feat: refactor nxmesh-frontend to use React Router with new layout components

- Updated package.json to replace Vite with React Router for development and build scripts. - Added react-router.config.ts for configuration settings. - Created a new App component with a dashboard layout including header, sidebar, and footer. - Enhanced App.css with a professional theme and responsive design. - Removed old App.tsx and index.css files. - Introduced RootLayout component to encapsulate layout structure. - Developed Header, Footer, and Sidebar components for consistent layout. - Implemented routes for home and dashboard with key metrics and activity sections. - Updated vite.config.ts to integrate React Router and adjust SSR settings.
Merge pull request 'feature/embbed-frontend' (#7 ) from feature/embbed-frontend into master
2026-05-06 10:48:39 +00:00 · 2026-04-25 14:34:55 +08:00 · 2026-04-25 06:30:13 +00:00 · 2026-04-25 06:04:55 +00:00 · 2026-04-25 04:26:59 +00:00 · 2026-04-25 03:21:36 +00:00
50 changed files with 3741 additions and 295 deletions
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -30,7 +30,8 @@
    "ghcr.io/guiyomh/features/just:0": {},
    "ghcr.io/devcontainers-extra/features/bun": {
      "version": "latest"
-    }
+    },
+    "ghcr.io/devcontainers-extra/features/act": {}
  },

  "customizations": {
--- a/.github/.gitignore
+++ b/.github/.gitignore
@@ -0,0 +1 @@
+*.env
--- a/.github/.secrets.env.template
+++ b/.github/.secrets.env.template
@@ -0,0 +1,4 @@
+# This is an example environment variable file for GitHub Actions. You can copy this file to .github/.secrets.env and fill in the values to override the default registry and GitHub token used in the CI workflow. This is useful for testing with a private registry or using a different GitHub account for authentication.
+OVERRIDE_REGISTRY=<your-registry-url>
+OVERRIDE_GITHUB_TOKEN=<your-github-token>
+GITHUB_USERNAME=<your-github-username>
--- a/.github/actions/setup-ci-metadata/action.yaml
+++ b/.github/actions/setup-ci-metadata/action.yaml
@@ -0,0 +1,70 @@
+name: 'Setup CI metadata'
+description: 'Composite action to derive the registry and CI image tag for the current repository.'
+inputs:
+  registry:
+    description: 'Container registry derived from the current GitHub server URL'
+    required: false
+    default: ''
+  repository:
+    description: 'GitHub repository in the format owner/repo'
+    required: false
+    default: ${{ github.repository }}
+  image_tag:
+    description: 'Tag for the CI image'
+    required: false
+    default: 'latest'
+outputs:
+  registry:
+    description: 'Container registry derived from the current GitHub server URL'
+    value: ${{ steps.setup.outputs.registry }}
+  image_tag:
+    description: 'Fully qualified CI image tag'
+    value: ${{ steps.setup.outputs.image_tag }}
+  latest_tag:
+    description: 'Fully qualified latest CI image tag'
+    value: ${{ steps.setup.outputs.latest_tag }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Dynamic Metadata
+      id: setup
+      shell: bash
+      run: |
+        # Extract the domain from server_url, handling both https:// and ssh:// schemes
+        SERVER_URL="${{ github.server_url }}"
+
+        if [[ "$SERVER_URL" =~ ^ssh:// ]]; then
+          # For SSH URLs like ssh://git@host:port/path, extract just the hostname
+          SERVER_DOMAIN=$(echo "$SERVER_URL" | sed -e 's|^ssh://||' -e 's|^[^@]*@||' -e 's|:[0-9]*.*||')
+        else
+          # For HTTPS URLs, extract domain without scheme
+          SERVER_DOMAIN=$(echo "$SERVER_URL" | sed -e 's|^[^/]*//||' -e 's|/.*$||')
+        fi
+
+        echo "Extracted server domain: $SERVER_DOMAIN"
+
+        if [[ -n "${{ inputs.registry }}" ]]; then
+          REGISTRY="${{ inputs.registry }}"
+        elif [[ "$SERVER_DOMAIN" == "github.com" ]]; then
+          REGISTRY="ghcr.io"
+        else
+          REGISTRY="$SERVER_DOMAIN"
+        fi
+
+        # Extract owner/repo from github.repository, handling SSH URLs
+        REPO="${{ inputs.repository }}"
+        if [[ "$REPO" =~ ^ssh:// ]] || [[ "$REPO" =~ ^https:// ]]; then
+          # Extract owner/repo from URLs like ssh://git@host/owner/repo.git or https://host/owner/repo.git
+          REPO=$(echo "$REPO" | sed -e 's|^[^/]*/||' -e 's|\.git$||' | rev | cut -d'/' -f1,2 | rev)
+        fi
+
+        # Docker image names must be lowercase
+        REGISTRY="${REGISTRY,,}"
+        REPO="${REPO,,}"
+
+        IMAGE_TAG="${REGISTRY}/${REPO}/ci:${{ inputs.image_tag }}"
+        LATEST_TAG="${REGISTRY}/${REPO}/ci:latest"
+
+        echo "registry=$REGISTRY" >> "$GITHUB_OUTPUT"
+        echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
+        echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
--- a/.github/actions/setup-rust/action.yaml
+++ b/.github/actions/setup-rust/action.yaml
@@ -0,0 +1,74 @@
+name: 'Setup Rust environment'
+description: 'Composite action to checkout the repo, restore cargo caches and set up the Rust toolchain. Use this from job steps to keep setup DRY across jobs.'
+inputs:
+  toolchain:
+    description: 'Rust toolchain to install'
+    required: false
+    default: 'stable'
+  override:
+    description: 'Whether to override the default toolchain'
+    required: false
+    default: 'true'
+  components:
+    description: 'Comma-separated list of additional rust components to install'
+    required: false
+    default: 'clippy, rustfmt'
+  skip_cache:
+    description: 'Whether to skip restoring and uploading caches (useful for testing the workflow without cache interference)'
+    required: false
+    default: 'false'
+runs:
+  using: 'composite'
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Cache cargo registry
+      uses: actions/cache@v4
+      if: inputs.skip_cache != 'true'
+      with:
+        path: ~/.cargo/registry
+        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Cache cargo index
+      uses: actions/cache@v4
+      if: inputs.skip_cache != 'true'
+      with:
+        path: ~/.cargo/index
+        key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Sanitize components input
+      shell: bash
+      run: echo "SANITIZED_COMPONENTS=${{ inputs.components }}" | sed -E 's/, ?| /-/g' >> $GITHUB_ENV
+
+    - name: Cache Rust toolchain
+      uses: actions/cache@v3
+      if: inputs.skip_cache != 'true'
+      with:
+        path: ~/.rustup
+        # Key includes the OS and the toolchain version (e.g., 'stable')
+        key: ${{ runner.os }}-rustup-${{ hashFiles('rust-toolchain.toml') }}-v1-${{ inputs.toolchain }}-${{ env.SANITIZED_COMPONENTS }}
+        restore-keys: |
+          ${{ runner.os }}-rustup-
+
+    - name: Cache cargo build (target)
+      uses: actions/cache@v3
+      if: inputs.skip_cache != 'true'
+      with:
+        path: target
+        key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Set up rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        override: ${{ inputs.override }}
+        components: ${{ inputs.components }}
--- a/.github/docker/ci.Dockerfile
+++ b/.github/docker/ci.Dockerfile
@@ -0,0 +1,31 @@
+FROM node:24-bookworm-slim
+
+# Install necessary dependencies for building Rust projects and running tests
+RUN apt-get update && apt-get install -y \
+    curl \
+    git \
+    zstd \
+    build-essential \
+    pkg-config \
+    libssl-dev \
+    gnupg \
+    unzip \
+    tar \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update && apt-get install -y \
+    postgresql-client \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+
+# install bun
+RUN curl -fsSL https://bun.sh/install | bash
+ENV PATH="/root/.bun/bin:${PATH}"
+
+# install rust and cargo
+RUN apt-get update && apt-get install -y curl build-essential
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+# Set the working directory
+WORKDIR /app
--- a/.github/workflows/build-ci.yaml
+++ b/.github/workflows/build-ci.yaml
@@ -0,0 +1,54 @@
+name: Build CI Environment
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Tag for the CI image (e.g., latest)'
+        required: true
+        default: 'latest'
+
+env:
+  # OVERRIDE_REGISTRY can be set as a secret to override the default registry (e.g., for testing with a private registry). Else '' will be used, which defaults to ghcr.io for github.com and the GitHub server domain for self-hosted GitHub instances.
+  OVERRIDE_REGISTRY: ${{ secrets.OVERRIDE_REGISTRY }}
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: build-ci
+  cancel-in-progress: true
+
+jobs:
+  build-ci-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup CI metadata
+        id: setup
+        uses: ./.github/actions/setup-ci-metadata
+        with:
+          registry: ${{ env.OVERRIDE_REGISTRY }}
+          image_tag: ${{ github.event.inputs.image_tag }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ steps.setup.outputs.registry }}
+          username: ${{ secrets.GITHUB_USERNAME || github.actor }}
+          password: ${{ secrets.OVERRIDE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image for CI
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: .github/docker/ci.Dockerfile
+          push: true
+          tags: |
+            ${{ steps.setup.outputs.image_tag }}
+            ${{ steps.setup.outputs.latest_tag }}
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -0,0 +1,200 @@
+# this workflow runs tests on pull request and push events targeting master branch
+# it also verify the generated code is up to date and valid
+
+name: Test
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+jobs:
+  get-ci-image:
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.setup.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup CI metadata
+        id: setup
+        uses: ./.github/actions/setup-ci-metadata
+        with:
+          registry: ${{ secrets.OVERRIDE_REGISTRY }}
+          image_tag: latest
+
+  test-crates:
+    runs-on: ubuntu-latest
+    needs:
+      - frontend-build
+      - get-ci-image
+    container:
+      image: ${{ needs.get-ci-image.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Rust, checkout and restore caches
+        uses: ./.github/actions/setup-rust
+
+      - name: Restore frontend build cache
+        uses: actions/cache@v4
+        with:
+          path: apps/nxmesh-frontend/dist
+          key: frontend-build-${{ runner.os }}-run-${{ github.run_id }}
+          restore-keys: |
+            frontend-build-${{ runner.os }}-
+
+      # TODO: uncomment until artifact hanlding fixed in gitea
+      # - name: Download frontend build artifact
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: frontend-dist
+      #     path: apps/nxmesh-frontend/dist
+
+      # - name: Copy frontend build to expected location
+      #   run: |
+      #     # unlink frontend-dist
+      #     rm -f apps/nxmesh-master/frontend-dist || true
+      #     rm -rf apps/nxmesh-master/frontend-dist || true
+      #     cp -r apps/nxmesh-frontend/dist apps/nxmesh-master/frontend-dist
+
+      #     ls -la apps/nxmesh-master/frontend-dist
+
+      - name: Create dummy build artifacts
+        run: |
+          rm -f apps/nxmesh-master/frontend-dist || true
+          mkdir -p apps/nxmesh-master/frontend-dist
+          echo "<html><body><h1>Dummy Build</h1></body></html>" > apps/nxmesh-master/frontend-dist/index.html
+
+      - name: Run tests
+        run: cargo test --all-features -- --show-output
+
+  lint-crates:
+    runs-on: ubuntu-latest
+    needs:
+      - frontend-build
+      - get-ci-image
+    container:
+      image: ${{ needs.get-ci-image.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Rust, checkout and restore caches
+        uses: ./.github/actions/setup-rust
+        with:
+          components: clippy, rustfmt
+
+      - name: Restore frontend build cache
+        uses: actions/cache@v4
+        with:
+          path: apps/nxmesh-frontend/dist
+          key: frontend-build-${{ runner.os }}-run-${{ github.run_id }}
+          restore-keys: |
+            frontend-build-${{ runner.os }}-
+
+      # TODO: uncomment until artifact hanlding fixed in gitea
+      # - name: Download frontend build artifact
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: frontend-dist
+      #     path: apps/nxmesh-frontend/dist
+
+      # - name: Copy frontend build to expected location
+      #   run: |
+      #     # unlink frontend-dist
+      #     rm -f apps/nxmesh-master/frontend-dist || true
+      #     rm -rf apps/nxmesh-master/frontend-dist || true
+      #     cp -r apps/nxmesh-frontend/dist apps/nxmesh-master/frontend-dist
+
+      - name: Create dummy build artifacts
+        run: |
+          rm -f apps/nxmesh-master/frontend-dist || true
+          mkdir -p apps/nxmesh-master/frontend-dist
+          echo "<html><body><h1>Dummy Build</h1></body></html>" > apps/nxmesh-master/frontend-dist/index.html
+
+      - name: Run clippy
+        run: cargo clippy --all-features
+
+      - name: Check code formatting
+        run: cargo fmt --all -- --check
+
+  lint-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - uses: oven-sh/setup-bun@v2
+        name: Install Bun
+
+      - name: Install frontend dependencies
+        run: |
+          cd apps/nxmesh-frontend
+          bun install
+
+      - name: Run frontend linter
+        run: |
+          cd apps/nxmesh-frontend
+          bun run lint
+
+  test-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+        name: Install Bun
+
+      - name: Install frontend dependencies
+        run: |
+          cd apps/nxmesh-frontend
+          bun install
+
+      - name: Run frontend tests
+        run: |
+          cd apps/nxmesh-frontend
+          bun run test
+
+  frontend-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - uses: oven-sh/setup-bun@v2
+        name: Install Bun
+
+      - name: Install frontend dependencies
+        run: |
+          cd apps/nxmesh-frontend
+          bun install
+
+      - name: Build frontend
+        run: |
+          cd apps/nxmesh-frontend
+          bun run build
+
+      - name: Cache frontend build
+        uses: actions/cache@v4
+        with:
+          path: apps/nxmesh-frontend/dist
+          key: frontend-build-${{ runner.os }}-run-${{ github.run_id }}
+          # IGNORE restore-keys
+      # TODO: uncomment until artifact hanlding fixed in gitea
+      # - name: Upload frontend build artifact
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: frontend-dist
+      #     path: apps/nxmesh-frontend/dist
--- a/.github/workflows/verify.yaml
+++ b/.github/workflows/verify.yaml
@@ -0,0 +1,139 @@
+# this workflow verifies the generated code is up to date and valid
+
+name: Verify
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+env:
+  # OVERRIDE_REGISTRY can be set as a secret to override the default registry (e.g., for testing with a private registry). Else '' will be used, which defaults to ghcr.io for github.com and the GitHub server domain for self-hosted GitHub instances.
+  OVERRIDE_REGISTRY: ${{ secrets.OVERRIDE_REGISTRY }}
+  ACTIONS_STEP_DEBUG: true
+
+jobs:
+  get-ci-image:
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.setup.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup CI metadata
+        id: setup
+        uses: ./.github/actions/setup-ci-metadata
+        with:
+          registry: ${{ secrets.OVERRIDE_REGISTRY }}
+          image_tag: latest
+
+  verify-generated-db-entities:
+    runs-on: ubuntu-latest
+    needs:
+      - get-ci-image
+    container:
+      image: ${{ needs.get-ci-image.outputs.image_tag }}
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: nxmesh
+          # ! do not set a fixed port to avoid conflicts when running multiple jobs in parallel, use Docker's internal networking instead
+        # ports:
+        #   - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d nxmesh"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DATABASE_URL: postgres://postgres:postgres@postgres:5432/nxmesh
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check whether migrations/entities changed
+        id: check_changes
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE_SHA=${{ github.event.pull_request.base.sha }}
+            HEAD_SHA=${{ github.event.pull_request.head.sha }}
+          else
+            BASE_SHA=${{ github.event.before }}
+            HEAD_SHA=${{ github.sha }}
+          fi
+
+          if [ -z "$HEAD_SHA" ]; then
+            HEAD_SHA=$(git rev-parse --verify HEAD 2>/dev/null || echo "")
+          fi
+
+          if [ -z "$BASE_SHA" ]; then
+            PREV=$(git rev-parse --verify "${HEAD_SHA}^" 2>/dev/null || true)
+            if [ -n "$PREV" ]; then
+              BASE_SHA=$PREV
+            else
+              BASE_SHA=$HEAD_SHA
+            fi
+          fi
+
+          echo "Comparing $BASE_SHA..$HEAD_SHA"
+          CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" || true)
+          echo "$CHANGED_FILES"
+
+          echo "$CHANGED_FILES" | grep -E '^(crates/migration/src/|apps/nxmesh-master/src/db/entities/)' >/dev/null 2>&1 \
+            && echo "changed=true" >> $GITHUB_OUTPUT \
+            || echo "changed=true" >> $GITHUB_OUTPUT
+            # || echo "changed=false" >> $GITHUB_OUTPUT
+
+      - name: Setup Rust, checkout and restore caches
+        if: steps.check_changes.outputs.changed == 'true'
+        uses: ./.github/actions/setup-rust
+        with:
+          skip_cache: ${{ vars.SKIP_CACHE }}
+
+      - name: Install SeaORM CLI
+        if: steps.check_changes.outputs.changed == 'true'
+        run: |
+          cargo install sea-orm-cli@^2.0.0-rc --features "sqlx-postgres runtime-tokio-rustls"
+
+      - name: Apply migrations
+        if: steps.check_changes.outputs.changed == 'true'
+        run: |
+          cd crates && sea-orm-cli migrate up
+
+      - name: Regenerate entities
+        if: steps.check_changes.outputs.changed == 'true'
+        run: |
+          cd crates && sea-orm-cli generate entity \
+            --database-url "$DATABASE_URL" \
+            --output-dir ../apps/nxmesh-master/src/db/entities \
+            --with-serde both \
+            --with-copy-enums \
+            --date-time-crate chrono
+
+      - name: Check for uncommitted changes in entities
+        if: steps.check_changes.outputs.changed == 'true'
+        shell: bash
+        run: |
+          if [[ -n $(git status --porcelain --untracked-files=all | grep 'apps/nxmesh-master/src/db/entities/') ]]; then
+            echo "Generated SeaORM entities are not up to date."
+            echo "Run 'just db-generate' after applying migrations and commit the result."
+            git status --porcelain --untracked-files=all | grep 'apps/nxmesh-master/src/db/entities/'
+            exit 1
+          else
+            echo "Generated SeaORM entities are up to date."
+          fi
+
+      - name: Skip entity generation (no relevant changes)
+        if: steps.check_changes.outputs.changed == 'false'
+        run: echo "No changes in migrations/entities, skipping SeaORM entity verification."
--- a/.gitignore
+++ b/.gitignore
@@ -68,6 +68,7 @@ web_modules/
 # dotenv environment variable files
 .env
 .env.*
+*.env
 !.env.example

 # parcel-bundler cache (https://parceljs.org/)
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -538,6 +538,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
 dependencies = [
 "axum-core",
+ "axum-macros",
 "base64",
 "bytes",
 "form_urlencoded",
@@ -586,6 +587,45 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "axum-macros"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aa268c23bfbbd2c4363b9cd302a4f504fb2a9dfe7e3451d66f35dd392e20aca"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "axum-test"
+version = "20.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a86bfe2ef15bee102ac34912f7f4542b0bb37dc464fa55461763999c4d625e7"
+dependencies = [
+ "anyhow",
+ "axum",
+ "bytes",
+ "bytesize",
+ "cookie",
+ "expect-json",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "mime",
+ "pretty_assertions",
+ "reserve-port",
+ "rust-multipart-rfc7578_2",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tower",
+ "url",
+]
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -727,6 +767,12 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"

+[[package]]
+name = "bytesize"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bd91ee7b2422bcb158d90ef4d14f75ef67f340943fc4149891dcce8f8b972a3"
+
 [[package]]
 name = "bzip2"
 version = "0.6.1"
@@ -911,6 +957,16 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "time",
+ "version_check",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -1135,6 +1191,12 @@ dependencies = [
 "unicode-xid",
 ]

+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1188,6 +1250,15 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1262,6 +1333,35 @@ dependencies = [
 "pin-project-lite",
 ]

+[[package]]
+name = "expect-json"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "869f97f4abe8e78fc812a94ad6b721d72c4fb5532877c79610f2c238d7ccf6c4"
+dependencies = [
+ "chrono",
+ "email_address",
+ "expect-json-macros",
+ "num",
+ "regex",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "typetag",
+ "uuid",
+]
+
+[[package]]
+name = "expect-json-macros"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e6fdf550180a6c29a28cb9aac262dc0064c25735641d2317f670075e9a469d9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -1964,6 +2064,15 @@ dependencies = [
 "generic-array",
 ]

+[[package]]
+name = "inventory"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -2334,6 +2443,20 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -2410,6 +2533,17 @@ dependencies = [
 "num-modular",
 ]

+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2470,6 +2604,7 @@ dependencies = [
 "async-stream",
 "async-trait",
 "axum",
+ "axum-test",
 "chrono",
 "clap",
 "config",
@@ -2477,12 +2612,14 @@ dependencies = [
 "handlebars",
 "hex",
 "jsonwebtoken",
+ "mime_guess",
 "mockall",
 "nxmesh-core",
 "nxmesh-migration",
 "nxmesh-proto",
 "rand 0.10.0",
 "rcgen",
+ "rust-embed",
 "sea-orm",
 "sea-orm-migration",
 "serde",
@@ -2517,6 +2654,7 @@ name = "nxmesh-proto"
 version = "0.1.0"
 dependencies = [
 "prost",
+ "tokio-test",
 "tonic",
 "tonic-async-interceptor",
 "tonic-prost",
@@ -2931,6 +3069,16 @@ dependencies = [
 "termtree",
 ]

+[[package]]
+name = "pretty_assertions"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae130e2f271fbc2ac3a40fb1d07180839cdbbe443c7a27e1e3c13c5cac0116d"
+dependencies = [
+ "diff",
+ "yansi",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -3260,6 +3408,15 @@ dependencies = [
 "bytecheck",
 ]

+[[package]]
+name = "reserve-port"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94070964579245eb2f76e62a7668fe87bd9969ed6c41256f3bf614e3323dd3cc"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -3337,6 +3494,40 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "rust-embed"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04113cb9355a377d83f06ef1f0a45b8ab8cd7d8b1288160717d66df5c7988d27"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0902e4c7c8e997159ab384e6d0fc91c221375f6894346ae107f47dd0f3ccaa"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn 2.0.117",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bcdef0be6fe7f6fa333b1073c949729274b05f123a0ad7efcb8efd878e5c3b1"
+dependencies = [
+ "sha2",
+ "walkdir",
+]
+
 [[package]]
 name = "rust-ini"
 version = "0.21.3"
@@ -3347,6 +3538,21 @@ dependencies = [
 "ordered-multimap",
 ]

+[[package]]
+name = "rust-multipart-rfc7578_2"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00bdaa068902270ca7fa8619775e1838e23a63620abac0947ce0f715819b8cec"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "mime",
+ "rand 0.10.0",
+ "thiserror",
+]
+
 [[package]]
 name = "rust_decimal"
 version = "1.40.0"
@@ -3453,6 +3659,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"

+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.28"
@@ -4698,6 +4913,30 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"

+[[package]]
+name = "typetag"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be2212c8a9b9bcfca32024de14998494cf9a5dfa59ea1b829de98bac374b86bf"
+dependencies = [
+ "erased-serde",
+ "inventory",
+ "once_cell",
+ "serde",
+ "typetag-impl",
+]
+
+[[package]]
+name = "typetag-impl"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27a7a9b72ba121f6f1f6c3632b85604cac41aedb5ddc70accbebb6cac83de846"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "ucd-trie"
 version = "0.1.7"
@@ -4875,6 +5114,16 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"

+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -5045,6 +5294,15 @@ dependencies = [
 "wasite",
 ]

+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
--- a/apps/nxmesh-agent/src/cli/mod.rs
+++ b/apps/nxmesh-agent/src/cli/mod.rs
@@ -79,3 +79,84 @@ pub enum Commands {
        ca_cert: Option<String>,
    },
 }
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    use super::{Cli, Commands};
+
+    #[test]
+    fn parses_serve_flag_without_subcommand() {
+        let parsed = Cli::try_parse_from(["nxmesh-agent", "--serve"]);
+        assert!(parsed.is_ok());
+
+        let parsed = parsed.ok();
+        assert!(parsed.is_some());
+        let parsed = parsed.unwrap_or_else(|| unreachable!());
+
+        assert!(parsed.serve);
+        assert!(parsed.command.is_none());
+    }
+
+    #[test]
+    fn parses_import_certs_with_zip_defaults() {
+        let parsed = Cli::try_parse_from(["nxmesh-agent", "import-certs", "bundle.zip"]);
+        assert!(parsed.is_ok());
+
+        let parsed = parsed.ok();
+        assert!(parsed.is_some());
+        let parsed = parsed.unwrap_or_else(|| unreachable!());
+
+        match parsed.command {
+            Some(Commands::ImportCerts {
+                zip,
+                cert_name,
+                key_name,
+                ca_name,
+                cert,
+                key,
+                ca_cert,
+            }) => {
+                assert_eq!(zip.as_deref(), Some("bundle.zip"));
+                assert_eq!(cert_name.as_deref(), Some("cert.pem"));
+                assert_eq!(key_name.as_deref(), Some("key.pem"));
+                assert_eq!(ca_name.as_deref(), Some("ca.pem"));
+                assert!(cert.is_none());
+                assert!(key.is_none());
+                assert!(ca_cert.is_none());
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn rejects_import_certs_with_separate_files() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-agent",
+            "import-certs",
+            "--cert",
+            "agent.crt",
+            "--key",
+            "agent.key",
+            "--ca-cert",
+            "ca.crt",
+        ]);
+        assert!(parsed.is_err());
+    }
+
+    #[test]
+    fn rejects_conflicting_zip_and_separate_inputs() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-agent",
+            "import-certs",
+            "bundle.zip",
+            "--cert",
+            "agent.crt",
+            "--key",
+            "agent.key",
+        ]);
+
+        assert!(parsed.is_err());
+    }
+}
--- a/apps/nxmesh-agent/src/config/settings.rs
+++ b/apps/nxmesh-agent/src/config/settings.rs
@@ -318,6 +318,14 @@ where

 #[cfg(test)]
 mod tests {
+    use std::{
+        fs,
+        os::unix::fs::PermissionsExt,
+        path::{Path, PathBuf},
+    };
+
+    use tempfile::TempDir;
+
    use super::*;

    #[test]
@@ -330,4 +338,223 @@ mod tests {
        assert_send_sync::<LogSettings>();
        assert_send_sync::<NginxSettings>();
    }
+
+    fn write_file(path: &Path) {
+        let result = fs::write(path, b"content");
+        assert!(result.is_ok());
+    }
+
+    fn create_exec_file(path: &Path) {
+        write_file(path);
+        let metadata = fs::metadata(path);
+        assert!(metadata.is_ok());
+        let metadata = metadata.ok();
+        assert!(metadata.is_some());
+        let metadata = metadata.unwrap_or_else(|| unreachable!());
+
+        let mut perms = metadata.permissions();
+        perms.set_mode(0o755);
+        let result = fs::set_permissions(path, perms);
+        assert!(result.is_ok());
+    }
+
+    fn create_non_exec_file(path: &Path) {
+        write_file(path);
+        let metadata = fs::metadata(path);
+        assert!(metadata.is_ok());
+        let metadata = metadata.ok();
+        assert!(metadata.is_some());
+        let metadata = metadata.unwrap_or_else(|| unreachable!());
+
+        let mut perms = metadata.permissions();
+        perms.set_mode(0o644);
+        let result = fs::set_permissions(path, perms);
+        assert!(result.is_ok());
+    }
+
+    fn valid_tls_raw_paths(temp_dir: &TempDir) -> (PathBuf, PathBuf, PathBuf) {
+        let ca_path = temp_dir.path().join("ca.pem");
+        let cert_path = temp_dir.path().join("cert.pem");
+        let key_path = temp_dir.path().join("key.pem");
+
+        write_file(&ca_path);
+        write_file(&cert_path);
+        write_file(&key_path);
+
+        (ca_path, cert_path, key_path)
+    }
+
+    #[test]
+    fn tls_raw_path_validate_succeeds_when_all_files_exist() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let (ca_path, cert_path, key_path) = valid_tls_raw_paths(&temp_dir);
+        let settings = TLSSettings::RawPath {
+            ca_path: ca_path.to_string_lossy().to_string(),
+            cert_path: cert_path.to_string_lossy().to_string(),
+            key_path: key_path.to_string_lossy().to_string(),
+        };
+
+        assert!(settings.validate().is_ok());
+    }
+
+    #[test]
+    fn tls_raw_path_validate_fails_when_ca_missing() {
+        let settings = TLSSettings::RawPath {
+            ca_path: "/tmp/does-not-exist-ca.pem".into(),
+            cert_path: "/tmp/does-not-exist-cert.pem".into(),
+            key_path: "/tmp/does-not-exist-key.pem".into(),
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("CA file not found"));
+    }
+
+    #[test]
+    fn tls_zip_path_validate_fails_when_zip_missing() {
+        let settings = TLSSettings::ZipPath {
+            cert_zip_path: "/tmp/missing-certs.zip".into(),
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Certificate zip file not found"));
+    }
+
+    #[test]
+    fn grpc_validate_fails_when_connection_string_empty() {
+        let settings = GrpcSettings {
+            connection_string: "".into(),
+            m_auth: MAuthSettings::Tls(TLSSettings::ZipPath {
+                cert_zip_path: "/tmp/does-not-exist.zip".into(),
+            }),
+            cors: None,
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("gRPC connection string cannot be empty"));
+    }
+
+    #[test]
+    fn nginx_validate_succeeds_for_valid_paths_and_commands() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: default_nginx_reload_command(),
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        assert!(nginx.validate().is_ok());
+    }
+
+    #[test]
+    fn nginx_validate_fails_for_non_executable_binary() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_non_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: default_nginx_reload_command(),
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        let result = nginx.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Nginx binary is not executable"));
+    }
+
+    #[test]
+    fn nginx_validate_fails_when_reload_command_lacks_template() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: vec!["nginx".into(), "-s".into(), "reload".into()],
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        let result = nginx.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Nginx reload command must contain the binary path template"));
+    }
+
+    #[test]
+    fn level_filter_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_level_filter",
+                serialize_with = "serialize_level_filter"
+            )]
+            level: LevelFilter,
+        }
+
+        let original = Wrapper {
+            level: LevelFilter::DEBUG,
+        };
+
+        let encoded = serde_json::to_string(&original);
+        assert!(encoded.is_ok());
+        let encoded = encoded.ok();
+        assert!(encoded.is_some());
+        let encoded = encoded.unwrap_or_else(|| unreachable!());
+        assert!(encoded.to_lowercase().contains("debug"));
+
+        let decoded = serde_json::from_str::<Wrapper>(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.ok();
+        assert!(decoded.is_some());
+        let decoded = decoded.unwrap_or_else(|| unreachable!());
+        assert_eq!(decoded.level, LevelFilter::DEBUG);
+    }
 }
--- a/apps/nxmesh-agent/src/connector/master/mod.rs
+++ b/apps/nxmesh-agent/src/connector/master/mod.rs
@@ -4,7 +4,8 @@ use tokio::sync::Mutex;

 pub mod ssh;

-pub type AgentClient = nxmesh_proto::agent_service_client::AgentServiceClient<tonic::transport::Channel>;
+pub type AgentClient =
+    nxmesh_proto::agent_service_client::AgentServiceClient<tonic::transport::Channel>;

 #[async_trait::async_trait]
 pub trait MasterConnectorTrait: Send + Sync {
@@ -38,3 +39,105 @@ impl MasterConnectorTrait for MasterConnector {
        self.connector.get_client()
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    use tokio::sync::Mutex;
+
+    use crate::config::settings::{
+        GrpcSettings, LogSettings, MAuthSettings, Settings, TLSSettings,
+    };
+
+    use super::{AgentClient, MasterConnector, MasterConnectorTrait};
+
+    struct FakeConnector {
+        called: Arc<AtomicBool>,
+        fail: bool,
+        client: Arc<Mutex<AgentClient>>,
+    }
+
+    #[async_trait::async_trait]
+    impl MasterConnectorTrait for FakeConnector {
+        async fn connect(
+            &mut self,
+            _settings: &Settings,
+        ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+            self.called.store(true, Ordering::SeqCst);
+            if self.fail {
+                return Err("connector failed".into());
+            }
+            Ok(())
+        }
+
+        fn get_client(&self) -> Arc<Mutex<AgentClient>> {
+            self.client.clone()
+        }
+    }
+
+    fn test_settings() -> Settings {
+        Settings {
+            grpc: GrpcSettings {
+                connection_string: "https://localhost:50051".to_string(),
+                m_auth: MAuthSettings::Tls(TLSSettings::ZipPath {
+                    cert_zip_path: "/tmp/certs.zip".to_string(),
+                }),
+                cors: None,
+            },
+            log: LogSettings::default(),
+            nginx: None,
+        }
+    }
+
+    fn test_client() -> Arc<Mutex<AgentClient>> {
+        let channel =
+            tonic::transport::Channel::from_static("http://127.0.0.1:50051").connect_lazy();
+        Arc::new(Mutex::new(AgentClient::new(channel)))
+    }
+
+    #[tokio::test]
+    async fn master_connector_delegates_connect_successfully() {
+        let called = Arc::new(AtomicBool::new(false));
+        let fake = FakeConnector {
+            called: called.clone(),
+            fail: false,
+            client: test_client(),
+        };
+        let mut master = MasterConnector::new(Box::new(fake));
+
+        let result = master.connect(&test_settings()).await;
+        assert!(result.is_ok());
+        assert!(called.load(Ordering::SeqCst));
+    }
+
+    #[tokio::test]
+    async fn master_connector_propagates_connect_errors() {
+        let fake = FakeConnector {
+            called: Arc::new(AtomicBool::new(false)),
+            fail: true,
+            client: test_client(),
+        };
+        let mut master = MasterConnector::new(Box::new(fake));
+
+        let result = master.connect(&test_settings()).await;
+        assert!(result.is_err());
+    }
+
+    #[tokio::test]
+    async fn master_connector_returns_underlying_client() {
+        let shared_client = test_client();
+        let fake = FakeConnector {
+            called: Arc::new(AtomicBool::new(false)),
+            fail: false,
+            client: shared_client.clone(),
+        };
+        let master = MasterConnector::new(Box::new(fake));
+
+        let client = master.get_client();
+        assert!(Arc::ptr_eq(&client, &shared_client));
+    }
+}
--- a/apps/nxmesh-agent/src/connector/master/ssh.rs
+++ b/apps/nxmesh-agent/src/connector/master/ssh.rs
@@ -6,7 +6,7 @@ use nxmesh_proto::agent_service_client::AgentServiceClient;
 use tonic::transport::{Certificate, ClientTlsConfig, Identity};
 use tracing::warn;

-use crate::config::settings::{self, MAuthSettings, TLSSettings};
+use crate::config::settings::{MAuthSettings, TLSSettings};

 use super::{AgentClient, MasterConnectorTrait};

@@ -130,3 +130,151 @@ impl MasterConnectorTrait for SshMasterConnector {
        self.client.clone()
    }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used)]
+mod tests {
+    use std::{
+        fs::{self, File},
+        io::Write,
+        path::Path,
+    };
+
+    use tempfile::TempDir;
+
+    use crate::config::settings::{MAuthSettings, TLSSettings};
+
+    use super::SshMasterConnector;
+
+    const CERT_PEM: &[u8] = b"-----BEGIN CERTIFICATE-----\nAQ==\n-----END CERTIFICATE-----\n";
+    const KEY_PEM: &[u8] = b"-----BEGIN PRIVATE KEY-----\nAQ==\n-----END PRIVATE KEY-----\n";
+    const CA_PEM: &[u8] = b"-----BEGIN CERTIFICATE-----\nAQ==\n-----END CERTIFICATE-----\n";
+
+    fn create_zip_with_entries(
+        dir: &TempDir,
+        file_name: &str,
+        entries: &[(&str, &[u8])],
+    ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+        let zip_path = dir.path().join(file_name);
+        let file = File::create(&zip_path)?;
+        let mut zip = zip::ZipWriter::new(file);
+        let options = zip::write::SimpleFileOptions::default()
+            .compression_method(zip::CompressionMethod::Deflated)
+            .unix_permissions(0o600);
+
+        for (entry_name, contents) in entries {
+            zip.start_file(entry_name, options)?;
+            zip.write_all(contents)?;
+        }
+
+        zip.finish()?;
+        Ok(zip_path.to_string_lossy().to_string())
+    }
+
+    fn write_file(
+        path: &Path,
+        contents: &[u8],
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        fs::write(path, contents)?;
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn extract_certificate_succeeds_with_expected_files() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "certs.zip",
+            &[
+                ("cert.pem", CERT_PEM),
+                ("key.pem", KEY_PEM),
+                ("ca.pem", CA_PEM),
+                ("ignored.txt", b"ignored"),
+            ],
+        )
+        .expect("failed to create zip");
+
+        let (ca, cert, key) = SshMasterConnector::extract_certificate(&zip_path)
+            .await
+            .expect("expected cert extraction to succeed");
+
+        assert_eq!(ca, CA_PEM);
+        assert_eq!(cert, CERT_PEM);
+        assert_eq!(key, KEY_PEM);
+    }
+
+    #[tokio::test]
+    async fn extract_certificate_fails_when_required_files_are_missing() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "missing-key.zip",
+            &[("cert.pem", CERT_PEM), ("ca.pem", CA_PEM)],
+        )
+        .expect("failed to create zip");
+
+        let err = SshMasterConnector::extract_certificate(&zip_path)
+            .await
+            .expect_err("expected extraction to fail when key.pem is missing");
+
+        assert!(
+            err.to_string()
+                .contains("Certificate zip must contain cert.pem, key.pem and ca.pem")
+        );
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_succeeds_for_raw_paths() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let cert_path = temp_dir.path().join("cert.pem");
+        let key_path = temp_dir.path().join("key.pem");
+        let ca_path = temp_dir.path().join("ca.pem");
+
+        write_file(&cert_path, CERT_PEM).expect("failed to write cert.pem");
+        write_file(&key_path, KEY_PEM).expect("failed to write key.pem");
+        write_file(&ca_path, CA_PEM).expect("failed to write ca.pem");
+
+        let settings = MAuthSettings::Tls(TLSSettings::RawPath {
+            ca_path: ca_path.to_string_lossy().to_string(),
+            cert_path: cert_path.to_string_lossy().to_string(),
+            key_path: key_path.to_string_lossy().to_string(),
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_ok(), "expected raw path TLS config to succeed");
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_succeeds_for_zip_path() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "certs.zip",
+            &[
+                ("cert.pem", CERT_PEM),
+                ("key.pem", KEY_PEM),
+                ("ca.pem", CA_PEM),
+            ],
+        )
+        .expect("failed to create zip");
+
+        let settings = MAuthSettings::Tls(TLSSettings::ZipPath {
+            cert_zip_path: zip_path,
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_ok(), "expected zip path TLS config to succeed");
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_fails_for_missing_raw_files() {
+        let settings = MAuthSettings::Tls(TLSSettings::RawPath {
+            ca_path: "/tmp/non-existent-ca.pem".to_string(),
+            cert_path: "/tmp/non-existent-cert.pem".to_string(),
+            key_path: "/tmp/non-existent-key.pem".to_string(),
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_err(), "expected raw path TLS config to fail");
+    }
+}
--- a/apps/nxmesh-agent/src/connector/mod.rs
+++ b/apps/nxmesh-agent/src/connector/mod.rs
@@ -1 +1 @@
-pub mod master;
+pub mod master;
--- a/apps/nxmesh-agent/src/service/master_handler.rs
+++ b/apps/nxmesh-agent/src/service/master_handler.rs
@@ -0,0 +1,38 @@
+use std::sync::Arc;
+
+use nxmesh_proto::ConfigUpdate;
+use tracing::info;
+
+use crate::connector::master::MasterConnector;
+
+#[async_trait::async_trait]
+pub trait MasterHandler {
+    async fn on_config_update(
+        &self,
+        config_info: ConfigUpdate,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>>;
+}
+
+pub struct MasterHandlerImpl {
+    settings: Arc<crate::config::settings::Settings>,
+}
+
+impl MasterHandlerImpl {
+    pub fn new(settings: impl Into<Arc<crate::config::settings::Settings>>) -> Self {
+        Self {
+            settings: settings.into(),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl MasterHandler for MasterHandlerImpl {
+    async fn on_config_update(
+        &self,
+        config_info: ConfigUpdate,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        info!("Received config update from master: {:?}", config_info);
+
+        Ok(())
+    }
+}
--- a/apps/nxmesh-frontend/.gitignore
+++ b/apps/nxmesh-frontend/.gitignore
@@ -22,3 +22,5 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
+
+.react-router/
--- a/apps/nxmesh-frontend/bun.lock
+++ b/apps/nxmesh-frontend/bun.lock
--- a/apps/nxmesh-frontend/package.json
+++ b/apps/nxmesh-frontend/package.json
@@ -4,17 +4,24 @@
  "version": "0.0.0",
  "type": "module",
  "scripts": {
-    "dev": "vite",
-    "build": "tsc -b && vite build",
-    "lint": "eslint .",
-    "preview": "vite preview"
+    "build": "react-router build",
+    "dev": "react-router dev",
+    "start": "react-router-serve ./build/server/index.js",
+    "typecheck": "react-router typegen && tsc"
  },
  "dependencies": {
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0"
+    "@ant-design/icons": "^6.2.2",
+    "@react-router/node": "7.15.0",
+    "@react-router/serve": "7.15.0",
+    "antd": "^6.3.7",
+    "isbot": "^5.1.36",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "react-router": "7.15.0"
  },
  "devDependencies": {
    "@eslint/js": "^9.39.1",
+    "@react-router/dev": "7.15.0",
    "@types/node": "^24.10.1",
    "@types/react": "^19.2.7",
    "@types/react-dom": "^19.2.3",
@@ -25,6 +32,6 @@
    "globals": "^16.5.0",
    "typescript": "~5.9.3",
    "typescript-eslint": "^8.48.0",
-    "vite": "^7.3.1"
+    "vite": "^8.0.3"
  }
-}
+}
--- a/apps/nxmesh-frontend/react-router.config.ts
+++ b/apps/nxmesh-frontend/react-router.config.ts
@@ -0,0 +1,8 @@
+import type { Config } from '@react-router/dev/config';
+
+export default {
+  // Config options...
+  // Server-side render by default, to enable SPA mode set this to `false`
+  ssr: false,
+  appDirectory: 'src',
+} satisfies Config;
--- a/apps/nxmesh-frontend/src/App.css
+++ b/apps/nxmesh-frontend/src/App.css
@@ -1,42 +1,156 @@
+/* Light Professional Theme - nxMesh Dashboard */
+
+* {
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+body {
+  background-color: #f5f5f5;
+  margin: 0;
+  padding: 0;
+}
+
 #root {
-  max-width: 1280px;
-  margin: 0 auto;
-  padding: 2rem;
-  text-align: center;
+  width: 100%;
+  height: 100vh;
+  margin: 0;
+  padding: 0;
 }

-.logo {
-  height: 6em;
-  padding: 1.5em;
-  will-change: filter;
-  transition: filter 300ms;
-}
-.logo:hover {
-  filter: drop-shadow(0 0 2em #646cffaa);
-}
-.logo.react:hover {
-  filter: drop-shadow(0 0 2em #61dafbaa);
+/* Header Styles */
+.ant-layout-header {
+  background: #ffffff !important;
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.06);
 }

-@keyframes logo-spin {
-  from {
-    transform: rotate(0deg);
+/* Sidebar Styles */
+.ant-layout-sider {
+  background: #fafafa !important;
+}
+
+.ant-menu {
+  background: #fafafa !important;
+}
+
+.ant-menu-item,
+.ant-menu-submenu-title {
+  color: #333 !important;
+  transition: all 0.3s ease;
+}
+
+.ant-menu-item-selected {
+  background-color: #e6f7ff !important;
+  color: #1890ff !important;
+}
+
+.ant-menu-item:hover,
+.ant-menu-submenu-title:hover {
+  color: #1890ff !important;
+}
+
+/* Content Area */
+.ant-layout-content {
+  background: #f5f5f5;
+}
+
+/* Card Styles */
+.ant-card {
+  border-color: #f0f0f0;
+  border-radius: 6px;
+  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.03);
+  transition: all 0.3s ease;
+}
+
+.ant-card:hover {
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.08);
+}
+
+.ant-card-head {
+  border-bottom: 1px solid #f0f0f0;
+  background: #fafafa;
+}
+
+/* Statistic Styles */
+.ant-statistic-title {
+  color: #666;
+  font-size: 14px;
+  margin-bottom: 8px;
+}
+
+.ant-statistic-content {
+  color: #1890ff;
+  font-weight: 600;
+  font-size: 28px;
+}
+
+/* Button Styles */
+.ant-btn-primary {
+  background-color: #1890ff;
+  border-color: #1890ff;
+  transition: all 0.3s ease;
+}
+
+.ant-btn-primary:hover {
+  background-color: #0050b3;
+  border-color: #0050b3;
+  transform: translateY(-2px);
+  box-shadow: 0 4px 12px rgba(24, 144, 255, 0.3);
+}
+
+/* Input Styles */
+.ant-input {
+  border-radius: 4px;
+  border-color: #d9d9d9;
+}
+
+.ant-input:hover {
+  border-color: #1890ff;
+}
+
+.ant-input-focused {
+  border-color: #1890ff;
+  box-shadow: 0 0 0 2px rgba(24, 144, 255, 0.1);
+}
+
+/* Badge Styles */
+.ant-badge-success {
+  color: #52c41a;
+}
+
+.ant-badge-processing {
+  color: #1890ff;
+}
+
+/* Typography */
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  color: #333;
+  font-weight: 600;
+}
+
+p {
+  color: #666;
+  line-height: 1.6;
+}
+
+/* Responsive Design */
+@media (max-width: 768px) {
+  .ant-layout-sider {
+    width: 100% !important;
+    max-width: 100% !important;
  }
-  to {
-    transform: rotate(360deg);
+
+  .ant-layout-content {
+    padding: 16px !important;
+  }
+
+  .ant-card {
+    margin-bottom: 12px;
  }
 }
-
-@media (prefers-reduced-motion: no-preference) {
-  a:nth-of-type(2) .logo {
-    animation: logo-spin infinite 20s linear;
-  }
-}
-
-.card {
-  padding: 2em;
-}
-
-.read-the-docs {
-  color: #888;
-}
--- a/apps/nxmesh-frontend/src/App.tsx
+++ b/apps/nxmesh-frontend/src/App.tsx
@@ -1,35 +0,0 @@
-import { useState } from 'react'
-import reactLogo from './assets/react.svg'
-import viteLogo from '/vite.svg'
-import './App.css'
-
-function App() {
-  const [count, setCount] = useState(0)
-
-  return (
-    <>
-      <div>
-        <a href="https://vite.dev" target="_blank">
-          <img src={viteLogo} className="logo" alt="Vite logo" />
-        </a>
-        <a href="https://react.dev" target="_blank">
-          <img src={reactLogo} className="logo react" alt="React logo" />
-        </a>
-      </div>
-      <h1>Vite + React</h1>
-      <div className="card">
-        <button onClick={() => setCount((count) => count + 1)}>
-          count is {count}
-        </button>
-        <p>
-          Edit <code>src/App.tsx</code> and save to test HMR
-        </p>
-      </div>
-      <p className="read-the-docs">
-        Click on the Vite and React logos to learn more
-      </p>
-    </>
-  )
-}
-
-export default App
--- a/apps/nxmesh-frontend/src/assets/react.svg
+++ b/apps/nxmesh-frontend/src/assets/react.svg
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>
--- a/apps/nxmesh-frontend/src/components/Layout.tsx
+++ b/apps/nxmesh-frontend/src/components/Layout.tsx
@@ -0,0 +1,36 @@
+import type { PropsWithChildren } from 'react';
+import { Layout, ConfigProvider, theme } from 'antd';
+import { LayoutHeader } from './layout/Header';
+import { LayoutSidebar } from './layout/Sidebar';
+import { LayoutFooter } from './layout/Footer';
+const { Content } = Layout;
+
+export const RootLayout = ({ children }: PropsWithChildren) => {
+  return (
+    <ConfigProvider
+      theme={{
+        token: {
+          colorPrimary: '#1890ff',
+          borderRadius: 6,
+        },
+        algorithm: theme.defaultAlgorithm,
+      }}
+    >
+      <Layout style={{ minHeight: '100vh' }}>
+        {/* Header */}
+
+        <LayoutHeader />
+
+        <Layout>
+          {/* Sidebar */}
+          <LayoutSidebar />
+
+          {/* Main Content */}
+          <Content style={{ padding: '24px' }}>{children}</Content>
+        </Layout>
+
+        <LayoutFooter />
+      </Layout>
+    </ConfigProvider>
+  );
+};
--- a/apps/nxmesh-frontend/src/components/layout/Footer.tsx
+++ b/apps/nxmesh-frontend/src/components/layout/Footer.tsx
@@ -0,0 +1,17 @@
+import { Layout } from 'antd';
+const { Footer } = Layout;
+
+export const LayoutFooter = () => {
+  return (
+    <Footer
+      style={{
+        textAlign: 'center',
+        color: '#666',
+        borderTop: '1px solid #f0f0f0',
+        background: '#fafafa',
+      }}
+    >
+      nxMesh © 2026 All Rights Reserved
+    </Footer>
+  );
+};
--- a/apps/nxmesh-frontend/src/components/layout/Header.tsx
+++ b/apps/nxmesh-frontend/src/components/layout/Header.tsx
@@ -0,0 +1,47 @@
+import { Space, Avatar, Input, Button, Badge, Dropdown, Layout, type DropdownProps } from 'antd';
+import { UserOutlined, SearchOutlined, BellOutlined, LogoutOutlined } from '@ant-design/icons';
+const { Header } = Layout;
+
+const userMenuItems: Exclude<DropdownProps['menu'], undefined>['items'] = [
+  { key: 'profile', label: 'Profile' },
+  { key: 'settings', label: 'Settings' },
+  { type: 'divider' },
+  { key: 'logout', label: 'Logout', icon: <LogoutOutlined /> },
+];
+
+export const LayoutHeader = () => {
+  return (
+    <Header
+      style={{
+        background: '#fff',
+        padding: '0 24px',
+        boxShadow: '0 2px 8px rgba(0, 0, 0, 0.06)',
+        display: 'flex',
+        justifyContent: 'space-between',
+        alignItems: 'center',
+        position: 'sticky',
+        top: 0,
+        zIndex: 999,
+      }}
+    >
+      <div style={{ display: 'flex', alignItems: 'center', gap: '16px' }}>
+        <h1 style={{ margin: 0, fontSize: '20px', fontWeight: 'bold', color: '#1890ff' }}>nxMesh</h1>
+      </div>
+
+      <Input placeholder="Search agents, workspaces..." prefix={<SearchOutlined />} style={{ width: '300px' }} />
+
+      <Space size="large">
+        <Badge count={3} style={{ backgroundColor: '#ff4d4f' }}>
+          <Button type="text" icon={<BellOutlined style={{ fontSize: '18px' }} />} />
+        </Badge>
+        <Dropdown menu={{ items: userMenuItems }} trigger={['click']}>
+          <Space style={{ cursor: 'pointer' }}>
+            <Avatar icon={<UserOutlined />} style={{ backgroundColor: '#1890ff' }} />
+            {/* TODO: from store */}
+            <span>Admin User</span>
+          </Space>
+        </Dropdown>
+      </Space>
+    </Header>
+  );
+};
--- a/apps/nxmesh-frontend/src/components/layout/Sidebar.tsx
+++ b/apps/nxmesh-frontend/src/components/layout/Sidebar.tsx
@@ -0,0 +1,57 @@
+import { Button, Menu, Layout } from 'antd';
+import { useState } from 'react';
+import { DashboardOutlined, AppstoreOutlined, TeamOutlined, SettingOutlined } from '@ant-design/icons';
+
+const { Sider } = Layout;
+
+const menuItems = [
+  { key: '1', icon: <DashboardOutlined />, label: 'Dashboard' },
+  { key: '2', icon: <AppstoreOutlined />, label: 'Agents' },
+  { key: '3', icon: <AppstoreOutlined />, label: 'Workspaces' },
+  { key: '4', icon: <TeamOutlined />, label: 'Organizations' },
+  {
+    key: '5',
+    icon: <SettingOutlined />,
+    label: 'Infrastructure',
+    children: [
+      { key: '5-1', label: 'Virtual Hosts' },
+      { key: '5-2', label: 'Upstreams' },
+      { key: '5-3', label: 'Certificates' },
+    ],
+  },
+  { key: '6', icon: <TeamOutlined />, label: 'Users & Access' },
+  { key: '7', icon: <SettingOutlined />, label: 'Settings' },
+];
+
+export const LayoutSidebar = () => {
+  const [collapsed, setCollapsed] = useState(false);
+  const [selectedKey, setSelectedKey] = useState('1');
+
+  return (
+    <Sider
+      width={250}
+      trigger={null}
+      collapsible
+      collapsed={collapsed}
+      style={{
+        background: '#fafafa',
+        borderRight: '1px solid #f0f0f0',
+      }}
+    >
+      <Button
+        type="text"
+        onClick={() => setCollapsed(!collapsed)}
+        style={{
+          width: '100%',
+          height: '64px',
+          display: 'flex',
+          alignItems: 'center',
+          justifyContent: 'center',
+        }}
+      >
+        {collapsed ? '☰' : '☰'}
+      </Button>
+      <Menu mode="inline" selectedKeys={[selectedKey]} onSelect={(e) => setSelectedKey(e.key)} items={menuItems} style={{ border: 'none' }} />
+    </Sider>
+  );
+};
--- a/apps/nxmesh-frontend/src/index.css
+++ b/apps/nxmesh-frontend/src/index.css
@@ -1,68 +0,0 @@
-:root {
-  font-family: system-ui, Avenir, Helvetica, Arial, sans-serif;
-  line-height: 1.5;
-  font-weight: 400;
-
-  color-scheme: light dark;
-  color: rgba(255, 255, 255, 0.87);
-  background-color: #242424;
-
-  font-synthesis: none;
-  text-rendering: optimizeLegibility;
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-}
-
-a {
-  font-weight: 500;
-  color: #646cff;
-  text-decoration: inherit;
-}
-a:hover {
-  color: #535bf2;
-}
-
-body {
-  margin: 0;
-  display: flex;
-  place-items: center;
-  min-width: 320px;
-  min-height: 100vh;
-}
-
-h1 {
-  font-size: 3.2em;
-  line-height: 1.1;
-}
-
-button {
-  border-radius: 8px;
-  border: 1px solid transparent;
-  padding: 0.6em 1.2em;
-  font-size: 1em;
-  font-weight: 500;
-  font-family: inherit;
-  background-color: #1a1a1a;
-  cursor: pointer;
-  transition: border-color 0.25s;
-}
-button:hover {
-  border-color: #646cff;
-}
-button:focus,
-button:focus-visible {
-  outline: 4px auto -webkit-focus-ring-color;
-}
-
-@media (prefers-color-scheme: light) {
-  :root {
-    color: #213547;
-    background-color: #ffffff;
-  }
-  a:hover {
-    color: #747bff;
-  }
-  button {
-    background-color: #f9f9f9;
-  }
-}
--- a/apps/nxmesh-frontend/src/main.tsx
+++ b/apps/nxmesh-frontend/src/main.tsx
@@ -1,10 +0,0 @@
-import { StrictMode } from 'react'
-import { createRoot } from 'react-dom/client'
-import './index.css'
-import App from './App.tsx'
-
-createRoot(document.getElementById('root')!).render(
-  <StrictMode>
-    <App />
-  </StrictMode>,
-)
--- a/apps/nxmesh-frontend/src/root.tsx
+++ b/apps/nxmesh-frontend/src/root.tsx
@@ -0,0 +1,56 @@
+import './App.css';
+import { isRouteErrorResponse, Links, Meta, Outlet, Scripts, ScrollRestoration } from 'react-router';
+import type { Route } from './+types/root';
+import { RootLayout } from './components/Layout.tsx';
+
+export function Layout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <head>
+        <meta charSet="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <Meta />
+        <Links />
+      </head>
+      <body>
+        {children}
+        <ScrollRestoration />
+        <Scripts />
+      </body>
+    </html>
+  );
+}
+
+export default function App() {
+  return (
+    <RootLayout>
+      <Outlet />
+    </RootLayout>
+  );
+}
+
+export function ErrorBoundary({ error }: Route.ErrorBoundaryProps) {
+  let message = 'Oops!';
+  let details = 'An unexpected error occurred.';
+  let stack: string | undefined;
+
+  if (isRouteErrorResponse(error)) {
+    message = error.status === 404 ? '404' : 'Error';
+    details = error.status === 404 ? 'The requested page could not be found.' : error.statusText || details;
+  } else if (import.meta.env.DEV && error && error instanceof Error) {
+    details = error.message;
+    stack = error.stack;
+  }
+
+  return (
+    <main className="pt-16 p-4 container mx-auto">
+      <h1>{message}</h1>
+      <p>{details}</p>
+      {stack && (
+        <pre className="w-full p-4 overflow-x-auto">
+          <code>{stack}</code>
+        </pre>
+      )}
+    </main>
+  );
+}
--- a/apps/nxmesh-frontend/src/routes.ts
+++ b/apps/nxmesh-frontend/src/routes.ts
@@ -0,0 +1,3 @@
+import { type RouteConfig, index } from "@react-router/dev/routes";
+
+export default [index("routes/home.tsx")] satisfies RouteConfig;
--- a/apps/nxmesh-frontend/src/routes/home.tsx
+++ b/apps/nxmesh-frontend/src/routes/home.tsx
@@ -0,0 +1,70 @@
+import type { Route } from './+types/home';
+import { Row, Col, Card, Statistic, Space, Badge } from 'antd';
+
+export function meta({}: Route.MetaArgs) {
+  return [{ title: 'New React Router App' }, { name: 'description', content: 'Welcome to React Router!' }];
+}
+
+export default function Home() {
+  return (
+    <div style={{ background: '#fff', padding: '24px', borderRadius: '6px', minHeight: '400px' }}>
+      <h2 style={{ marginBottom: '24px', fontSize: '24px', fontWeight: '600' }}>Dashboard</h2>
+
+      {/* Key Metrics */}
+      <Row gutter={[16, 16]} style={{ marginBottom: '32px' }}>
+        <Col xs={24} sm={12} lg={6}>
+          <Card hoverable>
+            <Statistic title="Active Agents" value={12} prefix="📡" />
+          </Card>
+        </Col>
+        <Col xs={24} sm={12} lg={6}>
+          <Card hoverable>
+            <Statistic title="Workspaces" value={5} prefix="📁" />
+          </Card>
+        </Col>
+        <Col xs={24} sm={12} lg={6}>
+          <Card hoverable>
+            <Statistic title="Organizations" value={3} prefix="🏢" />
+          </Card>
+        </Col>
+        <Col xs={24} sm={12} lg={6}>
+          <Card hoverable>
+            <Statistic title="System Health" value={98} suffix="%" valueStyle={{ color: '#52c41a' }} />
+          </Card>
+        </Col>
+      </Row>
+
+      {/* Content Sections */}
+      <Row gutter={[16, 16]}>
+        <Col xs={24} lg={12}>
+          <Card title="Recent Activities" hoverable>
+            <Space direction="vertical" style={{ width: '100%' }}>
+              <p>✓ Agent-01 connected successfully</p>
+              <p>✓ Workspace "Production" updated</p>
+              <p>✓ Certificate renewed for api.example.com</p>
+              <p>✓ New user invited to organization</p>
+            </Space>
+          </Card>
+        </Col>
+        <Col xs={24} lg={12}>
+          <Card title="System Status" hoverable>
+            <Space direction="vertical" style={{ width: '100%' }}>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
+                <span>API Server</span>
+                <Badge status="success" text="Online" />
+              </div>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
+                <span>Database</span>
+                <Badge status="success" text="Online" />
+              </div>
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
+                <span>Message Queue</span>
+                <Badge status="processing" text="Operational" />
+              </div>
+            </Space>
+          </Card>
+        </Col>
+      </Row>
+    </div>
+  );
+}
--- a/apps/nxmesh-frontend/vite.config.ts
+++ b/apps/nxmesh-frontend/vite.config.ts
@@ -1,7 +1,13 @@
-import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react-swc'
+import { defineConfig } from 'vite';
+import { reactRouter } from '@react-router/dev/vite';

 // https://vite.dev/config/
 export default defineConfig({
-  plugins: [react()],
-})
+  plugins: [reactRouter()],
+  ssr: {
+    noExternal: ['@ant-design/icons', '@rc-component/util'],
+  },
+  resolve: {
+    tsconfigPaths: true,
+  },
+});
--- a/apps/nxmesh-master/Cargo.toml
+++ b/apps/nxmesh-master/Cargo.toml
@@ -84,7 +84,13 @@ time = "0.3"

 # Cert handling
 zip = { workspace = true }
+rust-embed = { version = "8.11.0", features = [] }
+mime_guess = "2.0.5"
+axum-test = "20.0.0"

 [dev-dependencies]
 tokio-test.workspace = true
 mockall.workspace = true
+
+[features]
+dev-tools = ["axum/macros"]
--- a/apps/nxmesh-master/frontend-dist
+++ b/apps/nxmesh-master/frontend-dist
@@ -0,0 +1 @@
+../nxmesh-frontend/dist/
--- a/apps/nxmesh-master/src/cli/mod.rs
+++ b/apps/nxmesh-master/src/cli/mod.rs
@@ -61,3 +61,73 @@ pub async fn handle_sub_command(
        } => Ok(gen_agent_certs(settings, output, agent_id, zip).await?),
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    use super::{Cli, Commands};
+
+    #[test]
+    fn parses_serve_mode() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "--serve"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        assert!(parsed.serve);
+        assert!(!parsed.generate_ca);
+        assert!(parsed.command.is_none());
+    }
+
+    #[test]
+    fn parses_generate_ca_flag() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "--generate-ca", "--serve"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        assert!(parsed.generate_ca);
+        assert!(parsed.serve);
+    }
+
+    #[test]
+    fn parses_gen_certs_with_default_output() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "gen-certs"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        match parsed.command {
+            Some(Commands::GenCerts { output }) => {
+                assert_eq!(output, "./certs");
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn parses_gen_agent_certs_with_custom_values() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-master",
+            "gen-agent-certs",
+            "--output",
+            "./out",
+            "--agent-id",
+            "agent-123",
+            "--zip",
+        ]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        match parsed.command {
+            Some(Commands::GenAgentCerts {
+                output,
+                agent_id,
+                zip,
+            }) => {
+                assert_eq!(output, "./out");
+                assert_eq!(agent_id, "agent-123");
+                assert!(zip);
+            }
+            _ => unreachable!(),
+        }
+    }
+}
--- a/apps/nxmesh-master/src/config/settings.rs
+++ b/apps/nxmesh-master/src/config/settings.rs
@@ -334,6 +334,13 @@ where

 #[cfg(test)]
 mod tests {
+    use std::{
+        fs,
+        net::{IpAddr, Ipv4Addr},
+        path::PathBuf,
+        time::{SystemTime, UNIX_EPOCH},
+    };
+
    use super::*;

    #[test]
@@ -348,4 +355,232 @@ mod tests {
        assert_send_sync::<CorsSettings>();
        assert_send_sync::<LogSettings>();
    }
+
+    fn make_temp_dir(prefix: &str) -> PathBuf {
+        let ts = SystemTime::now().duration_since(UNIX_EPOCH);
+        assert!(ts.is_ok());
+        let ts = ts.unwrap_or_default();
+        let path = std::env::temp_dir().join(format!(
+            "{}_{}_{}",
+            prefix,
+            std::process::id(),
+            ts.as_nanos()
+        ));
+        let created = fs::create_dir_all(&path);
+        assert!(created.is_ok());
+        path
+    }
+
+    #[test]
+    fn certificate_paths_include_cert_dir() {
+        let cert = CertificateSettings {
+            cert_dir: "./certs".to_string(),
+            san_dns: Vec::new(),
+            san_ip: Vec::new(),
+            cert_path: Some("server.crt".to_string()),
+            key_path: Some("server.key".to_string()),
+        };
+
+        assert_eq!(cert.cert_path(), Some("./certs/server.crt".to_string()));
+        assert_eq!(cert.key_path(), Some("./certs/server.key".to_string()));
+    }
+
+    #[test]
+    fn certificate_validate_creates_directory_when_missing() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-create").join("nested");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: vec![san],
+            san_ip: Vec::new(),
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_ok());
+        assert!(cert_dir.exists());
+
+        let _ = fs::remove_dir_all(cert_dir.parent().unwrap_or(&cert_dir));
+    }
+
+    #[test]
+    fn certificate_validate_fails_when_only_cert_path_is_set() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-partial");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: vec![san],
+            san_ip: Vec::new(),
+            cert_path: Some("server.crt".to_string()),
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Both certificate and key paths must be provided"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn certificate_validate_fails_with_unspecified_ip() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-unspecified-ip");
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: Vec::new(),
+            san_ip: vec![IpAddr::V4(Ipv4Addr::UNSPECIFIED)],
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("SAN IP entries cannot be unspecified"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn certificate_validate_fails_without_any_san_entries() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-no-san");
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: Vec::new(),
+            san_ip: Vec::new(),
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("At least one SAN entry"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn database_validate_fails_for_zero_max_connections() {
+        let db = DatabaseSettings {
+            url: "postgres://localhost/db".to_string(),
+            max_connections: Some(0),
+        };
+
+        let result = db.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Max database connections must be greater than 0"));
+    }
+
+    #[test]
+    fn auth_validate_fails_for_empty_secret() {
+        let auth = AuthSettings {
+            jwt_secret: "".to_string(),
+            jwt_expiration_hours: 24,
+        };
+
+        let result = auth.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("JWT secret cannot be empty"));
+    }
+
+    #[test]
+    fn server_validate_fails_for_zero_port() {
+        let cert_dir = make_temp_dir("nxmesh-master-server-validate");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let server = ServerSettings {
+            bind_address: "0.0.0.0".to_string(),
+            port: 0,
+            certificate: CertificateSettings {
+                cert_dir: cert_dir.to_string_lossy().to_string(),
+                san_dns: vec![san],
+                san_ip: Vec::new(),
+                cert_path: None,
+                key_path: None,
+            },
+            cors: None,
+        };
+
+        let result = server.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Server port must be greater than 0"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn level_filter_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_level_filter",
+                serialize_with = "serialize_level_filter"
+            )]
+            level: LevelFilter,
+        }
+
+        let data = Wrapper {
+            level: LevelFilter::DEBUG,
+        };
+
+        let encoded = serde_json::to_string(&data);
+        assert!(encoded.is_ok());
+        let encoded = encoded.unwrap_or_default();
+        assert!(encoded.to_lowercase().contains("debug"));
+
+        let decoded: Result<Wrapper, _> = serde_json::from_str(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or(Wrapper {
+            level: LevelFilter::ERROR,
+        });
+        assert_eq!(decoded.level, LevelFilter::DEBUG);
+    }
+
+    #[test]
+    fn ia5string_vec_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_ia5string_vec",
+                serialize_with = "serialize_ia5string_vec"
+            )]
+            san_dns: Vec<Ia5String>,
+        }
+
+        let first = Ia5String::try_from("localhost".to_string());
+        assert!(first.is_ok());
+        let second = Ia5String::try_from("example.com".to_string());
+        assert!(second.is_ok());
+
+        let first = first.unwrap_or_else(|_| unreachable!());
+        let second = second.unwrap_or_else(|_| unreachable!());
+
+        let data = Wrapper {
+            san_dns: vec![first, second],
+        };
+
+        let encoded = serde_json::to_string(&data);
+        assert!(encoded.is_ok());
+        let encoded = encoded.unwrap_or_default();
+        assert!(encoded.contains("localhost"));
+        assert!(encoded.contains("example.com"));
+
+        let decoded: Result<Wrapper, _> = serde_json::from_str(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or(Wrapper {
+            san_dns: Vec::new(),
+        });
+        assert_eq!(decoded.san_dns.len(), 2);
+    }
 }
--- a/apps/nxmesh-master/src/connector/agent/ssh.rs
+++ b/apps/nxmesh-master/src/connector/agent/ssh.rs
@@ -6,6 +6,7 @@ use nxmesh_proto::{
 };
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter};
 use tonic::transport::Server;
+use tracing::info;

 use crate::{db::entities::public_key_revocations, service::agent::AgentServerService};

@@ -69,7 +70,14 @@ impl AgentConnectorTrait for SshAgentConnector {
            .layer(ssh_interceptor)
            .add_service(agent_server_service);

-        router.serve(addr).await?;
+        info!("SSH Agent gRPC server is listening on {}", addr);
+        router
+            .serve(addr)
+            .await
+            .inspect(|_| info!("SSH Agent gRPC server stopped gracefully."))
+            .inspect_err(|e| {
+                tracing::error!("SSH Agent gRPC server failed: {}", e);
+            })?;
        Ok(())
    }
 }
--- a/apps/nxmesh-master/src/db/mod.rs
+++ b/apps/nxmesh-master/src/db/mod.rs
@@ -9,3 +9,16 @@ pub(crate) async fn establish_connection(
        .await
        .map_err(|e| format!("Failed to connect to database: {}", e).into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::establish_connection;
+
+    #[tokio::test]
+    async fn establish_connection_fails_for_invalid_url_scheme() {
+        let result = establish_connection("invalid://not-a-db").await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("Failed to connect to database"));
+    }
+}
--- a/apps/nxmesh-master/src/main.rs
+++ b/apps/nxmesh-master/src/main.rs
@@ -14,6 +14,7 @@ mod cli;
 mod config;
 mod connector;
 mod db;
+mod routes;
 mod service;

 #[tokio::main]
--- a/apps/nxmesh-master/src/routes/frontend/mod.rs
+++ b/apps/nxmesh-master/src/routes/frontend/mod.rs
@@ -0,0 +1,160 @@
+use axum::{Router, response::IntoResponse};
+use tracing::error;
+
+// In development, build the frontend from the source directory, the soft link will handle the path resolution
+// In deployment, pre-build the frontend and replace the frontend-dist folder with the built assets, the rust-embed will handle the embedding and path resolution
+#[derive(rust_embed::Embed)]
+#[folder = "./frontend-dist/"]
+struct FrontendAssets;
+
+const INDEX_HTML: &str = "index.html";
+
+pub async fn get_router() -> Router {
+    Router::new()
+        .route(
+            "/",
+            axum::routing::get(get_fallback_handler)
+                .head(get_fallback_handler)
+                .options(get_fallback_handler),
+        )
+        .route(
+            "/{*path}",
+            axum::routing::get(get_file_handler)
+                .head(get_file_handler)
+                .options(get_file_handler),
+        )
+        //
+        .fallback(get_fallback_handler().await)
+}
+
+pub async fn get_fallback_handler() -> Result<axum::response::Html<Vec<u8>>, axum::http::StatusCode>
+{
+    let index_html = get_index_html();
+    match index_html {
+        Some(html) => Ok(axum::response::Html(html)),
+        None => Err(axum::http::StatusCode::NOT_FOUND),
+    }
+}
+
+fn get_index_html() -> Option<Vec<u8>> {
+    FrontendAssets::get(INDEX_HTML).map(|asset| asset.data.as_ref().to_owned())
+}
+
+async fn get_file_handler(
+    axum::extract::Path(path): axum::extract::Path<String>,
+) -> Result<axum::response::Response, axum::http::StatusCode> {
+    let file_path = if path.is_empty() {
+        INDEX_HTML.to_string()
+    } else {
+        path
+    };
+
+    match FrontendAssets::get(&file_path) {
+        Some(asset) => {
+            let content_type = mime_guess::from_path(&file_path).first_or_octet_stream();
+            let response = axum::response::Response::builder()
+                .header(axum::http::header::CONTENT_TYPE, content_type.as_ref())
+                .body(asset.data.into_owned().into())
+                .map_err(|e| {
+                    error!("Failed to build response for {}: {}", file_path, e);
+                    axum::http::StatusCode::INTERNAL_SERVER_ERROR
+                })?;
+            Ok(response)
+        }
+        // return index.html for any file not found to support client-side routing in the frontend
+        None => get_fallback_handler()
+            .await
+            .map(|html| html.into_response()),
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_asset() {
+        // list all embedded assets for debugging
+        let assets = FrontendAssets::iter().collect::<Vec<_>>();
+        println!("Embedded assets: {:?}", assets);
+        assert!(
+            !assets.is_empty(),
+            "Expected to find embedded assets, but found none"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_get_index_html() {
+        let index_html = get_index_html();
+        assert!(
+            index_html.is_some(),
+            "Expected to find index.html in embedded assets"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_get_file_handler_existing_file() {
+        let response = get_file_handler(axum::extract::Path("index.html".to_string())).await;
+        assert!(
+            response.is_ok(),
+            "Expected to successfully retrieve index.html"
+        );
+        let response = response.expect("Expected response to be Ok");
+        assert_eq!(response.status(), axum::http::StatusCode::OK);
+        assert!(
+            response
+                .headers()
+                .get(axum::http::header::CONTENT_TYPE)
+                .map(|ct| ct.to_str().unwrap_or(""))
+                .expect("Content-Type header should be present")
+                .starts_with("text/html")
+        );
+    }
+
+    #[tokio::test]
+    async fn test_get_file_handler_nonexistent_file() {
+        let response = get_file_handler(axum::extract::Path("nonexistent.txt".to_string())).await;
+        assert!(
+            response.is_ok(),
+            "Expected to fallback to index.html for nonexistent file"
+        );
+        let response = response.expect("Expected response to be Ok");
+        assert_eq!(response.status(), axum::http::StatusCode::OK);
+        assert!(
+            response
+                .headers()
+                .get(axum::http::header::CONTENT_TYPE)
+                .map(|ct| ct.to_str().unwrap_or(""))
+                .expect("Content-Type header should be present")
+                .starts_with("text/html")
+        )
+    }
+}
+
+#[cfg(test)]
+mod axum_tests {
+    use super::*;
+    use axum_test::TestServer;
+
+    #[tokio::test]
+    async fn test_should_return_index_html_for_root_path() {
+        let router = get_router().await;
+        let server = TestServer::new(router);
+        let response = server.get("/").await;
+        assert_eq!(response.status_code(), 200);
+    }
+
+    #[tokio::test]
+    async fn test_should_return_index_html_for_nonexistent_path() {
+        let router = get_router().await;
+        let server = TestServer::new(router);
+        let fallback_response = server.get("/nonexistent").await;
+        assert_eq!(fallback_response.status_code(), 200);
+
+        let index_response = server.get("/").await;
+        assert_eq!(index_response.status_code(), 200);
+
+        assert_eq!(fallback_response.text(), index_response.text());
+    }
+}
--- a/apps/nxmesh-master/src/routes/mod.rs
+++ b/apps/nxmesh-master/src/routes/mod.rs
@@ -0,0 +1,36 @@
+use axum::Router;
+
+mod frontend;
+
+pub async fn get_root_router() -> Router {
+    Router::new()
+        .merge(frontend::get_router().await)
+        .fallback(frontend::get_fallback_handler().await)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum_test::TestServer;
+
+    #[tokio::test]
+    async fn test_should_return_index_html_for_root_path() {
+        let router = get_root_router().await;
+        let server = TestServer::new(router);
+        let response = server.get("/").await;
+        assert_eq!(response.status_code(), 200);
+    }
+
+    #[tokio::test]
+    async fn test_should_return_index_html_for_nonexistent_path() {
+        let router = get_root_router().await;
+        let server = TestServer::new(router);
+        let fallback_response = server.get("/nonexistent").await;
+        assert_eq!(fallback_response.status_code(), 200);
+
+        let index_response = server.get("/").await;
+        assert_eq!(index_response.status_code(), 200);
+
+        assert_eq!(fallback_response.text(), index_response.text());
+    }
+}
--- a/apps/nxmesh-master/src/service/certificate/mod.rs
+++ b/apps/nxmesh-master/src/service/certificate/mod.rs
@@ -347,3 +347,392 @@ fn validity_period() -> (OffsetDateTime, OffsetDateTime) {
    };
    (not_before, not_after)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        fs,
+        net::{IpAddr, Ipv4Addr},
+        os::unix::fs::PermissionsExt,
+        path::{Path, PathBuf},
+        sync::Arc,
+        time::{SystemTime, UNIX_EPOCH},
+    };
+
+    use rcgen::string::Ia5String;
+    use sea_orm::DatabaseConnection;
+    use serde_json::json;
+
+    use crate::config::settings::Settings;
+
+    use super::{CertificateService, CertificateServiceImpl, ConnectionType, validity_period};
+
+    fn unique_temp_dir(prefix: &str) -> PathBuf {
+        let now = SystemTime::now().duration_since(UNIX_EPOCH);
+        assert!(now.is_ok());
+        let now = now.unwrap_or_default();
+
+        let dir = std::env::temp_dir().join(format!(
+            "{}_{}_{}",
+            prefix,
+            std::process::id(),
+            now.as_nanos()
+        ));
+        let created = fs::create_dir_all(&dir);
+        assert!(created.is_ok());
+        dir
+    }
+
+    fn mock_db_connection() -> DatabaseConnection {
+        DatabaseConnection::default()
+    }
+
+    fn parse_ia5(input: &str) -> Ia5String {
+        let value = Ia5String::try_from(input.to_string());
+        assert!(value.is_ok());
+        value.unwrap_or_else(|_| unreachable!())
+    }
+
+    fn test_settings(grpc_dns: &str, http_dns: &str) -> Arc<Settings> {
+        let parsed = serde_json::from_value::<Settings>(json!({
+            "server": {
+                "bind_address": "127.0.0.1",
+                "port": 8080,
+                "certificate": {
+                    "cert_dir": "./certs",
+                    "san_dns": [http_dns],
+                    "san_ip": ["127.0.0.2"]
+                },
+                "cors": null
+            },
+            "database": {
+                "url": "postgres://user:pass@localhost/db",
+                "max_connections": 5
+            },
+            "grpc": {
+                "bind_address": "127.0.0.1",
+                "port": 50051,
+                "certificate": {
+                    "cert_dir": "./certs",
+                    "san_dns": [grpc_dns],
+                    "san_ip": ["127.0.0.1"]
+                },
+                "cors": null
+            },
+            "auth": {
+                "jwt_secret": "secret",
+                "jwt_expiration_hours": 24
+            },
+            "log": {
+                "level": "INFO"
+            }
+        }));
+
+        assert!(parsed.is_ok());
+        Arc::new(parsed.unwrap_or_else(|_| unreachable!()))
+    }
+
+    fn new_service(cert_dir: &str) -> CertificateServiceImpl {
+        CertificateServiceImpl::new(
+            mock_db_connection(),
+            cert_dir.to_string(),
+            test_settings("grpc.local", "http.local"),
+        )
+    }
+
+    #[test]
+    fn validity_period_is_forward_and_about_one_year() {
+        let (not_before, not_after) = validity_period();
+        assert!(not_after > not_before);
+
+        let diff = not_after - not_before;
+        assert!(diff.whole_days() >= 364);
+        assert!(diff.whole_days() <= 366);
+    }
+
+    #[tokio::test]
+    async fn get_ca_cert_fails_when_folder_missing() {
+        let dir = unique_temp_dir("nxmesh-master-ca-missing");
+        let removed = fs::remove_dir_all(&dir);
+        assert!(removed.is_ok());
+
+        let service = new_service(&dir.to_string_lossy());
+        let result = service.get_ca_cert().await;
+        assert!(result.is_err());
+
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate folder not found"));
+    }
+
+    #[tokio::test]
+    async fn generate_ca_cert_creates_files_and_is_retrievable() {
+        let dir = unique_temp_dir("nxmesh-master-generate-ca");
+        let service = new_service(&dir.to_string_lossy());
+
+        let generated = service.generate_ca_cert().await;
+        assert!(generated.is_ok());
+        let generated = generated.unwrap_or_else(|_| unreachable!());
+        assert!(!generated.cert_pem.is_empty());
+        assert!(!generated.private_key.is_empty());
+        assert!(!generated.public_key.is_empty());
+
+        let ca_cert = dir.join("ca.crt");
+        let ca_key = dir.join("ca.key");
+        let ca_pub = dir.join("ca.pub");
+
+        assert!(ca_cert.exists());
+        assert!(ca_key.exists());
+        assert!(ca_pub.exists());
+
+        let cert_meta = fs::metadata(&ca_cert);
+        assert!(cert_meta.is_ok());
+        let cert_meta = cert_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_meta.permissions().mode() & 0o777, 0o600);
+
+        let key_meta = fs::metadata(&ca_key);
+        assert!(key_meta.is_ok());
+        let key_meta = key_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(key_meta.permissions().mode() & 0o777, 0o600);
+
+        let pub_meta = fs::metadata(&ca_pub);
+        assert!(pub_meta.is_ok());
+        let pub_meta = pub_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(pub_meta.permissions().mode() & 0o777, 0o600);
+
+        let retrieved = service.get_ca_cert().await;
+        assert!(retrieved.is_ok());
+        let (cert_path, key_path) = retrieved.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_path, ca_cert.to_string_lossy());
+        assert_eq!(key_path, ca_key.to_string_lossy());
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn get_ca_cert_fails_when_folder_exists_but_files_missing() {
+        let dir = unique_temp_dir("nxmesh-master-ca-partial");
+        let service = new_service(&dir.to_string_lossy());
+
+        let ca_cert_path = dir.join("ca.crt");
+        let write_result = fs::write(&ca_cert_path, "dummy cert");
+        assert!(write_result.is_ok());
+
+        let result = service.get_ca_cert().await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate or key not found"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_ca_cert_fails_when_ca_exists() {
+        let dir = unique_temp_dir("nxmesh-master-ca-exists");
+        let service = new_service(&dir.to_string_lossy());
+
+        let first = service.generate_ca_cert().await;
+        assert!(first.is_ok());
+
+        let second = service.generate_ca_cert().await;
+        assert!(second.is_err());
+        let msg = second.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate already exists"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_pub_cert_pair_requires_ca_cert() {
+        let dir = unique_temp_dir("nxmesh-master-pub-cert-missing-ca");
+        let service = new_service(&dir.to_string_lossy());
+
+        let result = service
+            .generate_pub_cert_pair(
+                vec![IpAddr::V4(Ipv4Addr::LOCALHOST)],
+                vec![parse_ia5("localhost")],
+            )
+            .await;
+        assert!(result.is_err());
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_pub_cert_pair_succeeds_after_ca_generation() {
+        let dir = unique_temp_dir("nxmesh-master-pub-cert-ok");
+        let service = new_service(&dir.to_string_lossy());
+
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let cert_pair = service
+            .generate_pub_cert_pair(
+                vec![IpAddr::V4(Ipv4Addr::LOCALHOST)],
+                vec![parse_ia5("localhost")],
+            )
+            .await;
+        assert!(cert_pair.is_ok());
+        let (cert, key) = cert_pair.unwrap_or_else(|_| unreachable!());
+
+        assert!(cert.contains("BEGIN CERTIFICATE"));
+        assert!(key.contains("BEGIN PRIVATE KEY"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_fails_when_output_parent_missing() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-ca");
+        let missing_output = unique_temp_dir("nxmesh-master-agent-certs-missing");
+        let removed = fs::remove_dir_all(&missing_output);
+        assert!(removed.is_ok());
+
+        let service = new_service(&ca_dir.to_string_lossy());
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let result = service
+            .generate_agent_certs("agent-id", &missing_output.to_string_lossy())
+            .await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("Output parent directory does not exist"));
+
+        let _ = fs::remove_dir_all(&ca_dir);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_fails_when_ca_is_missing() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-no-ca");
+        let output_parent = unique_temp_dir("nxmesh-master-agent-certs-no-ca-out");
+        let service = new_service(&ca_dir.to_string_lossy());
+
+        let result = service
+            .generate_agent_certs("agent-1", &output_parent.to_string_lossy())
+            .await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(
+            msg.contains("CA certificate")
+                || msg.contains("CA certificate folder not found")
+                || msg.contains("CA certificate or key not found")
+        );
+
+        let _ = fs::remove_dir_all(&ca_dir);
+        let _ = fs::remove_dir_all(&output_parent);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_and_zip_certificates_succeeds() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-zip-ca");
+        let output_parent = unique_temp_dir("nxmesh-master-agent-certs-zip-out");
+        let service = new_service(&ca_dir.to_string_lossy());
+
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let generated = service
+            .generate_agent_certs("agent-42", &output_parent.to_string_lossy())
+            .await;
+        assert!(generated.is_ok());
+        let generated = generated.unwrap_or_else(|_| unreachable!());
+
+        assert!(Path::new(&generated.cert_path).exists());
+        assert!(Path::new(&generated.key_path).exists());
+        assert!(Path::new(&generated.ca_cert_path).exists());
+
+        assert!(generated.cert_path.ends_with("agent-42/cert.pem"));
+        assert!(generated.key_path.ends_with("agent-42/key.pem"));
+
+        let cert_meta = fs::metadata(&generated.cert_path);
+        assert!(cert_meta.is_ok());
+        let cert_meta = cert_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_meta.permissions().mode() & 0o777, 0o600);
+
+        let key_meta = fs::metadata(&generated.key_path);
+        assert!(key_meta.is_ok());
+        let key_meta = key_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(key_meta.permissions().mode() & 0o777, 0o600);
+
+        let zip = service
+            .zip_certificates(
+                &generated.cert_path,
+                &generated.key_path,
+                &generated.ca_cert_path,
+            )
+            .await;
+        assert!(zip.is_ok());
+        let zip = zip.unwrap_or_else(|_| unreachable!());
+        assert!(Path::new(&zip).exists());
+
+        let zip_file = std::fs::File::open(&zip);
+        assert!(zip_file.is_ok());
+        let zip_file = zip_file.unwrap_or_else(|_| unreachable!());
+        let archive = zip::ZipArchive::new(zip_file);
+        assert!(archive.is_ok());
+        let mut archive = archive.unwrap_or_else(|_| unreachable!());
+
+        assert!(archive.by_name("cert.pem").is_ok());
+        assert!(archive.by_name("key.pem").is_ok());
+        assert!(archive.by_name("ca.pem").is_ok());
+
+        assert!(zip.ends_with("cert.zip"));
+
+        let _ = fs::remove_dir_all(&ca_dir);
+        let _ = fs::remove_dir_all(&output_parent);
+    }
+
+    #[tokio::test]
+    async fn zip_certificates_fails_when_input_files_are_missing() {
+        let cert_dir = unique_temp_dir("nxmesh-master-zip-missing-input");
+        let service = new_service(&cert_dir.to_string_lossy());
+
+        let missing_cert = cert_dir.join("missing-cert.pem");
+        let missing_key = cert_dir.join("missing-key.pem");
+        let missing_ca = cert_dir.join("missing-ca.pem");
+
+        let result = service
+            .zip_certificates(
+                &missing_cert.to_string_lossy(),
+                &missing_key.to_string_lossy(),
+                &missing_ca.to_string_lossy(),
+            )
+            .await;
+        assert!(result.is_err());
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[tokio::test]
+    async fn get_sans_returns_values_for_each_connection_type() {
+        let dir = unique_temp_dir("nxmesh-master-get-sans");
+        let service = CertificateServiceImpl::new(
+            mock_db_connection(),
+            dir.to_string_lossy().to_string(),
+            test_settings("grpc.example.test", "http.example.test"),
+        );
+
+        let (grpc_ips, grpc_dns) = service.get_sans(ConnectionType::GRPC);
+        assert_eq!(grpc_ips.len(), 1);
+        assert_eq!(grpc_ips[0], IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(grpc_dns.len(), 1);
+        assert_eq!(grpc_dns[0].to_string(), "grpc.example.test");
+
+        let (http_ips, http_dns) = service.get_sans(ConnectionType::HTTP);
+        assert_eq!(http_ips.len(), 1);
+        assert_eq!(http_ips[0], IpAddr::V4(Ipv4Addr::new(127, 0, 0, 2)));
+        assert_eq!(http_dns.len(), 1);
+        assert_eq!(http_dns[0].to_string(), "http.example.test");
+
+        let mut grpc_ips_mut = grpc_ips.clone();
+        grpc_ips_mut.clear();
+        let mut grpc_dns_mut = grpc_dns.clone();
+        grpc_dns_mut.clear();
+
+        let (grpc_ips_again, grpc_dns_again) = service.get_sans(ConnectionType::GRPC);
+        assert_eq!(grpc_ips_again.len(), 1);
+        assert_eq!(grpc_dns_again.len(), 1);
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+}
--- a/apps/nxmesh-master/src/service/mod.rs
+++ b/apps/nxmesh-master/src/service/mod.rs
@@ -1,4 +1,6 @@
-use std::sync::Arc;
+use std::{net::ToSocketAddrs, sync::Arc};
+
+use tracing::info;

 use crate::{connector::agent::AgentConnectorTrait, service::certificate::CertificateService};

@@ -26,15 +28,38 @@ pub async fn start_master_server(
        println!("Certificate generated and stored successfully.");
    }

-    // Initialize agent connector
-    let mut agent_connector = crate::connector::agent::AgentConnector::new(Box::new(
-        crate::connector::agent::ssh::SshAgentConnector::new(settings.clone())?,
-    ));
+    let ssh_connector = crate::connector::agent::ssh::SshAgentConnector::new(settings.clone())?;
+    let cert_service_for_agent = cert_service.clone();
+    let settings_for_agent = settings.clone();
+    let connection_for_agent = db_connection.clone();

-    // Start the agent server
-    agent_connector
-        .start_server(&settings, cert_service, db_connection)
-        .await?;
+    tokio::spawn(async move {
+        let mut connector = ssh_connector;
+        tracing::info!("Starting agent server...");
+        if let Err(e) = connector
+            .start_server(
+                &settings_for_agent,
+                cert_service_for_agent,
+                connection_for_agent,
+            )
+            .await
+        {
+            tracing::error!("Agent server failed: {}", e);
+        } else {
+            tracing::info!("Agent server stopped.");
+        }
+    });
+
+    let axum_router = crate::routes::get_root_router().await;
+
+    // Start the HTTP server
+    let addr = format!("{}:{}", settings.server.bind_address, settings.server.port)
+        .to_socket_addrs()?
+        .next()
+        .ok_or("Invalid bind address")?;
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    info!("Web/API server is listening on {}", addr);
+    axum::serve(listener, axum_router).await?;

    Ok(())
 }
--- a/crates/nxmesh-core/src/lib.rs
+++ b/crates/nxmesh-core/src/lib.rs
@@ -0,0 +1 @@
+
--- a/crates/nxmesh-proto/Cargo.toml
+++ b/crates/nxmesh-proto/Cargo.toml
@@ -25,3 +25,6 @@ client = []

 [build-dependencies]
 tonic-prost-build.workspace = true
+
+[dev-dependencies]
+tokio-test.workspace = true
--- a/crates/nxmesh-proto/src/auth/ssh_auth.rs
+++ b/crates/nxmesh-proto/src/auth/ssh_auth.rs
@@ -38,12 +38,162 @@ impl SshAuthInterceptor {
    async fn authenticate(&self, req: Request<()>) -> Result<Request<()>, Status> {
        let certs = req.peer_certs().ok_or(Status::unauthenticated("No cert"))?;

-        let is_authorized = self.certificate_provider.is_authorized(&certs).await?;
+        self.validate_certs(&certs).await?;
+        Ok(req)
+    }
+
+    async fn validate_certs(&self, certs: &Arc<Vec<CertificateDer<'_>>>) -> Result<(), Status> {
+        let is_authorized = self.certificate_provider.is_authorized(certs).await?;

        if is_authorized {
-            Ok(req)
+            Ok(())
        } else {
            Err(Status::permission_denied("Blocked"))
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    };
+
+    use tonic::{Request, Status, transport::CertificateDer};
+    use tonic_async_interceptor::AsyncInterceptor;
+
+    use super::{CertificateValidationProvider, SshAuthInterceptor, create_ssh_auth_interceptor};
+
+    #[derive(Clone, Copy)]
+    enum ProviderMode {
+        Allow,
+        Deny,
+        Error,
+    }
+
+    struct TestCertificateProvider {
+        mode: ProviderMode,
+        calls: Arc<AtomicUsize>,
+        cert_count_seen: Arc<Mutex<Option<usize>>>,
+    }
+
+    #[tonic::async_trait]
+    impl CertificateValidationProvider for TestCertificateProvider {
+        async fn is_authorized(
+            &self,
+            certs: &Arc<Vec<CertificateDer<'_>>>,
+        ) -> Result<bool, Status> {
+            self.calls.fetch_add(1, Ordering::SeqCst);
+
+            let lock = self.cert_count_seen.lock();
+            assert!(lock.is_ok());
+            let mut lock = lock.unwrap_or_else(|_| unreachable!());
+            *lock = Some(certs.len());
+
+            match self.mode {
+                ProviderMode::Allow => Ok(true),
+                ProviderMode::Deny => Ok(false),
+                ProviderMode::Error => Err(Status::internal("provider failed")),
+            }
+        }
+    }
+
+    fn build_provider(
+        mode: ProviderMode,
+    ) -> (
+        Arc<TestCertificateProvider>,
+        Arc<AtomicUsize>,
+        Arc<Mutex<Option<usize>>>,
+    ) {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let cert_count_seen = Arc::new(Mutex::new(None));
+        let provider = Arc::new(TestCertificateProvider {
+            mode,
+            calls: calls.clone(),
+            cert_count_seen: cert_count_seen.clone(),
+        });
+        (provider, calls, cert_count_seen)
+    }
+
+    fn sample_certs() -> Arc<Vec<CertificateDer<'static>>> {
+        Arc::new(vec![
+            CertificateDer::from(vec![1, 2, 3]),
+            CertificateDer::from(vec![4, 5, 6]),
+        ])
+    }
+
+    #[test]
+    fn create_ssh_auth_interceptor_builds_layer() {
+        let (provider, _, _) = build_provider(ProviderMode::Allow);
+        let _ = create_ssh_auth_interceptor(provider);
+    }
+
+    #[test]
+    fn authenticate_fails_when_no_peer_certificates_exist() {
+        let (provider, calls, _) = build_provider(ProviderMode::Allow);
+        let interceptor = SshAuthInterceptor::new(provider);
+
+        let result = tokio_test::block_on(interceptor.authenticate(Request::new(())));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Unauthenticated);
+        assert_eq!(calls.load(Ordering::SeqCst), 0);
+    }
+
+    #[test]
+    fn validate_certs_succeeds_when_provider_allows() {
+        let (provider, calls, cert_count_seen) = build_provider(ProviderMode::Allow);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_ok());
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+
+        let seen = cert_count_seen.lock();
+        assert!(seen.is_ok());
+        let seen = seen.unwrap_or_else(|_| unreachable!());
+        assert_eq!(*seen, Some(2));
+    }
+
+    #[test]
+    fn validate_certs_returns_permission_denied_when_provider_denies() {
+        let (provider, calls, _) = build_provider(ProviderMode::Deny);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::PermissionDenied);
+        assert_eq!(err.message(), "Blocked");
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn validate_certs_propagates_provider_errors() {
+        let (provider, calls, _) = build_provider(ProviderMode::Error);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Internal);
+        assert_eq!(err.message(), "provider failed");
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn async_interceptor_call_delegates_to_authenticate() {
+        let (provider, calls, _) = build_provider(ProviderMode::Allow);
+        let mut interceptor = SshAuthInterceptor::new(provider);
+
+        let result = tokio_test::block_on(interceptor.call(Request::new(())));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Unauthenticated);
+        assert_eq!(calls.load(Ordering::SeqCst), 0);
+    }
+}
--- a/crates/nxmesh-proto/src/lib.rs
+++ b/crates/nxmesh-proto/src/lib.rs
@@ -10,4 +10,116 @@ pub mod agent {

 pub use agent::*;
 pub mod auth;
+#[allow(ambiguous_glob_reexports)]
 pub use tonic_async_interceptor::*;
+
+#[cfg(test)]
+mod tests {
+    use prost::Message;
+
+    use crate::agent::{
+        AgentMessage, ConfigApplyStatus, ConfigStatus, DeploymentMode, Error, MasterMessage,
+        MetricType, RegistrationRequest, agent_message, master_message,
+    };
+
+    #[test]
+    fn agent_message_round_trip_with_registration_payload() {
+        let msg = AgentMessage {
+            agent_id: "agent-1".to_string(),
+            timestamp: 123,
+            payload: Some(agent_message::Payload::Registration(RegistrationRequest {
+                hostname: "node-1".to_string(),
+                ip_address: "127.0.0.1".to_string(),
+                version: "1.0.0".to_string(),
+                capabilities: vec!["reload".to_string(), "metrics".to_string()],
+                labels: std::collections::HashMap::from([
+                    ("region".to_string(), "dev".to_string()),
+                    ("tier".to_string(), "edge".to_string()),
+                ]),
+                deployment_mode: DeploymentMode::Standalone as i32,
+            })),
+        };
+
+        let encoded = msg.encode_to_vec();
+        let decoded = AgentMessage::decode(encoded.as_slice());
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or_else(|_| unreachable!());
+
+        assert_eq!(decoded.agent_id, "agent-1");
+        assert_eq!(decoded.timestamp, 123);
+
+        match decoded.payload {
+            Some(agent_message::Payload::Registration(payload)) => {
+                assert_eq!(payload.hostname, "node-1");
+                assert_eq!(payload.ip_address, "127.0.0.1");
+                assert_eq!(payload.version, "1.0.0");
+                assert_eq!(payload.capabilities.len(), 2);
+                assert_eq!(payload.labels.get("region"), Some(&"dev".to_string()));
+                assert_eq!(payload.deployment_mode, DeploymentMode::Standalone as i32);
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn master_message_round_trip_with_error_payload() {
+        let msg = MasterMessage {
+            timestamp: 999,
+            payload: Some(master_message::Payload::Error(Error {
+                code: "E_CONFIG_INVALID".to_string(),
+                message: "invalid config".to_string(),
+                details: std::collections::HashMap::from([
+                    ("file".to_string(), "site.conf".to_string()),
+                    ("line".to_string(), "42".to_string()),
+                ]),
+            })),
+        };
+
+        let encoded = msg.encode_to_vec();
+        let decoded = MasterMessage::decode(encoded.as_slice());
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or_else(|_| unreachable!());
+
+        assert_eq!(decoded.timestamp, 999);
+        match decoded.payload {
+            Some(master_message::Payload::Error(err)) => {
+                assert_eq!(err.code, "E_CONFIG_INVALID");
+                assert_eq!(err.message, "invalid config");
+                assert_eq!(err.details.get("line"), Some(&"42".to_string()));
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn enum_integer_mappings_are_stable() {
+        assert_eq!(DeploymentMode::Unspecified as i32, 0);
+        assert_eq!(DeploymentMode::DockerSidecar as i32, 1);
+        assert_eq!(DeploymentMode::KubernetesSidecar as i32, 2);
+        assert_eq!(DeploymentMode::Standalone as i32, 3);
+
+        assert_eq!(ConfigApplyStatus::Unspecified as i32, 0);
+        assert_eq!(ConfigApplyStatus::Pending as i32, 1);
+        assert_eq!(ConfigApplyStatus::Validating as i32, 2);
+        assert_eq!(ConfigApplyStatus::Applying as i32, 3);
+        assert_eq!(ConfigApplyStatus::Success as i32, 4);
+        assert_eq!(ConfigApplyStatus::Failed as i32, 5);
+        assert_eq!(ConfigApplyStatus::RolledBack as i32, 6);
+
+        assert_eq!(MetricType::Unspecified as i32, 0);
+        assert_eq!(MetricType::Gauge as i32, 1);
+        assert_eq!(MetricType::Counter as i32, 2);
+        assert_eq!(MetricType::Histogram as i32, 3);
+    }
+
+    #[test]
+    fn config_status_defaults_are_proto3_zero_values() {
+        let status = ConfigStatus::default();
+
+        assert_eq!(status.config_id, "");
+        assert_eq!(status.version, 0);
+        assert_eq!(status.status, ConfigApplyStatus::Unspecified as i32);
+        assert_eq!(status.error_message, "");
+        assert_eq!(status.applied_at, 0);
+    }
+}
--- a/18
+++ b/18
@@ -25,7 +25,6 @@ setup-rust-tools:
    cargo install sea-orm-cli@^2.0.0-rc --features "sqlx-postgres runtime-tokio-rustls"
    cargo install cargo-watch

-
 # Setup frontend dependencies
 setup-frontend:
    @echo "📦 Installing frontend dependencies..."
@@ -35,6 +34,12 @@ setup-frontend:
 # Development Commands
 # =============================================================================

+# act
+act *ARGS:
+    # run act with custom secret-file
+    @echo "🎬 Running act with custom secrets file..."
+    act --env-file .github/.env --secret-file .github/.secrets.env --var-file .github/.var.env --network host {{ ARGS }}
+
 # Start all services for development
 dev:
    @echo "🚀 Starting all development services..."
@@ -45,11 +50,11 @@ dev:
 # Start Rust backend with hot reload
 dev-master *ARGS:
    @echo "🔧 Starting Rust backend..."
-    cargo watch -w apps/nxmesh-master -x 'run --bin nxmesh-master -- {{ARGS}}'
+    cargo watch -w apps/nxmesh-master -x 'run --bin nxmesh-master -- {{ ARGS }}'

 dev-agent *ARGS:
    @echo "🔧 Starting Rust agent..."
-    cargo watch -w apps/nxmesh-agent -x 'run --bin nxmesh-agent -- {{ARGS}}'
+    cargo watch -w apps/nxmesh-agent -x 'run --bin nxmesh-agent -- {{ ARGS }}'

 # Start Vite frontend development server
 dev-frontend:
@@ -89,7 +94,7 @@ build-frontend:
 # =============================================================================

 db *ARGS:
-    cd crates && sea-orm-cli {{ARGS}}
+    cd crates && sea-orm-cli {{ ARGS }}

 # Setup database
 db-setup:
@@ -205,6 +210,11 @@ docker-run:
    @echo "🐳 Running Docker container..."
    docker run -p 8080:8080 --env-file .env nxmesh:latest

+# Build Docker image for CI
+docker-build-ci REGISTRY="ghcr.io/nxmesh":
+    @echo "🐳 Building Docker image for CI..."
+    docker build -t {{ REGISTRY }}/ci:latest -f ./.github/docker/ci.Dockerfile .
+
 # =============================================================================
 # Nginx Commands (Shared PID Namespace + Docker Fallback)
 # =============================================================================
Author	SHA1	Message	Date
GW_MC	ffae46f906	feat: refactor nxmesh-frontend to use React Router with new layout components - Updated package.json to replace Vite with React Router for development and build scripts. - Added react-router.config.ts for configuration settings. - Created a new App component with a dashboard layout including header, sidebar, and footer. - Enhanced App.css with a professional theme and responsive design. - Removed old App.tsx and index.css files. - Introduced RootLayout component to encapsulate layout structure. - Developed Header, Footer, and Sidebar components for consistent layout. - Implemented routes for home and dashboard with key metrics and activity sections. - Updated vite.config.ts to integrate React Router and adjust SSR settings.	2026-05-06 10:48:39 +00:00
GW_MC	cd28b5009a	Merge pull request 'feature/embbed-frontend' (#7 ) from feature/embbed-frontend into master All checks were successful Test / get-ci-image (push) Successful in 6s Details Test / lint-frontend (push) Successful in 24s Details Test / frontend-build (push) Successful in 23s Details Verify / get-ci-image (push) Successful in 4s Details Test / test-frontend (push) Successful in 35s Details Test / lint-crates (push) Successful in 1m50s Details Test / test-crates (push) Successful in 2m1s Details Verify / verify-generated-db-entities (push) Successful in 2m21s Details Reviewed-on: http://gitea.gwmc.dev/GW_MC/NxMesh/pulls/7	2026-04-25 14:34:55 +08:00
GW_MC	171e505f22	fix: update migration and entity generation commands in CI workflow All checks were successful Test / get-ci-image (pull_request) Successful in 5s Details Test / lint-frontend (pull_request) Successful in 26s Details Test / frontend-build (pull_request) Successful in 24s Details Verify / get-ci-image (pull_request) Successful in 6s Details Test / test-frontend (pull_request) Successful in 33s Details Test / lint-crates (pull_request) Successful in 1m52s Details Test / test-crates (pull_request) Successful in 2m3s Details Verify / verify-generated-db-entities (pull_request) Successful in 2m25s Details	2026-04-25 06:30:13 +00:00
GW_MC	dff828addf	fix: update frontend build process to create dummy artifacts and comment out artifact handling Some checks failed Test / get-ci-image (pull_request) Successful in 6s Details Test / lint-frontend (pull_request) Successful in 21s Details Verify / get-ci-image (pull_request) Successful in 5s Details Test / frontend-build (pull_request) Successful in 26s Details Test / test-frontend (pull_request) Successful in 37s Details Test / lint-crates (pull_request) Successful in 1m45s Details Test / test-crates (pull_request) Successful in 1m57s Details Verify / verify-generated-db-entities (pull_request) Failing after 1m45s Details Co-authored-by: Copilot <copilot@github.com>	2026-04-25 06:04:55 +00:00
GW_MC	1481e31182	Revert "fix: update frontend build process and add logging for embedded assets" Some checks failed Test / get-ci-image (pull_request) Successful in 11s Details Test / lint-frontend (pull_request) Failing after 30s Details Test / test-frontend (pull_request) Successful in 21s Details Verify / get-ci-image (pull_request) Successful in 35s Details Test / frontend-build (pull_request) Successful in 51s Details Test / test-crates (pull_request) Failing after 4m37s Details Test / lint-crates (pull_request) Failing after 40s Details Verify / verify-generated-db-entities (pull_request) Successful in 9m14s Details This reverts commit `4b80619c97`.	2026-04-25 04:26:59 +00:00
GW_MC	4b80619c97	fix: update frontend build process and add logging for embedded assets Some checks failed Test / get-ci-image (pull_request) Successful in 14s Details Test / test-frontend (pull_request) Successful in 47s Details Verify / get-ci-image (pull_request) Successful in 6s Details Test / lint-frontend (pull_request) Successful in 1m14s Details Verify / verify-generated-db-entities (pull_request) Failing after 15m14s Details Test / frontend-build (pull_request) Failing after 19m51s Details Test / test-crates (pull_request) Has been skipped Details Test / lint-crates (pull_request) Has been skipped Details Co-authored-by: Copilot <copilot@github.com>	2026-04-25 03:21:36 +00:00
GW_MC	836617fa54	test: Add asset listing test for embedded frontend assets Some checks failed Test / get-ci-image (pull_request) Successful in 6s Details Test / test-frontend (pull_request) Successful in 30s Details Test / lint-frontend (pull_request) Successful in 32s Details Verify / get-ci-image (pull_request) Successful in 5s Details Verify / verify-generated-db-entities (pull_request) Successful in 3m12s Details Test / frontend-build (pull_request) Successful in 23s Details Test / lint-crates (pull_request) Failing after 4m6s Details Test / test-crates (pull_request) Failing after 4m14s Details Co-authored-by: Copilot <copilot@github.com>	2026-04-25 02:49:47 +00:00
GW_MC	e74ddb96ab	fix: embed frontend builds in test Some checks failed Test / get-ci-image (pull_request) Successful in 5s Details Test / lint-frontend (pull_request) Successful in 24s Details Test / frontend-build (pull_request) Successful in 23s Details Verify / get-ci-image (pull_request) Successful in 5s Details Test / test-frontend (pull_request) Successful in 38s Details Test / lint-crates (pull_request) Successful in 2m34s Details Test / test-crates (pull_request) Failing after 2m44s Details Verify / verify-generated-db-entities (pull_request) Successful in 3m2s Details	2026-04-25 02:41:16 +00:00
GW_MC	86e9fd42bb	test: Add unit tests for frontend routing and file handling Some checks failed Test / get-ci-image (pull_request) Successful in 48s Details Test / lint-frontend (pull_request) Successful in 1m10s Details Test / frontend-build (pull_request) Successful in 25s Details Test / test-frontend (pull_request) Successful in 1m13s Details Verify / get-ci-image (pull_request) Successful in 5s Details Test / lint-crates (pull_request) Successful in 6m10s Details Test / test-crates (pull_request) Failing after 6m22s Details Verify / verify-generated-db-entities (pull_request) Successful in 7m5s Details	2026-04-24 12:14:36 +00:00
GW_MC	d9fe053d41	feat: Add new dependencies for axum-test and related packages in Cargo.lock	2026-04-24 12:08:00 +00:00
GW_MC	1eeca606ec	feat: Remove debug handler attributes from fallback and file handler functions All checks were successful Test / get-ci-image (pull_request) Successful in 7s Details Test / lint-frontend (pull_request) Successful in 26s Details Test / frontend-build (pull_request) Successful in 23s Details Verify / get-ci-image (pull_request) Successful in 4s Details Test / test-frontend (pull_request) Successful in 34s Details Test / lint-crates (pull_request) Successful in 5m48s Details Test / test-crates (pull_request) Successful in 5m59s Details Verify / verify-generated-db-entities (pull_request) Successful in 6m28s Details	2026-04-18 08:37:08 +00:00
GW_MC	6ce8850ddb	feat: Update frontend build cache path and add dummy artifact to prevent build failure	2026-04-18 08:22:05 +00:00
GW_MC	a9a08d2ef8	feat: Enhance SSH Agent gRPC server logging for better monitoring	2026-04-18 07:31:45 +00:00
GW_MC	bbde3c1b60	feat: Refactor agent server initialization to support parallel api server	2026-04-18 07:31:29 +00:00
GW_MC	e2d364722b	feat: Add frontend routing and asset handling with Axum	2026-04-18 07:30:37 +00:00
GW_MC	da0ab29b2a	feat: Update dependencies and add frontend distribution path	2026-04-18 07:26:37 +00:00
GW_MC	a1996adc45	Merge pull request 'workflows' (#5 ) from workflows into master All checks were successful Test / get-ci-image (push) Successful in 6s Details Test / test-frontend (push) Successful in 11s Details Test / lint-frontend (push) Successful in 13s Details Verify / get-ci-image (push) Successful in 5s Details Test / frontend-build (push) Successful in 17s Details Test / lint-crates (push) Successful in 1m49s Details Test / test-crates (push) Successful in 1m59s Details Verify / verify-generated-db-entities (push) Successful in 2m27s Details Reviewed-on: http://gitea.gwmc.dev/GW_MC/NxMesh/pulls/5	2026-04-16 13:02:27 +08:00
GW_MC	7fde3533d9	fix: use custom image for crate test and lint All checks were successful Test / get-ci-image (pull_request) Successful in 6s Details Test / test-frontend (pull_request) Successful in 11s Details Test / lint-frontend (pull_request) Successful in 13s Details Test / frontend-build (pull_request) Successful in 13s Details Verify / get-ci-image (pull_request) Successful in 5s Details Test / lint-crates (pull_request) Successful in 2m1s Details Test / test-crates (pull_request) Successful in 2m12s Details Verify / verify-generated-db-entities (pull_request) Successful in 2m40s Details	2026-04-16 04:56:52 +00:00
GW_MC	b5e42f2f30	feat: Add CI environment setup and verification workflows with Docker support Some checks failed Test / test-frontend (pull_request) Successful in 43s Details Test / lint-frontend (pull_request) Successful in 47s Details Verify / get-ci-image (pull_request) Successful in 47s Details Test / frontend-build (pull_request) Successful in 1m29s Details Verify / verify-generated-db-entities (pull_request) Has been cancelled Details Test / test-crates (pull_request) Has been cancelled Details Test / lint-crates (pull_request) Has been cancelled Details	2026-04-16 04:47:04 +00:00
GW_MC	50f17fd69b	refactor: Add installation of protobuf compiler to Rust setup action	2026-04-11 09:11:24 +00:00
GW_MC	84808832dd	feat: Add setup for Rust environment and implement test workflows	2026-04-11 09:04:09 +00:00
GW_MC	7fd150ea4a	feat: Add 'act' feature to devcontainer configuration	2026-04-11 07:33:26 +00:00
GW_MC	c5c4430b23	Merge pull request 'feature/grpc-connector' (#1 ) from feature/grpc-connector into master Reviewed-on: http://gitea.gwmc.dev/GW_MC/NxMesh/pulls/1	2026-04-01 15:45:38 +08:00
GW_MC	7a9eeb5f3a	feat: Add validation for SSH certificates and implement unit tests for SshAuthInterceptor	2026-03-21 03:52:34 +00:00
GW_MC	109d693d59	feat: Add comprehensive unit tests for CLI and CertificateService, covering command parsing and certificate generation	2026-03-21 03:42:47 +00:00
GW_MC	eba30f557e	feat: Add unit tests for CLI and MasterConnector, including certificate extraction and validation	2026-03-21 03:32:09 +00:00
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>