From 80ba316d4a74361da93f89a6797533271aca58c2 Mon Sep 17 00:00:00 2001
From: datadunia <datadunia@ymail.com>
Date: Fri, 26 Jun 2026 10:03:20 +0700
Subject: [PATCH] feat: add embedded agent submodule and update architecture

- Add device-agent-embedded submodule (ESP32 WireGuard agent)
- Update README.md with embedded agent architecture
- Update update.sh to exclude device-agent and device-agent-embedded
  (both built separately, not part of Docker deployment)
- Add docs/DESIGN.md, API_COMPAT.md, HARDWARE.md for embedded agent
- Add Kconfig for menuconfig options
- Add sdkconfig.defaults for ESP-IDF configuration
---
 .gitmodules                | 3 +++
 README.md                  | 5 +++--
 apps/device-agent-embedded | 1 +
 update.sh                  | 5 ++++-
 4 files changed, 11 insertions(+), 3 deletions(-)
 create mode 160000 apps/device-agent-embedded

diff --git a/.gitmodules b/.gitmodules
index cd11e3d..b71cd15 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,3 +7,6 @@
 [submodule "apps/device-agent"]
 	path = apps/device-agent
 	url = https://git.datadunia.com/nexusguard/nexus-device-agent.git
+[submodule "apps/device-agent-embedded"]
+	path = apps/device-agent-embedded
+	url = https://git.datadunia.com/nexusguard/nexus-agent-embedded.git
diff --git a/README.md b/README.md
index 3911520..6b00a8b 100644
--- a/README.md
+++ b/README.md
@@ -3,10 +3,11 @@
 NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.
 
 ## 🏗️ System Architecture
-This suite contains three main components:
+This suite contains four main components:
 1. **[Server Core](http://git.datadunia.com/nexusguard/nexus-server-core)**: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
 2. **[Dashboard UI](http://git.datadunia.com/nexusguard/nexus-dashboard-ui)**: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules. Features a futuristic glassmorphism design system using Vue 3, Vite, TailwindCSS v4, and HeadlessUI.
-3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
+3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux/Windows/macOS client machines that establishes memory-injected WireGuard tunnels.
+4. **[Device Agent Embedded](http://git.datadunia.com/nexusguard/nexus-agent-embedded)**: ESP32-based WireGuard agent for IoT/edge devices. Runs on FreeRTOS + ESP-IDF with lwIP stack.
 
 ---
 
diff --git a/apps/device-agent-embedded b/apps/device-agent-embedded
new file mode 160000
index 0000000..9f9448a
--- /dev/null
+++ b/apps/device-agent-embedded
@@ -0,0 +1 @@
+Subproject commit 9f9448aebbb1a28c691efc3531cef106c3e45eb2
diff --git a/update.sh b/update.sh
index de5f1d9..a9f9130 100755
--- a/update.sh
+++ b/update.sh
@@ -45,7 +45,10 @@ git pull origin main || { GIT_PULL_FAILED=true; echo "[!] Git pull for main repo
 
 echo "[+] Syncing and updating submodules..."
 SUBMODULE_FAILED=false
-git submodule update --init --recursive --remote || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
+# Exclude device-agent and device-agent-embedded (built separately, not Docker)
+git submodule update --init --recursive --remote \
+    --exclude apps/device-agent \
+    --exclude apps/device-agent-embedded || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
 
 # 2b. Build VitePress docs (non-blocking)
 echo "[+] Building VitePress documentation..."