# Features

NexusGuard provides enterprise-grade SD-WAN capabilities with a focus on security, automation, and ease of use.

## Zero-Trust Security

### No Public Registration

The `/auth/register` endpoint is locked. Admin accounts can only be created via CLI:

```bash
# Docker
docker exec -it nexus-guard-suite-server-core-1 ./server-core \
  -create-admin -user admin -pass "SecurePassword123!"

# Native
sudo /usr/local/bin/nexusguard-server \
  -create-admin -user admin -pass "SecurePassword123!"
```

**Why?** Eliminates the attack surface of open registration. No bots, no brute force, no unauthorized accounts.

### Encrypted Provisioning

Agent provisioning uses AES-256-GCM encryption:

1. Agent sends registration token + hardware ID (HWID)
2. Server generates WireGuard config
3. Config encrypted with AES-256-GCM before transmission
4. Agent decrypts in memory, never touches disk

**Why?** WireGuard keys are sensitive. Encryption in transit prevents interception even on compromised networks.

### Memory-Injected Tunnels

WireGuard configuration is injected directly into the kernel via `IpcSet`:

```
Traditional:  Config file → /etc/wireguard/wg0.conf → wg-quick up wg0
NexusGuard:   Config bytes → IpcSet() → Tunnel active (no files)
```

**Benefits:**
- No config files to steal
- No lingering configs after disconnect
- Multiple agents can run without conflicts
- Clean uninstall = kill process

### Hardware ID Binding

Each agent is bound to its hardware via HWID:

- **Linux:** `/sys/class/dmi/id/product_uuid` or CPU serial
- **Windows:** DMI product UUID
- **macOS:** IOPlatformSerialNumber

HWID is included in provisioning request. Server validates before issuing config.

## Multi-Node Support

### Geographic Scaling

Deploy WireGuard servers across multiple regions:

```
Node 1 (Singapore):  10.172.21.0/24
Node 2 (Frankfurt):  10.172.22.0/24
Node 3 (Virginia):   10.172.23.0/24
```

Each node has its own:
- IP pool (CIDR)
- Interface address
- Peer defaults (DNS, MTU, Keepalive)
- Endpoint (IP/Domain + Port)

### Centralized IPAM

IP Address Management is centralized in the database:

1. Admin defines IP pool per node (e.g., `10.172.21.0/24`)
2. When device is created, server allocates next available IP
3. IP is reserved in database (no duplicates)
4. IP is released when device is deleted

**Why?** Prevents IP conflicts across nodes. Enables static IP assignment for critical devices.

### Per-Node Defaults

Each node can have different peer defaults:

| Setting | Node 1 (SG) | Node 2 (DE) |
|---------|-------------|-------------|
| DNS | `1.1.1.1` | `8.8.8.8` |
| MTU | 1420 | 1280 |
| Keepalive | 25s | 0s |
| AllowedIPs | `10.172.21.0/24` | `0.0.0.0/0` |

Devices inherit from their node, with per-device overrides available.

## Real-Time Firewall

### nftables Integration

NexusGuard manages Linux nftables directly:

```bash
# What NexusGuard creates in the kernel
table ip nexusguard {
    set peers_v4 {
        type ipv4_addr
        elements = { 10.172.21.2, 10.172.21.3, ... }
    }
    chain forward {
        type filter hook forward priority 0; policy accept;
        ip daddr @peers_v4 accept
        ip saddr @peers_v4 accept
        drop
    }
}
```

### Per-Peer Rules

Each device can have custom firewall rules:

- **Allow/Block IP ranges** — `192.168.1.0/24`, `10.0.0.1`
- **Port filtering** — TCP/UDP port ranges
- **Direction control** — Inbound, outbound, or both

Changes are synced to kernel instantly — no restart required.

### Default SSH Provisioning

New peers automatically get SSH access (port 22):

```go
// Automatically added on peer creation
AddFirewallRule(peerIP, "0.0.0.0/0", 22, "tcp", "allow")
```

**Why?** Ensures remote access isn't accidentally locked out.

## Cross-Platform Agent

### Linux — Systemd Daemon

```bash
# Automated install
sudo ./install_agent.sh \
  --server-url "https://api.yourdomain.com" \
  --token "REG_TOKEN"

# Verify
sudo systemctl status sys-bridge.service
```

Features:
- Runs as root (required for WireGuard)
- Auto-restart on failure
- Journal logging
- Config at `~/.config/nexusguard/nexusguard.conf`

### Windows — System Tray + Service

System tray application with service management:

| Menu Item | Action |
|-----------|--------|
| Status | Shows Connected/Disconnected |
| IP | Shows internal VPN IP |
| Connect | Start tunnel |
| Disconnect | Stop tunnel |
| Install as Service | Register Windows service |
| Start on Boot | Toggle auto-start |

### macOS — System Tray

System tray application (no service support):

- Config at `~/Library/Application Support/NexusGuard/nexusguard.conf`
- Logs at `~/Library/Logs/NexusGuard/`

### Self-Healing

All platforms implement exponential backoff:

```
Failure 1: Wait 30s, retry
Failure 2: Wait 60s, retry
Failure 3: Wait 120s, retry
...
Failure N: Wait 300s (max), retry
```

Network drops are handled gracefully — tunnel stays alive, agent reconnects in background.

## Dashboard

### Glassmorphism Design

Futuristic UI with glass-like transparency:

- Backdrop blur effects
- Semi-transparent panels
- Gradient accents
- Smooth animations

### Live Telemetry

Device health polled every 10 seconds:

```
┌─────────────────────────────────────────┐
│ Device: server-01                       │
│ Status: ● Online                        │
│ IP: 10.172.21.2                         │
│ Last Handshake: 15s ago                 │
│ Uptime: 3d 14h 22m                      │
└─────────────────────────────────────────┘
```

### Server-Side Config Sync

Config changes (firewall rules, AllowedIPs, DNS, endpoint) are detected via SHA256 hash comparison:

- Server computes `config_hash = SHA256(tunnelFields) + ":" + SHA256(forwards)`
- Agent compares with previous hash → if different → tunnel rebuilds automatically
- Works over both HTTP heartbeat (30s) and gRPC (immediate)
- Agent never caches config — server loads fresh from DB each heartbeat

### QR Code Setup

Generate QR codes for mobile WireGuard clients:

1. Create device in Dashboard
2. Click "Show QR Code"
3. Scan with WireGuard app on iOS/Android
4. Tunnel ready — no manual config

### Share Links

Time-limited config sharing:

1. Click "Generate Share Link"
2. Set expiration (1h, 24h, 7d)
3. Share URL with recipient
4. Recipient downloads `.conf` file
5. Link expires automatically

## Deployment Flexibility

### Docker (Recommended)

```bash
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
bash update.sh
```

One command to start everything. Auto-migration on first boot.

### Native Install

For servers without Docker:

```bash
sudo bash nexusguard-install.sh
```

Creates systemd service, nginx config, PostgreSQL database.

### Development Mode

Hot-reload for both backend and frontend:

```bash
# Terminal 1: Backend
cd apps/server-core
go run -tags dev .

# Terminal 2: Frontend
cd apps/dashboard-ui
npm run dev
```

Auto-migration on startup. No Docker required.

## Comparison

| Feature | NexusGuard | Traditional VPN | Commercial SD-WAN |
|---------|------------|-----------------|-------------------|
| Zero-trust | ✅ | ❌ | ✅ |
| Fileless tunnel | ✅ | ❌ | ❌ |
| Multi-platform agent | ✅ | Partial | ✅ |
| Real-time firewall | ✅ | ❌ | ✅ |
| Self-hosted | ✅ | ✅ | ❌ |
| Open source | ✅ | ✅ | ❌ |
| Cost | Free | Free | $$$$ |