feat(telemetry): add canonical VPS host monitoring

2026-08-22 17:29:30 +03:00
parent a3e7a015de
commit 23ea96fbb2
33 changed files with 2541 additions and 51 deletions
@@ -0,0 +1,40 @@
+{
+  "schemaVersion": "nodedc.device-plane.device-control-core-release.v3",
+  "releaseId": "__PATCH_ID__",
+  "action": "upgrade",
+  "predecessor": {
+    "kind": "release",
+    "patchId": "device-control-core-release-v2-20260822-038",
+    "artifactSha256": "e2d062b82b022dba662522b5d6e192026ac964d78950d903295ca3cbbc95ab28"
+  },
+  "service": "device-control-core",
+  "composeActivation": "preserve-active-v4-topology",
+  "identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
+  "identityRecovery": "forbidden-valid-existing-identity-required",
+  "tlsPurpose": "clientAuth",
+  "direction": "core-initiated",
+  "endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
+  "coreNetworks": [
+    "device-plane-private",
+    "device-plane-egress"
+  ],
+  "publicIngress": "none-on-synology",
+  "edgeRegistrations": "preserved",
+  "commandTransport": "typed-service-ping-v1",
+  "commandCatalog": "allowlisted-adapter-typed-commands-only",
+  "credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
+  "telemetryTransport": "edge-channel-host-telemetry-observed-v1",
+  "telemetryContract": "nodedc.infrastructure.host-telemetry.v1",
+  "telemetryStorage": "device-control-core-postgres-seven-day-retention",
+  "ontologyProjection": "observation-observed-property-provenance-freshness-v1",
+  "telemetryFreshness": "fifteen-seconds-missing-stale-not-unhealthy",
+  "gelios": "untouched-legacy-only",
+  "preservedServices": [
+    "device-manager",
+    "device-gateway",
+    "device-postgres",
+    "device-backhaul-target"
+  ],
+  "healthGate": "bounded-container-grace+core-edge-contract+exact-private-egress-network-boundary",
+  "rollback": "restore-preapply-source-and-core-runtime"
+}
@@ -0,0 +1,77 @@
+{
+  "schemaVersion": "nodedc.device-edge-vps.host-telemetry.v1",
+  "mode": "provider-neutral-host-observation-over-accepted-core-channel",
+  "status": "active-host-telemetry",
+  "authority": "DCPLATFORM-21/DCPLATFORM-76/DCPLATFORM-77/ADR-0001",
+  "component": "device-edge-vps",
+  "phase": "host-telemetry",
+  "runtimeHost": "koffyvngij",
+  "predecessorPatch": "device-edge-vps-command-transport-20260812-013",
+  "predecessorArtifactSha256": "c7486ec879681ddd706f229628c8556ca8c9ccc4f152a85debb409c302759ef",
+  "agent": "telegraf",
+  "agentVersion": "1.38.4",
+  "agentRuntimeUser": "nodedc-telemetry",
+  "agentService": "nodedc-host-telemetry-agent.service",
+  "collector": "127.0.0.1:18223/internal/v1/host-telemetry",
+  "collectorExposure": "loopback-only",
+  "transport": "existing-core-initiated-pinned-mtls-channel",
+  "messageKind": "host.telemetry.observed",
+  "observationEntity": "observation.observation",
+  "observationTarget": "infrastructure.host",
+  "observedProperties": [
+    "host.cpu.utilization",
+    "host.memory.utilization",
+    "host.swap.utilization",
+    "host.disk.utilization",
+    "host.network.counters",
+    "host.process.counts",
+    "host.systemd.unit-state"
+  ],
+  "commandTransport": "typed-service-ping-v1",
+  "publicIngress": "preserved:tcp/443-mtls-core-channel+tcp/9921-bidirectional-tracker-session",
+  "mqtt": "disabled-no-public-broker-no-wan-plaintext",
+  "database": "none-on-vps",
+  "credentials": "none-added",
+  "gelios": "untouched-legacy-only",
+  "resourceCeilings": {
+    "agentMemory": "96M",
+    "agentSwap": "0",
+    "agentCpu": "15%",
+    "agentTasks": 64,
+    "agentOpenFiles": 512,
+    "collectorBodyBytes": 524288,
+    "channelEnvelopeBytes": 1048576
+  },
+  "preserved": [
+    "management-ssh-key",
+    "accepted-node-runtime",
+    "accepted-core-channel-trust-and-registration",
+    "accepted-tracker-ingress",
+    "accepted-typed-command-transport",
+    "retired-tailnet-boundary",
+    "gelios-production-path"
+  ],
+  "forbidden": [
+    "public-mqtt",
+    "plaintext-wan-telemetry",
+    "vps-initiated-synology-connection",
+    "public-health",
+    "vps-database",
+    "browser-secrets",
+    "generic-shell",
+    "ontology-core-telemetry-storage"
+  ],
+  "acceptance": [
+    "exact-command-transport-013-predecessor",
+    "telegraf-1.38.4-exact-archive-and-binary",
+    "dedicated-non-root-agent",
+    "loopback-only-http-output",
+    "core-channel-remains-accepted",
+    "host-observation-reaches-device-control-core",
+    "public-port-set-unchanged",
+    "typed-command-transport-preserved",
+    "tailscale-remains-absent",
+    "gelios-untouched"
+  ],
+  "rollback": "restore-exact-command-transport-013-source-runtime-and-remove-agent-runtime"
+}
@@ -0,0 +1,56 @@
+{
+  "schemaVersion": "nodedc.device-plane.device-manager-release.v9",
+  "releaseId": "__PATCH_ID__",
+  "action": "upgrade",
+  "predecessor": {
+    "kind": "release",
+    "patchId": "device-manager-release-v8-20260822-039",
+    "artifactSha256": "30a83d4c6b5c029c96c4af19fa558e0ae75e4b60bc897881457304bd17e0e465"
+  },
+  "controlCorePredecessor": {
+    "patchId": "device-control-core-release-v3-20260822-040",
+    "artifactSha256": "08448a56cdf391076f92c5242e368fd0033b420167874645eebfa1f22184ee92"
+  },
+  "edgeChannelPredecessor": {
+    "patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
+    "artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
+  },
+  "service": "device-manager",
+  "publicIngress": "reverse-proxy-only",
+  "deviceCoreManagementApi": "file-token-authenticated",
+  "launcherTrust": "file-token-scoped-to-device-core-handoff",
+  "edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
+  "edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
+  "edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
+  "healthGate": "bounded-container-grace+core-contract+persistent-data",
+  "commandTransport": "typed-service-ping-v1",
+  "commandCatalog": "allowlisted-adapter-typed-commands-only",
+  "credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
+  "presentationPersistence": "runner-managed-host-data-bind",
+  "presentationDataHostPath": "/volume1/docker/nodedc-device-plane/data/device-manager",
+  "presentationDataContainerPath": "/var/lib/nodedc-device-manager",
+  "presentationDataOwnership": "uid-1000-gid-1000-mode-0750",
+  "presentationDataLifecycle": "preserve-across-manager-recreate-and-source-rollback",
+  "presentationPath": "/var/lib/nodedc-device-manager/device-manager-presentation.json",
+  "mediaRoot": "/var/lib/nodedc-device-manager/media",
+  "defaultAccentHex": "#f5f5f5",
+  "overviewLayout": "mission-core-landing-stage-v1",
+  "faviconSet": "nodedc-adaptive-v1",
+  "commandFormLayout": "aligned-control-row-v1",
+  "secondaryEmptyTypography": "help-text-sm-v1",
+  "infrastructureHostProjection": "ontology-backed-host-runtime-v1",
+  "ontologyFoundation": "ontology-core-device-foundation-20260822-001",
+  "ontologyCatalogHash": "229c61c02a790906",
+  "assetBinding": "temporal-device-asset-binding-v1",
+  "infrastructureRuntime": "host-endpoint-deployment-service-instance-v1",
+  "healthEvidence": "ttl-observation-missing-not-unhealthy-v1",
+  "telemetryWorkspace": "mission-core-compute-module-parity-v1",
+  "telemetryNavigation": "full-workspace-back-navigation-v1",
+  "telemetryPollInterval": "three-seconds",
+  "telemetryFreshness": "fifteen-seconds-missing-stale-not-unhealthy",
+  "telemetryOntologyProjection": "observation-observed-property-provenance-freshness-v1",
+  "telemetryAgent": "telegraf-host-observer-v1",
+  "interactiveShell": "disabled-pending-managed-session-boundary",
+  "gelios": "untouched-legacy-only",
+  "rollback": "restore-preapply-snapshot-preserve-manager-data"
+}