datadunia
bf9cbba535
Backend (server-core): - Extend firewall NetManager with AddForwardRule, AddInputRule via nft CLI - Sync FORWARD rules on peer create, update, delete, suspend/unsuspend - Sync INPUT rules on server create, update (port change), delete - Fix duplicate import and missing firewall cleanup calls Frontend (dashboard-ui): - Add Edit Node modal for MTU, DNS, ListenPort configuration - Add Advanced Peer Settings accordion (AllowedIPs, DNS, MTU, Keepalive, Notes) - Add Suspend/Unsuspend toggle with SUSPENDED badge - Update API client for new endpoints and fields
NexusGuard SD-WAN Suite
NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via nftables.
🏗️ System Architecture
This suite contains three main components:
- Server Core: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
- Dashboard UI: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules.
- Device Agent: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
🚀 Deployment & Installation
1. Initial Setup
To deploy the entire backend infrastructure (PostgreSQL, Redis, and Server-Core), simply clone this repository and run the setup script:
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
cd Nexus-Guard-Suite
chmod +x setup.sh
./setup.sh
The setup.sh script will automatically:
- Create a master
.envfile (if it doesn't exist). - Boot up all required infrastructure via
docker-compose.
2. Domain & Port Configuration
If you are deploying this to production, you must edit the .env file generated in the root directory:
- Change API Port: Modify
API_PORT=8080. - Change Web/API Domain: Modify
VITE_API_BASE_URLto point to your public API domain (e.g.,https://api.yourdomain.com/api/v1). - Database & Crypto: Ensure you change the default database passwords and generate secure 256-bit Hex keys for
JWT_SECRETandSERVER_SALT.
3. Creating / Changing the Admin Account
The system operates on a strict Zero-Attack Surface policy. The /auth/register API is locked down. To create the first Admin user (or reset their password), you must execute a command directly inside the running Docker container:
docker exec -it nexus-guard-suite-server-core-1 ./server-core -create-admin -user "admin" -pass "YourNewSecurePassword123!"
(You can use this exact same command later if you ever forget the admin password to forcefully reset it).
📖 Operational Workflow
Once the server is running and the Admin account is created, follow this flow:
- Log in to the Dashboard UI using the
admincredentials. - Register a WireGuard Node: Go to the Nodes menu. Add your public WireGuard server endpoint (e.g.,
vpn.yourdomain.com:51820) and its Public Key. - Add a Device: Go to the Devices menu. Click + New Device, select the target Node, and name the device.
- Copy the Token: The system will display a single-use Registration Token.
- Install the Agent on Client: On the target Linux machine, run the agent installer:
sudo ./install_agent.sh --server-url "https://api.yourdomain.com" --token "<REG_TOKEN>" - The client will automatically connect, provision its WireGuard keys securely via AES-256-GCM, and appear as Online on your Dashboard.