diff --git a/TODO.md b/TODO.md
index 6366acee..0b4f2d06 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,6 @@
 # Smart City Digital Twin — TODO List
 
-> Dernière mise à jour : 2026-05-26 22:00
+> Dernière mise à jour : 2026-05-26 23:00
 
 ## ✅ Complété
 | ID | Tâche |
@@ -19,6 +19,9 @@
 | or-pg-fix | Image PostgreSQL changée → timescaledb-ha:pg15 |
 | grafana-fix | Dashboard "no data" corrigé — datasource + requêtes Flux |
 | grafana-v4 | Dashboard v4 poussé avec 14 panels, données confirmées ✅ |
+| bunkerm-activate | BunkerM activé dans simulateur + Telegraf |
+| superset-deploy | Apache Superset déployé derrière Traefik ✅ |
+| metabase-deploy | Metabase déployé derrière Traefik ✅ |
 
 ## 🔴 En cours
 | ID | Tâche | Notes |
@@ -32,24 +35,24 @@
 | p4-ditto | Ditto.digitribe.fr | MongoDB localhost hardcodé |
 | p3-kepler | KeplerGL | Image Docker incomplète |
 
-## ⏳ En attente (par priorité)
-| ID | Tâche | Priorité |
-|----|-------|----------|
-| p1-contexus-60 | Configurer les 60 devices Contexus | Haute |
-| p1-bunkerm-telegraf | Réactiver BunkerM dans Telegraf (port 1883 vs 1900) | Moyenne |
-| p1-grafana-maps | Ajouter carte Grafana avec points capteurs GPS | Moyenne |
-| p1-thingsboard | Relayer ThingsBoard (si CPU dispo) | Moyenne |
-| p3-analyse | Analyse: GeoMesa + KeplerGL | Basse |
-| p1-ngsi | NGSI-LD: validation pipeline | Basse |
-| p0-chirpstack | ChirpStack: login API gRPC-REST | Basse |
+## ⏳ En attente
+| ID | Tâche |
+|----|-------|
+| p1-contexus-60 | Configurer les 60 devices Contexus |
+| p3-analyse | Analyse: GeoMesa + KeplerGL |
+| p1-ngsi | NGSI-LD: validation pipeline (basse priorité) |
+| p0-chirpstack | ChirpStack: login API gRPC-REST |
+| p1-thingsboard | Relayer ThingsBoard (si CPU dispo) |
 
 ## 📝 Notes 2026-05-26
+- **Pipeline données** : Simulateur → EMQX/Mosquitto/BunkerM → Telegraf → InfluxDB → Grafana ✅
 - **Grafana** : Dashboard smartcity-martinique-complete v4 — données confirmées ✅
-- **Pipeline** : Simulateur → EMQX/Mosquitto → Telegraf → InfluxDB → Grafana ✅
+- **Superset** : https://superset.digitribe.fr ✅ (UP, healthy)
+- **Metabase** : https://metabase.digitribe.fr ✅ (UP, healthy)
+- **BunkerM** : Port 1883→1900, dynsec désactivé, auth par password_file
+- **BunkerM Traefik** : https://bunkerm.digitribe.fr (config 27-bunkerm-web.yml corrigée)
 - **InfluxDB** : bucket `smartcity`, measurement `mqtt_consumer`, tag `topic` pour le type
 - **OpenRemote** : Abandon pour l'instant, l'utilisateur va recloner le répertoire
-- **Keycloak** : Recréé manuellement (ancien supprimé par docker-compose up échoué)
-- **Grafana provisioning** : smart-city-dashboards.json déplacé en .bak pour éviter écrasement
 
 ## Credentials
 - **Contexus**: iotevadmin / Digitribe972
@@ -58,4 +61,6 @@
 - **Redis Contexus**: Digitribe972
 - **Telegraf InfluxDB**: token=my-super-token, org=digitribe, bucket=smartcity
 - **Grafana**: admin / Digitribe972
-- **InfluxDB**: admin / Digitribe972
+- **Superset**: admin / Digitribe972 (à configurer au premier accès)
+- **Metabase**: admin@digitribe.fr / Digitribe972
+- **BunkerM MQTT**: bunker / bunker
diff --git a/docker-compose.metabase.yml b/docker-compose.metabase.yml
new file mode 100644
index 00000000..87b0e626
--- /dev/null
+++ b/docker-compose.metabase.yml
@@ -0,0 +1,71 @@
+# Metabase - BI Dashboard for Smart City Digital Twin
+# Usage: docker compose -f docker-compose.metabase.yml up -d
+# Access: https://metabase.digitribe.fr
+
+version: '3.8'
+
+networks:
+  smartcity-shared:
+    external: true
+  traefik-public:
+    external: true
+
+volumes:
+  metabase_data:
+    name: smart-city-metabase-data
+
+services:
+  metabase-db:
+    image: postgres:15-alpine
+    container_name: metabase-postgres
+    restart: unless-stopped
+    networks:
+      - smartcity-shared
+    environment:
+      POSTGRES_DB: metabase
+      POSTGRES_USER: metabase
+      POSTGRES_PASSWORD: Digitribe972
+    volumes:
+      - metabase_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U metabase"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  metabase:
+    image: metabase/metabase:latest
+    container_name: metabase-app
+    restart: unless-stopped
+    networks:
+      - smartcity-shared
+      - traefik-public
+    depends_on:
+      metabase-db:
+        condition: service_healthy
+    environment:
+      MB_DB_TYPE: postgres
+      MB_DB_DBNAME: metabase
+      MB_DB_PORT: 5432
+      MB_DB_USER: metabase
+      MB_DB_PASS: Digitribe972
+      MB_DB_HOST: metabase-postgres
+      MB_SITE_NAME: "Smart City Martinique"
+      MB_SITE_URL: "https://metabase.digitribe.fr"
+      MB_APPLICATION_DB: "file:/metabase-data/metabase.db"
+      MB_ENABLE_PASSWORD_LOGIN: "true"
+      MB_ADMIN_EMAIL: admin@digitribe.fr
+      MB_ADMIN_PASSWORD: Digitribe972
+      MB_JETTY_PORT: 3000
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.metabase.rule=Host(`metabase.digitribe.fr`)"
+      - "traefik.http.routers.metabase.entrypoints=websecure"
+      - "traefik.http.routers.metabase.tls.certresolver=letsencrypt"
+      - "traefik.http.services.metabase.loadbalancer.server.port=3000"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 120s
diff --git a/docker-compose.superset.yml b/docker-compose.superset.yml
new file mode 100644
index 00000000..e5154db8
--- /dev/null
+++ b/docker-compose.superset.yml
@@ -0,0 +1,88 @@
+# Apache Superset - BI Dashboard for Smart City Digital Twin
+# Usage: docker compose -f docker-compose.superset.yml up -d
+# Access: https://superset.digitribe.fr
+
+version: '3.8'
+
+networks:
+  smartcity-shared:
+    external: true
+  traefik-public:
+    external: true
+
+volumes:
+  superset_data:
+    name: smart-city-superset-data
+  superset_redis:
+    name: smart-city-superset-redis
+
+services:
+  superset-redis:
+    image: redis:7-alpine
+    container_name: superset-redis
+    restart: unless-stopped
+    networks:
+      - smartcity-shared
+    volumes:
+      - superset_redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  superset-db:
+    image: postgres:15-alpine
+    container_name: superset-postgres
+    restart: unless-stopped
+    networks:
+      - smartcity-shared
+    environment:
+      POSTGRES_DB: superset
+      POSTGRES_USER: superset
+      POSTGRES_PASSWORD: Digitribe972
+    volumes:
+      - superset_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U superset"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  superset:
+    image: apache/superset:4.0.0
+    container_name: superset-app
+    restart: unless-stopped
+    networks:
+      - smartcity-shared
+      - traefik-public
+    depends_on:
+      superset-db:
+        condition: service_healthy
+      superset-redis:
+        condition: service_healthy
+    environment:
+      SUPERSET_SECRET_KEY: superset-secret-key-change-me-2024
+      DATABASE_DIALECT: postgresql
+      DATABASE_HOST: superset-postgres
+      DATABASE_PORT: 5432
+      DATABASE_DB: superset
+      DATABASE_USER: superset
+      DATABASE_PASSWORD: Digitribe972
+      REDIS_HOST: superset-redis
+      REDIS_PORT: 6379
+      SUPERSET_ENV: production
+      SUPERSET_LOAD_EXAMPLES: "false"
+      MAPBOX_API_KEY: ""
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.superset.rule=Host(`superset.digitribe.fr`)"
+      - "traefik.http.routers.superset.entrypoints=websecure"
+      - "traefik.http.routers.superset.tls.certresolver=letsencrypt"
+      - "traefik.http.services.superset.loadbalancer.server.port=8088"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8088/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 120s