# Module: Nexus Device Management

**Placering:** `source/nexus-device-management/`  
**Fase:** 4  
**Type:** Cloud service + Agent integration

---

## Funktioner

- Enhedsregistrering med bootstrap token og device certificate
- Enhedsgrupper (statisk og dynamisk baseret på kriterier)
- Hardware/software/OS-inventar
- Policy definition, versioning og distribution
- Compliance rules og rapportering
- Device trust scoring
- Remote wipe og lock

---

## Ansvar

| Ansvar | Ejer |
|--------|------|
| Enheds-lifecycle (register → active → decommission) | Device Mgmt |
| Inventar aggregation | Device Mgmt (data fra Agent) |
| Policy authoring og distribution | Device Mgmt |
| Compliance evaluation | Device Mgmt |
| Policy enforcement | Agent (eksekvering) |

---

## Datamodel

```
Device
├── id: UUID (PK)
├── hostname: string
├── hardware_id: string (unique)
├── os_info: JSON
├── agent_version: string
├── shell_version: string
├── trust_score: integer (0-100)
├── compliance_status: compliant|non_compliant|unknown
├── status: active|inactive|decommissioned
├── organization_id: UUID (FK)
├── last_seen_at: timestamp

DeviceGroup
├── id: UUID (PK)
├── name: string
├── type: static|dynamic
├── criteria: JSON (for dynamic)
├── parent_group_id: UUID (FK, nullable)

DeviceGroupMember
├── device_id: UUID (FK)
├── group_id: UUID (FK)

Policy
├── id: UUID (PK)
├── name: string
├── version: integer
├── definition: JSON
├── type: security|apps|network|nexus
├── status: draft|active|archived

PolicyAssignment
├── policy_id: UUID (FK)
├── target_type: device|group|global
├── target_id: UUID

ComplianceReport
├── device_id: UUID (FK)
├── policy_id: UUID (FK)
├── status: compliant|non_compliant
├── details: JSON
├── evaluated_at: timestamp

InventorySnapshot
├── device_id: UUID (FK)
├── hardware: JSON
├── software: JSON[]
├── captured_at: timestamp
```

---

## Afhængigheder

| Afhænger af | Hvorfor |
|-------------|---------|
| Nexus Agent | Inventar, policy enforcement, heartbeat |
| Identity | Bruger-enhed binding |
| Control Center | Admin UI, API |

| Afhænges af af | Hvorfor |
|----------------|---------|
| Remote Support | Enheds-targeting |
| Update Service | Enheds-targeting for deployment |
| Shell | Device trust visning |

---

*Se: [security/DEVICE_TRUST.md](../security/DEVICE_TRUST.md)*
