# NexusGuard SD-WAN Suite

NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.

## 🏗️ System Architecture
This suite contains three main components:
1. **[Server Core](http://git.datadunia.com/nexusguard/nexus-server-core)**: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
2. **[Dashboard UI](http://git.datadunia.com/nexusguard/nexus-dashboard-ui)**: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules.
3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.

---

## 🚀 Deployment & Installation

### 1. Initial Setup
To deploy the entire backend infrastructure (PostgreSQL, Redis, and Server-Core), simply clone this repository and run the setup script:

```bash
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
chmod +x setup.sh
./setup.sh
```

The `setup.sh` script will automatically:
- Create a master `.env` file (if it doesn't exist).
- Boot up all required infrastructure via `docker-compose`.

### 2. Domain & Port Configuration
If you are deploying this to production, you must edit the `.env` file generated in the root directory:
- **Change API Port**: Modify `API_PORT=8080`.
- **Change Web/API Domain**: Modify `VITE_API_BASE_URL` to point to your public API domain (e.g., `https://api.yourdomain.com/api/v1`).
- **Database & Crypto**: Ensure you change the default database passwords and generate secure 256-bit Hex keys for `JWT_SECRET` and `SERVER_SALT`.

### 3. Creating / Changing the Admin Account
The system operates on a strict **Zero-Attack Surface** policy. The `/auth/register` API is locked down. To create the first Admin user (or reset their password), you must execute a command directly inside the running Docker container:

```bash
docker exec -it nexus-guard-suite-server-core-1 ./server-core -create-admin -user "admin" -pass "YourNewSecurePassword123!"
```
*(You can use this exact same command later if you ever forget the admin password to forcefully reset it).*

---

## 📖 Operational Workflow

Once the server is running and the Admin account is created, follow this flow:

1. **Log in to the Dashboard UI** using the `admin` credentials.
2. **Register a WireGuard Node**: Go to the **Nodes** menu. Add your public WireGuard server endpoint (e.g., `vpn.yourdomain.com:51820`) and its Public Key.
3. **Add a Device**: Go to the **Devices** menu. Click **+ New Device**, select the target Node, and name the device.
4. **Copy the Token**: The system will display a single-use **Registration Token**.
5. **Install the Agent on Client**: On the target Linux machine, run the agent installer:
   ```bash
   sudo ./install_agent.sh --server-url "https://api.yourdomain.com" --token "<REG_TOKEN>"
   ```
6. The client will automatically connect, provision its WireGuard keys securely via AES-256-GCM, and appear as **Online** on your Dashboard.