NEXUS COMPASS — 2026-08-15¶

NeXuS Map · Wiki Sync Pipeline · NeXuS CA · TLD Migration Decision¶

Session export: ~/claude/2026-08-15-21-setup-proper-CA-migrating-2-NeXuS-TLD.txt Preceded by: NEXUS_COMPASS_2026-08-15_app-registry-nncc-hud-timeline.md

1. NEXUS MAP — Intranet Landing Page¶

What: Built a full intranet hub that now serves as the root / of the NeXuS web server. Replaces the old static file served at / with a living dashboard.

File: ~/Projects/nexus-web-server/nexus_web_server.py (multiple additions)

Sections on the Map: - ⚡ Apps grid — auto-generated from APP_REGISTRY + built-in routes (Timeline, Servers, OC, NeXuS Wiki public link) - 🪨 Fossil Repos — scanned from NEXUS_FOSSIL_DIR (default ~/museum/) — 16 found - 📄 Latest Exports — 12 most recent .txt files from NEXUS_CLAUDE_DIR (default ~/claude/) - 🐙 GitHub — live from api.github.com using NEXUS_GITHUB_USER env var (default: hackenstacks) - 📰 Hacker News — live from hn.algolia.com — top 12 stories - 📡 RSS Feeds — localStorage-managed, add/remove from UI - 🔍 Search bar — submits to /search?q=… (nxs-search app) - ⚡ AI slide-out — right-side panel, talks to /api/llm, provider selector

New server API endpoints added: - GET /api/nexus/map — returns apps, fossils, exports, github_user, node name - POST /api/nexus/wiki-sync — triggers nexus-wiki-publish.sh, returns output JSON

New routes in do_GET: / and /map and /map/ → _serve_map() New route in do_POST: /api/nexus/ routes dispatched through _nexus_api()

Map tile env var overrides (optional, in nexus.env):

NEXUS_APP_<ID>_label=Friendly Name
NEXUS_APP_<ID>_icon=🔍
NEXUS_GITHUB_USER=hackenstacks
NEXUS_FOSSIL_DIR=~/museum
NEXUS_CLAUDE_DIR=~/claude

2. ONLINE WIKI WIRED INTO MAP + SYNC PIPELINE¶

What: Wired https://hackenstacks.github.io/nexus/ as a quick-link tile on the Map. Built a full doc sync pipeline from all project repos into the wiki.

nexus-wiki-publish.sh¶

File: ~/scripts/nexus-wiki-publish.sh

What it syncs: - All <project>/docs/action_report.md → ~/git/nexus/docs/reports/<project>.md (25 found) - ~/NeXuS/timeline/NEXUS_TIMELINE.md → ~/git/nexus/docs/timeline.md - All ~/NeXuS/timeline/compass/*.md → ~/git/nexus/docs/compass/ (23 synced) - Generates ~/git/nexus/docs/reports/index.md with table of all projects - Updates ~/git/nexus/mkdocs.yml nav — inserts Reports + Session Compass sections between markers

Markers in mkdocs.yml:

# --- NEXUS-WIKI-AUTO-START ---
  - Timeline: timeline.md
  - Reports: ...
  - Session Compass: ...
# --- NEXUS-WIKI-AUTO-END ---

Safe to run repeatedly — idempotent, updates between markers without touching rest of nav.

Usage:

nexus-wiki-publish.sh              # sync local only
nexus-wiki-publish.sh --dry-run    # preview changes
nexus-wiki-publish.sh --deploy     # sync + mkdocs gh-deploy → hackenstacks.github.io/nexus

Wiki location: ~/git/nexus/ — NEXUS_WIKI_DIR env var to override Online wiki: https://hackenstacks.github.io/nexus/

Sync button on the Map: "📚 Sync Wiki" button in search bar — POSTs to /api/nexus/wiki-sync, shows toast with output.

3. NEXUS CA — CERTIFICATE AUTHORITY (step-certificates)¶

What: Initialized a proper internal Certificate Authority using Smallstep step-ca. Replaces all self-signed certs across NeXuS. First cert issued to nexus-web-server.

CA Details¶

Item	Value
CA Name	NeXuS CA
CA Address	`127.0.0.1:9000`
Root fingerprint	`99f17400023e289fee7bac581a2f4f0178dd63f9a16f59d8fef97cfd3132f22d`
SANs	`localhost`, `local.host.local`, `127.0.0.1`, `192.168.1.15`
Root cert validity	2026 → 2036 (10 years)
Provisioner	`nexus` (JWK) + ACME
Max cert duration	8760h (1 year)
Default cert duration	2160h (90 days)

File locations (under ~/NeXuS/ TLD)¶

~/NeXuS/data/step-ca/
  config/
    ca.json              ← CA config
    defaults.json        ← client defaults
  certs/
    root_ca.crt          ← ROOT — import this to trust NeXuS certs
    intermediate_ca.crt  ← intermediate
  secrets/
    root_ca_key          ← encrypted root key
    intermediate_ca_key  ← encrypted intermediate key
  db/                    ← badger cert database

~/NeXuS/secrets/
  nexus-ca.passwd        ← CA password (chmod 600)

First cert issued¶

~/NeXuS/Projects/nexus-web-server/
  cert.pem    ← signed by NeXuS CA Intermediate CA
  key.pem     ← ECDSA P-256, chmod 600

Valid: 2026-08-16 → 2027-08-16 Subject: local.host.local + SANs: localhost, 127.0.0.1, 192.168.1.15

Start the CA¶

STEPPATH=~/NeXuS/data/step-ca step-ca \
  ~/NeXuS/data/step-ca/config/ca.json \
  --password-file ~/NeXuS/secrets/nexus-ca.passwd

Issue a cert for any new project¶

STEPPATH=~/NeXuS/data/step-ca \
step ca certificate "<project-name>" \
  ~/NeXuS/Projects/<project>/cert.pem \
  ~/NeXuS/Projects/<project>/key.pem \
  --ca-url https://127.0.0.1:9000 \
  --root ~/NeXuS/data/step-ca/certs/root_ca.crt \
  --provisioner nexus \
  --provisioner-password-file ~/NeXuS/secrets/nexus-ca.passwd \
  --san localhost --san 127.0.0.1 --san local.host.local \
  --not-after 8760h

Trust the root cert (run in terminal with TTY)¶

doas cp ~/NeXuS/data/step-ca/certs/root_ca.crt /usr/local/share/ca-certificates/nexus-ca.crt
doas update-ca-certificates

Firefox: Settings → Privacy → Certificates → View Certificates → Import → root_ca.crt

4. TLD MIGRATION DECISION¶

Decision: All NeXuS projects live under ~/NeXuS/Projects/project/. Personal files (Pictures, Music, Documents) stay in XDG dirs.

Canonical structure¶

~/NeXuS/                          ← NEXUS_HOME — everything NeXuS
  Projects/                       ← NEXUS_PROJECTS — code, apps, repos
    nexus-web-server/
      nexus_web_server.py
      cert.pem  key.pem           ← own cert (no sharing)
      dist/                       ← own static root
      .local.env                  ← own local config
      docs/action_report.md
    nexus-portal/
    nexus-nncc/
    ...
  scripts/                        ← NEXUS_SCRIPTS (migrating from ~/scripts/)
  timeline/                       ← already here ✓
  characters/                     ← already here ✓
  secrets/nexus.env               ← shared API keys (ONLY shared resource)
  data/                           ← runtime data (step-ca, nncc, etc.)
  museum/                         ← fossil repos (migrating from ~/museum/)
  docs/
~/Pictures/                       ← XDG — stays here
~/Music/                          ← XDG — stays here
~/Documents/                      ← XDG — stays here

The three rules (non-negotiable)¶

No script contains a path — reads $NEXUS_* vars with sane defaults
No app contains a path — reads env vars; defaults to ~/NeXuS/…
Projects are sealed — everything a project needs lives inside it; projects communicate via APIs and env vars only, never by reading each other's files

The portability test¶

Can you mv ~/NeXuS/Projects/nexus-web-server /tmp/ and run it from there by setting one env var? If yes — portable. If no — something is hardcoded.

Env var foundation (nexus-env.sh — PENDING creation)¶

export NEXUS_HOME="${NEXUS_HOME:-$HOME/NeXuS}"
export NEXUS_PROJECTS="${NEXUS_PROJECTS:-$NEXUS_HOME/Projects}"
export NEXUS_SCRIPTS="${NEXUS_SCRIPTS:-$NEXUS_HOME/scripts}"
export NEXUS_DATA="${NEXUS_DATA:-$NEXUS_HOME/data}"
export NEXUS_SECRETS="${NEXUS_SECRETS:-$NEXUS_HOME/secrets}"
export NEXUS_MUSEUM="${NEXUS_MUSEUM:-$NEXUS_HOME/museum}"
export NEXUS_TIMELINE="${NEXUS_TIMELINE:-$NEXUS_HOME/timeline}"
export NEXUS_CHARACTERS="${NEXUS_CHARACTERS:-$NEXUS_HOME/characters}"

5. PACKAGE REVIEWS — KEEPERS¶

Installed this session (via nexus-apk-sink.sh)¶

15 new packages stuck, 21 already installed, 0 conflicts:

Package	Purpose
`step-certificates` + `step-certificates-openrc`	NeXuS CA — issues legit TLS certs
`trivy`	Container/filesystem vulnerability scanner
`fsverity-utils`	File integrity verification (dm-verity per file)
`wipe`	Secure file deletion
`pebble`	ACME test server for step-ca testing
`clustershell`	Run commands across all NeXuS nodes simultaneously
`s-tui`	Stress + temperature monitoring TUI
`flawfinder`	C/C++ security flaw scanner
`cargo-audit`	Rust dependency vulnerability auditor
`mailsec-check`	Check DMARC/SPF/DKIM for domain
`nmap-scripts`	NSE scripts for nmap
`mitmproxy`	HTTPS intercept proxy — THE PII scrubber
`frp`	Fast Reverse Proxy — expose nodes through NAT
`coova-chilli`	Captive portal controller (pairs with nexus-portal)

Already installed: kanidm, nebula, kernel-hardening-checker, tetragon-client, hubble-cli, naabu, xdg-ninja, verco, gosec, lynis, nikto, nmap+ncat+nping, way-secure, py3-landlock, meek, bubblewrap, shellinabox

Discussed — not yet installed¶

kea — DHCP server (pairs with coova-chilli for captive portal)
ThoughtDAG — visual LLM DAG canvas (in ~/git/thoughtdag/, needs npm build)
PrivAiTe / Presidio — PII scrubbing proxy for LLM traffic

6. NEXUS PORTAL — FOUND & ANALYZED¶

Found at: ~/scripts/nexus-portal/index.html (418 lines, status: Planned)

What it is: Public-facing captive portal for NeXuS hotspot nodes. A visitor who connects to a NeXuS WiFi node gets this page.

Sections: - Welcome — shows visitor their device IP - Proxy Setup — SOCKS5/HTTP proxy config for Tor, I2P, Privoxy - File Share — local-only drag-and-drop file sharing - Censorship Circumvention Guide — Tor bridges, V2Ray, Psiphon, SSH tunneling, DoH - Network Map — live status of Tor, I2P, Privoxy, IPFS, Yggdrasil, HAProxy + .onion addresses

Stack: HTML/CSS/JS only — self-contained single file

PENDING: Move to ~/NeXuS/Projects/nexus-portal/, replace hardcoded 192.168.88.1 with dynamic window.location.hostname, replace individual port checks with NNCC /api/health for live network status, wire into App Registry at /portal.

Captive portal flow:

Device connects to NeXuS hotspot
  → kea assigns IP
  → coova-chilli intercepts traffic
  → redirects browser to /portal
  → visitor gets proxy setup + network status + censorship guide

7. PRIVACY PROXY RESEARCH¶

The user was looking for a proxy that strips passwords, API keys, and self-identifying info from outgoing traffic.

mitmproxy — identified as the tool. Intercepts HTTPS, runs Python addons on every request/response. Write the scrubbing logic, it handles the intercept. Ready-made addons for API key stripping on GitHub.

PrivAiTe (github.com/crp4222/PrivAiTe) — LLM-specific proxy. Reversibly redacts PII before prompts reach external APIs. marie@acme.com → <EMAIL_ADDRESS_1> on the wire, restored in response. API keys redacted irreversibly on purpose. Uses Presidio + OpenAI privacy-filter model.

The NeXuS approach: The web server at :8443 already intercepts every LLM call via /api/llm. Presidio or a custom scrubber inserted into _llm_proxy() would cover all apps simultaneously. One place, all apps protected.

Privoxy can also do this via +filter action rules for regex patterns (API keys, emails, auth headers) — already deployed in the darknet stack.

8. OFFICIAL NEXUS SOFTWARE REGISTRY¶

Core Infrastructure¶

App	Location	Port	Purpose
NeXuS Web Server	`~/Projects/nexus-web-server/`	`:8443`	HTTPS hub, API key proxy, App Registry
NeXuS CA	`~/NeXuS/data/step-ca/`	`:9000`	Internal certificate authority (NEW)
NeXuS Map	served by web server	`/`	Intranet home — apps, feeds, AI panel (NEW)
NeXuS Scripts	`~/scripts/`	—	All management scripts

Apps & Services (App Registry)¶

App	Prefix	Port	Purpose
NeXuS Search	`/search`	`:5000`	Canonical file search across 530K+ files
NeXuS NNCC	`/nncc`	`:8801`	Network Command Center — darknet control
Beautiful Wiki	`/wiki`	`:6789`	Local wiki / knowledge base
Character Cards	`/charcard`	`:7420`	PNG² character card editor
Conduit Matrix	`/matrix`	`:6167`	Matrix homeserver (Conduit)
Text Editor	`/txt`	`:8091`	TXT blogger / text editor
AI Chat	`/aichat`	`:3030`	aichat HTTP bridge
VM Foundry	`/foundry`	`:7432`	nexus-vm-forge — pure-bash VM maker TUI
NeXuS Docs	`/docs`	`:8000`	MkDocs local docs server
OpenCharacters	`/oc`	static	OpenCharacters web app

Web Surfaces (static, served by web server)¶

App	Prefix	Purpose
Living Timeline	`/timeline`	NeXuS history — inline markdown renderer
Server Status	`/servers`	Port health dashboard
NeXuS Portal	`/portal`	Public captive portal — PENDING migration

External / Published¶

App	URL	Purpose
NeXuS Wiki (Online)	`https://hackenstacks.github.io/nexus/`	Published MkDocs wiki
ThoughtDAG	`~/git/thoughtdag/`	Visual LLM DAG canvas — PENDING wire-up

CLI / TUI Tools¶

Tool	Script	Purpose
Security HUD	`nexus-security-hud.sh`	PSAD + fail2ban + OSSEC live feed TUI
Dashboard	`nexus-dashboard.sh`	wtfutil system dashboard
NNCC Manager	`nexus-nncc.sh`	start/stop/restart/logs NNCC backend
Wiki Sync	`nexus-wiki-publish.sh`	Sync project docs → wiki → gh-deploy (NEW)
APK Sink	`nexus-apk-sink.sh`	Conflict-aware batch package installer
APK Sink	`nexus-apk-sink.sh`	Conflict-aware batch package installer

Character / AI Ecosystem¶

App	Location	Purpose
AI Home	`~/Projects/nexus-ai-home/`	Web character gen — main surface
Char TUI	`nexus-char-tui.fossil`	Python TUI character creator
Adv CLI Char Gen	`nexus-adv-cli-char-gen.fossil`	Advanced CLI character generator
NeXuS Party	`nexus-party.fossil`	Character deck / AI party TUI
Char Creator Framework	`~/git/NeXuS-Char-Creator-Framework/`	Umbrella framework tying all char-gen cogs
AXIOM	`~/NeXuS/characters/AXIOM/`	Official NeXuS Android — Claude production

Darknet Stack (containers)¶

Service	Purpose
`nexus-tor`	Tor circuits + Privoxy
`nexus-i2p`	I2P network
`nexus-yggdrasil`	Yggdrasil encrypted mesh
`nexus-reticulum`	Reticulum mesh network
`nexus-ipfs`	IPFS distributed storage
`nexus-snowflake`	Tor bridge (Snowflake PT)

9. PENDING / NEXT¶

Priority	Task
HIGH	Run `doas cp ~/NeXuS/data/step-ca/certs/root_ca.crt /usr/local/share/ca-certificates/nexus-ca.crt && doas update-ca-certificates` to trust NeXuS CA system-wide
HIGH	Create `~/NeXuS/nexus-env.sh` — single source of truth for all NEXUS_* path vars
HIGH	Write `nexus-migrate.sh` — archive-first, symlink-bridge migration from ~/Projects/ → ~/NeXuS/Projects/
HIGH	Migrate nexus-portal → `~/NeXuS/Projects/nexus-portal/` + NNCC live status wiring
MED	Wire `step-ca` into OpenRC — `step-certificates-openrc` is installed
MED	Build + wire ThoughtDAG into App Registry at `/thoughtdag`
MED	Write `nexus-wiki-publish.sh --deploy` into tmux menu or Map button
MED	Add `kea` DHCP server for coova-chilli captive portal stack
MED	Add mitmproxy PII scrubbing layer to `_llm_proxy()` in web server
LOW	Issue certs for all other projects (nexus-nncc, nexus-portal, etc.)
LOW	Add `doas addgroup user ossecr` for OSSEC live feed in Security HUD

Cat Report¶

Luna, Wookie (Tury), Mid, BigMaN, Peewee — present and accounted for. Multiple keyboard contributions this session. All cats healthy. meWEwowow