode Sans Echec** | Pilotes minimaux pour depannage |
+| **Sans Persistance** | Demarrage vierge, modifications non sauvegardees |
+| **En RAM** | Charger tout le systeme en memoire |
+
+## Identifiants par Defaut
+
+| Service | Utilisateur | Mot de passe |
+|---------|-------------|--------------|
+| Interface Web | admin | admin |
+| SSH | root | secubox |
+| SSH | secubox | secubox |
+
+**Important :** Changez les mots de passe apres le premier demarrage !
+
+## Acces Reseau
+
+Apres le demarrage :
+
+1. Trouver l'IP : `ip addr` ou verifier les baux DHCP du routeur
+2. Interface Web : `https://<IP>:8443`
+3. SSH : `ssh root@<IP>`
+
+Configuration reseau par defaut :
+- Client DHCP sur toutes les interfaces
+- Repli : 192.168.1.1/24
+
+## Persistance
+
+Modifications sauvegardees automatiquement :
+- `/home/*` - Fichiers utilisateur
+- `/etc/*` - Configuration
+- `/var/log/*` - Journaux
+- Paquets installes
+
+### Reinitialiser la Persistance
+
+```bash
+# Demarrer avec "Sans Persistance", puis :
+sudo mkfs.ext4 -L persistence /dev/sdX3
+```
+
+## Schema des Partitions
+
+| Partition | Taille | Type | Fonction |
+|-----------|--------|------|----------|
+| p1 | 512Mo | EFI | Chargeur GRUB |
+| p2 | 2Go | FAT32 | Systeme live (SquashFS) |
+| p3 | Restant | ext4 | Persistance |
+
+## Verification
+
+```bash
+# Telecharger les checksums
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/SHA256SUMS
+
+# Verifier
+sha256sum -c SHA256SUMS --ignore-missing
+```
+
+## Depannage
+
+### USB Ne Demarre Pas
+
+1. Entrer dans BIOS/UEFI (F2, F12, Suppr, Echap)
+2. Activer le demarrage USB
+3. Desactiver Secure Boot
+4. Definir USB comme premier peripherique de demarrage
+
+### Ecran Noir
+
+1. Essayer "Mode Sans Echec" dans le menu
+2. Ajouter `nomodeset` aux parametres du noyau :
+   - Appuyer sur `e` dans GRUB
+   - Ajouter `nomodeset` a la ligne `linux`
+   - Appuyer sur Ctrl+X
+
+### Pas de Reseau
+
+```bash
+ip link show
+sudo systemctl restart networking
+sudo dhclient eth0
+```
+
+## Compilation depuis les Sources
+
+```bash
+git clone https://github.com/CyberMind-FR/secubox-deb
+cd secubox-deb
+sudo bash image/build-live-usb.sh --size 8G --slipstream
+```
+
+## Voir Aussi
+
+- [[Installation-FR]] - Installation permanente
+- [[Configuration-FR]] - Configuration systeme
+- [[Troubleshooting-FR]] - Plus de solutions
--- a/wiki/Live-USB-ZH.md
+++ b/wiki/Live-USB-ZH.md
@ -0,0 +1,142 @@
+# Live USB 指南
+
+[English](Live-USB) | [Francais](Live-USB-FR)
+
+直接从 USB 启动 SecuBox，所有软件包已预装。
+
+## 下载
+
+**最新版本：** [secubox-live-amd64-bookworm.img.gz](https://github.com/CyberMind-FR/secubox-deb/releases/latest)
+
+## 功能特性
+
+| 功能 | 描述 |
+|------|------|
+| UEFI 启动 | 现代 GRUB 引导程序 |
+| SquashFS | 压缩根文件系统（约250MB） |
+| 持久化 | 重启后保留更改 |
+| 预装 | 包含全部30+个 SecuBox 软件包 |
+
+## 写入 USB
+
+### Linux / macOS
+
+```bash
+# 查找 USB 设备
+lsblk
+
+# 写入（将 /dev/sdX 替换为你的设备！）
+zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+sync
+```
+
+### Windows
+
+1. 下载 [Rufus](https://rufus.ie/) 或 [balenaEtcher](https://etcher.balena.io/)
+2. 解压 `.img.gz` 文件得到 `.img`
+3. 选择 `.img` 文件
+4. 选择你的 USB 驱动器
+5. 点击写入/烧录
+
+## 启动菜单选项
+
+| 选项 | 描述 |
+|------|------|
+| **SecuBox Live** | 正常启动（带持久化） |
+| **安全模式** | 最小驱动，用于故障排除 |
+| **无持久化** | 全新启动，不保存更改 |
+| **加载到内存** | 将整个系统加载到内存 |
+
+## 默认凭据
+
+| 服务 | 用户名 | 密码 |
+|------|--------|------|
+| Web 界面 | admin | admin |
+| SSH | root | secubox |
+| SSH | secubox | secubox |
+
+**重要：** 首次启动后请修改密码！
+
+## 网络访问
+
+启动后：
+
+1. 查找 IP：`ip addr` 或查看路由器 DHCP 租约
+2. Web 界面：`https://<IP>:8443`
+3. SSH：`ssh root@<IP>`
+
+默认网络配置：
+- 所有接口使用 DHCP 客户端
+- 备用：192.168.1.1/24
+
+## 持久化
+
+自动保存的更改：
+- `/home/*` - 用户文件
+- `/etc/*` - 配置
+- `/var/log/*` - 日志
+- 已安装的软件包
+
+### 重置持久化
+
+```bash
+# 使用"无持久化"启动，然后：
+sudo mkfs.ext4 -L persistence /dev/sdX3
+```
+
+## 分区布局
+
+| 分区 | 大小 | 类型 | 用途 |
+|------|------|------|------|
+| p1 | 512MB | EFI | GRUB 引导程序 |
+| p2 | 2GB | FAT32 | Live 系统（SquashFS） |
+| p3 | 剩余空间 | ext4 | 持久化存储 |
+
+## 验证
+
+```bash
+# 下载校验和
+wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/SHA256SUMS
+
+# 验证
+sha256sum -c SHA256SUMS --ignore-missing
+```
+
+## 故障排除
+
+### USB 无法启动
+
+1. 进入 BIOS/UEFI（F2、F12、Del、Esc）
+2. 启用 USB 启动
+3. 禁用安全启动
+4. 将 USB 设为第一启动设备
+
+### 黑屏
+
+1. 从启动菜单选择"安全模式"
+2. 添加 `nomodeset` 到内核参数：
+   - 在 GRUB 按 `e`
+   - 在 `linux` 行添加 `nomodeset`
+   - 按 Ctrl+X
+
+### 无网络
+
+```bash
+ip link show
+sudo systemctl restart networking
+sudo dhclient eth0
+```
+
+## 从源码构建
+
+```bash
+git clone https://github.com/CyberMind-FR/secubox-deb
+cd secubox-deb
+sudo bash image/build-live-usb.sh --size 8G --slipstream
+```
+
+## 另请参阅
+
+- [[Installation-ZH]] - 永久安装
+- [[Configuration-ZH]] - 系统配置
+- [[Troubleshooting-ZH]] - 更多解决方案
--- a/wiki/Live-USB.md
+++ b/wiki/Live-USB.md
@ -1,6 +1,12 @@
-# SecuBox Live USB
+# Live USB Guide

-Boot SecuBox directly from a USB drive - no installation required.
+[Francais](Live-USB-FR) | [中文](Live-USB-ZH)
+
+Boot SecuBox directly from a USB drive with all packages pre-installed.
+
+## Download
+
+**Latest Release:** [secubox-live-amd64-bookworm.img.gz](https://github.com/CyberMind-FR/secubox-deb/releases/latest)

 ## Features

@ -9,11 +15,7 @@ Boot SecuBox directly from a USB drive - no installation required.
 | UEFI Boot | Modern GRUB bootloader |
 | SquashFS | Compressed root (~250MB) |
 | Persistence | Save changes across reboots |
-| Slipstream | All SecuBox packages included |
-
-## Download
-
-**Latest Release:** [secubox-live-amd64-bookworm.img.gz](https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz)
+| Slipstream | All 30+ SecuBox packages included |

 ## Flash to USB

@ -30,21 +32,20 @@ sync

 ### Windows

-Use [Rufus](https://rufus.ie/) or [balenaEtcher](https://etcher.balena.io/):
+1. Download [Rufus](https://rufus.ie/) or [balenaEtcher](https://etcher.balena.io/)
+2. Extract the `.img.gz` file to get `.img`
+3. Select the `.img` file
+4. Select your USB drive
+5. Click Write/Flash

-1. Download and extract the `.img.gz` file
-2. Select the `.img` file in Rufus/Etcher
-3. Select your USB drive
-4. Click Write/Flash
+## Boot Menu Options

-## Boot Menu
-
-| Option | Use Case |
-|--------|----------|
+| Option | Description |
+|--------|-------------|
 | **SecuBox Live** | Normal boot with persistence |
-| **Safe Mode** | Hardware compatibility issues |
-| **No Persistence** | Fresh start, no saved changes |
-| **To RAM** | Run entirely from memory |
+| **Safe Mode** | Minimal drivers for troubleshooting |
+| **No Persistence** | Fresh start, changes not saved |
+| **To RAM** | Load entire system to memory |

 ## Default Credentials

@ -54,25 +55,23 @@ Use [Rufus](https://rufus.ie/) or [balenaEtcher](https://etcher.balena.io/):
 | SSH | root | secubox |
 | SSH | secubox | secubox |

-> **Security:** Change passwords immediately after first boot!
+**Important:** Change passwords after first boot!

 ## Network Access

 After booting:

-1. Find IP address: `ip addr` or check your router's DHCP leases
+1. Find IP: `ip addr` or check router DHCP leases
 2. Web UI: `https://<IP>:8443`
 3. SSH: `ssh root@<IP>`

-### Default Network
-
+Default network configuration:
 - DHCP client on all interfaces
- Fallback: 192.168.1.1/24 on first interface
+- Fallback: 192.168.1.1/24

 ## Persistence

-Changes are automatically saved to the persistence partition:
-
+Changes saved automatically:
 - `/home/*` - User files
 - `/etc/*` - Configuration
 - `/var/log/*` - Logs
@ -81,14 +80,22 @@ Changes are automatically saved to the persistence partition:
 ### Reset Persistence

 ```bash
-# Boot with "No Persistence" option, then:
+# Boot with "No Persistence", then:
 sudo mkfs.ext4 -L persistence /dev/sdX3
 ```

+## Partition Layout
+
+| Partition | Size | Type | Purpose |
+|-----------|------|------|---------|
+| p1 | 512MB | EFI | GRUB bootloader |
+| p2 | 2GB | FAT32 | Live system (SquashFS) |
+| p3 | Remaining | ext4 | Persistence |
+
 ## Verification

 ```bash
-# Download checksum
+# Download checksums
 wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/SHA256SUMS

 # Verify
@ -99,7 +106,7 @@ sha256sum -c SHA256SUMS --ignore-missing

 ### USB Not Booting

-1. Enter BIOS/UEFI setup (F2, F12, Del, or Esc at boot)
+1. Enter BIOS/UEFI (F2, F12, Del, Esc)
 2. Enable USB boot
 3. Disable Secure Boot
 4. Set USB as first boot device
@ -108,20 +115,15 @@ sha256sum -c SHA256SUMS --ignore-missing

 1. Try "Safe Mode" from boot menu
 2. Add `nomodeset` to kernel parameters:
-   - Press `e` at GRUB menu
-   - Add `nomodeset` to the `linux` line
-   - Press Ctrl+X to boot
+   - Press `e` at GRUB
+   - Add `nomodeset` to `linux` line
+   - Press Ctrl+X

 ### No Network

 ```bash
-# Check interfaces
 ip link show
-
-# Restart networking
 sudo systemctl restart networking
-
-# Manual DHCP
 sudo dhclient eth0
 ```

@ -130,15 +132,11 @@ sudo dhclient eth0
 ```bash
 git clone https://github.com/CyberMind-FR/secubox-deb
 cd secubox-deb
-
-# Build live USB image
 sudo bash image/build-live-usb.sh --size 8G --slipstream
 ```

-See [[Building Images]] for more options.
-
 ## See Also

 - [[Installation]] - Permanent installation
- [[First Boot]] - Initial configuration
+- [[Configuration]] - System setup
 - [[Troubleshooting]] - More solutions
--- a/wiki/Modules-FR.md
+++ b/wiki/Modules-FR.md
@ -0,0 +1,287 @@
+# Modules SecuBox
+
+[English](Modules) | [中文](Modules-ZH)
+
+Liste complete des paquets SecuBox et leurs fonctionnalites.
+
+## Modules Coeur
+
+### secubox-core
+**Bibliotheques Partagees & Framework**
+
+- Bibliotheque Python partagee (`secubox_core`)
+- Framework authentification JWT
+- Gestion configuration (TOML)
+- Utilitaires de journalisation
+- Configuration nginx de base
+
+### secubox-hub
+**Tableau de Bord Central**
+
+- Interface web principale
+- Apercu statut modules
+- Surveillance sante systeme
+- Agregation alertes
+- Generation menu dynamique
+
+### secubox-portal
+**Portail d'Authentification**
+
+- Connexion/deconnexion JWT
+- Gestion sessions
+- Reinitialisation mot de passe
+- Support multi-utilisateurs
+
+## Modules Securite
+
+### secubox-crowdsec
+**IDS/IPS avec CrowdSec**
+
+- Detection menaces temps reel
+- Listes de blocage communautaires
+- Gestion decisions (ban/captcha)
+- Integration bouncers
+- Scenarios personnalises
+
+### secubox-waf
+**Pare-feu Applicatif Web**
+
+- 300+ regles ModSecurity
+- OWASP Core Rule Set
+- Regles personnalisees
+- Filtrage requetes/reponses
+- Protection injection SQL
+- Prevention XSS
+
+### secubox-auth
+**OAuth2 & Portail Captif**
+
+- Fournisseur OAuth2/OIDC
+- Portail captif invites
+- Systeme de vouchers
+- Integration login social
+- Backend RADIUS
+
+### secubox-nac
+**Controle d'Acces Reseau**
+
+- Empreinte peripheriques
+- Acces base MAC
+- Attribution VLAN
+- Isolation invites
+- Reseau quarantaine
+
+### secubox-users
+**Gestion Identite Unifiee**
+
+- Base utilisateurs centrale
+- Synchronisation 7 services
+- Integration LDAP
+- Gestion groupes
+- Politiques mot de passe
+
+## Modules Reseau
+
+### secubox-wireguard
+**Tableau de Bord VPN**
+
+- Gestion interfaces
+- Configuration peers
+- Generation cles
+- Export QR code
+- Statistiques trafic
+
+### secubox-haproxy
+**Repartiteur de Charge & Proxy**
+
+- Pools serveurs backend
+- Verifications sante
+- Terminaison SSL/TLS
+- Regles ACL
+- Tableau statistiques
+
+### secubox-dpi
+**Inspection Approfondie Paquets**
+
+- Detection applications (netifyd)
+- Classification protocoles
+- Analyse flux
+- Surveillance bande passante
+- Top consommateurs
+
+### secubox-qos
+**Qualite de Service**
+
+- Shaping trafic HTB
+- Files prioritaires
+- Limites bande passante
+- Regles par peripherique
+- Stats temps reel
+
+### secubox-netmodes
+**Modes Reseau**
+
+- Mode routeur
+- Mode bridge
+- Mode point d'acces
+- Configuration netplan
+- Agregation interfaces
+
+### secubox-vhost
+**Hotes Virtuels**
+
+- Gestion vhost nginx
+- Certificats ACME
+- Reverse proxy
+- Configuration SSL
+- Routage domaines
+
+### secubox-cdn
+**Cache CDN**
+
+- Cache proxy Squid
+- Cache nginx
+- API purge cache
+- Gestion stockage
+- Statistiques hit rate
+
+## Modules Supervision
+
+### secubox-netdata
+**Supervision Temps Reel**
+
+- Metriques systeme
+- Statistiques reseau
+- Tableaux personnalises
+- Configuration alertes
+- Donnees historiques
+
+### secubox-mediaflow
+**Detection Streaming Media**
+
+- Detection flux
+- Utilisation bande passante
+- Identification protocoles
+- Metriques qualite
+
+### secubox-metrics
+**Collection Metriques**
+
+- Format Prometheus
+- Metriques personnalisees
+- Endpoints API
+- Integration tableaux
+
+## Modules DNS & Email
+
+### secubox-dns
+**Serveur DNS**
+
+- Zones BIND9
+- Support DNSSEC
+- Mises a jour dynamiques
+- Interface gestion zones
+- Journalisation requetes
+
+### secubox-mail
+**Serveur Email**
+
+- MTA Postfix
+- IMAP/POP3 Dovecot
+- SpamAssassin
+- Signature DKIM
+- Domaines virtuels
+
+### secubox-mail-lxc
+**Conteneur LXC Mail**
+
+- Environnement mail isole
+- Limites ressources
+- Deploiement facile
+
+### secubox-webmail
+**Interface Webmail**
+
+- Roundcube / SOGo
+- Integration calendrier
+- Carnet d'adresses
+- Filtres Sieve
+
+## Modules Publication
+
+### secubox-droplet
+**Editeur de Fichiers**
+
+- Upload glisser-deposer
+- Partage public/prive
+- Liens expirants
+- Journalisation acces
+
+### secubox-streamlit
+**Plateforme Streamlit**
+
+- Hebergement apps Python
+- Tableaux de donnees
+- Apps interactives
+- Instances multiples
+
+### secubox-streamforge
+**Gestionnaire Streamlit**
+
+- Deploiement apps
+- Controle versions
+- Gestion ressources
+
+### secubox-metablogizer
+**Generateur Site Statique**
+
+- Contenu Markdown
+- Service cache Tor
+- Support themes
+- Flux RSS
+
+### secubox-publish
+**Tableau Publication**
+
+- Interface unifiee
+- Tous outils publication
+- Gestion contenu
+
+## Modules Systeme
+
+### secubox-system
+**Gestion Systeme**
+
+- Controle services
+- Visualiseur logs
+- Mises a jour paquets
+- Redemarrage/arret
+- Sauvegarde/restauration
+
+### secubox-hardening
+**Durcissement Securite**
+
+- Parametres noyau
+- Verrouillage services
+- Permissions fichiers
+- Journalisation audit
+
+## Metapaquets
+
+### secubox-full
+Installe tous les modules. Recommande pour :
+- MOCHAbin
+- VMs avec 2+ Go RAM
+- Deploiements complets
+
+### secubox-lite
+Installe modules essentiels. Recommande pour :
+- ESPRESSObin (RAM limitee)
+- Deploiements minimaux
+- Peripheriques edge
+
+## Voir Aussi
+
+- [[Installation-FR]] - Comment installer
+- [[API-Reference-FR]] - APIs modules
+- [[Configuration-FR]] - Guide configuration
--- a/wiki/Modules-ZH.md
+++ b/wiki/Modules-ZH.md
@ -0,0 +1,287 @@
+# SecuBox 模块
+
+[English](Modules) | [Francais](Modules-FR)
+
+SecuBox 软件包及其功能的完整列表。
+
+## 核心模块
+
+### secubox-core
+**共享库与框架**
+
+- Python 共享库 (`secubox_core`)
+- JWT 认证框架
+- 配置管理（TOML）
+- 日志工具
+- nginx 基础配置
+
+### secubox-hub
+**中央仪表板**
+
+- 主 Web 界面
+- 模块状态概览
+- 系统健康监控
+- 告警聚合
+- 动态菜单生成
+
+### secubox-portal
+**认证门户**
+
+- JWT 登录/登出
+- 会话管理
+- 密码重置
+- 多用户支持
+
+## 安全模块
+
+### secubox-crowdsec
+**IDS/IPS（CrowdSec）**
+
+- 实时威胁检测
+- 社区封锁列表
+- 决策管理（封禁/验证码）
+- Bouncer 集成
+- 自定义场景
+
+### secubox-waf
+**Web 应用防火墙**
+
+- 300+ ModSecurity 规则
+- OWASP 核心规则集
+- 自定义规则支持
+- 请求/响应过滤
+- SQL 注入防护
+- XSS 防护
+
+### secubox-auth
+**OAuth2 与强制门户**
+
+- OAuth2/OIDC 提供者
+- 访客强制门户
+- 凭证系统
+- 社交登录集成
+- RADIUS 后端
+
+### secubox-nac
+**网络访问控制**
+
+- 设备指纹识别
+- MAC 地址访问控制
+- VLAN 分配
+- 访客隔离
+- 隔离网络
+
+### secubox-users
+**统一身份管理**
+
+- 中央用户数据库
+- 7 服务同步
+- LDAP 集成
+- 组管理
+- 密码策略
+
+## 网络模块
+
+### secubox-wireguard
+**VPN 仪表板**
+
+- 接口管理
+- 对等节点配置
+- 密钥生成
+- 二维码导出
+- 流量统计
+
+### secubox-haproxy
+**负载均衡器与代理**
+
+- 后端服务器池
+- 健康检查
+- SSL/TLS 终止
+- ACL 规则
+- 统计仪表板
+
+### secubox-dpi
+**深度包检测**
+
+- 应用检测（netifyd）
+- 协议分类
+- 流量分析
+- 带宽监控
+- 流量排行
+
+### secubox-qos
+**服务质量**
+
+- HTB 流量整形
+- 优先级队列
+- 带宽限制
+- 按设备规则
+- 实时统计
+
+### secubox-netmodes
+**网络模式**
+
+- 路由器模式
+- 网桥模式
+- 接入点模式
+- Netplan 配置
+- 接口绑定
+
+### secubox-vhost
+**虚拟主机**
+
+- nginx vhost 管理
+- ACME 证书
+- 反向代理
+- SSL 配置
+- 域名路由
+
+### secubox-cdn
+**CDN 缓存**
+
+- Squid 代理缓存
+- nginx 缓存
+- 缓存清除 API
+- 存储管理
+- 命中率统计
+
+## 监控模块
+
+### secubox-netdata
+**实时监控**
+
+- 系统指标
+- 网络统计
+- 自定义仪表板
+- 告警配置
+- 历史数据
+
+### secubox-mediaflow
+**媒体流检测**
+
+- 流检测
+- 带宽使用
+- 协议识别
+- 质量指标
+
+### secubox-metrics
+**指标收集**
+
+- Prometheus 格式
+- 自定义指标
+- API 端点
+- 仪表板集成
+
+## DNS 与邮件模块
+
+### secubox-dns
+**DNS 服务器**
+
+- BIND9 区域
+- DNSSEC 支持
+- 动态更新
+- 区域管理界面
+- 查询日志
+
+### secubox-mail
+**邮件服务器**
+
+- Postfix MTA
+- Dovecot IMAP/POP3
+- SpamAssassin
+- DKIM 签名
+- 虚拟域
+
+### secubox-mail-lxc
+**邮件 LXC 容器**
+
+- 隔离邮件环境
+- 资源限制
+- 简易部署
+
+### secubox-webmail
+**Webmail 界面**
+
+- Roundcube / SOGo
+- 日历集成
+- 通讯录
+- Sieve 过滤器
+
+## 发布模块
+
+### secubox-droplet
+**文件发布器**
+
+- 拖放上传
+- 公开/私密分享
+- 过期链接
+- 访问日志
+
+### secubox-streamlit
+**Streamlit 平台**
+
+- Python 应用托管
+- 数据仪表板
+- 交互式应用
+- 多实例
+
+### secubox-streamforge
+**Streamlit 管理器**
+
+- 应用部署
+- 版本控制
+- 资源管理
+
+### secubox-metablogizer
+**静态站点生成器**
+
+- Markdown 内容
+- Tor 隐藏服务
+- 主题支持
+- RSS 订阅
+
+### secubox-publish
+**发布仪表板**
+
+- 统一界面
+- 所有发布工具
+- 内容管理
+
+## 系统模块
+
+### secubox-system
+**系统管理**
+
+- 服务控制
+- 日志查看器
+- 软件包更新
+- 重启/关机
+- 备份/恢复
+
+### secubox-hardening
+**安全加固**
+
+- 内核参数
+- 服务锁定
+- 文件权限
+- 审计日志
+
+## 元软件包
+
+### secubox-full
+安装所有模块。推荐用于：
+- MOCHAbin
+- 2+ GB 内存的虚拟机
+- 完整功能部署
+
+### secubox-lite
+仅安装核心模块。推荐用于：
+- ESPRESSObin（内存有限）
+- 最小化部署
+- 边缘设备
+
+## 另请参阅
+
+- [[Installation-ZH]] - 如何安装
+- [[API-Reference-ZH]] - 模块 API
+- [[Configuration-ZH]] - 配置指南
--- a/wiki/Modules.md
+++ b/wiki/Modules.md
@ -0,0 +1,287 @@
+# SecuBox Modules
+
+[Francais](Modules-FR) | [中文](Modules-ZH)
+
+Complete list of SecuBox packages and their functionality.
+
+## Core Modules
+
+### secubox-core
+**Shared Libraries & Framework**
+
+- Python shared library (`secubox_core`)
+- JWT authentication framework
+- Configuration management (TOML)
+- Logging utilities
+- nginx base configuration
+
+### secubox-hub
+**Central Dashboard**
+
+- Main web interface
+- Module status overview
+- System health monitoring
+- Alert aggregation
+- Dynamic menu generation
+
+### secubox-portal
+**Authentication Portal**
+
+- JWT-based login/logout
+- Session management
+- Password reset
+- Multi-user support
+
+## Security Modules
+
+### secubox-crowdsec
+**IDS/IPS with CrowdSec**
+
+- Real-time threat detection
+- Community blocklists
+- Decision management (ban/captcha)
+- Bouncer integration
+- Custom scenarios
+
+### secubox-waf
+**Web Application Firewall**
+
+- 300+ ModSecurity rules
+- OWASP Core Rule Set
+- Custom rule support
+- Request/response filtering
+- SQL injection protection
+- XSS prevention
+
+### secubox-auth
+**OAuth2 & Captive Portal**
+
+- OAuth2/OIDC provider
+- Captive portal for guests
+- Voucher system
+- Social login integration
+- RADIUS backend
+
+### secubox-nac
+**Network Access Control**
+
+- Device fingerprinting
+- MAC-based access
+- VLAN assignment
+- Guest isolation
+- Quarantine network
+
+### secubox-users
+**Unified Identity Management**
+
+- Central user database
+- 7-service synchronization
+- LDAP integration
+- Group management
+- Password policies
+
+## Network Modules
+
+### secubox-wireguard
+**VPN Dashboard**
+
+- Interface management
+- Peer configuration
+- Key generation
+- QR code export
+- Traffic statistics
+
+### secubox-haproxy
+**Load Balancer & Proxy**
+
+- Backend server pools
+- Health checks
+- SSL/TLS termination
+- ACL rules
+- Statistics dashboard
+
+### secubox-dpi
+**Deep Packet Inspection**
+
+- Application detection (netifyd)
+- Protocol classification
+- Flow analysis
+- Bandwidth monitoring
+- Top talkers
+
+### secubox-qos
+**Quality of Service**
+
+- HTB traffic shaping
+- Priority queues
+- Bandwidth limits
+- Per-device rules
+- Real-time stats
+
+### secubox-netmodes
+**Network Modes**
+
+- Router mode
+- Bridge mode
+- Access Point mode
+- Netplan configuration
+- Interface bonding
+
+### secubox-vhost
+**Virtual Hosts**
+
+- nginx vhost management
+- ACME certificates
+- Reverse proxy
+- SSL configuration
+- Domain routing
+
+### secubox-cdn
+**CDN Cache**
+
+- Squid proxy cache
+- nginx caching
+- Cache purge API
+- Storage management
+- Hit rate statistics
+
+## Monitoring Modules
+
+### secubox-netdata
+**Real-time Monitoring**
+
+- System metrics
+- Network statistics
+- Custom dashboards
+- Alert configuration
+- Historical data
+
+### secubox-mediaflow
+**Media Streaming Detection**
+
+- Stream detection
+- Bandwidth usage
+- Protocol identification
+- Quality metrics
+
+### secubox-metrics
+**Metrics Collection**
+
+- Prometheus format
+- Custom metrics
+- API endpoints
+- Dashboard integration
+
+## DNS & Email Modules
+
+### secubox-dns
+**DNS Server**
+
+- BIND9 zones
+- DNSSEC support
+- Dynamic updates
+- Zone management UI
+- Query logging
+
+### secubox-mail
+**Email Server**
+
+- Postfix MTA
+- Dovecot IMAP/POP3
+- SpamAssassin
+- DKIM signing
+- Virtual domains
+
+### secubox-mail-lxc
+**Mail LXC Container**
+
+- Isolated mail environment
+- Resource limits
+- Easy deployment
+
+### secubox-webmail
+**Webmail Interface**
+
+- Roundcube / SOGo
+- Calendar integration
+- Address book
+- Sieve filters
+
+## Publishing Modules
+
+### secubox-droplet
+**File Publisher**
+
+- Drag & drop upload
+- Public/private sharing
+- Expiring links
+- Access logging
+
+### secubox-streamlit
+**Streamlit Platform**
+
+- Python app hosting
+- Data dashboards
+- Interactive apps
+- Multiple instances
+
+### secubox-streamforge
+**Streamlit Manager**
+
+- App deployment
+- Version control
+- Resource management
+
+### secubox-metablogizer
+**Static Site Generator**
+
+- Markdown content
+- Tor hidden service
+- Theme support
+- RSS feeds
+
+### secubox-publish
+**Publishing Dashboard**
+
+- Unified interface
+- All publishing tools
+- Content management
+
+## System Modules
+
+### secubox-system
+**System Management**
+
+- Service control
+- Log viewer
+- Package updates
+- Reboot/shutdown
+- Backup/restore
+
+### secubox-hardening
+**Security Hardening**
+
+- Kernel parameters
+- Service lockdown
+- File permissions
+- Audit logging
+
+## Metapackages
+
+### secubox-full
+Installs all modules. Recommended for:
+- MOCHAbin
+- VMs with 2+ GB RAM
+- Full-featured deployments
+
+### secubox-lite
+Installs core modules only. Recommended for:
+- ESPRESSObin (limited RAM)
+- Minimal deployments
+- Edge devices
+
+## See Also
+
+- [[Installation]] - How to install
+- [[API-Reference]] - Module APIs
+- [[Configuration]] - Configuration guide
--- a/wiki/_Sidebar.md
+++ b/wiki/_Sidebar.md
@ -1,21 +1,15 @@
-### Getting Started
-* [[Home]]
-* [[Live USB]]
-* [[Installation]]
-* [[First Boot]]
+**[Home](Home)** | [FR](Home-FR) | [中文](Home-ZH)

-### User Guides
-* [[Dashboard]]
-* [[Security]]
-* [[Networking]]
-* [[Email]]
+### Getting Started
+* [[Live-USB]]
+* [[Installation]]
+* [[Modules]]

 ### Reference
-* [[API Reference]]
+* [[API-Reference]]
 * [[Configuration]]
 * [[Troubleshooting]]

-### Development
-* [[Building Packages]]
-* [[Building Images]]
-* [[Contributing]]
+### Links
+* [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
+* [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)