nexusguard/Nexus-Guard-Suite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

chore(server-core): update submodule to multi-stage Dockerfile

Browse Source
This commit is contained in:
datadunia
2026-05-22 16:08:25 +07:00
parent 821169a179
commit 92051d5fb4
2 changed files with 69 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+68 -14
View File
@@ -13,26 +13,39 @@ This suite contains three main components:
## 🚀 Deployment & Installation
### 1. Initial Setup
To deploy the entire backend infrastructure (PostgreSQL, Redis, and Server-Core), simply clone this repository and run the setup script:
Clone this repository and start all services:
```bash
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
chmod +x setup.sh
./setup.sh
cp .env.example .env # Edit .env with your configuration
make up # Start all services (PostgreSQL, Redis, Server-Core, Dashboard UI)
```
The `setup.sh` script will automatically:
- Create a master `.env` file (if it doesn't exist).
- Boot up all required infrastructure via `docker-compose`.
The first run will automatically:
- Create the database schema via GORM AutoMigrate.
- Boot up all required infrastructure via Docker Compose.
### 2. Domain & Port Configuration
### 2. Quick Reference with Makefile
| Command | Description |
|---------|-------------|
| `make up` | Start all services |
| `make down` | Stop all services |
| `make logs` | Tail all service logs |
| `make dev` | Start with hot-reload (air) for development |
| `make migrate` | Run production database migration manually |
| `make reset-db` | **Reset database to initial state** (drops volume, recreates tables, runs migration) |
> `make reset-db` is useful during development to wipe all data and start fresh. It stops all containers, deletes the PostgreSQL volume, recreates the tables, and runs the migration in one command.
### 3. Domain & Port Configuration
If you are deploying this to production, you must edit the `.env` file generated in the root directory:
- **Change API Port**: Modify `API_PORT=8080`.
- **Change Web/API Domain**: Modify `VITE_API_BASE_URL` to point to your public API domain (e.g., `https://api.yourdomain.com/api/v1`).
- **Database & Crypto**: Ensure you change the default database passwords and generate secure 256-bit Hex keys for `JWT_SECRET` and `SERVER_SALT`.
### 3. Creating / Changing the Admin Account
### 4. Creating / Changing the Admin Account
The system operates on a strict **Zero-Attack Surface** policy. The `/auth/register` API is locked down. To create the first Admin user (or reset their password), you must execute a command directly inside the running Docker container:
```bash
@@ -40,18 +53,59 @@ docker exec -it nexus-guard-suite-server-core-1 ./server-core -create-admin -use
```
*(You can use this exact same command later if you ever forget the admin password to forcefully reset it).*
Or using the Makefile directly (requires local Go toolchain):
```bash
make migrate
go run -tags dev ./apps/server-core -create-admin -user "admin" -pass "YourNewSecurePassword123!"
```
---
## 📖 Operational Workflow
Once the server is running and the Admin account is created, follow this flow:
1. **Log in to the Dashboard UI** using the `admin` credentials.
2. **Register a WireGuard Node**: Go to the **Nodes** menu. Add your public WireGuard server endpoint (e.g., `vpn.yourdomain.com:51820`) and its Public Key.
3. **Add a Device**: Go to the **Devices** menu. Click **+ New Device**, select the target Node, and name the device.
4. **Copy the Token**: The system will display a single-use **Registration Token**.
5. **Install the Agent on Client**: On the target Linux machine, run the agent installer:
### Managing Nodes
1. Go to the **Nodes** menu.
2. Click **Register Node** and fill in:
- **Basic Info**: Name, Public Key, Public Endpoint
- **Network Settings**: Listen Address, Port, MTU, DNS, IP Pool (CIDR), Interface Address
- **Advanced Overrides**: Table (Auto/Off), PreUp/PostDown scripts
- **Peer Defaults**: Default DNS, MTU, Keepalive, AllowedIPs for new peers on this node
3. The Interface Address is auto-calculated from the IP Pool CIDR (first usable IP) if left empty.
4. Edit existing nodes to adjust any overrides or peer defaults at any time.
### Adding Peers (Devices)
1. Go to the **Devices** menu.
2. Click **+ Add Peer**.
3. Select the target Node and name the device.
4. Toggle **Allow Internet Access** for full-tunnel VPN (0.0.0.0/0).
5. After creation, you can:
- Download the .conf file
- Show the QR code for mobile apps
- Copy the config text
- Generate a **Share Link** (public, time-limited)
- Configure **Firewall Rules** for the peer
### Advanced Device Settings
Each device has detailed configuration options in its detail page:
- **Allowed IPs**: Override the default routing prefix
- **DNS / MTU / PersistentKeepalive**: Device-level overrides (cascade: device > node defaults > hardcoded defaults)
- **Notes**: Annotate the device
- **Suspend/Unsuspend**: Temporarily disable the tunnel without deleting the device
### Firewall Rules
Manage per-peer nftables firewall rules directly from the UI:
- Allow/block specific IP ranges and port numbers
- Rules are synced to the server kernel in real-time via nft
- Default SSH access (port 22) is provisioned automatically for new peers
### Agent Provisioning (automated device registration)
For automated client deployment with the Device Agent:
1. Create a device from the **Devices** page.
2. Copy the single-use **Registration Token**.
3. On the target Linux machine, run:
```bash
sudo ./install_agent.sh --server-url "https://api.yourdomain.com" --token "<REG_TOKEN>"
```
6. The client will automatically connect, provision its WireGuard keys securely via AES-256-GCM, and appear as **Online** on your Dashboard.
4. The agent will securely provision its WireGuard keys via AES-256-GCM and appear as **Online** on the Dashboard.