chore: remove stale device-agent-embedded submodule from index

docker-compose.yml

@@ -15,6 +15,11 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
 
@@ -31,6 +36,11 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
 
@@ -53,6 +63,11 @@ services:
       - NET_ADMIN
       - NET_RAW
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
 
   dashboard-ui:
     build:
@@ -67,6 +82,11 @@ services:
     depends_on:
       - server-core
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
     extra_hosts:

docs/portfolio/README.md

@@ -29,6 +29,19 @@ NexusGuard is a production-grade, zero-trust SD-WAN solution built with Go, Vue
                          └─────────────────┘         └─────────┘
 ```
 
+## Submodule Knowledge Bases
+
+Each submodule has its own `AGENTS.md` with detailed architecture, conventions, and anti-patterns:
+
+| Submodule | AGENTS.md | Scope |
+|-----------|-----------|-------|
+| [Server Core](apps/server-core/) | [AGENTS.md](apps/server-core/AGENTS.md) | API handlers, database models, firewall rules, gRPC signaling, WireGuard management |
+| [Dashboard UI](apps/dashboard-ui/) | [AGENTS.md](apps/dashboard-ui/AGENTS.md) | Vue 3 components, Pinia stores, TailwindCSS styling, API client |
+| [Device Agent](apps/device-agent/) | [AGENTS.md](apps/device-agent/AGENTS.md) | Go daemon, system tray, memory-injected WireGuard, heartbeat, gRPC signaling |
+| [Android Agent](apps/android-agent/) | [AGENTS.md](apps/android-agent/AGENTS.md) | Kotlin VPNService, GoBackend tunnel, HTTP heartbeat, port forwarding |
+
+**Rule**: When working on a submodule, always read its `AGENTS.md` first.
+
 ## Documentation
 
 | Document | Description |

docs/portfolio/architecture.md

@@ -107,13 +107,17 @@ Stealth VPN daemon. Cross-platform Go binary.
 ```
 Every 30 seconds:
 1. Agent reads last_handshake_time from WireGuard IPC
-2. Agent computes config_hash = endpoint + internalIP + serverPub
-3. Agent POSTs {config_hash, last_handshake, tunnel_up} to server
-4. Server compares with stored config
-5. If config changed → server responds with new config
-6. Agent detects change → rebuilds tunnel
+2. Agent POSTs {device_id, tunnel_up, last_handshake} to server
+3. Server loads Device + WgServer fresh from DB (dynamic, not cached)
+4. Server computes config_hash = SHA256(tunnelFields) + ":" + SHA256(forwards)
+   - Tunnel fields: server_pub, endpoint, internal_ip, private_key, preshared_key, allowed_ips, dns
+   - Forwards: sorted protocol:publicPort->targetIP:targetPort:ID
+5. Server responds with full config + config_hash
+6. Agent compares config_hash with previous → if different → rebuild tunnel/reload forwards
 ```
 
+> **Design**: Peers (devices) store only their own data (keys, IP, settings). Node data (endpoint, public key) is loaded fresh from DB on every heartbeat. This ensures config always reflects the latest node state without requiring agent restart.
+
 ### Suspend/Resume Flow
 
 ```

docs/portfolio/features.md

@@ -220,6 +220,15 @@ Device health polled every 10 seconds:
 └─────────────────────────────────────────┘
 ```
 
+### Server-Side Config Sync
+
+Config changes (firewall rules, AllowedIPs, DNS, endpoint) are detected via SHA256 hash comparison:
+
+- Server computes `config_hash = SHA256(tunnelFields) + ":" + SHA256(forwards)`
+- Agent compares with previous hash → if different → tunnel rebuilds automatically
+- Works over both HTTP heartbeat (30s) and gRPC (immediate)
+- Agent never caches config — server loads fresh from DB each heartbeat
+
 ### QR Code Setup
 
 Generate QR codes for mobile WireGuard clients: