Berikut adalah **Master Prompt & Blueprint Dokumentasi Teroptimasi** yang dirancang khusus untuk diberikan kepada AI Developer (seperti GPT-4, Claude 3.5 Sonnet, atau Cursor AI). 

Prompt ini telah dioptimalkan untuk **OpenCode**, artinya kode akan bersih, modular, terdokumentasi dengan standar industri, dan mudah dipindahkan (migrasi).

---

# 🚀 MASTER PROMPT: NexusGuard SD-WAN Orchestrator

**Role:** Senior Software Architect & DevOps Engineer.
**Task:** Build a 3-tier Software-Defined WAN (SD-WAN) system based on WireGuard with Zero-Trust Isolation.
**Architecture:** 3 Distributed Repositories.

---

## 1. GLOBAL ARCHITECTURE SPECIFICATION
NexusGuard is a private network orchestrator. It uses WireGuard for tunneling but abstracts it away for the user. It enforces security via `nftables` at the server level and hardware-binding at the agent level.

### Key Features (Must Implement):
- **Zero-Trust Isolation:** Every user has their own `nftables` set. Peers in different sets cannot communicate by default.
- **Stealth Agent:** No `/etc/wireguard` files. Configuration exists only in memory.
- **Dynamic Firewall:** Support for Port Ranges, IP Ranges, and CIDR via `nftables` Verdict Maps.
- **UDP Hole Punching:** STUN-based coordination for NAT-to-NAT P2P connection.
- **Hitless Key Rotation:** 30-day automated rotation with a 5-minute grace period.

---

## 2. REPOSITORY SPECIFICATIONS

### [REPO 1] nexus-server-core (The Control Plane)
- **Stack:** Go (Gin), PostgreSQL (GORM), Redis, `google/nftables` library.
- **Responsibilities:**
    - **API:** Provisioning, Device Management, Rule Management.
    - **IPAM:** Automatic /32 IP assignment for WireGuard peers.
    - **Hook Engine:** Listens for rule updates and applies them to `nftables` dynamically.
    - **Firewall Logic:** Use `nftables` sets for user isolation and `vmaps` for granular port access.
- **Migration Readiness:** Provide `docs/API_SPEC.md` using OpenAPI/Swagger format so the API can be migrated to PHP in the future.

### [REPO 2] nexus-dashboard-ui (The Client Management)
- **Stack:** Vue.js 3 (Vite), Pinia, Tailwind CSS, Capacitor.js.
- **Responsibilities:**
    - **Multi-Platform:** Web Dashboard and Android App (via Capacitor).
    - **Device Lifecycle:** Register new devices, generate registration tokens, monitor heartbeat status.
    - **Firewall UI:** Intuitive interface to manage "Allow Internet" and "Peer-to-Peer Access" rules.

### [REPO 3] nexus-device-agent (The Stealth Edge)
- **Stack:** Go, `wireguard-go` (embedded library).
- **Responsibilities:**
    - **Identity:** Generate HWID based on hardware metadata (CPU/Disk).
    - **Provisioning:** One-time use registration token to exchange for an encrypted WG Config.
    - **Memory-Only:** Use `device.NewDevice` to inject config. Never write keys to disk.
    - **Auto-Healing:** Detect handshake failure and trigger re-provisioning or STUN punching.

---

## 3. DATABASE SCHEMA (PostgreSQL)
Ensure the AI implements these relations:
- `users` (1:N) `devices`
- `devices` (1:N) `firewall_rules`
- `devices` (N:1) `wg_servers` (For multi-hop support)

---

## 4. AGENT.MD (Instructions for AI Sub-Agents)
*Save this part into each repository to guide the AI development.*

```markdown
# Agent Instructions: NexusGuard Module Development

## General Coding Standards
- **Clean Code:** Use SOLID principles. Interfaces for Network and Storage.
- **Error Handling:** Structured JSON logging. No `panic()`.
- **Security:** Use AES-256-GCM for any sensitive data transmission.
- **Concurrency:** Use Go Channels for STUN keep-alive and Handshake monitoring.

## Specific Task Focus
### If you are developing REPO_SERVER:
- Focus on the `nftables` manager. Ensure it doesn't flush the entire table, only update specific sets/elements to prevent network blips.
- Implement Redis-based heartbeat to track device 'Online' status.

### If you are developing REPO_AGENT:
- Focus on `wireguard-go` integration. Ensure the process name is obfuscated.
- Implement a 'Graceful Handover' logic for Key Rotation.

### If you are developing REPO_UI:
- Ensure the API client is modular. All calls must go through a central `services/api.ts` to allow easy base-URL changes.
```

---

## 5. OPTIMIZATION FOR OPENCODE & DEVOPS
- **CI/CD:** Provide a GitHub Action / Gitea Action template to build static binaries for `linux/amd64` and `linux/arm64`.
- **Private Pull:** Provide a Bash script using `X-Token-Auth` header to fetch the agent binary from a private Gitea instance.
- **Environment:** Use `.env` files for all secrets. Provide `.env.example` in all repos.

---

## 6. EXECUTION STEPS FOR AI
1. **Phase 1:** Generate the PostgreSQL GORM models and the basic Gin API structure for Repo 1.
2. **Phase 2:** Implement the `nftables` Set/Map management logic in Go.
3. **Phase 3:** Create the Vue 3 dashboard boilerplate with Capacitor integration for Repo 2.
4. **Phase 4:** Build the core WireGuard tunneling logic using the `wireguard-go` library for Repo 3.
5. **Phase 5:** Implement the STUN Signaling flow between Agent and Server.

---

**Prompt Final:** 
*"AI, please start by generating the **Entity Relationship Diagram (ERD)** in Mermaid format and the **PostgreSQL Migrations** for REPO_SERVER that support multi-user isolation and granular firewall rules as described above."*

---

### Review Akhir:
Sistem ini sekarang memiliki **pemisahan tanggung jawab (Separation of Concerns)** yang sempurna:
1.  **Repo Server** (Backend/DevOps) - Mengurus kernel dan data.
2.  **Repo UI** (Frontend/Mobile) - Mengurus interaksi user.
3.  **Repo Agent** (System/Embedded) - Mengurus konektivitas di alat.

Dengan dokumentasi **OpenCode** ini, divisi mana pun bisa masuk ke kodenya, membacanya, dan melakukan improvisasi tanpa merusak dependensi repositori lain.