diff --git a/.gitignore b/.gitignore
index 554211e..1a4f59e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,8 +14,9 @@ develop-eggs/
 downloads/
 eggs/
 .eggs/
-lib/
-lib64/
+# 仅忽略仓库根目录的 lib（勿用 lib/ 否则会误伤 scripts/linux/lib）
+/lib/
+/lib64/
 parts/
 sdist/
 var/
diff --git a/scripts/linux/lib/common.sh b/scripts/linux/lib/common.sh
new file mode 100644
index 0000000..9239246
--- /dev/null
+++ b/scripts/linux/lib/common.sh
@@ -0,0 +1,735 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="${ROOT_DIR:-$(cd "$LIB_DIR/../../.." && pwd)}"
+CONFIG_DIR="$ROOT_DIR/config"
+STACK_ENV="$CONFIG_DIR/system-stack.env"
+STACK_ENV_EXAMPLE="$CONFIG_DIR/system-stack.env.example"
+SERVICE_CTL="$ROOT_DIR/scripts/linux/service_ctl.sh"
+WEBTTY_SHELL="$ROOT_DIR/scripts/linux/webtty_shell.sh"
+APT_STAMP="/tmp/live-stack-apt-updated.stamp"
+
+INSTALL_TAG="${INSTALL_TAG:-stack}"
+
+log() {
+  printf '[%s] %s\n' "$INSTALL_TAG" "$*"
+}
+
+ensure_root() {
+  if [ "${EUID:-$(id -u)}" -ne 0 ]; then
+    exec sudo -E bash "$0" "$@"
+  fi
+}
+
+apt_update_once() {
+  local now age
+  now="$(date +%s)"
+  if [ -f "$APT_STAMP" ]; then
+    age=$((now - $(stat -c %Y "$APT_STAMP")))
+    if [ "$age" -lt 21600 ]; then
+      return 0
+    fi
+  fi
+  log "Updating apt metadata"
+  apt-get update
+  touch "$APT_STAMP"
+}
+
+apt_install() {
+  apt_update_once
+  apt-get install -y --no-install-recommends "$@"
+}
+
+have() {
+  command -v "$1" >/dev/null 2>&1
+}
+
+need_docker() {
+  [ "${ENABLE_SRS:-1}" = "1" ] || [ "${ENABLE_HOMEPAGE:-1}" = "1" ] || [ "${ENABLE_FILEBROWSER:-1}" = "1" ] || [ "${ENABLE_NEKO:-0}" = "1" ]
+}
+
+compose_run() {
+  local compose_file="$1"
+  shift
+  if docker compose version >/dev/null 2>&1; then
+    docker compose -f "$compose_file" "$@"
+  else
+    docker-compose -f "$compose_file" "$@"
+  fi
+}
+
+as_live() {
+  runuser -u live -- bash -lc "cd '$ROOT_DIR' && $*"
+}
+
+load_env() {
+  mkdir -p "$CONFIG_DIR"
+  if [ ! -f "$STACK_ENV" ] && [ -f "$STACK_ENV_EXAMPLE" ]; then
+    cp "$STACK_ENV_EXAMPLE" "$STACK_ENV"
+  fi
+  if [ -f "$STACK_ENV" ]; then
+    set -a
+    . "$STACK_ENV"
+    set +a
+  fi
+
+  HOSTNAME_ALIAS="${HOSTNAME_ALIAS:-live}"
+  PORT="${PORT:-8001}"
+  WEBTTY_PORT="${WEBTTY_PORT:-7681}"
+  HOMEPAGE_PORT="${HOMEPAGE_PORT:-80}"
+  FILEBROWSER_PORT="${FILEBROWSER_PORT:-8082}"
+  NETDATA_PORT="${NETDATA_PORT:-19999}"
+  SRS_HTTP_PORT="${SRS_HTTP_PORT:-8080}"
+  SRS_API_PORT="${SRS_API_PORT:-1985}"
+  SRS_RTMP_PORT="${SRS_RTMP_PORT:-1935}"
+  SRS_SRT_PORT="${SRS_SRT_PORT:-10080}"
+  SRS_WEBRTC_PORT="${SRS_WEBRTC_PORT:-8088}"
+  SHELLCRASH_DIR="${SHELLCRASH_DIR:-/etc/ShellCrash}"
+  WEBTTY_USER="${WEBTTY_USER:-live}"
+  WEBTTY_PASS="${WEBTTY_PASS:-12345678}"
+  FILEBROWSER_USER="${FILEBROWSER_USER:-live}"
+  FILEBROWSER_PASS="${FILEBROWSER_PASS:-12345678}"
+  WIFI_CONNECTION_NAME="${WIFI_CONNECTION_NAME:-live-wifi}"
+  WIFI_SSID="${WIFI_SSID:-live}"
+  WIFI_PSK="${WIFI_PSK:-12345678}"
+  BROWSER_PROFILE_DIR="${BROWSER_PROFILE_DIR:-/var/lib/live-browser/profile}"
+  DISABLE_IPV6="${DISABLE_IPV6:-1}"
+  ANDROID_PANEL_PORT="${ANDROID_PANEL_PORT:-5000}"
+  ANDROID_PANEL_DIR="${ANDROID_PANEL_DIR:-/opt/live-modules/web-scrcpy}"
+  ANDROID_PANEL_VIDEO_BIT_RATE="${ANDROID_PANEL_VIDEO_BIT_RATE:-1024000}"
+}
+
+ensure_live_user() {
+  if ! id -u live >/dev/null 2>&1; then
+    log "Creating live user"
+    useradd -m -s /bin/bash live
+  fi
+  echo "live:12345678" | chpasswd
+  usermod -aG sudo,audio,video,plugdev,render,gpio,spidev,pwm,i2c,docker live 2>/dev/null || true
+}
+
+install_base_packages() {
+  log "Installing base packages"
+  export DEBIAN_FRONTEND=noninteractive
+  apt_install \
+    git curl wget jq unzip xz-utils ca-certificates sudo \
+    python3 python3-venv python3-pip build-essential \
+    avahi-daemon avahi-utils libnss-mdns \
+    network-manager dnsmasq net-tools \
+    bluez
+  systemctl enable --now NetworkManager 2>/dev/null || true
+}
+
+install_media_packages() {
+  log "Installing media and Android tools"
+  export DEBIAN_FRONTEND=noninteractive
+  apt_install ffmpeg mpv adb xinit xserver-xorg openbox dbus-x11
+  apt_install scrcpy || true
+}
+
+install_nodejs() {
+  if have node; then
+    local major
+    major="$(node -p "process.versions.node.split('.')[0]" 2>/dev/null || echo 0)"
+    if [ "$major" -ge 20 ]; then
+      return 0
+    fi
+  fi
+  log "Installing Node.js 20"
+  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+  apt_install nodejs
+}
+
+install_docker_stack() {
+  if ! need_docker; then
+    return 0
+  fi
+  if have docker && (docker compose version >/dev/null 2>&1 || have docker-compose); then
+    return 0
+  fi
+  log "Installing Docker"
+  apt_install docker.io docker-compose
+  systemctl enable --now docker
+  usermod -aG docker live || true
+}
+
+prepare_python_runtime() {
+  log "Preparing Python virtual environment"
+  chown -R live:live "$ROOT_DIR"
+  as_live "python3 -m venv .venv"
+  as_live ". .venv/bin/activate && pip install --upgrade pip && pip install -r requirements.txt"
+}
+
+prepare_web_console() {
+  log "Building web console"
+  as_live "cd web-console && if [ -f package-lock.json ]; then npm ci; else npm install; fi && npm run build"
+}
+
+install_live_console_service() {
+  log "Installing live console service"
+  chmod +x "$ROOT_DIR/start.sh" "$ROOT_DIR/web.sh" "$ROOT_DIR/dev.sh" "$SERVICE_CTL" "$WEBTTY_SHELL"
+  cat >/etc/systemd/system/live-console.service <<UNIT
+[Unit]
+Description=Live Super Hub Control Plane
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+User=live
+WorkingDirectory=$ROOT_DIR
+Environment=HOST=0.0.0.0
+Environment=PORT=$PORT
+ExecStart=$ROOT_DIR/start.sh
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable --now live-console.service
+}
+
+configure_sudoers() {
+  log "Configuring sudoers for live control plane"
+  cat >/etc/sudoers.d/live-control-plane <<SUDOERS
+live ALL=(root) NOPASSWD: /bin/bash $SERVICE_CTL *
+SUDOERS
+  chmod 440 /etc/sudoers.d/live-control-plane
+}
+
+detect_mdns_interfaces() {
+  local primary iface path found=0
+  local -a ifaces=()
+
+  primary="$(ip route show default 2>/dev/null | awk 'NR==1 {print $5}')"
+  if [ -n "$primary" ] && [ -d "/sys/class/net/$primary" ]; then
+    ifaces+=("$primary")
+    found=1
+  fi
+
+  for path in /sys/class/net/*; do
+    [ -e "$path" ] || continue
+    iface="${path##*/}"
+    [ "$iface" = "lo" ] && continue
+    if [ -d "$path/wireless" ]; then
+      case " ${ifaces[*]} " in
+        *" $iface "*) ;;
+        *)
+          ifaces+=("$iface")
+          found=1
+          ;;
+      esac
+    fi
+  done
+
+  if [ "$found" -eq 0 ]; then
+    for path in /sys/class/net/*; do
+      [ -e "$path" ] || continue
+      iface="${path##*/}"
+      case "$iface" in
+        lo|docker*|br-*|veth*|virbr*|tun*|tap*|zt*|tailscale*|wg*|sit*|dummy*)
+          continue
+          ;;
+      esac
+      ifaces+=("$iface")
+      found=1
+      break
+    done
+  fi
+
+  if [ "${#ifaces[@]}" -gt 0 ]; then
+    local joined
+    joined="$(IFS=,; echo "${ifaces[*]}")"
+    printf '%s\n' "$joined"
+  fi
+}
+
+configure_mdns() {
+  if [ "${ENABLE_MDNS:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Configuring hostname and mDNS"
+  hostnamectl set-hostname "$HOSTNAME_ALIAS"
+
+  local mdns_interfaces
+  mdns_interfaces="$(detect_mdns_interfaces)"
+
+  python3 - <<PY
+from pathlib import Path
+import re
+
+hosts = Path("/etc/hosts")
+hosts_text = hosts.read_text(encoding="utf-8")
+if f"127.0.1.1\t${HOSTNAME_ALIAS}" not in hosts_text and f"127.0.1.1 ${HOSTNAME_ALIAS}" not in hosts_text:
+    lines = []
+    replaced = False
+    for raw in hosts_text.splitlines():
+        if raw.startswith("127.0.1.1"):
+            lines.append(f"127.0.1.1\t${HOSTNAME_ALIAS}")
+            replaced = True
+        else:
+            lines.append(raw)
+    if not replaced:
+        lines.append(f"127.0.1.1\t${HOSTNAME_ALIAS}")
+    hosts.write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+path = Path("/etc/avahi/avahi-daemon.conf")
+raw_lines = path.read_text(encoding="utf-8").splitlines()
+server_keys = {
+    "use-ipv4": "yes",
+    "use-ipv6": "no",
+}
+mdns_interfaces = "${mdns_interfaces}".strip()
+if mdns_interfaces:
+    server_keys["allow-interfaces"] = mdns_interfaces
+
+key_pattern = re.compile(r"^\s*[#;]?\s*([A-Za-z0-9-]+)\s*=.*$")
+section_pattern = re.compile(r"^\s*\[([^\]]+)\]\s*$")
+
+lines = []
+current_section = None
+server_seen = set()
+server_found = False
+
+def flush_server_defaults():
+    missing = [f"{key}={value}" for key, value in server_keys.items() if key not in server_seen]
+    if missing:
+        lines.extend(missing)
+
+for raw in raw_lines:
+    section_match = section_pattern.match(raw)
+    if section_match:
+        if current_section == "server":
+            flush_server_defaults()
+        current_section = section_match.group(1).strip().lower()
+        server_found = server_found or current_section == "server"
+        lines.append(raw)
+        continue
+
+    key_match = key_pattern.match(raw)
+    if key_match and key_match.group(1) in server_keys:
+        key = key_match.group(1)
+        if current_section == "server":
+            if key not in server_seen:
+                lines.append(f"{key}={server_keys[key]}")
+                server_seen.add(key)
+        continue
+
+    lines.append(raw)
+
+if server_found:
+    if current_section == "server":
+        flush_server_defaults()
+else:
+    if lines and lines[-1] != "":
+        lines.append("")
+    lines.append("[server]")
+    flush_server_defaults()
+
+path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+PY
+  if [ "$DISABLE_IPV6" = "1" ]; then
+    cat >/etc/sysctl.d/99-live-disable-ipv6.conf <<CONF
+net.ipv6.conf.all.disable_ipv6=1
+net.ipv6.conf.default.disable_ipv6=1
+net.ipv6.conf.lo.disable_ipv6=1
+CONF
+    sysctl --system >/dev/null 2>&1 || true
+  fi
+  systemctl enable --now avahi-daemon
+  systemctl restart avahi-daemon
+}
+
+configure_wifi_profile() {
+  if [ "${ENABLE_WIFI_PROFILE:-1}" != "1" ]; then
+    return 0
+  fi
+  if ! have nmcli || [ ! -d /sys/class/net/wlan0 ]; then
+    log "Skipping Wi-Fi profile setup: wlan0 or nmcli is missing"
+    return 0
+  fi
+  log "Ensuring Wi-Fi profile ${WIFI_CONNECTION_NAME}"
+  if ! nmcli connection show "$WIFI_CONNECTION_NAME" >/dev/null 2>&1; then
+    nmcli connection add type wifi ifname wlan0 con-name "$WIFI_CONNECTION_NAME" ssid "$WIFI_SSID" \
+      wifi-sec.key-mgmt wpa-psk wifi-sec.psk "$WIFI_PSK" ipv4.method auto connection.autoconnect yes
+  fi
+}
+
+install_shellcrash() {
+  if [ "${ENABLE_SHELLCRASH:-1}" != "1" ]; then
+    return 0
+  fi
+  if [ -x "$SHELLCRASH_DIR/start.sh" ]; then
+    log "ShellCrash already installed"
+    return 0
+  fi
+  log "Installing ShellCrash"
+  local url
+  for url in \
+    'https://testingcf.jsdelivr.net/gh/juewuy/ShellCrash@dev' \
+    'https://raw.githubusercontent.com/juewuy/ShellCrash/dev'
+  do
+    if wget -q --no-check-certificate -O /tmp/install_shellcrash.sh "$url/install_en.sh" && [ -s /tmp/install_shellcrash.sh ]; then
+      break
+    fi
+  done
+  if [ ! -s /tmp/install_shellcrash.sh ]; then
+    log "ShellCrash installer download failed"
+    return 1
+  fi
+  printf '1\n1\n1\n1\n' | bash /tmp/install_shellcrash.sh
+}
+
+install_browser_stack() {
+  if [ "${ENABLE_BROWSER:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Installing browser stack"
+  export DEBIAN_FRONTEND=noninteractive
+  apt_install chromium || apt_install chromium-browser || true
+  mkdir -p /etc/chromium/policies/managed /etc/chromium-browser/policies/managed
+  cat >/etc/chromium/policies/managed/live-browser.json <<JSON
+{
+  "ExtensionInstallForcelist": [
+    "dhdgffkkebhmkfjojejmpbldmpobfkfo;https://clients2.google.com/service/update2/crx"
+  ],
+  "DeveloperToolsAvailability": 1
+}
+JSON
+  cp /etc/chromium/policies/managed/live-browser.json /etc/chromium-browser/policies/managed/live-browser.json 2>/dev/null || true
+  mkdir -p "$BROWSER_PROFILE_DIR"
+  chown -R live:live "$(dirname "$BROWSER_PROFILE_DIR")"
+  chmod +x "$ROOT_DIR/scripts/linux/launch_browser.sh"
+}
+
+install_neko_browser() {
+  if [ "${ENABLE_NEKO:-0}" != "1" ]; then
+    return 0
+  fi
+  if ! have docker || ! (docker compose version >/dev/null 2>&1 || have docker-compose); then
+    log "Neko skipped: docker compose unavailable"
+    return 0
+  fi
+  log "Installing Neko Chromium (Docker, m1k1o/neko)"
+  set -a
+  [ -f "$STACK_ENV" ] && . "$STACK_ENV"
+  set +a
+  export NEKO_HTTP_PORT="${NEKO_HTTP_PORT:-9200}"
+  compose_run "$ROOT_DIR/services/neko/docker-compose.yml" up -d
+}
+
+configure_adb_udev() {
+  log "Configuring Android udev access"
+  cat >/etc/udev/rules.d/51-live-android.rules <<RULES
+SUBSYSTEM=="usb", ATTR{idVendor}=="2207", MODE="0660", GROUP="plugdev", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0660", GROUP="plugdev", TAG+="uaccess"
+RULES
+  udevadm control --reload-rules || true
+  udevadm trigger || true
+}
+
+install_android_panel() {
+  if [ "${ENABLE_ANDROID_PANEL:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Installing Android web panel (ws-scrcpy)"
+  mkdir -p "$(dirname "$ANDROID_PANEL_DIR")"
+  ANDROID_PANEL_GIT_URL="${ANDROID_PANEL_GIT_URL:-https://github.com/baixin1228/web-scrcpy.git}"
+  if [ ! -d "$ANDROID_PANEL_DIR/.git" ]; then
+    rm -rf "$ANDROID_PANEL_DIR"
+    git clone "$ANDROID_PANEL_GIT_URL" "$ANDROID_PANEL_DIR"
+  else
+    git -C "$ANDROID_PANEL_DIR" pull --ff-only
+  fi
+  python3 - <<PY
+from pathlib import Path
+path = Path(r"$ANDROID_PANEL_DIR/app.py")
+text = path.read_text(encoding="utf-8")
+if "import os" not in text:
+    text = "import os\n" + text
+text = text.replace(
+    "socketio.run(app, host='0.0.0.0', port=5000)",
+    "socketio.run(app, host='0.0.0.0', port=int(os.environ.get('ANDROID_PANEL_PORT', '5000')), allow_unsafe_werkzeug=True)",
+)
+path.write_text(text, encoding="utf-8")
+PY
+  chown -R live:live "$ANDROID_PANEL_DIR"
+  runuser -u live -- bash -lc "python3 -m venv '$ANDROID_PANEL_DIR/.venv' && . '$ANDROID_PANEL_DIR/.venv/bin/activate' && pip install --upgrade pip && pip install -r '$ANDROID_PANEL_DIR/requirements.txt'"
+
+  cat >/etc/systemd/system/live-android-panel.service <<UNIT
+[Unit]
+Description=Live Android Web Panel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=live
+WorkingDirectory=$ANDROID_PANEL_DIR
+Environment=ANDROID_PANEL_PORT=$ANDROID_PANEL_PORT
+ExecStart=$ANDROID_PANEL_DIR/.venv/bin/python $ANDROID_PANEL_DIR/app.py --video_bit_rate $ANDROID_PANEL_VIDEO_BIT_RATE
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable --now live-android-panel.service
+}
+
+install_webtty() {
+  if [ "${ENABLE_WEBTTY:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Installing WebTTY"
+  export DEBIAN_FRONTEND=noninteractive
+  if ! apt-get install -y --no-install-recommends ttyd >/dev/null 2>&1; then
+    log "ttyd package unavailable in apt repositories"
+  fi
+  if ! have ttyd; then
+    log "WebTTY skipped because ttyd is unavailable"
+    return 0
+  fi
+
+  systemctl disable --now ttyd.service >/dev/null 2>&1 || true
+
+  cat >/etc/systemd/system/live-webtty.service <<UNIT
+[Unit]
+Description=Live WebTTY
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=live
+WorkingDirectory=$ROOT_DIR
+ExecStart=$(command -v ttyd) -W -p $WEBTTY_PORT -c $WEBTTY_USER:$WEBTTY_PASS $WEBTTY_SHELL
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable --now live-webtty.service
+}
+
+install_cockpit() {
+  if [ "${ENABLE_COCKPIT:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Installing Cockpit"
+  export DEBIAN_FRONTEND=noninteractive
+  apt_install cockpit cockpit-networkmanager
+  systemctl enable --now cockpit.socket
+}
+
+install_netdata() {
+  if [ "${ENABLE_NETDATA:-1}" != "1" ]; then
+    return 0
+  fi
+  log "Installing Netdata"
+  export DEBIAN_FRONTEND=noninteractive
+  apt_install netdata
+  python3 - <<PY
+from pathlib import Path
+path = Path("/etc/netdata/netdata.conf")
+text = path.read_text(encoding="utf-8")
+if "bind socket to IP = 127.0.0.1" in text:
+    text = text.replace("bind socket to IP = 127.0.0.1", "bind socket to IP = 0.0.0.0")
+elif "bind socket to IP =" not in text:
+    text += "\n[global]\n\tbind socket to IP = 0.0.0.0\n"
+path.write_text(text, encoding="utf-8")
+PY
+  systemctl enable --now netdata
+  systemctl restart netdata
+}
+
+render_homepage_services() {
+  local target="$ROOT_DIR/services/homepage/config/services.yaml"
+  log "Rendering Homepage service links"
+  cat >"$target" <<YAML
+- Infrastructure:
+    - Hub Console:
+        href: http://${HOSTNAME_ALIAS}.local:${PORT}
+        description: Chinese-first control plane and modular service center
+YAML
+  if [ "${ENABLE_WEBTTY:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - WebTTY:
+        href: http://${HOSTNAME_ALIAS}.local:${WEBTTY_PORT}
+        description: Browser terminal as the live user
+YAML
+  fi
+  if [ "${ENABLE_COCKPIT:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - Cockpit:
+        href: https://${HOSTNAME_ALIAS}.local:9090
+        description: System administration
+YAML
+  fi
+  if [ "${ENABLE_FILEBROWSER:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - File Browser:
+        href: http://${HOSTNAME_ALIAS}.local:${FILEBROWSER_PORT}
+        description: Beginner-friendly file manager
+YAML
+  fi
+  if [ "${ENABLE_ANDROID_PANEL:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - Android Center:
+        href: http://${HOSTNAME_ALIAS}.local:${PORT}/android
+        description: Device center with preview, ADB controls and embedded web-scrcpy
+YAML
+  fi
+  if [ "${ENABLE_SHELLCRASH:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - ShellCrash:
+        href: http://${HOSTNAME_ALIAS}.local:${PORT}/shellcrash
+        description: Dedicated YAML, JSON and rule editing workspace
+YAML
+  fi
+  if [ "${ENABLE_NETDATA:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - Netdata:
+        href: http://${HOSTNAME_ALIAS}.local:${NETDATA_PORT}
+        description: Metrics and health monitoring
+YAML
+  fi
+  if [ "${ENABLE_SRS:-1}" = "1" ]; then
+    cat >>"$target" <<YAML
+    - SRS:
+        href: http://${HOSTNAME_ALIAS}.local:${SRS_HTTP_PORT}
+        description: RTMP, SRT and preview endpoint
+YAML
+  fi
+}
+
+prepare_homepage() {
+  if [ "${ENABLE_HOMEPAGE:-1}" != "1" ] || ! need_docker; then
+    return 0
+  fi
+  log "Preparing Homepage"
+  render_homepage_services
+  compose_run "$ROOT_DIR/services/homepage/docker-compose.yml" up -d
+}
+
+prepare_filebrowser() {
+  if [ "${ENABLE_FILEBROWSER:-1}" != "1" ] || ! need_docker; then
+    return 0
+  fi
+  log "Preparing File Browser"
+  local fb_image="filebrowser/filebrowser:latest"
+  local fb_db_dir="$ROOT_DIR/services/filebrowser/database"
+  local fb_cfg_dir="$ROOT_DIR/services/filebrowser/config"
+  local fb_db="$fb_db_dir/filebrowser.db"
+  local fb_settings="$fb_cfg_dir/settings.json"
+  local fb_tmp_json fb_hash
+  mkdir -p "$ROOT_DIR/services/filebrowser/database" "$ROOT_DIR/services/filebrowser/config"
+  rm -f "$fb_db"
+  touch "$fb_db"
+  chmod -R 0777 "$ROOT_DIR/services/filebrowser/database" "$ROOT_DIR/services/filebrowser/config"
+  compose_run "$ROOT_DIR/services/filebrowser/docker-compose.yml" down >/dev/null 2>&1 || true
+
+  docker run --rm \
+    -v "$fb_db_dir:/database" \
+    -v "$fb_cfg_dir:/config" \
+    "$fb_image" \
+    config init --config /config/settings.json --database /database/filebrowser.db >/dev/null 2>&1 || true
+
+  docker run --rm \
+    -v "$fb_db_dir:/database" \
+    -v "$fb_cfg_dir:/config" \
+    "$fb_image" \
+    config set \
+      --address 0.0.0.0 \
+      --port 80 \
+      --locale zh-cn \
+      --auth.method json \
+      --minimumPasswordLength 8 \
+      --hideLoginButton=false \
+      --branding.name "Live File Browser" \
+      --config /config/settings.json \
+      --database /database/filebrowser.db >/dev/null
+
+  fb_hash="$(docker run --rm "$fb_image" hash "$FILEBROWSER_PASS" | tail -n 1)"
+  fb_tmp_json="$fb_cfg_dir/filebrowser-users.import.json"
+  FILEBROWSER_HASH="$fb_hash" FILEBROWSER_USER="$FILEBROWSER_USER" python3 - <<'PY' >"$fb_tmp_json"
+import json
+import os
+
+password_hash = os.environ["FILEBROWSER_HASH"].strip()
+username = os.environ["FILEBROWSER_USER"].strip() or "live"
+base_user = {
+    "scope": ".",
+    "locale": "zh-cn",
+    "lockPassword": False,
+    "viewMode": "mosaic",
+    "singleClick": False,
+    "redirectAfterCopyMove": True,
+    "perm": {
+        "admin": True,
+        "execute": True,
+        "create": True,
+        "rename": True,
+        "modify": True,
+        "delete": True,
+        "share": True,
+        "download": True,
+    },
+    "commands": [],
+    "sorting": {"by": "name", "asc": False},
+    "rules": [],
+    "hideDotfiles": False,
+    "dateFormat": False,
+    "aceEditorTheme": "",
+}
+print(
+    json.dumps(
+        [
+            {"id": 1, "username": "admin", "password": password_hash, **base_user},
+            {"id": 0, "username": username, "password": password_hash, **base_user},
+        ],
+        indent=2,
+    )
+)
+PY
+  chmod 0666 "$fb_tmp_json"
+
+  docker run --rm \
+    -w /config \
+    -v "$fb_db_dir:/database" \
+    -v "$fb_cfg_dir:/config" \
+    "$fb_image" \
+    users import $(basename "$fb_tmp_json") --overwrite --config /config/settings.json --database /database/filebrowser.db >/dev/null
+  rm -f "$fb_cfg_dir/users.backup.json"
+  rm -f "$fb_tmp_json"
+
+  compose_run "$ROOT_DIR/services/filebrowser/docker-compose.yml" up -d
+}
+
+prepare_srs() {
+  if [ "${ENABLE_SRS:-1}" != "1" ] || ! need_docker; then
+    return 0
+  fi
+  log "Starting SRS"
+  mkdir -p "$ROOT_DIR/services/srs/data"
+  compose_run "$ROOT_DIR/services/srs/docker-compose.yml" up -d
+}
+
+run_hardware_probe() {
+  log "Probing hardware profile"
+  as_live ". .venv/bin/activate && python scripts/hardware_probe.py --write"
+}
+
+print_summary() {
+  local profile="$1"
+  cat <<TXT
+
+Profile: $profile
+Control Plane: http://${HOSTNAME_ALIAS}.local:${PORT}
+Homepage: http://${HOSTNAME_ALIAS}.local${HOMEPAGE_PORT:+:${HOMEPAGE_PORT}}
+WebTTY: http://${HOSTNAME_ALIAS}.local:${WEBTTY_PORT}
+TXT
+}