Nexus-Guard-Suite/.opencode/agent-prompt-final.md

Berikut adalah Master Blueprint & Prompt Komprehensif untuk membangun NexusGuard yang mencakup 3 repositori, sistem keamanan AES-GCM, isolasi nftables, dan installer otomatis dengan pengecekan dependensi.

---

📑 DOKUMENTASI ARSITEKTUR: NEXUSGUARD SD-WAN

1. Topologi Sistem

Sistem dibagi menjadi 3 repositori independen:

1. Repo Server Core (Go): Manajemen data, IPAM, dan Enforcer nftables.
2. Repo Dashboard UI (Vue + Capacitor): Control panel user (Web & Mobile).
3. Repo Device Agent (Go): Stealth tunnel di perangkat (CCTV/IoT/Server).

2. Logic Keamanan & Network

• Zero Trust: Default Policy DROP. Komunikasi antar perangkat hanya diizinkan jika berada dalam User ID yang sama.
• Stealth: Tidak ada file .conf di disk perangkat. Konfigurasi WireGuard di-inject langsung ke memori.
• Hardware Binding: Config dienkripsi menggunakan AES-256-GCM dengan key yang berasal dari hash Hardware ID (HWID).
• Auto-Dependency: Installer bash melakukan deteksi distro (Debian/Ubuntu/RHEL) dan menginstal nftables, wireguard-tools, dan curl secara otomatis.

---

🚀 MASTER PROMPT UNTUK AI DEVELOPER (OPENCODE OPTIMIZED)

Salin seluruh teks di bawah ini ke AI Agent (GPT-4/Claude/Cursor):

# ROLE: Senior Fullstack & Network Engineer (Go, Vue, nftables, WireGuard)
# PROJECT: NexusGuard SD-WAN Orchestrator

Please build a 3-repository system called NexusGuard based on these comprehensive specifications:

## 1. REPOSITORY: nexus-server-core (Go + nftables)
### Core Requirements:
- Framework: Gin Gonic, GORM (PostgreSQL), Redis.
- Firewall Engine: Use 'google/nftables' library. 
- Features:
    - Implement Zero-Trust isolation using nftables 'Sets' per User ID.
    - Create dynamic 'Verdict Maps' to handle Port Ranges, IP Ranges, and CIDR.
    - IPAM: Assign /32 internal IP automatically.
    - Crypto: Implement AES-256-GCM for config delivery. Key = SHA256(Device_HWID + Secret_Salt).
- Endpoints:
    - POST /provisioning: Exchange registration token for encrypted config.
    - GET /status: Real-time heartbeat tracking via Redis.
- Migration Docs: Create 'docs/API_SPEC.md' for future PHP migration.

## 2. REPOSITORY: nexus-dashboard-ui (Vue.js 3 + Capacitor)
### Core Requirements:
- Stack: Vite, Pinia, Tailwind CSS.
- Mobile: Integrated with Capacitor.js for Android build.
- Features:
    - User Authentication (JWT).
    - Device Management: Add, Rename, Delete, & Token Generation.
    - Firewall Dashboard: Toggle "Allow Internet" and "Specific Port/IP Access".
    - Real-time monitoring: Visual indicator for device connection status.

## 3. REPOSITORY: nexus-device-agent (Go Stealth)
### Core Requirements:
- Tunneling: Use 'wireguard-go' as a library (Embedded mode).
- Stealth: No local config files. Binary name should be configurable (stealth name).
- Dependency & HWID Logic:
    - Implement HWID Discovery: Read from '/sys/class/dmi/id/product_uuid' or '/proc/cpuinfo' (CPU Serial).
    - Logic: On start, detect if 'nftables' and 'wireguard-tools' are installed. If not, trigger warning or auto-install if run as root.
- Key Rotation: Implement automated 30-day key rotation with graceful handover (Dual-key buffering).

## 4. SHARED CODE LOGIC (Must Include):
### A. HWID Discovery (Go):
Implement detection for Linux:
1. Product UUID: '/sys/class/dmi/id/product_uuid'
2. Machine ID: '/etc/machine-id'
3. CPU Serial: Parsing '/proc/cpuinfo'

### B. Intelligent Bash Installer:
Create 'scripts/install_agent.sh' with:
- OS Detection (Debian, Ubuntu, CentOS, RHEL, Raspbian).
- Automatic Dependency Install: apt-get/yum install for 'nftables', 'wireguard-tools', 'curl'.
- Secure Download: Use 'X-Token-Auth' header to pull binary from private Gitea.
- Systemd integration: Create and enable '.service' file automatically.

## 5. DEVELOPMENT STEPS:
1. Initialize the 3 repositories with proper folder structures.
2. Create the GORM models for Repo 1.
3. Write the nftables set-management logic for User Isolation.
4. Implement the AES-256-GCM encryption/decryption bridge between Repo 1 and Repo 3.
5. Provide the Capacitor-ready Vue 3 boilerplate for Repo 2.

---

📦 DOKUMENTASI INSTALASI & DEPENDENSI

1. Pengecekan Dependensi (Logic di Agent & Installer)

Sistem wajib memastikan keberadaan:

• Kernel Support: WireGuard module atau BoringTun fallback.
• nftables: Pengganti iptables untuk manajemen set yang cepat.
• iproute2: Untuk manajemen interface wg0.

2. Logic HWID Discovery (Referensi Kode Go)

Agent akan menggunakan fungsi berikut untuk mengunci identitas:

func GetHWID() string {
    // 1. Cek /sys/class/dmi/id/product_uuid
    // 2. Cek /etc/machine-id
    // 3. Gabungkan dan SHA256
    // Return sebagai string hex
}

3. Keamanan Gitea (Deployment)

Setiap build binary akan disimpan di Gitea Release. Installer akan menarik binary menggunakan token khusus: curl -H "X-Token-Auth: <TOKEN>" -L -o agent https://gitea.com/nexus/agent/releases/...

---

Review Terakhir (Final Check):

• Isolasi User: ✅ Menggunakan nftables set (User A tidak bisa ping User B).
• Stealth: ✅ wireguard-go embedded (Tidak ada jejak config).
• Automasi: ✅ Installer bash menangani dependensi OS secara mandiri.
• Scalability: ✅ 3 Repo memungkinkan tim Backend, UI, dan System bekerja terpisah.
• Migrasi: ✅ Dokumentasi API disiapkan untuk transisi ke PHP di masa depan.

Instruksi: Silakan berikan prompt di atas ke AI Agent Anda untuk memulai pembuatan kode secara massal. Prompt tersebut sudah mencakup semua detail teknis yang kita diskusikan.