# NexusGuard SD-WAN Suite

NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard.

## System Architecture
This suite contains three main components:
1. **[Server Core (Master/Hub)](apps/server-core/README.md)**: The central API and VPN Hub managing IPAM, routing, and `nftables` isolation.
2. **[Dashboard UI](apps/dashboard-ui/README.md)**: The Admin web interface for managing users, devices, and firewall rules.
3. **[Device Agent](apps/device-agent/README.md)**: A stealth background service for client machines that establishes secure WireGuard tunnels.

---

## Complete Workflow Guide

### 1. Initial Setup & Creating the Admin (Terminal)
For maximum security, the initial administrator account **cannot** be created via the web. It must be created directly on the server via the terminal.
Inside the `apps/server-core` directory (or inside your docker container), run:
```bash
go run . -create-admin -user "admin" -pass "YourSecurePassword123"
```
*(This command creates the superuser `admin` in the database).*

### 2. Creating Regular Users (Web Dashboard)
1. Open the **Dashboard UI** in your web browser.
2. Log in using the `admin` credentials created in Step 1.
3. Once logged in as `admin`, you have the authorization to create regular User accounts for your team members.
*(Note: Public registration is disabled. Only the `admin` can provision new users).*

### 3. Registering a Device
1. A User logs into the Dashboard UI using their assigned account.
2. They click **"+ New Device"** and enter a recognizable name (e.g., "Johns-Laptop").
3. The Dashboard will display a one-time **Registration Token**. 
4. The user copies this token and runs the agent installer on their machine:
   ```bash
   sudo ./install_agent.sh --server-url "http://<SERVER_IP>:8080" --token "<REGISTRATION_TOKEN>"
   ```
5. The device connects, binds its Hardware ID securely, provisions its WireGuard keys, and appears as **Online** in the Dashboard.