# Architecture Overview — Ninja Nexus

Samlet arkitekturoverblik. Detaljer findes i [`architecture/`](../architecture/).

---

## Kerneprincip

Ninja Nexus er et **lag ovenpå Windows**, ikke en erstatning:

```
┌──────────────────────────────────────────────────────────┐
│                    BRUGERLAG                              │
│  Login → Shell → Launcher → Apps → App Center            │
├──────────────────────────────────────────────────────────┤
│                    PLATFORMLAG                            │
│  Identity │ Device Mgmt │ Deployment │ Remote Support    │
├──────────────────────────────────────────────────────────┤
│                    AGENTLAG                               │
│  Nexus Agent (Windows service) — politikker, sync, MDM   │
├──────────────────────────────────────────────────────────┤
│                    ADMINISTRATION                         │
│  Nexus Control Center (cloud + web)                      │
├──────────────────────────────────────────────────────────┤
│                    WINDOWS (fundament)                    │
│  Kernel · NTFS · Netværk · Hardware · Win32/WinRT        │
└──────────────────────────────────────────────────────────┘
```

---

## Moduler

| Modul | Type | Rolle |
|-------|------|-------|
| **Nexus Shell** | Desktop-klient | Brugerens desktop, taskbar, widgets |
| **Nexus Agent** | Windows service | Enhedskommunikation, politikker, heartbeat |
| **Nexus Control Center** | Cloud + web | Central administration |
| **Nexus Identity** | Cloud service | Brugere, roller, MFA, sessions |
| **Nexus Device Management** | Cloud + agent | Inventar, politikker, compliance |
| **Nexus App Center** | Cloud + shell | Intern app store |
| **Nexus Update Service** | Cloud + agent | Platform- og app-opdateringer |
| **Nexus Remote Support** | Cloud + agent | Fjernsupport, remote terminal |
| **Shared** | Biblioteker | Fælles typer, protokoller, UI-komponenter |

Se [MODULE_OVERVIEW.md](../architecture/MODULE_OVERVIEW.md) og [modules/](../modules/).

---

## Client ↔ Server

```
┌─────────────┐         HTTPS/mTLS          ┌─────────────────────┐
│  PC (Agent  │ ◄──────────────────────────► │  Control Center     │
│  + Shell)   │         WebSocket (events)   │  (Cloud API)        │
└─────────────┘                              └──────────┬──────────┘
                                                        │
                              ┌─────────────────────────┼─────────────────────────┐
                              ▼                         ▼                         ▼
                       ┌────────────┐          ┌────────────┐          ┌────────────┐
                       │  Identity  │          │  Device    │          │  App       │
                       │  Service   │          │  Mgmt      │          │  Center    │
                       └────────────┘          └────────────┘          └────────────┘
```

Detaljer: [CLIENT_SERVER_ARCHITECTURE.md](../architecture/CLIENT_SERVER_ARCHITECTURE.md)

---

## Dataflow (forenklet)

1. **Login:** Shell → Identity (OAuth2/OIDC) → session token
2. **Desktop:** Shell loader brugerprofil og widgets fra Control Center cache
3. **Politikker:** Agent poller Control Center → anvender lokalt → rapporterer compliance
4. **Apps:** App Center katalog → Shell launcher → Agent installerer/opdaterer
5. **Support:** Admin initierer session → Agent etablerer sikker tunnel → audit log

Detaljer: [DATA_FLOW.md](../architecture/DATA_FLOW.md)

---

## Offline-strategi

- Agent og Shell cacher kritisk data lokalt (SQLite/encrypted store)
- Politikker og app-manifest synkroniseres ved forbindelse
- MFA og login kræver netværk (med begrænset offline-grace period)
- Remote support kræver netværk
- Conflict resolution: server wins for politikker, merge for brugerdata

Detaljer: [OFFLINE_STRATEGY.md](../architecture/OFFLINE_STRATEGY.md)

---

## Sikkerhed (kort)

| Princip | Implementering |
|---------|----------------|
| Zero Trust | Verificer identitet + enhed + kontekst ved hver handling |
| Device Trust | Agent rapporterer compliance; upålidelige enheder begrænses |
| MFA | TOTP → FIDO2 → adaptive (fasevis) |
| Audit | Alle admin- og brugerhandlinger logges centralt |
| Permissions | RBAC med fine-grained permissions per modul |

Detaljer: [security/](../security/)

---

## Teknisk stack (anbefalet)

| Lag | Teknologi |
|-----|-----------|
| Shell (desktop) | C# / WinUI 3 eller WPF |
| Agent (service) | C# / .NET Windows Service |
| Control Center (API) | .NET 8 / ASP.NET Core |
| Control Center (UI) | React / TypeScript |
| Identity | .NET 8 + OpenIddict / Duende |
| Database | PostgreSQL (cloud), SQLite (lokal) |
| Messaging | Redis / Azure Service Bus |
| Infrastructure | Azure / container-baseret |

Detaljer: [TECH_STACK.md](../decisions/TECH_STACK.md)

---

## Afhængigheder mellem moduler

```mermaid
graph TD
    Shell[Nexus Shell] --> Identity[Nexus Identity]
    Shell --> AppCenter[Nexus App Center]
    Agent[Nexus Agent] --> ControlCenter[Nexus Control Center]
    Shell --> Agent
    ControlCenter --> Identity
    ControlCenter --> DeviceMgmt[Nexus Device Management]
    ControlCenter --> AppCenter
    ControlCenter --> UpdateSvc[Nexus Update Service]
    ControlCenter --> RemoteSupport[Nexus Remote Support]
    DeviceMgmt --> Agent
    UpdateSvc --> Agent
    RemoteSupport --> Agent
    AppCenter --> UpdateSvc
```

---

## Relaterede dokumenter

- [SYSTEM_OVERVIEW.md](../architecture/SYSTEM_OVERVIEW.md) — detaljeret systemdiagram
- [MODULE_OVERVIEW.md](../architecture/MODULE_OVERVIEW.md) — alle moduler
- [DATA_FLOW.md](../architecture/DATA_FLOW.md) — dataflow
- [WINDOWS_STRATEGY.md](../decisions/WINDOWS_STRATEGY.md) — Windows som base
- [SECURITY_MODEL.md](../security/SECURITY_MODEL.md) — sikkerhedsmodel

---

*Dette dokument opdateres ved arkitekturændringer. Version: 1.0*
