chore: update .gitignore, add docs site, plan docs

apps/docs/.vitepress/config.mts

@@ -0,0 +1,22 @@
+import { defineConfig } from 'vitepress'
+
+export default defineConfig({
+  title: 'NexusGuard Docs',
+  description: 'Enterprise Zero-Trust SD-WAN Documentation',
+  cleanUrls: true,
+  themeConfig: {
+    sidebar: [
+      {
+        text: 'Guides',
+        items: [
+          { text: 'Sign In', link: '/guides/sign-in' },
+          { text: 'Access Remote Server', link: '/guides/access-remote-server' },
+          { text: 'Add WireGuard Configuration', link: '/guides/add-wireguard-configuration' },
+          { text: 'Peers', link: '/guides/peers' },
+          { text: 'Email Service', link: '/guides/email-service' },
+          { text: 'WebHooks', link: '/guides/webhooks' },
+        ]
+      }
+    ]
+  }
+})

apps/docs/guides/access-remote-server.md

@@ -0,0 +1,15 @@
+# Access Remote Server
+
+Connect to and manage remote WireGuard servers through the NexusGuard Dashboard.
+
+## Overview
+
+NexusGuard supports multiple server nodes across different geographic regions. Each node runs a WireGuard instance managed centrally by the Server Core.
+
+## Steps
+
+1. Ensure the remote server has the Device Agent installed and running.
+2. Register the server's public key and endpoint in the Dashboard Nodes page.
+3. The Server Core will establish communication with the remote node.
+4. Monitor node status (Online/Offline) from the Nodes table.
+5. Configure firewall rules and peer assignments per node as needed.

apps/docs/guides/add-wireguard-configuration.md

@@ -0,0 +1,15 @@
+# Add WireGuard Configuration
+
+Create and manage WireGuard peer configurations for client devices.
+
+## Overview
+
+Each device connected to the NexusGuard network gets a unique WireGuard configuration file. These can be downloaded, displayed as QR codes, or shared via time-limited links.
+
+## Steps
+
+1. Navigate to the **Devices** page in the Dashboard.
+2. Click **+ Add Peer** and select the target server node.
+3. Enter a name for the device and configure network settings.
+4. Optionally enable **Allow Internet Access** for full-tunnel VPN.
+5. After creation, download the `.conf` file, show the QR code, or copy the config text.

apps/docs/guides/email-service.md

@@ -0,0 +1,21 @@
+# Email Service
+
+Configure email notifications for important system events.
+
+## Overview
+
+NexusGuard can send email notifications for events such as new device registrations, security alerts, and system status changes.
+
+## Configuration
+
+1. Configure SMTP server settings in the Dashboard Settings page.
+2. Provide sender email address and authentication credentials.
+3. Select which notification types to enable.
+4. Test the email configuration by sending a test message.
+
+## Events
+
+- New device registration
+- Device online/offline status change
+- Firewall rule violations
+- Admin account changes

apps/docs/guides/peers.md

@@ -0,0 +1,15 @@
+# Peers
+
+Manage peer devices and their advanced network settings.
+
+## Overview
+
+Peers represent individual client devices connected to the NexusGuard network. Each peer has configurable network parameters that can override node-level defaults.
+
+## Features
+
+- **Allowed IPs**: Override the default routing prefix for a specific device.
+- **DNS / MTU / Keepalive**: Device-level overrides that cascade from device → node defaults → hardcoded defaults.
+- **Notes**: Add annotations to any device for organizational purposes.
+- **Suspend/Unsuspend**: Temporarily disable a device's tunnel without deleting its configuration.
+- **Firewall Rules**: Configure per-device nftables rules for fine-grained access control.

apps/docs/guides/sign-in.md

@@ -0,0 +1,16 @@
+# Sign In
+
+Learn how to access the NexusGuard Dashboard using your admin credentials.
+
+## Overview
+
+The NexusGuard Dashboard uses a secure authentication system with JWT tokens. Access is restricted to authorized administrators only.
+
+## Steps
+
+1. Open your browser and navigate to your NexusGuard Dashboard URL.
+2. Enter your admin username and password.
+3. Click **Sign In** to authenticate.
+4. Upon successful login, you will be redirected to the Nodes management page.
+
+If you have forgotten your password, you can reset it using the `-create-admin` CLI command on the server.

apps/docs/guides/webhooks.md

@@ -0,0 +1,21 @@
+# WebHooks
+
+Integrate NexusGuard with external systems using webhook callbacks.
+
+## Overview
+
+Webhooks allow NexusGuard to send real-time event notifications to external services, enabling integration with monitoring systems, incident management platforms, and custom automation workflows.
+
+## Configuration
+
+1. Navigate to Webhooks settings in the Dashboard.
+2. Add a new webhook endpoint URL.
+3. Select the events that should trigger the webhook.
+4. Optionally add a secret token for payload verification.
+
+## Supported Events
+
+- Device created, updated, or deleted
+- Node online/offline status change
+- Firewall rule triggered
+- Peer configuration downloaded or shared

apps/docs/index.md

@@ -0,0 +1,13 @@
+# NexusGuard SD-WAN Suite
+
+Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. Enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.
+
+## Overview
+
+NexusGuard provides a complete secure networking solution with three main components:
+
+- **Server Core**: Central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
+- **Dashboard UI**: Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules.
+- **Device Agent**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
+
+Use the guide sections to learn how to set up and manage your NexusGuard network.

apps/docs/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "nexusguard-docs",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "docs:dev": "vitepress dev",
+    "docs:build": "vitepress build",
+    "docs:preview": "vitepress preview"
+  },
+  "devDependencies": {
+    "vitepress": "^1.6.0"
+  }
+}