diff --git a/DEPLOY.md b/DEPLOY.md
new file mode 100644
index 0000000..95d56a4
--- /dev/null
+++ b/DEPLOY.md
@@ -0,0 +1,91 @@
+# CyberLux — production on Tor (.onion)
+
+This app is designed to run **behind nginx on loopback**, with **one Tor v3 hidden service per logical site** (hub, wiki, dedicated verticals, shadow `/w` node). Nginx listens on `127.0.0.1:8080–8122` (see `scripts/onion-nodes.json`); Tor forwards port 80 on each onion to the matching loopback port. **Next.js binds only `127.0.0.1:3000`** — never expose 3000 or the nginx loopback ports to the public internet.
+
+Onion hostnames are **created locally** when Tor first starts; there are no fixed `.onion` URLs in the repo. Back up `/var/lib/tor/*/hs_ed25519_secret_key` (the install flow uses `scripts/backup-onion-keys.sh`).
+
+## One-time server setup (Debian/Ubuntu-style)
+
+```bash
+sudo apt update
+sudo apt install -y tor nginx curl nodejs npm build-essential
+# Or install Node.js LTS from NodeSource / nvm — `node` and `npm` must be on PATH.
+```
+
+## Deploy the app
+
+From the repo root (as the user that will own the process):
+
+```bash
+./start.sh
+```
+
+This will: regenerate Tor/nginx maps from `scripts/onion-nodes.json`, `npm install`, `npm run build`, install Tor+nginx configs (`sudo`), wait for hostname files, print every `.onion` URL, then **foreground** `next start` on `127.0.0.1:3000`.
+
+For a **one-shot prepare** (build + Tor/nginx, no Next.js — for systemd):
+
+```bash
+CYBERLUX_PREPARE_ONLY=1 ./start.sh
+```
+
+## systemd — start on boot
+
+1. Ensure `./start.sh` or `CYBERLUX_PREPARE_ONLY=1 ./start.sh` has been run at least once so `.next` exists and Tor directories are populated.
+2. Install the unit (run as root; set user to the account that owns the repo):
+
+```bash
+sudo CYBERLUX_USER=youruser bash scripts/install-systemd.sh
+# optional: sudo CYBERLUX_CHOWN_REPO=1 CYBERLUX_USER=youruser bash scripts/install-systemd.sh
+```
+
+3. Enable **Tor**, **nginx**, and **CyberLux** at boot:
+
+```bash
+sudo systemctl enable tor.service nginx.service cyberlux.service
+# if your distro uses tor@default instead of tor:
+# sudo systemctl enable tor@default.service nginx.service cyberlux.service
+sudo systemctl start tor.service nginx.service cyberlux.service
+```
+
+4. Check logs:
+
+```bash
+journalctl -u cyberlux.service -f
+```
+
+5. Health check (local):
+
+```bash
+npm run health:stack
+```
+
+6. **List every `.onion` URL** and **check that each nginx loopback vhost answers** (needs Tor running; use `sudo` if hostname files are root-only):
+
+```bash
+npm run onions:status
+# or:
+sudo node scripts/onion-status.cjs
+```
+
+## Changing the onion map
+
+1. Edit `scripts/onion-nodes.json`.
+2. Run `node scripts/generate-onion-config.cjs` (or `npm run build`, which runs it in `prebuild`).
+3. `sudo bash scripts/install-tor-onion.sh`
+4. Rebuild/restart the app: `npm run build` and `sudo systemctl restart cyberlux.service`
+
+## Verification
+
+```bash
+npm run verify
+```
+
+## Security & compliance
+
+- You are responsible for **local law**, hosting terms, and **Tor / relay policies**. This repo is a **parody web app**; treat operational security seriously if you run it on a real server.
+
+## Security notes
+
+- Only **Tor** should be reachable from outside; bind **nothing** to `0.0.0.0` for this stack.
+- Prefer firewall defaults that deny incoming except what you need for SSH.
+- Optional: `sudo bash scripts/classroom-ufw.sh` (if present) for a restrictive UFW profile.
diff --git a/README.md b/README.md
index 40ec067..55373a0 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,25 @@
# CYBERLUX
-> Neon storefront. Forty-three onion doors. One build. One app. No dead air.
+> One Next build. Dozens of v3 onions. Nginx in the middle. Tor does the rest.
-CyberLux is a layered Next.js fiction stack built for dark-web literacy, classroom demos, mirror discipline drills, and absurdly overbuilt cyberpunk presentation. It runs one app behind Tor + nginx, then fans that app out into dedicated v3 hidden services for the hub, forum, exchange, market, crawler, syndicate, wiki layer, and every other top-level surface in `scripts/onion-nodes.json`.
+CyberLux is a **single** Next.js app projected through **nginx loopbacks** into **one Tor hidden service per vertical** — hub, forum, exchange, market, wiki, syndicate, shadow `/w` nodes, and the rest of `scripts/onion-nodes.json`. Same codebase, same deploy, **different `.onion` front doors** with host-aware rewrites (`proxy.ts` + `X-Cyberlux-Node`).
-This repo is built to feel like a real underground property while still being a controlled demo environment:
+**Not a toy route list:** stable `HiddenServiceDir` names, backup/restore for onion keys, generated Tor + nginx from one JSON source of truth. Built to **boot, survive operator mistakes, and stay readable under stress**.
+
+Operator cheat sheet:
+
+| Command | What |
+|--------|------|
+| `./start.sh` | Full pipeline: generate → build → Tor/nginx → print **every `.onion` URL** → `next start` on `127.0.0.1:3000` |
+| `npm run onions:list` | Print all `http://….onion` URLs from `/var/lib/tor/*/hostname` (use `sudo` if needed) |
+| `npm run health:stack` | **Terminal A:** keep `npm run start:onion` running · **Terminal B:** curl Tor/nginx/Next loopbacks |
+| `npm run onions:status` | URLs + HTTP probe each nginx vhost |
+| `sudo bash scripts/install-systemd.sh` | Install `cyberlux.service` for boot-time Next |
+| See **`DEPLOY.md`** | Firewall posture, compliance reminder, full systemd notes |
+
+**Tor Browser on phone:** use **Onion Browser** (iOS) or **Tor Browser for Android** — Safari/Chrome will **never** resolve `.onion`. Paste the full `http://` + 56-char host + `.onion`; cellular networks sometimes block Tor (try Wi‑Fi).
+
+This repo ships:
- `43` Tor v3 services
- stable loopback range `127.0.0.1:8080–8122`
@@ -164,29 +179,19 @@ npm run build
npm run start:onion
```
-## Boot At Startup
+## Boot at startup (systemd)
-`scripts/cyberlux.service` is included as a systemd template for the Next process.
-
-Before installing it, set:
-
-- `User=`
-- `Group=`
-- `WorkingDirectory=`
-
-Then install:
+Generate the real unit with your Unix user and repo path (don’t hand-edit placeholders):
```bash
-sudo install -m 0644 scripts/cyberlux.service /etc/systemd/system/cyberlux.service
-sudo systemctl daemon-reload
-sudo systemctl enable --now cyberlux.service
+sudo CYBERLUX_USER=$USER bash scripts/install-systemd.sh
+sudo systemctl enable --now tor.service nginx.service cyberlux.service
+# use `tor@default.service` instead of `tor.service` if your distro names it that way
```
-Notes:
+The installer writes `/etc/systemd/system/cyberlux.service` and `/etc/default/cyberlux`. Legacy template notes live in `scripts/cyberlux.service` (prefer the generator).
-- Tor and nginx should already be installed and enabled
-- the service unit keeps the Next process alive
-- Tor/nginx config is still managed by the repo scripts
+Tor + nginx must already be configured (`./start.sh` or `sudo bash scripts/install-tor-onion.sh` at least once).
## Verification
@@ -259,14 +264,12 @@ There are additional dedicated onions for many top-level routes beyond those.
- Tor hidden services
- generated route / host mapping
-## Final Word
+## Final word
-CyberLux is supposed to boot like a machine that knows what it is:
+If you’re running this, you’re past LARP. The stack is designed to:
-- same onion doors
-- same identities
-- no shallow mirrors
-- no fake “self healing” copy without actual restore logic
-- no dead routes pretending to be part of the network
+- keep **onion identities** across rebuilds when you respect `torDir` names and backups
+- expose **only** what Tor publishes — not your loopback ports to the raw internet
+- fail **loud** in verification (`npm run verify`) instead of silently rotting
-If it starts, it should start hard.
+Read **`DEPLOY.md`** before you point real people at it. **You** own jurisdiction, opsec, and what you ship.
diff --git a/app/comparison/page.tsx b/app/comparison/page.tsx
index cc52d30..2bcfa53 100644
--- a/app/comparison/page.tsx
+++ b/app/comparison/page.tsx
@@ -236,7 +236,7 @@ export default function ComparisonPage() {
diff --git a/app/launch/page.tsx b/app/launch/page.tsx
new file mode 100644
index 0000000..e1d4531
--- /dev/null
+++ b/app/launch/page.tsx
@@ -0,0 +1,63 @@
+import Link from "next/link";
+import Navbar from "@/components/Navbar";
+import ParticleBackground from "@/components/ParticleBackground";
+
+export default function LaunchPage() {
+ return (
+ <>
+
+
+
+
deployment
+
Launch on the dark web
+
+ Ship this stack as Tor v3 hidden services: nginx on loopback ports, Next.js on{" "}
+ 127.0.0.1:3000, one onion per vertical.
+ Repo ships generators and systemd hooks — you bring the box and opsec.
+
+
+
+
1. Build & wire Tor + nginx
+
+ {`cd ~/cyberlux
+./start.sh
+# or prepare only, then systemd:
+# CYBERLUX_PREPARE_ONLY=1 ./start.sh
+# sudo CYBERLUX_USER=$USER bash scripts/install-systemd.sh`}
+
+ {`npm run health:stack
+npm run onions:list # every .onion URL
+sudo bash scripts/list-onion-urls.sh # if hostname files need root
+npm run onions:status # URLs + loopback checks`}
+
+
+
+
+ Full reference: DEPLOY.md in the repo root (Torrc, key backup, firewall).
+
+
+
+
+ ← Hub
+
+
+ Hidden services & mirrors
+
+
+
+
+ );
+}
diff --git a/app/links/page.tsx b/app/links/page.tsx
index ffe56ef..32c5365 100644
--- a/app/links/page.tsx
+++ b/app/links/page.tsx
@@ -123,7 +123,7 @@ export default function LinksPage() {
},
{
title: "ARB Academy",
- description: "Learn 47 guaranteed ways to make money (parody). Most lessons end with your LUX balance going down.",
+ description: "Learn 47 guaranteed ways to make money. Most lessons end with your LUX balance going down.",
url: "/arb-academy",
internal: true,
icon: "🎓",
@@ -166,7 +166,7 @@ export default function LinksPage() {
VERIFIED LINKS
Sites that have been vetted by our community.
-
+
High Trust
Medium
Low
@@ -176,7 +176,7 @@ export default function LinksPage() {
{darkWebLinks.map((link) => (
{link.icon}
@@ -188,7 +188,7 @@ export default function LinksPage() {