datadunia
120 lines
5.5 KiB
Markdown
120 lines
5.5 KiB
Markdown
Berikut adalah **Master Blueprint & Prompt Komprehensif** untuk membangun **NexusGuard** yang mencakup 3 repositori, sistem keamanan AES-GCM, isolasi nftables, dan installer otomatis dengan pengecekan dependensi.
|
|
|
|
---
|
|
|
|
# 📑 DOKUMENTASI ARSITEKTUR: NEXUSGUARD SD-WAN
|
|
|
|
## 1. Topologi Sistem
|
|
Sistem dibagi menjadi 3 repositori independen:
|
|
1. **Repo Server Core (Go):** Manajemen data, IPAM, dan Enforcer nftables.
|
|
2. **Repo Dashboard UI (Vue + Capacitor):** Control panel user (Web & Mobile).
|
|
3. **Repo Device Agent (Go):** Stealth tunnel di perangkat (CCTV/IoT/Server).
|
|
|
|
## 2. Logic Keamanan & Network
|
|
- **Zero Trust:** Default Policy `DROP`. Komunikasi antar perangkat hanya diizinkan jika berada dalam User ID yang sama.
|
|
- **Stealth:** Tidak ada file `.conf` di disk perangkat. Konfigurasi WireGuard di-inject langsung ke memori.
|
|
- **Hardware Binding:** Config dienkripsi menggunakan `AES-256-GCM` dengan key yang berasal dari hash Hardware ID (HWID).
|
|
- **Auto-Dependency:** Installer bash melakukan deteksi distro (Debian/Ubuntu/RHEL) dan menginstal `nftables`, `wireguard-tools`, dan `curl` secara otomatis.
|
|
|
|
---
|
|
|
|
# 🚀 MASTER PROMPT UNTUK AI DEVELOPER (OPENCODE OPTIMIZED)
|
|
|
|
**Salin seluruh teks di bawah ini ke AI Agent (GPT-4/Claude/Cursor):**
|
|
|
|
```markdown
|
|
# ROLE: Senior Fullstack & Network Engineer (Go, Vue, nftables, WireGuard)
|
|
# PROJECT: NexusGuard SD-WAN Orchestrator
|
|
|
|
Please build a 3-repository system called NexusGuard based on these comprehensive specifications:
|
|
|
|
## 1. REPOSITORY: nexus-server-core (Go + nftables)
|
|
### Core Requirements:
|
|
- Framework: Gin Gonic, GORM (PostgreSQL), Redis.
|
|
- Firewall Engine: Use 'google/nftables' library.
|
|
- Features:
|
|
- Implement Zero-Trust isolation using nftables 'Sets' per User ID.
|
|
- Create dynamic 'Verdict Maps' to handle Port Ranges, IP Ranges, and CIDR.
|
|
- IPAM: Assign /32 internal IP automatically.
|
|
- Crypto: Implement AES-256-GCM for config delivery. Key = SHA256(Device_HWID + Secret_Salt).
|
|
- Endpoints:
|
|
- POST /provisioning: Exchange registration token for encrypted config.
|
|
- GET /status: Real-time heartbeat tracking via Redis.
|
|
- Migration Docs: Create 'docs/API_SPEC.md' for future PHP migration.
|
|
|
|
## 2. REPOSITORY: nexus-dashboard-ui (Vue.js 3 + Capacitor)
|
|
### Core Requirements:
|
|
- Stack: Vite, Pinia, Tailwind CSS.
|
|
- Mobile: Integrated with Capacitor.js for Android build.
|
|
- Features:
|
|
- User Authentication (JWT).
|
|
- Device Management: Add, Rename, Delete, & Token Generation.
|
|
- Firewall Dashboard: Toggle "Allow Internet" and "Specific Port/IP Access".
|
|
- Real-time monitoring: Visual indicator for device connection status.
|
|
|
|
## 3. REPOSITORY: nexus-device-agent (Go Stealth)
|
|
### Core Requirements:
|
|
- Tunneling: Use 'wireguard-go' as a library (Embedded mode).
|
|
- Stealth: No local config files. Binary name should be configurable (stealth name).
|
|
- Dependency & HWID Logic:
|
|
- Implement HWID Discovery: Read from '/sys/class/dmi/id/product_uuid' or '/proc/cpuinfo' (CPU Serial).
|
|
- Logic: On start, detect if 'nftables' and 'wireguard-tools' are installed. If not, trigger warning or auto-install if run as root.
|
|
- Key Rotation: Implement automated 30-day key rotation with graceful handover (Dual-key buffering).
|
|
|
|
## 4. SHARED CODE LOGIC (Must Include):
|
|
### A. HWID Discovery (Go):
|
|
Implement detection for Linux:
|
|
1. Product UUID: '/sys/class/dmi/id/product_uuid'
|
|
2. Machine ID: '/etc/machine-id'
|
|
3. CPU Serial: Parsing '/proc/cpuinfo'
|
|
|
|
### B. Intelligent Bash Installer:
|
|
Create 'scripts/install_agent.sh' with:
|
|
- OS Detection (Debian, Ubuntu, CentOS, RHEL, Raspbian).
|
|
- Automatic Dependency Install: apt-get/yum install for 'nftables', 'wireguard-tools', 'curl'.
|
|
- Secure Download: Use 'X-Token-Auth' header to pull binary from private Gitea.
|
|
- Systemd integration: Create and enable '.service' file automatically.
|
|
|
|
## 5. DEVELOPMENT STEPS:
|
|
1. Initialize the 3 repositories with proper folder structures.
|
|
2. Create the GORM models for Repo 1.
|
|
3. Write the nftables set-management logic for User Isolation.
|
|
4. Implement the AES-256-GCM encryption/decryption bridge between Repo 1 and Repo 3.
|
|
5. Provide the Capacitor-ready Vue 3 boilerplate for Repo 2.
|
|
```
|
|
|
|
---
|
|
|
|
# 📦 DOKUMENTASI INSTALASI & DEPENDENSI
|
|
|
|
### 1. Pengecekan Dependensi (Logic di Agent & Installer)
|
|
Sistem wajib memastikan keberadaan:
|
|
- **Kernel Support:** WireGuard module atau BoringTun fallback.
|
|
- **nftables:** Pengganti iptables untuk manajemen set yang cepat.
|
|
- **iproute2:** Untuk manajemen interface `wg0`.
|
|
|
|
### 2. Logic HWID Discovery (Referensi Kode Go)
|
|
Agent akan menggunakan fungsi berikut untuk mengunci identitas:
|
|
```go
|
|
func GetHWID() string {
|
|
// 1. Cek /sys/class/dmi/id/product_uuid
|
|
// 2. Cek /etc/machine-id
|
|
// 3. Gabungkan dan SHA256
|
|
// Return sebagai string hex
|
|
}
|
|
```
|
|
|
|
### 3. Keamanan Gitea (Deployment)
|
|
Setiap build binary akan disimpan di Gitea Release. Installer akan menarik binary menggunakan token khusus:
|
|
`curl -H "X-Token-Auth: <TOKEN>" -L -o agent https://gitea.com/nexus/agent/releases/...`
|
|
|
|
---
|
|
|
|
### **Review Terakhir (Final Check):**
|
|
- **Isolasi User:** ✅ Menggunakan `nftables set` (User A tidak bisa ping User B).
|
|
- **Stealth:** ✅ `wireguard-go` embedded (Tidak ada jejak config).
|
|
- **Automasi:** ✅ Installer bash menangani dependensi OS secara mandiri.
|
|
- **Scalability:** ✅ 3 Repo memungkinkan tim Backend, UI, dan System bekerja terpisah.
|
|
- **Migrasi:** ✅ Dokumentasi API disiapkan untuk transisi ke PHP di masa depan.
|
|
|
|
**Instruksi:** Silakan berikan prompt di atas ke AI Agent Anda untuk memulai pembuatan kode secara massal. Prompt tersebut sudah mencakup semua detail teknis yang kita diskusikan. |