# NexusGuard SD-WAN Suite

> Enterprise Zero-Trust SD-WAN with WireGuard

NexusGuard is a production-grade, zero-trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via Linux `nftables` — all managed through a futuristic glassmorphism dashboard.

## Key Highlights

- **Zero-Attack Surface** — No public registration. Admin accounts created via CLI only.
- **Stealth Agent** — WireGuard config injected into memory. No files written to `/etc/wireguard/`.
- **Real-time Firewall** — Per-peer nftables rules synced to kernel instantly.
- **Cross-Platform** — Agent runs on Linux (daemon), Windows (tray + service), and macOS (tray).

## Tech Stack

`Go` · `Vue 3` · `WireGuard` · `PostgreSQL` · `Redis` · `nftables` · `gRPC` · `Docker`

## Architecture

```
┌──────────────┐         ┌─────────────────┐         ┌──────────────┐
│  Dashboard   │──HTTP──▶│  Server Core    │◀─WG────▶│ Device Agent │
│  (Vue 3)     │  :8080  │  (Go/Gin)       │  :51820 │  (Go)        │
└──────────────┘         │                 │         └──────────────┘
                         │  Port 8080:     │              │
                         │  - HTTP API     │         ┌────┴────┐
                         │  - gRPC Signal  │         │ TUN (wg)│
                         │  (cmux)         │         │ Memory  │
                         └─────────────────┘         └─────────┘
```

## Submodule Knowledge Bases

Each submodule has its own `AGENTS.md` with detailed architecture, conventions, and anti-patterns:

| Submodule | AGENTS.md | Scope |
|-----------|-----------|-------|
| [Server Core](apps/server-core/) | [AGENTS.md](apps/server-core/AGENTS.md) | API handlers, database models, firewall rules, gRPC signaling, WireGuard management |
| [Dashboard UI](apps/dashboard-ui/) | [AGENTS.md](apps/dashboard-ui/AGENTS.md) | Vue 3 components, Pinia stores, TailwindCSS styling, API client |
| [Device Agent](apps/device-agent/) | [AGENTS.md](apps/device-agent/AGENTS.md) | Go daemon, system tray, memory-injected WireGuard, heartbeat, gRPC signaling |
| [Android Agent](apps/android-agent/) | [AGENTS.md](apps/android-agent/AGENTS.md) | Kotlin VPNService, GoBackend tunnel, HTTP heartbeat, port forwarding |

**Rule**: When working on a submodule, always read its `AGENTS.md` first.

## Documentation

| Document | Description |
|----------|-------------|
| [Architecture](architecture.md) | System architecture, data flow, security model |
| [Tech Stack](tech-stack.md) | Technology breakdown per component |
| [Features](features.md) | Feature showcase and capabilities |
| [Deployment](deployment.md) | Deployment guide (Docker, native, development) |

## Quick Start

```bash
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
bash update.sh
```

## License

Private — DataDunia