diff --git a/.gitignore b/.gitignore
index 0d2e966..f2b15ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 current
 startup_display.txt
 __pycache__
+tmp
+sticks
diff --git a/cfg/linse-apu5.cfg b/cfg/linse-apu5.cfg
index 74ee7c4..cc3a244 100644
--- a/cfg/linse-apu5.cfg
+++ b/cfg/linse-apu5.cfg
@@ -1,6 +1,7 @@
 [BOX]
 type=bare-apu
 MAC=00:0d:b9:5f:ba:48
+version=1
 
 [NETWORK]
 ; please refer to README.md for help
@@ -11,4 +12,4 @@ eth3=192.168.127.254
 
 [ROUTER]
 ; please refer to README.md for help
-3001=192.168.127.254:3001
+2000=192.168.2.2:2000
diff --git a/makeusb b/makeusb
deleted file mode 100755
index ea8bd44..0000000
--- a/makeusb
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/bin/bash
-# create an USB stick with TinyLinux on it
-# name of the USB stick to be created
-NAME=BOOT_TINY
-
-if [ "$EUID" -ne 0 ]
-  then echo "Please run as root"
-  exit
-fi
-
-# list removeable disks
-DISKS=()
-while read LINE
-do
-  ARR=($LINE)
-  if [[ ${ARR[@]:0:2} == "1 disk" ]]; then
-    DISKS+=(${ARR[@]:2:1})
-    printf "%-7s %7s " ${ARR[@]:2:2}
-    echo ${ARR[@]:4}
-  elif [[ ${ARR[@]:0:2} == "1 part" ]]; then
-    printf "        %7s " ${ARR[@]:3:1}
-    echo ${ARR[@]:4}
-  fi
-done < <(lsblk -l --output RM,TYPE,NAME,SIZE,LABEL,VENDOR,MODEL)
-
-echo "which device? should be one of: ${DISKS[@]}"
-read DEVICE
-
-if [ -z $DEVICE ] ; then
-  exit
-fi
-if [[ " ${DISKS[@]} " =~ " $DEVICE " ]]; then
-  echo "create TinyLinux"
-
-  if [ ! -d boot_tiny ] ; then
-    sudo --user l_samenv git clone --depth 1 https://gitea.psi.ch/linse/boot_tiny.git
-  fi
-
-  if [[ $(cat /sys/block/$DEVICE/removable) != "1" ]]; then
-    echo "/dev/$DEVICE is not a removable disk"
-    exit
-  fi
-
-  DEVICE=/dev/$DEVICE
-
-  umount ${DEVICE}1
-  dd if=/dev/zero of=${DEVICE} count=1 conv=notrunc
-  echo -e "o\nn\np\n1\n\n\nw" | fdisk ${DEVICE}
-  mkfs.vfat -n $NAME -I ${DEVICE}1
-
-  syslinux -i ${DEVICE}1
-  dd conv=notrunc bs=440 count=1 if=boot_tiny/mbr.bin of=${DEVICE}
-  parted ${DEVICE} set 1 boot on
-
-  mkdir -p /mnt/apusb
-  mount ${DEVICE}1 /mnt/apusb
-  echo "copy files ..."
-  cp -r boot_tiny/* /mnt/apusb/
-  umount /mnt/apusb
-
-  rm -rf boot_tiny
-  echo "done."
-else
-  echo "/dev/$DEVICE is not a removeable disk"
-fi
-
diff --git a/tinylinux/bootlocal.sh b/tinylinux/bootlocal.sh
new file mode 100644
index 0000000..53fe27e
--- /dev/null
+++ b/tinylinux/bootlocal.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+# /opt/bootlocal.sh - run as root at the end of boot (called by tc-config).
+# Everything needed is already inside core.gz: no network, no tce-load.
+
+# do what tce-load does after it has mounted an extension
+ldconfig 2> /dev/null
+for f in /usr/local/tce.installed/*; do
+  [ -x "$f" ] && "$f"
+done
+
+# passwords (delete these two lines if only key login is wanted)
+echo "tc:tc" | chpasswd
+echo "root:root" | chpasswd
+
+# ssh files for user tc, staged in /opt/ssh by build_core.sh
+if [ -d /opt/ssh ]; then
+  rm -rf /home/tc/.ssh
+  cp -a /opt/ssh /home/tc/.ssh
+  chown -R tc:staff /home/tc/.ssh
+  chmod 700 /home/tc/.ssh
+  chmod -R go-rwx /home/tc/.ssh
+fi
+
+/usr/local/etc/init.d/openssh start
+
+# marker so that you can see on the box that this script ran
+echo "bootlocal.sh finished $(date)" > /tmp/bootlocal.log
diff --git a/tinylinux/build_core.sh b/tinylinux/build_core.sh
new file mode 100644
index 0000000..c70e9cf
--- /dev/null
+++ b/tinylinux/build_core.sh
@@ -0,0 +1,129 @@
+#!/bin/bash
+# Build a custom core.gz for the BOOT_TINY stick:
+#  - nano, lz4, openssh (and their dependencies) are built in, so no
+#    network and no tce-load are needed at boot
+#  - /opt/bootlocal.sh starts sshd and sets up ~/.ssh
+#  - the ssh/ directory (authorized_keys, id_rsa, ...) is staged in /opt/ssh
+#  - the stick gets a hostname and its own, fixed ssh host keys
+#
+# Needs: root, cpio, gzip, unsquashfs (package squashfs-tools), ssh-keygen
+#
+# Put these next to this script:
+#   core.gz.orig   the original, unmodified core.gz (keep it, never overwrite)
+#   tcz/*.tcz      extensions fetched on the Tiny Core box with
+#                  "tce-load -w nano lz4 openssh", copied from tce/optional
+#   ssh/           files for ~/.ssh of user tc (authorized_keys, ...)
+#   bootlocal.sh
+#   sticks/<name>/hostkeys/  ssh host keys of the stick called <name>. Used if it
+#                  exists, created (and filled with new keys) if it does not.
+#                  Keep it, then a rebuilt stick keeps its identity.
+# Result: sticks/<name>/core.gz (copy it into boot_tiny/ and commit it)
+set -e
+cd "$(dirname "$0")"
+
+ORIG=core.gz.orig
+
+[ "$EUID" -eq 0 ] || { echo "Please run as root"; exit 1; }
+for f in "$ORIG" bootlocal.sh; do
+  [ -f "$f" ] || { echo "missing $f"; exit 1; }
+done
+ls tcz/*.tcz > /dev/null 2>&1 || { echo "no tcz/*.tcz found"; exit 1; }
+for c in cpio gzip unsquashfs ssh-keygen; do
+  command -v $c > /dev/null || { echo "need $c"; exit 1; }
+done
+
+file "$ORIG" | grep -q gzip || { echo "$ORIG is not gzip compressed:"; file "$ORIG"; exit 1; }
+
+if [ -z "$1" ]; then
+  read -p "stick name [apu-boot]: " stickname
+  stickname=${stickname:-apu-boot}
+else
+  stickname=$1
+fi
+label=${stickname//-/_}
+label=${label^^}
+
+# the name ends up in a directory name and in a script: allow only safe characters
+case "$stickname" in
+  *[!A-Za-z0-9-]*|.*) echo "invalid hostname '$stickname' (use letters, digits and dash only)"; exit 1 ;;
+esac
+
+# ssh host keys: use hostkeys_<name> if present, create missing keys otherwise
+STICKDIR=$PWD/sticks/$stickname
+KEYDIR=$STICKDIR/hostkeys
+SSHDIR=$PWD/tmp/ssh_for_boxes
+if [ -d "$KEYDIR" ]; then
+  echo "using ssh host keys from $KEYDIR"
+else
+  echo "creating $KEYDIR with new ssh host keys"
+  mkdir -p "$KEYDIR"
+fi
+for t in dsa rsa ecdsa ed25519; do
+  if [ ! -f "$KEYDIR/ssh_host_${t}_key" ]; then
+    echo "  generate $t key"
+    rm -f "$KEYDIR/ssh_host_${t}_key.pub"
+    ssh-keygen -q -t $t -N '' -f "$KEYDIR/ssh_host_${t}_key"
+  fi
+done
+
+cat << EOF > $STICKDIR/bootsync.sh
+#!/bin/sh
+# put other system startup commands here, the boot process will wait until they complete.
+# Use bootlocal.sh for system startup commands that can run in the background
+# and therefore not slow down the boot process.
+/usr/bin/sethostname $stickname
+/opt/bootlocal.sh &
+EOF
+
+WORK=$(mktemp -d)
+TMP=$(mktemp -d)
+trap 'rm -rf "$WORK" "$TMP"' EXIT
+
+echo "unpack $ORIG"
+zcat "$ORIG" | (cd "$WORK" && cpio -idm --quiet)
+
+for t in tcz/*.tcz; do
+  echo "add $t"
+  rm -rf "$TMP/x"
+  unsquashfs -d "$TMP/x" "$t" > /dev/null
+  cp -a "$TMP/x/." "$WORK/"
+done
+
+echo "add ssh files from $SSHDIR for user tc host"
+
+if [ -d "$SSHDIR" ]; then
+  echo "stage $SSHDIR in /opt/ssh"
+  mkdir -p "$WORK/opt/ssh"
+  cp -a "$SSHDIR"/. "$WORK/opt/ssh/"
+fi
+
+echo "add ssh host keys from $KEYDIR"
+
+mkdir -p "$WORK/usr/local/etc/ssh"
+for k in "$KEYDIR"/ssh_host_*_key; do
+  install -m 600 -o root -g root "$k" "$WORK/usr/local/etc/ssh/"
+  install -m 644 -o root -g root "$k.pub" "$WORK/usr/local/etc/ssh/"
+done
+
+install -m 755 -o root -g root bootlocal.sh "$WORK/opt/bootlocal.sh"
+install -m 755 -o root -g root $STICKDIR/bootsync.sh "$WORK/opt/bootsync.sh"
+
+# commands whose scripts live on the stick: small wrappers in /usr/local/bin
+STICKCMDS="clone write_to_ssd"
+mkdir -p "$WORK/usr/local/bin"
+for c in $STICKCMDS; do
+  printf '#!/bin/sh\ncd %s && exec bash ./%s "$@"\n' "/media/$label" "$c" > "$WORK/usr/local/bin/$c"
+  chmod 755 "$WORK/usr/local/bin/$c"
+done
+
+OUT=core.gz
+echo "pack $STICKDIR/$OUT"
+(cd "$WORK" && find . | cpio -o -H newc --quiet) | gzip -9 > "${OUT}.new"
+
+mv "${OUT}.new" $STICKDIR/$OUT
+
+# change ownership of generated files to the owner of the current directory
+chown -R --reference=. $STICKDIR
+
+ls -l "$STICKDIR/$OUT"
+echo "done."
diff --git a/tinylinux/core.gz.orig b/tinylinux/core.gz.orig
new file mode 100644
index 0000000..4d1a163
Binary files /dev/null and b/tinylinux/core.gz.orig differ
diff --git a/tinylinux/makeusb b/tinylinux/makeusb
new file mode 100755
index 0000000..dbd01cc
--- /dev/null
+++ b/tinylinux/makeusb
@@ -0,0 +1,98 @@
+#!/bin/bash
+# create an USB stick with TinyLinux on it
+# name of the USB stick to be created
+BOOT_TINY_SRC=l_samenv@linse-c:boxes/boot_tiny
+SSH_BOXES_SRC=l_samenv@linse-c:boxes/ssh_for_boxes
+
+[ "$EUID" -eq 0 ] || { echo "Please run as root"; exit 1; }
+
+# list removeable disks
+DISKS=()
+while read LINE
+do
+  ARR=($LINE)
+  if [[ ${ARR[@]:0:2} == "1 disk" ]]; then
+    DISKS+=(${ARR[@]:2:1})
+    printf "%-7s %7s " ${ARR[@]:2:2}
+    echo ${ARR[@]:4}
+  elif [[ ${ARR[@]:0:2} == "1 part" ]]; then
+    printf "        %7s " ${ARR[@]:3:1}
+    echo ${ARR[@]:4}
+  fi
+done < <(lsblk -l --output RM,TYPE,NAME,SIZE,LABEL,VENDOR,MODEL)
+
+echo "which device? should be one of: ${DISKS[@]}"
+read DEVICE
+
+if [ -z $DEVICE ] ; then
+  exit
+fi
+
+if [[ " ${DISKS[@]} " =~ " $DEVICE " ]]; then
+  if [[ $(cat /sys/block/$DEVICE/removable) != "1" ]]; then
+    echo "/dev/$DEVICE is not a removable disk"
+    exit
+  fi
+
+  if [ -z "$1" ]; then
+    read -p "name for stick name [apu-boot]: " name
+    name=${name:-apu-boot}
+  else
+    name=$1
+  fi
+
+  stickname=${name//_/-}
+  stickname=${stickname,,}
+  label=${name//-/_}
+  label=${label^^}
+
+  # allow only letters and digits
+  case "$stickname" in
+    *[!A-Za-z0-9-]*|.*) echo "invalid hostname '$stickname' (use letters, digits and dash only)"; exit 1 ;;
+  esac
+
+  echo "create TinyLinux stick $label (host name $stickname)"
+
+  rm -rf tmp
+  sudo --user l_samenv mkdir tmp
+  sudo --user l_samenv scp -r $BOOT_TINY_SRC tmp/
+  sudo --user l_samenv scp -r $SSH_BOXES_SRC tmp/
+
+  STICKDIR=sticks/$stickname
+  if [ ! -d $STICKDIR ]; then
+    mkdir -p $STICKDIR
+  fi
+  bash build_core.sh $stickname
+  if [ ! -f $STICKDIR/core.gz ]; then
+     echo "no core.gz created -> build_core.sh failed"
+     exit
+  fi
+  sudo --user l_samenv cp $STICKDIR/core.gz tmp/boot_tiny/scripts/
+  DEVICE=/dev/$DEVICE
+
+  umount ${DEVICE}1
+  dd if=/dev/zero of=${DEVICE} count=1 conv=notrunc
+  echo -e "o\nn\np\n1\n\n\nw" | fdisk ${DEVICE}
+  mkfs.vfat -n $label -I ${DEVICE}1
+
+  syslinux -i ${DEVICE}1
+  dd conv=notrunc bs=440 count=1 if=tmp/boot_tiny/mbr.bin of=${DEVICE}
+  parted ${DEVICE} set 1 boot on
+
+  mkdir -p /mnt/apusb
+  mount ${DEVICE}1 /mnt/apusb
+  echo "copy files ..."
+  cp -r tmp/boot_tiny/scripts/* /mnt/apusb/
+  umount /mnt/apusb
+
+  echo "done."
+  echo "--------------------------------------------------------------------"
+  echo "stick into a box, reboot and wait 2 minutes, then:"
+  echo ""
+  echo "nslookup $stickname"
+  echo ""
+  echo "if found ip start with 129.129., you can login as tc@$stickname"
+  echo "ip start with 10., the box has first to be registered to PacketFence"
+else
+  echo "/dev/$DEVICE is not a removeable disk"
+fi
diff --git a/tinylinux/tcz/lz4.tcz b/tinylinux/tcz/lz4.tcz
new file mode 100644
index 0000000..3715a9d
Binary files /dev/null and b/tinylinux/tcz/lz4.tcz differ
diff --git a/tinylinux/tcz/lz4.tcz.md5.txt b/tinylinux/tcz/lz4.tcz.md5.txt
new file mode 100644
index 0000000..f34e031
--- /dev/null
+++ b/tinylinux/tcz/lz4.tcz.md5.txt
@@ -0,0 +1 @@
+9a994075cedcc853c448cc9691c3fe38  lz4.tcz
diff --git a/tinylinux/tcz/nano.tcz b/tinylinux/tcz/nano.tcz
new file mode 100644
index 0000000..bd6186f
Binary files /dev/null and b/tinylinux/tcz/nano.tcz differ
diff --git a/tinylinux/tcz/nano.tcz.dep b/tinylinux/tcz/nano.tcz.dep
new file mode 100644
index 0000000..8ae0b07
--- /dev/null
+++ b/tinylinux/tcz/nano.tcz.dep
@@ -0,0 +1 @@
+ncurses.tcz
diff --git a/tinylinux/tcz/nano.tcz.md5.txt b/tinylinux/tcz/nano.tcz.md5.txt
new file mode 100644
index 0000000..595aa3c
--- /dev/null
+++ b/tinylinux/tcz/nano.tcz.md5.txt
@@ -0,0 +1 @@
+ce9cf3b540095da2f62d958d85a15e2e  nano.tcz
diff --git a/tinylinux/tcz/ncurses.tcz b/tinylinux/tcz/ncurses.tcz
new file mode 100644
index 0000000..d72d859
Binary files /dev/null and b/tinylinux/tcz/ncurses.tcz differ
diff --git a/tinylinux/tcz/ncurses.tcz.md5.txt b/tinylinux/tcz/ncurses.tcz.md5.txt
new file mode 100644
index 0000000..b253652
--- /dev/null
+++ b/tinylinux/tcz/ncurses.tcz.md5.txt
@@ -0,0 +1 @@
+234b09001894df7f888a5905067c9be3  ncurses.tcz
diff --git a/tinylinux/tcz/openssh.tcz b/tinylinux/tcz/openssh.tcz
new file mode 100644
index 0000000..82b029d
Binary files /dev/null and b/tinylinux/tcz/openssh.tcz differ
diff --git a/tinylinux/tcz/openssh.tcz.dep b/tinylinux/tcz/openssh.tcz.dep
new file mode 100644
index 0000000..8c212df
--- /dev/null
+++ b/tinylinux/tcz/openssh.tcz.dep
@@ -0,0 +1,2 @@
+openssl.tcz
+
diff --git a/tinylinux/tcz/openssh.tcz.md5.txt b/tinylinux/tcz/openssh.tcz.md5.txt
new file mode 100644
index 0000000..575c779
--- /dev/null
+++ b/tinylinux/tcz/openssh.tcz.md5.txt
@@ -0,0 +1 @@
+ad59211499d2b35c624b85eaec4ce53a  openssh.tcz
diff --git a/tinylinux/tcz/openssl.tcz b/tinylinux/tcz/openssl.tcz
new file mode 100644
index 0000000..500ed70
Binary files /dev/null and b/tinylinux/tcz/openssl.tcz differ
diff --git a/tinylinux/tcz/openssl.tcz.md5.txt b/tinylinux/tcz/openssl.tcz.md5.txt
new file mode 100644
index 0000000..9abc2dc
--- /dev/null
+++ b/tinylinux/tcz/openssl.tcz.md5.txt
@@ -0,0 +1 @@
+e7bfb084e3fbab7eae0a2a0f2cdef0ff  openssl.tcz