NEXXUS Tutorials & Guides

TUTORIAL 01 · GETTING STARTED

INSTALLING NEXXUS

Nexxus installs in seconds on Linux, macOS, and Windows. The entire browser is a single 12 MB binary — no Electron, no Chromium bloat, no telemetry.

The fastest way — one line in your terminal installs Nexxus to ~/.local/bin and works on any distro.

ONE-LINE INSTALLER

TERMINAL

$ curl -fsSL https://hub.io/scripts/install.sh | bash

1

Run the installer

Paste the one-liner above into your terminal. It detects your OS and architecture automatically.

2

Add to PATH (if needed)

If ~/.local/bin is not in your PATH, add this to ~/.bashrc or ~/.zshrc:

export PATH="$HOME/.local/bin:$PATH"

3

Launch Nexxus

Run nexxus in your terminal, or use the nexxus-launcher.sh script for a security preflight check.

nexxus

TUTORIAL 02 · SETUP

FIRST RUN SETUP WIZARD

When you launch Nexxus for the first time, the 6-step Setup Wizard walks you through personalizing your experience — theme, security level, privacy features, and notifications.

👤

IDENTITY

Choose your name/alias and usage profile: Personal, Professional, or Enterprise.

🎨

THEMES

8 visual themes: Cyber Night, Matrix, Solar Flare, Void Purple, Ghost Black, Ice Blue, Crimson, Sepia.

🛡️

SECURITY LEVEL

Standard, High Security, or Maximum/Gov-Level — controls Tor, JS policies, FIPS mode.

🔏

PRIVACY TOGGLES

Tor routing, ad blocking, anti-fingerprinting, DNS-over-HTTPS, offline mesh, auto-clear.

🔔

NOTIFICATIONS

Configure which security events trigger overlay alerts: threats, scans, downloads, Tor circuit changes.

✅

SUMMARY

Review and confirm all settings before launch. Settings are saved permanently and changeable later.

Access the wizard any time at nexxus://setup

1

Step 1 — Identity & Role

Enter your name or alias. Select Personal, Professional, or Enterprise. This affects default security presets.

2

Step 2 — Visual Theme

Pick from 8 high-contrast dark themes. All include the full 3D particle engine and security overlay.

3

Step 3 — Security Level

Standard (everyday), High (recommended for most), or Maximum (forces Tor, FIPS 140-3, no default JS).

4

Step 4 — Privacy Features

Toggle Tor, ad blocking, anti-fingerprinting, DNS-over-HTTPS, offline mesh, and auto-wipe individually.

5

Step 5 — Notifications

Choose which events generate toast notifications. Threat alerts and watchdog status are recommended.

6

Step 6 — Launch

A summary card shows all your choices. Click "Launch Nexxus" — settings are saved and applied immediately.

TUTORIAL 03 · OPERATION

24/7 SELF-HEALING DAEMON

Nexxus includes a watchdog daemon that keeps the browser running continuously, restarts it on crash, and performs hourly security checks — even without any user interaction.

The watchdog logs to ~/.local/share/nexxus/logs/ and can be installed as a systemd user service for boot-time auto-start.

1

Install as a systemd service (auto-start on boot)

Run the installer script once. It copies the watchdog to ~/.local/share/nexxus/ and registers it with systemd.

cd /path/to/Nexxus/scripts && bash install-service.sh

2

Or start the watchdog manually for 24/7 mode

Use the smart launcher with the --daemon flag to start the watchdog in the current terminal.

bash scripts/nexxus-launcher.sh --daemon

3

Monitor status

systemctl --user status nexxus journalctl --user -u nexxus -f

4

View live health in-browser

Navigate to the health monitor for real-time CPU, memory, security scores, and event logs.

nexxus://health

WATCHDOG BEHAVIOUR

🔄

AUTO-RESTART

Restarts within 3 seconds of any crash. Rate-limited to 10 restarts/30s to prevent loops.

🔍

HOURLY SCANS

8-module security scan runs every 60 minutes: binary integrity, memory, DNS, firewall, malware, keys, HMAC log.

📋

STRUCTURED LOGS

All events written to watchdog.log and security.log with ISO timestamps and severity levels.

TUTORIAL 04 · SECURITY

18-PHASE BOOT SCAN

Every time Nexxus starts, it runs a comprehensive 18-phase security scan taking 60–280+ seconds. This injects thousands of security protocols and verifies the integrity of the entire browser environment.

Access directly: nexxus://boot

🔑

KEY VALIDATION

All cryptographic keys verified against HMAC-SHA256 audit chain before any network activity.

💾

BINARY HASH

SHA-256 of the nexxus binary compared against stored baseline to detect tampering.

🌐

DNS PROBE

DNS-over-HTTPS validated against multiple resolvers. Automatic fallback if primary fails.

💥

RULE INJECTION

1M+ ad/tracker block rules loaded into memory. Certificate pinning for critical domains applied.

🧠

MEMORY SCAN

Heap and stack checked for known exploit patterns before enabling JS engine.

📦

SANDBOX INIT

Each tab process spawned in isolated sandbox with seccomp-bpf syscall filtering.

TUTORIAL 05 · SECURITY

PDF VAULT — 3-LAYER ENCRYPTION

PDF Vault encrypts any PDF with three sequential AEAD ciphers, Argon2id key derivation, and a BLAKE3 integrity hash — producing a NXPDF file that can only be decrypted with the correct passphrase.

Access at: nexxus://pdf-vault

1

Drop your PDF into the vault

Drag and drop any PDF file onto the Encrypt panel, or click to browse.

2

Enter a strong passphrase

The strength meter guides you. 24+ characters with mixed case, numbers, and symbols = Strong.

3

Choose KDF security level

Standard (64 MiB Argon2id) is recommended. Government level uses 256 MiB and takes ~5s longer.

4

Click Encrypt

Three encryption layers run sequentially: ChaCha20-Poly1305 ? AES-256-GCM ? HMAC-SHA256. Output: .nxpdf file.

ENCRYPTION LAYERS EXPLAINED

🔒

CHACHA20-POLY1305

Stream cipher. AAD = BLAKE3 hash of plaintext. Resists timing attacks on variable-length data.

🔐

AES-256-GCM

NIST FIPS 197 block cipher. AAD = ChaCha nonce ? BLAKE3 hash — prevents layer-swap attacks.

🔑

HMAC-SHA256

Over full header + ciphertext. Constant-time comparison. Tamper is detectable before any decryption attempt.

TUTORIAL 06 · PRIVACY

TOR & ANONYMOUS BROWSING

Nexxus routes all traffic through the Tor onion network via SOCKS5 proxy. Stream isolation ensures each tab gets a different circuit, preventing correlation attacks.

Configure at: nexxus://tor

1

Enable Tor in settings

Navigate to nexxus://tor and toggle the master switch. The circuit board visualizer shows your 3-hop path in real time.

2

Configure stream isolation

Stream isolation is on by default. Each browser tab uses a unique SOCKS5 username/password pair, ensuring different Tor circuits.

3

Visit .onion sites

Simply type any .onion address in the URL bar. Nexxus detects v2 (16-char) and v3 (56-char) onion addresses automatically.

http://duckduckgogg42ts4xpe.onion/

4

Choose exit country

Optionally pin your exit node to a specific country (Germany, Netherlands, Switzerland, etc.) for regulatory compliance.

TUTORIAL 07 · CONNECTIVITY

OFFLINE & P2P MESH NETWORK

Nexxus works without any internet connection. The built-in mesh networking layer lets Nexxus users communicate directly over Bluetooth, WiFi-Direct, or local LAN — no router, no ISP, no internet required.

Access at: nexxus://mesh

📶

WIFI-DIRECT

Peer-to-peer WiFi without a router. Range ~100–300m. Automatic discovery via mDNS/Bonjour.

📱

BLUETOOTH LE

Low-energy Bluetooth for close-range (10–30m) message relay. Battery-efficient relay node mode.

🖧️

LAN DISCOVERY

Automatically finds other Nexxus instances on the same local network. Works in cafes, offices, homes.

🔄

MULTI-HOP RELAY

Messages hop through other mesh nodes to extend range. A 3-node chain covers several kilometers.

💬

ENCRYPTED MESSAGES

All mesh messages end-to-end encrypted with X25519 ECDH + ChaCha20-Poly1305. Zero metadata.

📥

STORE & FORWARD

Messages queue when recipient is offline. Delivered automatically when they re-enter mesh range.

Mesh networking requires the device's WiFi or Bluetooth hardware. Permissions will be requested on first use.

TUTORIAL 08 · INTERFACE

BROWSER INTERFACE OVERVIEW

Nexxus features a unique 3D home screen powered by WebGL/Three.js, a spy-theme UI, and built-in pages accessible via the nexxus:// protocol — no extensions needed.

🏠

nexxus://home

3D particle home screen with animated HUD, quick-launch tiles, and real-time security status.

🛡️

nexxus://security

Live security dashboard: threats blocked, scans running, certificate checks, fingerprinting status.

⬇️

nexxus://downloads

Download hub with per-file security scanning, threat levels, permission management, and quarantine.

📄

nexxus://pdf-vault

3-layer PDF encryption and decryption with BLAKE3 integrity and HMAC audit chain.

🧅

nexxus://tor

Tor proxy configuration with circuit board visualizer and stream isolation controls.

💚

nexxus://health

24/7 system health monitor with CPU/memory sparklines, security scores, and event logs.

🌍

nexxus://languages

25 languages with RTL/LTR support, native name display, and live language switcher.

♿

nexxus://accessibility

WCAG 2.2 AAA controls: dyslexia font, high contrast, reduce motion, font size, 6 color schemes.

🔧

nexxus://setup

6-step animated setup wizard for first-run personalization and security configuration.

TUTORIAL 09 · ACCESSIBILITY

LANGUAGES & ACCESSIBILITY

Nexxus supports 25 languages across 3 tiers including RTL languages (Arabic, Farsi), WCAG 2.2 AAA compliance, and a dyslexia-friendly font option.

Language settings: nexxus://languages · Accessibility: nexxus://accessibility

🌐

RTL SUPPORT

Arabic and Farsi flip the entire UI to right-to-left layout automatically. Live RTL preview in settings.

📖

DYSLEXIA FONT

OpenDyslexic typeface with weighted bottoms reduces reading difficulty. Toggle in one click.

🔆

HIGH CONTRAST

Full high-contrast mode meets WCAG 2.2 Level AAA contrast ratios (7:1 minimum).

⌨️

KEYBOARD NAV

All UI controls fully accessible via Tab, Enter, Space, and Arrow keys. No mouse required.

TUTORIAL 10 · ADVANCED

NXL LANGUAGE & RUNTIME

NXL (Nexxus Language) is a domain-specific scripting language built into the browser for writing security policies, automation scripts, and extensions. NXL Bin is its compiled bytecode format.

Access the NXL REPL at: nexxus://specter

NXL SYNTAX EXAMPLE

NXL SCRIPT

// Block all third-party scripts from social media domains

policy block_social {

match domain contains ["facebook", "twitter", "tiktok"]

when request.type == "script" || request.type == "tracker"

action deny

log "Blocked social tracker: " + request.url

}

✅ Policy loaded — 3 domains blocked

KNOWLEDGE CHECK

TEST YOUR KNOWLEDGE

Answer these questions to verify you understand Nexxus's key security features.

📖 TUTORIALS 📖