Nexus-Guard-Suite/README.md

NexusGuard SD-WAN Suite

NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via nftables.

🏗️ System Architecture

This suite contains three main components:

1. Server Core: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
2. Dashboard UI: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules.
3. Device Agent: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.

---

🚀 Deployment & Installation

1. Initial Setup

To deploy the entire backend infrastructure (PostgreSQL, Redis, and Server-Core), simply clone this repository and run the setup script:

git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
chmod +x setup.sh
./setup.sh

The setup.sh script will automatically:

• Create a master .env file (if it doesn't exist).
• Boot up all required infrastructure via docker-compose.

2. Domain & Port Configuration

If you are deploying this to production, you must edit the .env file generated in the root directory:

• Change API Port: Modify API_PORT=8080.
• Change Web/API Domain: Modify VITE_API_BASE_URL to point to your public API domain (e.g., https://api.yourdomain.com/api/v1).
• Database & Crypto: Ensure you change the default database passwords and generate secure 256-bit Hex keys for JWT_SECRET and SERVER_SALT.

3. Creating / Changing the Admin Account

The system operates on a strict Zero-Attack Surface policy. The /auth/register API is locked down. To create the first Admin user (or reset their password), you must execute a command directly inside the running Docker container:

docker exec -it nexus-guard-suite-server-core-1 ./server-core -create-admin -user "admin" -pass "YourNewSecurePassword123!"

(You can use this exact same command later if you ever forget the admin password to forcefully reset it).

---

📖 Operational Workflow

Once the server is running and the Admin account is created, follow this flow:

1. Log in to the Dashboard UI using the admin credentials.
2. Register a WireGuard Node: Go to the Nodes menu. Add your public WireGuard server endpoint (e.g., vpn.yourdomain.com:51820) and its Public Key.
3. Add a Device: Go to the Devices menu. Click + New Device, select the target Node, and name the device.
4. Copy the Token: The system will display a single-use Registration Token.
5. Install the Agent on Client: On the target Linux machine, run the agent installer:

   sudo ./install_agent.sh --server-url "https://api.yourdomain.com" --token "<REG_TOKEN>"
   

6. The client will automatically connect, provision its WireGuard keys securely via AES-256-GCM, and appear as Online on your Dashboard.