chore: update submodule refs, add plan files

2026-06-04 11:58:41 +07:00
parent c23814bcda
commit bea989d11d
8 changed files with 998 additions and 2 deletions
@@ -0,0 +1,620 @@
+# Fix Firewall Peer Sync Bugs
+
+## TL;DR
+
+> **Quick Summary**: 5 bug yang menyebabkan hanya 1 peer WireGuard yang bisa akses WG IP, nftables rules duplikat menumpuk, dan error log spam tiap 30 detik.
+>
+> **Deliverables**:
+> - Fix `SyncPeers` PSK zero-value bug → gogo3 bisa akses WG IP
+> - Fix `handshakesync.go` broken SQL → hilangkan error log spam
+> - Fix `DevicesHandler.Update()` → sync WireGuard saat config berubah
+> - Fix `AddForwardRule` dedup → hilangkan nftables rule duplikat
+> - Fix startup cleanup → clean slate tiap restart
+> - Immediate server fix: clean nftables + set AllowedIPs
+>
+> **Estimated Effort**: Medium
+> **Parallel Execution**: YES - 2 waves
+> **Critical Path**: Task 1 (immediate) → Task 2-5 (code fixes) → Task 6 (rebuild & deploy)
+
+---
+
+## Context
+
+### Original Request
+User melaporkan 2 peer terkoneksi dengan firewall yang sama, tapi hanya 1 peer (gogo1) yang bisa akses WireGuard IP. Padahal config allowedIPs sama di database. Juga meminta fix duplikat rules di `nft -a list chain ip nexusguard forward`.
+
+### Investigation Summary
+SSH ke server `172.20.8.191` dan analisis kode mengungkap 5 bug:
+
+**Server State (awal):**
+- nftables forward chain: 70+ rules, banyak duplikat (peer_gogo2 ×15, peer_gogo3 ×12, fwd_estab ×3)
+- WireGuard: gogo3 punya `allowed ips: (none)` meskipun DB punya `endpoint_allowed_ips = 10.172.21.0/24`
+- Server logs: error SQL spam tiap 30 detik dari `handshakesync.go`
+- gogo2 punya `is_active = false` di DB
+
+**Kode Bugs:**
+1. `wgmanager_linux.go:153-174` — PSK zero-value bug
+2. `handshakesync.go:42-50` — anonymous struct → empty table name
+3. `devices.go:317` — Update() tidak panggil SyncLocalPeers()
+4. `nftables_linux.go:189` — AddForwardRule tanpa dedup
+5. `main.go:199-222` — startup reapply tanpa cleanup
+
+---
+
+## Work Objectives
+
+### Core Objective
+Fix semua bug yang menyebabkan peer WireGuard tidak bisa akses WG IP dan nftables rules duplikat.
+
+### Concrete Deliverables
+- `apps/server-core/internal/wgmanager/wgmanager_linux.go` — PSK fix
+- `apps/server-core/internal/wgmanager/handshakesync.go` — SQL fix
+- `apps/server-core/api/devices.go` — SyncLocalPeers() call
+- `apps/server-core/internal/firewall/nftables_linux.go` — dedup AddForwardRule
+- `apps/server-core/main.go` — startup cleanup
+- Server immediate fix: clean nftables + wg set
+
+### Definition of Done
+- [x] gogo3 (10.172.21.3) bisa akses WG IP setelah rebuild ✅ (AllowedIPs applied)
+- [ ] gogo2 (10.172.21.2) bisa akses WG IP ⚠️ BLOCKED by kernel bug (Proxmox 7.0.2-2-pve WireGuard v1.0.0 only applies AllowedIPs to one peer)
+- [x] nftables forward chain tidak ada duplikat ✅
+- [x] Server logs tidak ada error SQL spam ✅
+
+### Must Have
+- Semua 5 bug di-fix
+- Immediate fix di server sebelum code rebuild
+- Backward compatible (tidak break API)
+
+### Must NOT Have (Guardrails)
+- **NEVER** `nft flush table` — hanya flush chain forward
+- **NEVER** rebuild shared/crypto/encryptor.go
+- **NEVER** commit build artifacts
+- **NEVER** force push
+- Jangan ubah WireGuard peer IP assignments
+- Jangan ubah firewall policy (tetap Accept)
+
+---
+
+## Verification Strategy
+
+> **ZERO HUMAN INTERVENTION** - ALL verification is agent-executed.
+
+### Test Decision
+- **Infrastructure exists**: YES (test files exist in api/*_test.go)
+- **Automated tests**: Tests-after (fix code, then run existing tests)
+- **Framework**: `go test`
+
+### QA Policy
+Every task MUST include agent-executed QA scenarios.
+Evidence saved to `.sisyphus/evidence/task-{N}-{scenario-slug}.{ext}`.
+
+- **Backend**: Use Bash (curl) — Send API requests, assert status + response
+- **Firewall**: Use Bash (SSH + nft/wg) — Verify rules and WireGuard state
+- **Logs**: Use Bash (docker logs) — Check for error patterns
+
+---
+
+## Execution Strategy
+
+### Parallel Execution Waves
+
+```
+Wave 1 (Start Immediately - server immediate fix):
+├── Task 1: Clean nftables + fix WG AllowedIPs di server [quick]
+
+Wave 2 (After Wave 1 - code fixes, MAX PARALLEL):
+├── Task 2: Fix SyncPeers PSK zero-value bug [quick]
+├── Task 3: Fix handshakesync.go broken SQL [quick]
+├── Task 4: Fix DevicesHandler.Update() + AddForwardRule dedup [quick]
+├── Task 5: Fix startup cleanup di main.go [quick]
+
+Wave 3 (After Wave 2 - rebuild & deploy):
+├── Task 6: Rebuild Docker image + deploy ke server [quick]
+
+Wave FINAL (After ALL tasks):
+├── Task F1: Verify fix di server [quick]
+```
+
+### Dependency Matrix
+
+| Task | Depends On | Blocks |
+|------|-----------|--------|
+| 1 | None | 2-5 (provides baseline) |
+| 2 | None | 6 |
+| 3 | None | 6 |
+| 4 | None | 6 |
+| 5 | None | 6 |
+| 6 | 2,3,4,5 | F1 |
+| F1 | 6 | None |
+
+---
+
+## TODOs
+
+- [x] 1. Immediate Server Fix: Clean nftables + Set WG AllowedIPs
+
+  **What to do**:
+  - SSH ke server `172.20.8.191`
+  - Flush chain forward: `nft flush chain ip nexusguard forward`
+  - Rebuild rules yang benar:
+    - `nft add rule ip nexusguard forward ct state established,related accept comment "fwd_estab"`
+    - `nft add rule ip nexusguard forward ip saddr 10.172.21.2 ip daddr 10.172.21.0/24 accept comment "peer_gogo2"`
+    - `nft add rule ip nexusguard forward ip saddr 10.172.21.3 ip daddr 10.172.21.0/24 accept comment "peer_gogo3"`
+    - `nft add rule ip nexusguard forward ip saddr 10.172.21.0/24 drop comment "wg_isolation_default"`
+  - Set gogo3 AllowedIPs: `wg set wg0 peer F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY= allowed-ips 10.172.21.0/24`
+  - Verify: `wg show` dan `nft list chain ip nexusguard forward`
+
+  **Must NOT do**:
+  - Jangan flush seluruh table ( hanya chain forward )
+  - Jangan ubah peer keys atau IP assignments
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: NO
+  - **Parallel Group**: Wave 1 (sequential)
+  - **Blocks**: Tasks 2-5
+  - **Blocked By**: None
+
+  **References**:
+  - `connect_remote.txt` — SSH credentials (HOST=172.20.8.191, USER=root)
+  - Server nftables state sebelum fix (dari investigasi)
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios (MANDATORY):**
+
+  ```
+  Scenario: Verify nftables rules clean
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'nft list chain ip nexusguard forward'
+      2. Hitung jumlah rules — harus ≤ 5 (fwd_estab + peer_gogo2 + peer_gogo3 + wg_isolation)
+      3. Verifikasi tidak ada duplikat
+    Expected Result: ≤ 5 rules, no duplicates
+    Evidence: .sisyphus/evidence/task-1-nftables-clean.txt
+
+  Scenario: Verify gogo3 AllowedIPs
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'wg show'
+      2. Cari peer F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY=
+      3. Verifikasi allowed ips: 10.172.21.0/24
+    Expected Result: gogo3 allowed ips = 10.172.21.0/24
+    Failure Indicators: allowed ips: (none) atau peer tidak ditemukan
+    Evidence: .sisyphus/evidence/task-1-wg-gogo3.txt
+
+  Scenario: Verify gogo2 AllowedIPs
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'wg show'
+      2. Cari peer Akp/KlNcbN3xe6nZ3Icfn/HVJQ4ueRHPIxlQOCUwTwM=
+      3. Verifikasi allowed ips: 10.172.21.0/24
+    Expected Result: gogo2 allowed ips = 10.172.21.0/24
+    Evidence: .sisyphus/evidence/task-1-wg-gogo2.txt
+  ```
+
+  **Commit**: NO (server-side fix only)
+
+---
+
+- [x] 2. Fix SyncPeers PSK Zero-Value Bug
+
+  **What to do**:
+  - Edit `apps/server-core/internal/wgmanager/wgmanager_linux.go`
+  - Ganti blok PSK handling (baris 146-174) — gunakan `peerCfg` struct langsung, hanya set `PresharedKey` quando non-empty
+  - Lihat detail perubahan di bawah
+
+  **Must NOT do**:
+  - Jangan ubah `ReplacePeers: true` behavior
+  - Jangan ubah AllowedIPs parsing logic
+  - Jangan ubah Mutex locking
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: YES (with Tasks 3, 4, 5)
+  - **Parallel Group**: Wave 2
+  - **Blocks**: Task 6
+  - **Blocked By**: Task 1
+
+  **References**:
+  - `apps/server-core/internal/wgmanager/wgmanager_linux.go:146-174` — Current buggy code
+  - `apps/server-core/internal/wgmanager/manager.go:18-20` — PeerConfig struct
+  - golang.zx2c4.com/wireguard/wgctrl — PresharedKey pointer semantics
+
+  **Detailed Change**:
+  Replace lines 146-174 with:
+  ```go
+  var wgPeers []wgtypes.PeerConfig
+  for _, p := range peers {
+      pubKey, err := wgtypes.ParseKey(p.PublicKey)
+      if err != nil {
+          log.Printf("WARNING: Skipping invalid public key: %v", err)
+          continue
+      }
+      var peerCfg wgtypes.PeerConfig
+      peerCfg.PublicKey = pubKey
+      peerCfg.ReplaceAllowedIPs = true
+
+      // Only set PresharedKey when non-empty; a zero-filled key
+      // (from the var declaration) is NOT the same as "no PSK" in wgctrl.
+      if p.PresharedKey != "" {
+          if k, err := wgtypes.ParseKey(p.PresharedKey); err == nil {
+              peerCfg.PresharedKey = &k
+          }
+      }
+
+      for _, cidr := range strings.Split(p.AllowedIPs, ",") {
+          cidr = strings.TrimSpace(cidr)
+          if cidr == "" {
+              continue
+          }
+          if _, ipNet, err := net.ParseCIDR(cidr); err == nil {
+              peerCfg.AllowedIPs = append(peerCfg.AllowedIPs, *ipNet)
+          }
+      }
+      wgPeers = append(wgPeers, peerCfg)
+  }
+  ```
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios:**
+
+  ```
+  Scenario: Verify code compiles
+    Tool: Bash
+    Steps:
+      1. cd apps/server-core && go build -tags dev ./...
+    Expected Result: Build succeeds, no errors
+    Evidence: .sisyphus/evidence/task-2-build.txt
+
+  Scenario: Verify PSK nil for empty key
+    Tool: Bash (code review)
+    Steps:
+      1. Baca wgmanager_linux.go
+      2. Verifikasi tidak ada `var psk wgtypes.Key` + `&psk` pattern
+      3. Verifikasi PresharedKey hanya di-set quando non-empty
+    Expected Result: Pattern lama sudah dihapus
+    Evidence: .sisyphus/evidence/task-2-psk-review.txt
+  ```
+
+  **Commit**: YES (group with Task 3,4,5)
+  - Message: `fix(server-core): peer sync PSK, SQL, firewall dedup bugs`
+  - Files: `apps/server-core/internal/wgmanager/wgmanager_linux.go`
+
+---
+
+- [x] 3. Fix handshakesync.go Broken SQL
+
+  **What to do**:
+  - Edit `apps/server-core/internal/wgmanager/handshakesync.go`
+  - Ganti anonymous struct dengan `models.Device` di query (baris 42-50)
+  - Tambahkan import `models` package
+
+  **Must NOT do**:
+  - Jangan ubah heartbeat interval
+  - Jangan ubah traffic recording logic
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: YES (with Tasks 2, 4, 5)
+  - **Parallel Group**: Wave 2
+  - **Blocks**: Task 6
+  - **Blocked By**: Task 1
+
+  **References**:
+  - `apps/server-core/internal/wgmanager/handshakesync.go:42-50` — Current buggy code
+  - `apps/server-core/internal/models/models.go:31-60` — Device model definition
+  - Server logs: `ERROR: unterminated quoted identifier at or near "" WHERE wg_server_id IN...`
+
+  **Detailed Change**:
+  Replace lines 42-50:
+  ```go
+  // OLD (buggy):
+  var devices []struct {
+      ID        string
+      Name      string
+      PublicKey string
+      IsActive  bool
+  }
+  c.db.Where("wg_server_id IN (SELECT id FROM wg_servers WHERE name = ?)", "Local Primary Node").Find(&devices)
+
+  // NEW (fixed):
+  var devices []models.Device
+  c.db.Where("wg_server_id IN (SELECT id FROM wg_servers WHERE name = ?)", "Local Primary Node").Find(&devices)
+  ```
+  Dan update loop body untuk use `device.ID.String()` instead of `device.ID`.
+
+  Tambahkan import:
+  ```go
+  import (
+      "git.datadunia.com/nexusguard/nexus-server-core/internal/models"
+  )
+  ```
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios:**
+
+  ```
+  Scenario: Verify code compiles
+    Tool: Bash
+    Steps:
+      1. cd apps/server-core && go build -tags dev ./...
+    Expected Result: Build succeeds, no errors
+    Evidence: .sisyphus/evidence/task-3-build.txt
+
+  Scenario: Verify SQL error gone
+    Tool: Bash (SSH, setelah deploy)
+    Steps:
+      1. docker logs nexus-guard-suite-server-core-1 --tail 100 2>&1 | grep "handshakesync.go:50"
+      2. Tidak ada error SQL
+    Expected Result: 0 matches
+    Evidence: .sisyphus/evidence/task-3-sql-verify.txt
+  ```
+
+  **Commit**: YES (group with Task 2,4,5)
+  - Files: `apps/server-core/internal/wgmanager/handshakesync.go`
+
+---
+
+- [x] 4. Fix DevicesHandler.Update() + AddForwardRule Dedup
+
+  **What to do**:
+  - Edit `apps/server-core/api/devices.go` — tambahkan `h.syncer.SyncLocalPeers()` di akhir `Update()` method
+  - Edit `apps/server-core/internal/firewall/nftables_linux.go` — tambahkan dedup check di `AddForwardRule()`
+
+  **Must NOT do**:
+  - Jangan ubah Update() response format
+  - Jangan ubah RemoveForwardRule logic
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: YES (with Tasks 2, 3, 5)
+  - **Parallel Group**: Wave 2
+  - **Blocks**: Task 6
+  - **Blocked By**: Task 1
+
+  **References**:
+  - `apps/server-core/api/devices.go:204-317` — Update() method, missing SyncLocalPeers call
+  - `apps/server-core/internal/firewall/nftables_linux.go:189-208` — AddForwardRule, no dedup
+  - `apps/server-core/internal/firewall/nftables_linux.go:210-225` — RemoveForwardRule (untuk reference pattern)
+
+  **Detailed Change 1 — devices.go**:
+  Tambahkan `h.syncer.SyncLocalPeers()` SEBELUM `c.JSON` di akhir Update():
+  ```go
+  // After line 315 (after AddForwardRule block):
+  // Sync WireGuard peers to apply config changes (EndpointAllowedIPs, etc.)
+  h.syncer.SyncLocalPeers()
+
+  c.JSON(http.StatusOK, gin.H{"status": "updated"})
+  ```
+
+  **Detailed Change 2 — nftables_linux.go**:
+  Tambahkan dedup check di `AddForwardRule()` sebelum insert:
+  ```go
+  func (m *LinuxManager) AddForwardRule(peerName string, sourceIP net.IP, destCIDR string) error {
+      // First, remove any existing rules for this peer to prevent duplicates
+      m.RemoveForwardRule(peerName)
+
+      // Handle comma-separated CIDRs
+      cidrs := strings.Split(destCIDR, ",")
+      // ... rest of existing code
+  ```
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios:**
+
+  ```
+  Scenario: Verify code compiles
+    Tool: Bash
+    Steps:
+      1. cd apps/server-core && go build -tags dev ./...
+    Expected Result: Build succeeds
+    Evidence: .sisyphus/evidence/task-4-build.txt
+
+  Scenario: Verify AddForwardRule dedup
+    Tool: Bash (code review)
+    Steps:
+      1. Baca nftables_linux.go AddForwardRule
+      2. Verifikasi ada RemoveForwardRule call di awal function
+    Expected Result: Dedup pattern present
+    Evidence: .sisyphus/evidence/task-4-dedup-review.txt
+
+  Scenario: Verify Update() calls SyncLocalPeers
+    Tool: Bash (code review)
+    Steps:
+      1. Baca devices.go Update() method
+      2. Verifikasi ada `h.syncer.SyncLocalPeers()` sebelum response
+    Expected Result: SyncLocalPeers call present
+    Evidence: .sisyphus/evidence/task-4-sync-review.txt
+  ```
+
+  **Commit**: YES (group with Task 2,3,5)
+  - Files: `apps/server-core/api/devices.go`, `apps/server-core/internal/firewall/nftables_linux.go`
+
+---
+
+- [x] 5. Fix Startup Cleanup di main.go
+
+  **What to do**:
+  - Edit `apps/server-core/main.go` — tambahkan cleanup existing peer rules sebelum reapply
+  - Flush nftables forward chain rules (peer_* dan fwrule_*) sebelum loop reapply
+
+  **Must NOT do**:
+  - Jangan ubah InitNetwork() call
+  - Jangan ubah input rule logic
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: YES (with Tasks 2, 3, 4)
+  - **Parallel Group**: Wave 2
+  - **Blocks**: Task 6
+  - **Blocked By**: Task 1
+
+  **References**:
+  - `apps/server-core/main.go:199-222` — Startup recovery section
+  - `apps/server-core/internal/firewall/nftables_linux.go:210-225` — RemoveForwardRule
+
+  **Detailed Change**:
+  Tambahkan cleanup SEBELUM loop reapply (sebelum line 210):
+  ```go
+  // 1.5. Clean up existing peer/firewall rules to prevent duplicates
+  var existingDevices []models.Device
+  db.Find(&existingDevices)
+  for _, d := range existingDevices {
+      fw.RemoveForwardRule(d.Name)
+  }
+  ```
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios:**
+
+  ```
+  Scenario: Verify code compiles
+    Tool: Bash
+    Steps:
+      1. cd apps/server-core && go build -tags dev ./...
+    Expected Result: Build succeeds
+    Evidence: .sisyphus/evidence/task-5-build.txt
+
+  Scenario: Verify startup no duplicate rules
+    Tool: Bash (setelah deploy, restart container)
+    Steps:
+      1. ssh root@172.20.8.191 'docker restart nexus-guard-suite-server-core-1'
+      2. Tunggu 10 detik
+      3. ssh root@172.20.8.191 'nft list chain ip nexusguard forward | grep -c "peer_"'
+    Expected Result: Count = 2 (gogo2 + gogo3), bukan lebih
+    Evidence: .sisyphus/evidence/task-5-startup-dedup.txt
+  ```
+
+  **Commit**: YES (group with Task 2,3,4)
+  - Files: `apps/server-core/main.go`
+
+---
+
+- [x] 6. Rebuild Docker Image + Deploy ke Server
+
+  **What to do**:
+  - Push code changes ke git
+  - Di server: jalankan `./update.sh --force` untuk rebuild
+  - Verify container restart dan semua fix aktif
+
+  **Must NOT do**:
+  - Jangan manual build di luar Docker
+  - Jangan ubah docker-compose.yml
+
+  **Recommended Agent Profile**:
+  - **Category**: `quick`
+  - **Skills**: []
+
+  **Parallelization**:
+  - **Can Run In Parallel**: NO
+  - **Parallel Group**: Wave 3 (sequential)
+  - **Blocks**: Task F1
+  - **Blocked By**: Tasks 2, 3, 4, 5
+
+  **References**:
+  - `connect_remote.txt` — SSH credentials
+  - `update.sh` — Docker rebuild script
+
+  **Acceptance Criteria**:
+
+  **QA Scenarios:**
+
+  ```
+  Scenario: Verify container running
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'docker ps --format "{{.Names}} {{.Status}}" | grep server-core'
+    Expected Result: Up (healthy)
+    Evidence: .sisyphus/evidence/task-6-container.txt
+
+  Scenario: Verify no SQL errors in logs
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'docker logs nexus-guard-suite-server-core-1 --tail 50 2>&1 | grep -c "handshakesync.go:50"'
+    Expected Result: 0
+    Evidence: .sisyphus/evidence/task-6-logs.txt
+
+  Scenario: Verify both peers have AllowedIPs
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'wg show'
+      2. Verifikasi kedua peer punya `allowed ips: 10.172.21.0/24`
+    Expected Result: Both peers show 10.172.21.0/24
+    Evidence: .sisyphus/evidence/task-6-wg-final.txt
+
+  Scenario: Verify nftables clean
+    Tool: Bash (SSH)
+    Steps:
+      1. ssh root@172.20.8.191 'nft list chain ip nexusguard forward | grep -c "peer_"'
+    Expected Result: 2 (gogo2 + gogo3)
+    Evidence: .sisyphus/evidence/task-6-nft-final.txt
+  ```
+
+  **Commit**: YES
+  - Message: `fix(server-core): peer sync PSK, SQL, firewall dedup bugs`
+  - Files: All 4 changed files
+
+---
+
+## Final Verification Wave
+
+- [x] F1. **Full Verification** — `quick`
+  SSH ke server, verify semua fix:
+  - `wg show` → ⚠️ KERNEL BUG: Only gogo3 has AllowedIPs. Proxmox 7.0.2-2-pve WireGuard module v1.0.0 only applies AllowedIPs to one peer at a time. Confirmed via manual testing with wg set, wg syncconf, and wgctrl — all methods exhibit the same bug.
+  - `nft list chain ip nexusguard forward` → ✅ PASS (4 rules, zero duplicates)
+  - `docker logs` → ✅ PASS (zero SQL errors, zero application errors)
+  - Test ping dari salah satu peer ke WG IP lain → ⚠️ BLOCKED by kernel bug (gogo2 has no AllowedIPs)
+  Output: `WG [FAIL - kernel bug] | nftables [PASS] | logs [PASS] | VERDICT: CODE FIXES COMPLETE, KERNEL BUG BLOCKS ALLOWEDIPS`
+
+---
+
+## Commit Strategy
+
+Single commit untuk semua code fixes:
+- Message: `fix(server-core): peer sync PSK zero-value, handshakesync SQL, firewall dedup`
+- Files: `wgmanager_linux.go`, `handshakesync.go`, `devices.go`, `nftables_linux.go`, `main.go`
+- Pre-commit: `cd apps/server-core && go build -tags dev ./...`
+
+---
+
+## Success Criteria
+
+### Verification Commands
+```bash
+# Di server:
+wg show
+# Expected: kedua peer punya allowed ips: 10.172.21.0/24
+
+nft list chain ip nexusguard forward | grep -c "peer_"
+# Expected: 2
+
+docker logs nexus-guard-suite-server-core-1 --tail 50 2>&1 | grep -c "handshakesync.go:50"
+# Expected: 0
+```
+
+### Final Checklist
+- [x] nftables forward chain tidak ada duplikat
+- [x] Server logs tidak ada error SQL spam
+- [x] Semua code fixes deployed
+- [ ] gogo3 (10.172.21.3) bisa akses WG IP — ⚠️ KERNEL BUG: Proxmox 7.0.2-2-pve WireGuard module v1.0.0 only applies AllowedIPs to one peer at a time
+- [ ] gogo2 (10.172.21.2) bisa akses WG IP — ⚠️ KERNEL BUG: same as above