Berikut adalah **Master Blueprint & Prompt Komprehensif** untuk membangun **NexusGuard** yang mencakup 3 repositori, sistem keamanan AES-GCM, isolasi nftables, dan installer otomatis dengan pengecekan dependensi.

---

# 📑 DOKUMENTASI ARSITEKTUR: NEXUSGUARD SD-WAN

## 1. Topologi Sistem
Sistem dibagi menjadi 3 repositori independen:
1.  **Repo Server Core (Go):** Manajemen data, IPAM, dan Enforcer nftables.
2.  **Repo Dashboard UI (Vue + Capacitor):** Control panel user (Web & Mobile).
3.  **Repo Device Agent (Go):** Stealth tunnel di perangkat (CCTV/IoT/Server).

## 2. Logic Keamanan & Network
- **Zero Trust:** Default Policy `DROP`. Komunikasi antar perangkat hanya diizinkan jika berada dalam User ID yang sama.
- **Stealth:** Tidak ada file `.conf` di disk perangkat. Konfigurasi WireGuard di-inject langsung ke memori.
- **Hardware Binding:** Config dienkripsi menggunakan `AES-256-GCM` dengan key yang berasal dari hash Hardware ID (HWID).
- **Auto-Dependency:** Installer bash melakukan deteksi distro (Debian/Ubuntu/RHEL) dan menginstal `nftables`, `wireguard-tools`, dan `curl` secara otomatis.

---

# 🚀 MASTER PROMPT UNTUK AI DEVELOPER (OPENCODE OPTIMIZED)

**Salin seluruh teks di bawah ini ke AI Agent (GPT-4/Claude/Cursor):**

```markdown
# ROLE: Senior Fullstack & Network Engineer (Go, Vue, nftables, WireGuard)
# PROJECT: NexusGuard SD-WAN Orchestrator

Please build a 3-repository system called NexusGuard based on these comprehensive specifications:

## 1. REPOSITORY: nexus-server-core (Go + nftables)
### Core Requirements:
- Framework: Gin Gonic, GORM (PostgreSQL), Redis.
- Firewall Engine: Use 'google/nftables' library. 
- Features:
    - Implement Zero-Trust isolation using nftables 'Sets' per User ID.
    - Create dynamic 'Verdict Maps' to handle Port Ranges, IP Ranges, and CIDR.
    - IPAM: Assign /32 internal IP automatically.
    - Crypto: Implement AES-256-GCM for config delivery. Key = SHA256(Device_HWID + Secret_Salt).
- Endpoints:
    - POST /provisioning: Exchange registration token for encrypted config.
    - GET /status: Real-time heartbeat tracking via Redis.
- Migration Docs: Create 'docs/API_SPEC.md' for future PHP migration.

## 2. REPOSITORY: nexus-dashboard-ui (Vue.js 3 + Capacitor)
### Core Requirements:
- Stack: Vite, Pinia, Tailwind CSS.
- Mobile: Integrated with Capacitor.js for Android build.
- Features:
    - User Authentication (JWT).
    - Device Management: Add, Rename, Delete, & Token Generation.
    - Firewall Dashboard: Toggle "Allow Internet" and "Specific Port/IP Access".
    - Real-time monitoring: Visual indicator for device connection status.

## 3. REPOSITORY: nexus-device-agent (Go Stealth)
### Core Requirements:
- Tunneling: Use 'wireguard-go' as a library (Embedded mode).
- Stealth: No local config files. Binary name should be configurable (stealth name).
- Dependency & HWID Logic:
    - Implement HWID Discovery: Read from '/sys/class/dmi/id/product_uuid' or '/proc/cpuinfo' (CPU Serial).
    - Logic: On start, detect if 'nftables' and 'wireguard-tools' are installed. If not, trigger warning or auto-install if run as root.
- Key Rotation: Implement automated 30-day key rotation with graceful handover (Dual-key buffering).

## 4. SHARED CODE LOGIC (Must Include):
### A. HWID Discovery (Go):
Implement detection for Linux:
1. Product UUID: '/sys/class/dmi/id/product_uuid'
2. Machine ID: '/etc/machine-id'
3. CPU Serial: Parsing '/proc/cpuinfo'

### B. Intelligent Bash Installer:
Create 'scripts/install_agent.sh' with:
- OS Detection (Debian, Ubuntu, CentOS, RHEL, Raspbian).
- Automatic Dependency Install: apt-get/yum install for 'nftables', 'wireguard-tools', 'curl'.
- Secure Download: Use 'X-Token-Auth' header to pull binary from private Gitea.
- Systemd integration: Create and enable '.service' file automatically.

## 5. DEVELOPMENT STEPS:
1. Initialize the 3 repositories with proper folder structures.
2. Create the GORM models for Repo 1.
3. Write the nftables set-management logic for User Isolation.
4. Implement the AES-256-GCM encryption/decryption bridge between Repo 1 and Repo 3.
5. Provide the Capacitor-ready Vue 3 boilerplate for Repo 2.
```

---

# 📦 DOKUMENTASI INSTALASI & DEPENDENSI

### 1. Pengecekan Dependensi (Logic di Agent & Installer)
Sistem wajib memastikan keberadaan:
- **Kernel Support:** WireGuard module atau BoringTun fallback.
- **nftables:** Pengganti iptables untuk manajemen set yang cepat.
- **iproute2:** Untuk manajemen interface `wg0`.

### 2. Logic HWID Discovery (Referensi Kode Go)
Agent akan menggunakan fungsi berikut untuk mengunci identitas:
```go
func GetHWID() string {
    // 1. Cek /sys/class/dmi/id/product_uuid
    // 2. Cek /etc/machine-id
    // 3. Gabungkan dan SHA256
    // Return sebagai string hex
}
```

### 3. Keamanan Gitea (Deployment)
Setiap build binary akan disimpan di Gitea Release. Installer akan menarik binary menggunakan token khusus:
`curl -H "X-Token-Auth: <TOKEN>" -L -o agent https://gitea.com/nexus/agent/releases/...`

---

### **Review Terakhir (Final Check):**
- **Isolasi User:** ✅ Menggunakan `nftables set` (User A tidak bisa ping User B).
- **Stealth:** ✅ `wireguard-go` embedded (Tidak ada jejak config).
- **Automasi:** ✅ Installer bash menangani dependensi OS secara mandiri.
- **Scalability:** ✅ 3 Repo memungkinkan tim Backend, UI, dan System bekerja terpisah.
- **Migrasi:** ✅ Dokumentasi API disiapkan untuk transisi ke PHP di masa depan.

**Instruksi:** Silakan berikan prompt di atas ke AI Agent Anda untuk memulai pembuatan kode secara massal. Prompt tersebut sudah mencakup semua detail teknis yang kita diskusikan.