nexus-link

Hardware agent for connecting on-premise AI nodes to the Nexus platform.

nexus-link connects NVIDIA DGX Spark, A100, and H100 hardware nodes to the Nexus backend: live telemetry push and remote compose management — without requiring inbound network access into your infrastructure.

Installation

One-liner (recommended)

curl -fsSL https://nexus.gatewarden.eu/install-link.sh | bash

The installer detects your platform (Linux aarch64 / x86_64), downloads the pre-built binary from GitHub Releases, and verifies its SHA-256 checksum.

From source

cargo install --git https://github.com/gwnexus/nexus-link.git nexus-link-cli

Requires Rust >= 1.85 (2024 edition).

Container image

docker pull ghcr.io/gwnexus/nexus-link/nexus-link-service:latest

Multi-arch manifest (arm64 + amd64) — automatically selects the correct platform.

Quick start

# 1. Preflight check (optional — register runs this automatically)
nexus-link preflight

# 2. Register the node with both tokens from the Nexus dashboard
nexus-link register \
  --token     <nxs_node_*> \
  --cmd-token <nxs_cmd_*>

# 3. Start the telemetry agent
nexus-link agent start

# 4. Start the command service (receives compose management commands)
nexus-link-service

# 5. Check status
nexus-link status

Both tokens are generated and displayed once in the Nexus dashboard registration wizard. Copy them before closing the dialog.

Two-token security model

nexus-link uses two independent credentials with different trust levels:

This separation ensures a compromised telemetry process cannot trigger service restarts or modify compose configuration. Both tokens are stored in ~/.nexus-link/config.toml.

Token rotation

Compose management

The nexus-link-service (port 8443) exposes a compose management API used by the Nexus dashboard Compose tab:

All /api/compose/* endpoints require Authorization: Bearer <nxs_cmd_*>. The node token is not accepted on compose routes.

Dashboard integration

The AI Hardware node detail page has a Compose tab where you can:

• View and edit docker-compose.yaml and companion files (.env, .conf, .toml)
• Save & Commit — atomically writes the file with YAML validation
• Activate Config — runs docker compose up -d with output displayed in the UI
• Stream Logs — live docker compose logs --follow as Server-Sent Events

The dashboard proxy routes all compose API calls server-side — the command token never reaches the browser.

Ed25519 request signing

Write operations (PUT /api/compose/file, POST /api/compose/activate) support Ed25519 request signing. The Nexus backend signs each write request with its private key; nexus-link-service verifies the signature before processing.

Protection:

• 5-minute timestamp window prevents replay attacks
• SHA-256 body hash detects payload tampering
• The signing private key never leaves the Nexus backend

Signature enforcement is opt-in:

nexus-link config set compose.require_signatures true

The Ed25519 public key is delivered during node registration and stored in ~/.nexus-link/signing_key.pub.

Device compatibility

Registration includes an automatic preflight check:

Known devices (fully tested)

CLI reference

Core commands

Agent commands

Config commands