feat: establish standalone Device Core repository
This commit is contained in:
DCCONSTRUCTIONS
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-control-core-release.v1",
|
||||
"releaseId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"predecessor": {
|
||||
"kind": "edge-core-channel-upgrade-v4",
|
||||
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
|
||||
"artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "preserve-active-v4-topology",
|
||||
"identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "forbidden-valid-existing-identity-required",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
|
||||
"coreNetworks": [
|
||||
"device-plane-private",
|
||||
"device-plane-egress"
|
||||
],
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract+exact-private-egress-network-boundary",
|
||||
"rollback": "restore-preapply-source-and-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-control-core-release.v2",
|
||||
"releaseId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"predecessor": {
|
||||
"kind": "release",
|
||||
"patchId": "device-control-core-release-20260812-024",
|
||||
"artifactSha256": "a289e909283109642e6bba3d9822a31f63423cfe0bbcd52705979681bd2bc793"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "preserve-active-v4-topology",
|
||||
"identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "forbidden-valid-existing-identity-required",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
|
||||
"coreNetworks": [
|
||||
"device-plane-private",
|
||||
"device-plane-egress"
|
||||
],
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved",
|
||||
"commandTransport": "typed-service-ping-v1",
|
||||
"commandCatalog": "allowlisted-adapter-typed-commands-only",
|
||||
"credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
|
||||
"gelios": "untouched-legacy-only",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract+exact-private-egress-network-boundary",
|
||||
"rollback": "restore-preapply-source-and-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.admission-gate.v1",
|
||||
"mode": "single-nic-ipvlan-b2-relay-only",
|
||||
"runtimeHost": "ndcmini12",
|
||||
"component": "device-edge",
|
||||
"selectedServices": [
|
||||
"device-edge-relay"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-edge-backhaul",
|
||||
"tailnet"
|
||||
],
|
||||
"composeProject": "nodedc-device-edge",
|
||||
"composeFiles": [
|
||||
"docker-compose.device-edge.yml",
|
||||
"docker-compose.device-edge.ingress.yml"
|
||||
],
|
||||
"parentInterface": "enp1s0f0",
|
||||
"lanSubnet": "192.168.68.0/22",
|
||||
"lanGateway": "192.168.68.1",
|
||||
"ingressIpv4": "192.168.71.253",
|
||||
"ingressIpv4Approval": "approved-outside-dhcp-pool",
|
||||
"ingressNetwork": "nodedc-device-edge-ingress",
|
||||
"deviceTcpListen": "192.168.71.253:9921",
|
||||
"hostPortPublication": "disabled",
|
||||
"healthPublication": "disabled",
|
||||
"privateUpstream": "device-edge-backhaul:19921",
|
||||
"sourceAdmission": "public-ipv4-only",
|
||||
"maxTrackedSourceAddresses": 2048,
|
||||
"maxBytesPerDirection": 262144,
|
||||
"protocolInspection": "gateway-owned",
|
||||
"identityTrust": "claimed-not-ownership-proof",
|
||||
"discoveryLifecycle": "quarantine",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"amneziaHostFullTunnel": "preserved",
|
||||
"routerNatFirewall": "separate-manual-gate",
|
||||
"rollback": "restore-reviewed-ipvlan-predecessor-without-network-or-router-mutation"
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.backhaul.v1",
|
||||
"mode": "private-tailnet-ssh-local-forward",
|
||||
"runtimeHost": "ndcmini12",
|
||||
"selectedServices": [
|
||||
"device-edge-backhaul"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-edge-relay",
|
||||
"tailnet"
|
||||
],
|
||||
"tailnetSocksTarget": "nodedc-device-edge-tailnet-1:1055",
|
||||
"sshTarget": "100.109.216.21:2222",
|
||||
"sshUser": "device-backhaul",
|
||||
"localForward": "0.0.0.0:19921",
|
||||
"permittedRemoteTarget": "127.0.0.1:9921",
|
||||
"hostPortPublication": "disabled",
|
||||
"deviceIngress": "disabled",
|
||||
"protocolInspection": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"privateKey": "runtime-only-read-only",
|
||||
"knownHosts": "runner-prepared-exact-ed25519",
|
||||
"routerNatFirewall": "unchanged",
|
||||
"gelios": "untouched"
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-edge-core-channel-bootstrap.v1",
|
||||
"transitionId": "__PATCH_ID__",
|
||||
"action": "activate",
|
||||
"managerPredecessor": {
|
||||
"patchId": "device-manager-release-20260811-010",
|
||||
"artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
|
||||
},
|
||||
"failedPredecessor": {
|
||||
"patchId": "device-manager-release-20260811-016",
|
||||
"artifactSha256": "590405821b95b54088f926e0d3b2cdf9c704b339f6749da500c2bb64fe0e952d",
|
||||
"backupId": "device-plane-device-manager-release-20260811-016-20260811-215941",
|
||||
"invalidCoreCertificateSha256Fingerprint": "56:16:E0:3A:F4:03:85:FD:42:86:85:AF:2A:AF:1E:90:16:C8:F7:91:7C:AD:02:7D:B7:C2:ED:07:06:56:81:F6"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "dedicated-additive-override",
|
||||
"identity": "runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "exact-invalid-unexported-failed-predecessor-only",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract",
|
||||
"rollback": "restore-source-and-preapply-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.core-channel-source.v1",
|
||||
"status": "source-accepted",
|
||||
"authority": "DCPLATFORM-76/ADR-0001",
|
||||
"designContract": "nodedc.device-edge.core-channel.v1",
|
||||
"implementedAt": "2026-08-11",
|
||||
"transport": {
|
||||
"initiator": "device-gateway-core",
|
||||
"listener": "device-edge-channel",
|
||||
"protocol": "http2-bidirectional-ndjson",
|
||||
"tls": "TLSv1.3-mutual-authentication",
|
||||
"bearerAuthentication": false,
|
||||
"genericTcpForwarding": false
|
||||
},
|
||||
"sourceComponents": [
|
||||
"packages/device-edge-channel-contract",
|
||||
"services/device-edge-channel",
|
||||
"services/device-gateway-core"
|
||||
],
|
||||
"identity": {
|
||||
"edgeRegistrationRequired": true,
|
||||
"edgeCertificatePinRequired": true,
|
||||
"coreCertificateAllowlistRequired": true,
|
||||
"unknownOrRevokedIdentity": "reject",
|
||||
"rotation": "one-active-plus-one-staged-generation",
|
||||
"retiredFingerprint": "reject",
|
||||
"privateKeysInSource": false,
|
||||
"privateKeysInArtifact": false
|
||||
},
|
||||
"messageBoundary": {
|
||||
"schema": "nodedc.device-edge.channel-envelope.v1",
|
||||
"maximumEnvelopeBytes": 1048576,
|
||||
"directionLocalSequence": true,
|
||||
"unknownSchemaOrKind": "close-logical-session",
|
||||
"acceptanceWindow": 128,
|
||||
"trackerAckRule": "core-acceptance-required"
|
||||
},
|
||||
"realtime": {
|
||||
"polling": false,
|
||||
"keepaliveSeconds": 15,
|
||||
"deadPeerSeconds": 45,
|
||||
"reconnectMinimumSeconds": 1,
|
||||
"reconnectMaximumSeconds": 30,
|
||||
"delivery": "at-least-once-with-core-idempotency"
|
||||
},
|
||||
"sourceAcceptance": {
|
||||
"devicePlaneTestsPassed": 193,
|
||||
"tls13MutualAuthenticationTested": true,
|
||||
"keepaliveTested": true,
|
||||
"disconnectReconnectTested": true,
|
||||
"certificateRotationOverlapAndRetirementTested": true,
|
||||
"idempotentReplayTested": true,
|
||||
"unknownAndRevokedIdentityTested": true,
|
||||
"oversizedEnvelopeTested": true,
|
||||
"coreUnavailableRejectionTested": true,
|
||||
"crossSessionProgressAndPerSessionOrderingTested": true,
|
||||
"boundedAcceptanceWindowTested": true,
|
||||
"existingCoreImageBuild": "passed-no-cache",
|
||||
"existingGatewayImageBuild": "passed-no-cache"
|
||||
},
|
||||
"runtime": {
|
||||
"mutationInThisTransition": false,
|
||||
"edgePort8443Published": false,
|
||||
"trackerPort9921Published": false,
|
||||
"synologyPublicIngress": false,
|
||||
"trackerIngress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched"
|
||||
},
|
||||
"nextGate": "closed-port-synthetic-runtime-transition-under-DCPLATFORM-21",
|
||||
"rollback": "source-revert-only-runtime-unchanged"
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-edge-core-channel-upgrade.v1",
|
||||
"transitionId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"bootstrapPredecessor": {
|
||||
"patchId": "device-edge-core-channel-bootstrap-20260812-018",
|
||||
"artifactSha256": "5598b7388b491fe524ab46038ce476482a93a6cf07d8ca5e00206c69ded02931"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "preserve-dedicated-additive-override",
|
||||
"identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "forbidden-valid-existing-identity-required",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved-requires-explicit-443-reconciliation",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract",
|
||||
"rollback": "restore-bootstrap-018-source-and-preapply-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-edge-core-channel-upgrade.v2",
|
||||
"transitionId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"upgradePredecessor": {
|
||||
"patchId": "device-edge-core-channel-upgrade-20260812-019",
|
||||
"artifactSha256": "8e9a220275959f378c1c4b00be5c7192e79afe2134eaab808a64e515870a8438"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "preserve-dedicated-additive-override",
|
||||
"identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "forbidden-valid-existing-identity-required",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract",
|
||||
"rollback": "restore-upgrade-019-source-and-preapply-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-edge-core-channel-upgrade.v4",
|
||||
"transitionId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"upgradePredecessor": {
|
||||
"patchId": "device-edge-core-channel-upgrade-v2-20260812-021",
|
||||
"artifactSha256": "e40a6fd24edfecac09e42cd82635a77850541bcf047788db3e9c55d2b9e58867"
|
||||
},
|
||||
"failedAttempt": {
|
||||
"patchId": "device-edge-core-channel-upgrade-v3-20260812-022",
|
||||
"artifactSha256": "9e2b409a4b2d19711db434e90d03ac8e3db77bd74949f83cace7949f33caf613",
|
||||
"backupId": "device-plane-device-edge-core-channel-upgrade-v3-20260812-022-20260812-123620"
|
||||
},
|
||||
"service": "device-control-core",
|
||||
"composeActivation": "replace-core-network-membership-with-private-plus-egress",
|
||||
"identity": "reuse-existing-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"identityRecovery": "forbidden-valid-existing-identity-required",
|
||||
"tlsPurpose": "clientAuth",
|
||||
"direction": "core-initiated",
|
||||
"endpointPolicy": "public-ipv4-standard-https-tcp-443-only",
|
||||
"coreNetworks": [
|
||||
"device-plane-private",
|
||||
"device-plane-egress"
|
||||
],
|
||||
"removedCoreNetwork": "device-plane-control",
|
||||
"composeCompatibility": "synology-compose-v2.20-no-gw-priority",
|
||||
"publicIngress": "none-on-synology",
|
||||
"edgeRegistrations": "preserved",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preservedServices": [
|
||||
"device-manager",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"healthGate": "bounded-container-grace+core-edge-contract+exact-private-egress-network-boundary",
|
||||
"rollback": "restore-upgrade-v2-021-source-and-preapply-core-runtime"
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.core-channel.v1",
|
||||
"status": "accepted-design",
|
||||
"authority": "DCPLATFORM-76/ADR-0001",
|
||||
"direction": "device-gateway-core-initiated",
|
||||
"transport": {
|
||||
"protocol": "http2-bidirectional-stream",
|
||||
"tls": "TLSv1.3-mutual-authentication",
|
||||
"edgeListen": "0.0.0.0:443",
|
||||
"endpointSource": "device-control-core.edge-registration",
|
||||
"browserAccess": "forbidden",
|
||||
"bearerOnlyAuthentication": "forbidden",
|
||||
"genericTcpForwarding": "forbidden"
|
||||
},
|
||||
"identity": {
|
||||
"corePrivateKeyLocation": "synology-canonical-secret-boundary",
|
||||
"edgePrivateKeyLocation": "edge-runner-managed-trust-boundary",
|
||||
"privateKeysInArtifacts": false,
|
||||
"certificateRotation": "generation-bound-audited",
|
||||
"unknownOrRevokedEdge": "reject"
|
||||
},
|
||||
"networkBoundary": {
|
||||
"synologyPublicIngress": false,
|
||||
"synologyPortForward": false,
|
||||
"vpsInitiatedSynologyConnection": false,
|
||||
"subnetRoutes": false,
|
||||
"exitNode": false,
|
||||
"tailscaleSsh": false,
|
||||
"dockerSocket": false,
|
||||
"allowedEdgeListeners": [
|
||||
"management-ssh",
|
||||
"raw-device-tcp/9921",
|
||||
"core-channel-mtls/443"
|
||||
]
|
||||
},
|
||||
"messageContract": {
|
||||
"versioned": true,
|
||||
"bounded": true,
|
||||
"requiredKeys": [
|
||||
"schemaVersion",
|
||||
"edgeRegistrationId",
|
||||
"channelGeneration",
|
||||
"trackerSessionId",
|
||||
"adapterProfileRef",
|
||||
"sequence",
|
||||
"eventAt",
|
||||
"receivedAt",
|
||||
"messageKind",
|
||||
"correlationId"
|
||||
],
|
||||
"unknownKind": "close-logical-session",
|
||||
"rawArbitraryDestination": "forbidden"
|
||||
},
|
||||
"acknowledgement": {
|
||||
"trackerPackageAck": "only-after-bounded-core-acceptance",
|
||||
"coreUnavailable": "do-not-acknowledge-tracker-package",
|
||||
"deduplicationKey": [
|
||||
"edgeRegistrationId",
|
||||
"channelGeneration",
|
||||
"trackerSessionId",
|
||||
"packageNumber",
|
||||
"contentDigest"
|
||||
],
|
||||
"deliverySemantics": "at-least-once"
|
||||
},
|
||||
"pilotLimits": {
|
||||
"maxTrackerSessions": 128,
|
||||
"maxSessionsPerObservedSource": 16,
|
||||
"maxNewConnectionsPerMinutePerObservedSource": 60,
|
||||
"maxBufferedBytesPerTrackerSession": 262144,
|
||||
"maxAggregateBufferedBytes": 33554432,
|
||||
"maxEnvelopePayloadBytes": 1048576,
|
||||
"keepaliveSeconds": 15,
|
||||
"deadPeerSeconds": 45,
|
||||
"reconnectMinimumSeconds": 1,
|
||||
"reconnectMaximumSeconds": 30,
|
||||
"durableEdgeSpool": false
|
||||
},
|
||||
"pilotSlo": {
|
||||
"trackerAckBeforeDurableCoreAcceptance": 0,
|
||||
"lossOfCoreAcceptedPackages": 0,
|
||||
"edgeReceiveToCoreAcceptanceP95Milliseconds": 2000,
|
||||
"edgeReceiveToCoreAcceptanceP99Milliseconds": 5000,
|
||||
"channelReestablishmentP95Seconds": 60,
|
||||
"channelReestablishmentHardCeilingSeconds": 120,
|
||||
"deadCoreDetectionHardCeilingSeconds": 45,
|
||||
"malformedOrUnauthenticatedAcceptedRecords": 0,
|
||||
"availabilityCommitment": "deferred-until-measured"
|
||||
},
|
||||
"commandBoundary": {
|
||||
"typedOnly": true,
|
||||
"rawPayload": "forbidden",
|
||||
"durableEdgeQueue": false,
|
||||
"sentEqualsSuccess": false,
|
||||
"protocolAckMeans": "acknowledged-not-verified",
|
||||
"unsafeAutomaticRetry": "forbidden"
|
||||
},
|
||||
"preserved": [
|
||||
"device-control-core-database",
|
||||
"device-gateway-core",
|
||||
"hub-authentik",
|
||||
"engine",
|
||||
"foundry-runtime",
|
||||
"gelios-production-path"
|
||||
],
|
||||
"rollout": [
|
||||
"source-and-ops-contract",
|
||||
"closed-port-synthetic-core-channel",
|
||||
"negative-network-and-identity-acceptance",
|
||||
"separate-public-device-ingress-transition",
|
||||
"one-device-pilot"
|
||||
],
|
||||
"rollback": "restore-closed-port-predecessor-without-vps-initiated-backhaul"
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.ingress-ipvlan.v1",
|
||||
"mode": "single-nic-ipvlan-b2-relay-only",
|
||||
"runtimeHost": "ndcmini12",
|
||||
"component": "device-edge",
|
||||
"selectedServices": [
|
||||
"device-edge-relay"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-edge-backhaul",
|
||||
"tailnet"
|
||||
],
|
||||
"composeProject": "nodedc-device-edge",
|
||||
"composeFiles": [
|
||||
"docker-compose.device-edge.yml",
|
||||
"docker-compose.device-edge.ingress.yml"
|
||||
],
|
||||
"parentInterface": "enp1s0f0",
|
||||
"lanSubnet": "192.168.68.0/22",
|
||||
"lanGateway": "192.168.68.1",
|
||||
"ingressIpv4": "192.168.71.253",
|
||||
"ingressIpv4Approval": "approved-outside-dhcp-pool",
|
||||
"ingressNetwork": "nodedc-device-edge-ingress",
|
||||
"deviceTcpListen": "192.168.71.253:9921",
|
||||
"hostPortPublication": "disabled",
|
||||
"healthPublication": "disabled",
|
||||
"privateUpstream": "device-edge-backhaul:19921",
|
||||
"protocolInspection": "gateway-owned",
|
||||
"identityTrust": "claimed-not-ownership-proof",
|
||||
"discoveryLifecycle": "quarantine",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"amneziaHostFullTunnel": "preserved",
|
||||
"routerNatFirewall": "separate-manual-gate",
|
||||
"rollback": "restore-predecessor-relay-remove-unused-ingress-network"
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.backhaul.v1",
|
||||
"mode": "tailscale-userspace-key-only-ssh-local-forward",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"component": "device-edge-vps",
|
||||
"tailscaleNodeName": "nodedc-b2-vps",
|
||||
"tailnetDnsSuffix": "tail8d32ac.ts.net",
|
||||
"targetHost": "100.109.216.21",
|
||||
"targetPort": 2222,
|
||||
"targetHostKeyFingerprint": "SHA256:QERJ5CIUXRj0nLChGT6HMtoX+WTaeaEY5ZgaWqT8d30",
|
||||
"targetUser": "device-backhaul",
|
||||
"runtimeUser": "nodedc-backhaul",
|
||||
"credentialBoundary": "private-key-readable-only-by-nodedc-backhaul",
|
||||
"permitOpen": "127.0.0.1:9921",
|
||||
"localForward": "127.0.0.1:19921",
|
||||
"proxy": "tailscale-userspace-socks5-127.0.0.1:1055",
|
||||
"keyIdentity": "nodedc-device-edge-vps-backhaul",
|
||||
"publicB2Ingress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "remove-backhaul-unit-and-user-restore-foundation-key-ownership"
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.command-transport.v1",
|
||||
"mode": "provider-neutral-typed-command-transport-over-accepted-core-channel",
|
||||
"status": "active-typed-command-transport",
|
||||
"authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
|
||||
"component": "device-edge-vps",
|
||||
"phase": "command-transport",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"predecessorPatch": "device-edge-vps-tracker-ingress-20260812-012",
|
||||
"predecessorArtifactSha256": "290acef118839c6b0c31aac864c47da1832a289537366af9322d4624a1dd81ec",
|
||||
"runtimeUser": "nodedc-channel",
|
||||
"runtimeService": "nodedc-device-edge-channel.service",
|
||||
"runtimeComposition": "single-process-core-channel-plus-universal-device-gateway",
|
||||
"publicIngress": "tcp/443-mtls-core-channel+tcp/9921-bidirectional-tracker-session",
|
||||
"trackerIngress": "preserved:allowlisted-adapters-only",
|
||||
"initialAdapterProfile": "arusnavi.b2.internal.v1",
|
||||
"commandTransport": "typed-service-ping-v1",
|
||||
"commandCatalog": "allowlisted-adapter-typed-commands-only",
|
||||
"allowedCommands": [
|
||||
"service.ping"
|
||||
],
|
||||
"credentialBoundary": "transient-over-pinned-mtls-in-memory-until-single-tracker-write-never-stored-never-logged-never-returned",
|
||||
"responseBoundary": "exact-adapter-parser-serv-ok-only",
|
||||
"health": "127.0.0.1:18222",
|
||||
"adapterHealth": "127.0.0.1:18221",
|
||||
"rawDeviceTcp9921": "public-bidirectional-tracker-session-no-generic-forwarding",
|
||||
"gelios": "untouched-legacy-only",
|
||||
"tailscale": "absent",
|
||||
"dataBoundary": "no-vps-database-no-business-logic-no-synology-route",
|
||||
"resourceCeilings": {
|
||||
"memory": "192M",
|
||||
"swap": "0",
|
||||
"cpu": "75%",
|
||||
"tasks": 128,
|
||||
"openFiles": 1024,
|
||||
"sessions": 128,
|
||||
"sessionsPerAddress": 16,
|
||||
"connectionsPerMinutePerAddress": 60,
|
||||
"sessionBufferBytes": 65536,
|
||||
"aggregateBufferBytes": 33554432
|
||||
},
|
||||
"preserved": [
|
||||
"management-ssh-key",
|
||||
"accepted-node-runtime",
|
||||
"accepted-core-channel-trust-and-registration",
|
||||
"accepted-tracker-ingress",
|
||||
"retired-tailnet-boundary",
|
||||
"gelios-production-path"
|
||||
],
|
||||
"forbidden": [
|
||||
"vps-initiated-synology-connection",
|
||||
"generic-tcp-forwarding",
|
||||
"tailscale-runtime",
|
||||
"docker",
|
||||
"public-health",
|
||||
"vps-database",
|
||||
"vps-business-logic",
|
||||
"unregistered-adapter",
|
||||
"raw-command",
|
||||
"firmware-command",
|
||||
"reboot-command",
|
||||
"persistent-command-credential"
|
||||
],
|
||||
"acceptance": [
|
||||
"exact-tracker-ingress-012-predecessor",
|
||||
"single-non-root-edge-process",
|
||||
"core-channel-remains-accepted",
|
||||
"public-tracker-tcp-9921-listening",
|
||||
"adapter-profile-allowlisted",
|
||||
"typed-service-ping-only",
|
||||
"exact-serv-ok-response-parser",
|
||||
"bounded-session-and-buffer-limits",
|
||||
"tailscale-remains-absent",
|
||||
"no-vps-to-synology-route",
|
||||
"gelios-untouched"
|
||||
],
|
||||
"rollback": "restore-exact-tracker-ingress-012-source-and-existing-runtime"
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.core-channel.v1",
|
||||
"mode": "provider-neutral-core-initiated-mtls-http2",
|
||||
"status": "closed-tracker-ingress",
|
||||
"authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
|
||||
"component": "device-edge-vps",
|
||||
"phase": "core-channel",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"runtimeUser": "nodedc-channel",
|
||||
"runtimeService": "nodedc-device-edge-channel.service",
|
||||
"runtime": "accepted-node-v22.23.2-no-docker",
|
||||
"publicIngress": "tcp/443-mtls-only",
|
||||
"health": "127.0.0.1:18222",
|
||||
"trackerIngress": "disabled",
|
||||
"rawDeviceTcp9921": "closed",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"privateKeyBoundary": "runner-managed-host-local-only",
|
||||
"peerTrustPrerequisite": "exact-pinned-self-signed-core-certificate-and-fingerprint",
|
||||
"tls": "TLSv1.3+h2+mutual-authentication",
|
||||
"networkPrivilege": "CAP_NET_BIND_SERVICE-only-for-non-root-tcp-443",
|
||||
"resourceCeilings": {
|
||||
"memory": "128M",
|
||||
"swap": "0",
|
||||
"cpu": "50%",
|
||||
"tasks": 64,
|
||||
"openFiles": 1024
|
||||
},
|
||||
"preserved": [
|
||||
"management-ssh-key",
|
||||
"accepted-node-runtime",
|
||||
"foundation-source",
|
||||
"gelios-production-path"
|
||||
],
|
||||
"forbidden": [
|
||||
"vps-initiated-synology-connection",
|
||||
"generic-tcp-forwarding",
|
||||
"tailscale-ssh-backhaul",
|
||||
"docker",
|
||||
"public-health",
|
||||
"tracker-tcp/9921"
|
||||
],
|
||||
"acceptance": [
|
||||
"exact-non-root-runtime-identity",
|
||||
"tls13-h2-mutual-authentication",
|
||||
"edge-server-and-core-client-self-signed-identities-mutually-pinned",
|
||||
"core-initiated-channel-accepted",
|
||||
"unknown-core-certificate-rejected",
|
||||
"public-443-only-beside-management-ssh",
|
||||
"tracker-tcp-9921-closed",
|
||||
"loopback-health-contract",
|
||||
"resource-ceilings-present"
|
||||
],
|
||||
"rollback": "close-443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.foundation.v1",
|
||||
"mode": "static-runtime-key-only-ssh-default-deny-no-public-b2",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"publicIpv4": "155.212.211.15",
|
||||
"component": "device-edge-vps",
|
||||
"nodeVersion": "22.23.2",
|
||||
"nodeArchiveSha256": "d60acfe00a2932254bb0ad20e01b0d74397a0875595de719654b214f4b03f307",
|
||||
"tailscaleVersion": "1.102.2",
|
||||
"tailscaleArchiveSha256": "ad2cde12f8de95f7b93a1e0401e652291c603d42b9d60a33fb1741eb38ab04d8",
|
||||
"serviceUser": "nodedc-edge",
|
||||
"managementSsh": "root-key-only",
|
||||
"managementKeyFingerprint": "SHA256:DYYy1E3DaxIQGC0jnsW6SP7gXdBHUy3A1zn4pvgVUEw",
|
||||
"serverHostKeyFingerprint": "SHA256:mhqNn2S6zstkYL7VFdvt3SYHv1nLjB4J7/s57RrKG6w",
|
||||
"firewall": "default-deny-public-22-only",
|
||||
"tailscale": "userspace-needs-external-enrollment",
|
||||
"backhaulKey": "runner-managed-new-ed25519",
|
||||
"publicB2Ingress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-exact-ssh-firewall-service-and-absent-runtime-predecessor"
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.relay.v1",
|
||||
"mode": "public-b2-opaque-bounded-relay",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"publicIpv4": "155.212.211.15",
|
||||
"component": "device-edge-vps",
|
||||
"runtimeUser": "nodedc-relay",
|
||||
"credentialAccess": "none",
|
||||
"listen": "0.0.0.0:9921",
|
||||
"health": "127.0.0.1:18221",
|
||||
"privateUpstream": "127.0.0.1:19921",
|
||||
"sourceAdmission": "public-ipv4-only",
|
||||
"maxSessions": 128,
|
||||
"maxSessionsPerAddress": 16,
|
||||
"maxConnectionsPerMinutePerAddress": 60,
|
||||
"maxTrackedSourceAddresses": 4096,
|
||||
"maxBytesPerDirection": 67108864,
|
||||
"sessionTimeoutMs": 300000,
|
||||
"protocolInspection": "gateway-owned",
|
||||
"identityTrust": "claimed-not-ownership-proof",
|
||||
"discoveryLifecycle": "quarantine",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"dns": "unchanged",
|
||||
"b2Routes": "unchanged",
|
||||
"rollback": "close-9921-stop-relay-remove-user-and-restore-accepted-backhaul"
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.runtime-reconciliation.v1",
|
||||
"component": "device-edge-vps",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"publicIpv4": "155.212.211.15",
|
||||
"transition": "recover-exact-runtime-executable-modes-after-failed-core-channel-publish",
|
||||
"acceptedFoundationPatch": "device-edge-vps-foundation-20260806-003",
|
||||
"acceptedFoundationArtifactSha256": "1be852f144e9f0fea32af70bebd07a2607b6a1818825094bd4c1b4062064716a",
|
||||
"failedPatch": "device-edge-vps-core-channel-20260812-001",
|
||||
"failedArtifactSha256": "c199980e5754cf3e874a09f42e408fc88885cdbf7c872eac36c0ab768a7bab00",
|
||||
"runtimeMutation": "restore-root-owned-executable-mode-0755-for-exact-known-binaries",
|
||||
"publicCoreChannel": "disabled",
|
||||
"trackerIngress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-exact-runtime-files-modes-and-reconciliation-marker"
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.tailscale-retirement.v1",
|
||||
"mode": "retire-superseded-vps-tailnet-after-accepted-core-channel",
|
||||
"status": "core-channel-only",
|
||||
"authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
|
||||
"component": "device-edge-vps",
|
||||
"phase": "tailscale-retirement",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"predecessorPatch": "device-edge-vps-core-channel-20260812-010",
|
||||
"predecessorArtifactSha256": "c8ef3c4bb45850cad32e881eba081bc4c891c2886e5500d02cb94616d82353f3",
|
||||
"runtimeAction": "stop-disable-remove-userspace-tailscale-runtime-state-and-superseded-trust",
|
||||
"publicIngress": "tcp/443-mtls-only",
|
||||
"trackerIngress": "disabled",
|
||||
"rawDeviceTcp9921": "closed",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"preserved": [
|
||||
"management-ssh-key",
|
||||
"accepted-node-runtime",
|
||||
"accepted-core-channel-source-runtime-and-trust",
|
||||
"core-channel-registration",
|
||||
"foundation-source-for-audit-and-rollback",
|
||||
"gelios-production-path"
|
||||
],
|
||||
"retired": [
|
||||
"nodedc-b2-tailscaled.service",
|
||||
"userspace-socks5-127.0.0.1:1055",
|
||||
"tailscale-local-state",
|
||||
"tailscale-runtime-binaries",
|
||||
"superseded-backhaul-private-key"
|
||||
],
|
||||
"forbidden": [
|
||||
"tailscale-runtime",
|
||||
"tailnet-address",
|
||||
"vps-initiated-synology-connection",
|
||||
"generic-tcp-forwarding",
|
||||
"tailscale-ssh-backhaul",
|
||||
"docker",
|
||||
"public-health",
|
||||
"tracker-tcp/9921"
|
||||
],
|
||||
"acceptance": [
|
||||
"exact-core-channel-010-predecessor",
|
||||
"core-channel-remains-accepted",
|
||||
"tailscale-service-absent-inactive-and-disabled",
|
||||
"tailscale-userspace-listeners-absent",
|
||||
"tailscale-local-state-and-runtime-binaries-absent",
|
||||
"superseded-backhaul-private-key-absent",
|
||||
"public-443-only-beside-management-ssh",
|
||||
"tracker-tcp-9921-closed",
|
||||
"command-transport-disabled"
|
||||
],
|
||||
"externalRevocation": "delete-exact-nodedc-b2-vps-machine-in-tailnet-after-deploy-ok",
|
||||
"rollback": "before-external-tailnet-revocation-restore-backed-up-local-tailscale-runtime-state-unit-and-core-channel-predecessor"
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge-vps.tracker-ingress.v1",
|
||||
"mode": "provider-neutral-allowlisted-adapter-ingress-over-accepted-core-channel",
|
||||
"status": "active-tracker-ingress",
|
||||
"authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
|
||||
"component": "device-edge-vps",
|
||||
"phase": "tracker-ingress",
|
||||
"runtimeHost": "koffyvngij",
|
||||
"predecessorPatch": "device-edge-vps-tailscale-retirement-20260812-011",
|
||||
"predecessorArtifactSha256": "e7b61ec9c83122fa5631467010eff871b98935746df6a1326b6ff6bb9713d877",
|
||||
"runtimeUser": "nodedc-channel",
|
||||
"runtimeService": "nodedc-device-edge-channel.service",
|
||||
"runtimeComposition": "single-process-core-channel-plus-universal-device-gateway",
|
||||
"publicIngress": "tcp/443-mtls-core-channel+tcp/9921-tracker-telemetry",
|
||||
"trackerIngress": "enabled:allowlisted-adapters-only",
|
||||
"initialAdapterProfile": "arusnavi.b2.internal.v1",
|
||||
"acknowledgementBoundary": "tracker-ack-only-after-core-durable-acceptance",
|
||||
"health": "127.0.0.1:18222",
|
||||
"adapterHealth": "127.0.0.1:18221",
|
||||
"rawDeviceTcp9921": "public-telemetry-ingest",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"tailscale": "absent",
|
||||
"dataBoundary": "no-vps-database-no-business-logic-no-synology-route",
|
||||
"resourceCeilings": {
|
||||
"memory": "192M",
|
||||
"swap": "0",
|
||||
"cpu": "75%",
|
||||
"tasks": 128,
|
||||
"openFiles": 1024,
|
||||
"sessions": 128,
|
||||
"sessionsPerAddress": 16,
|
||||
"connectionsPerMinutePerAddress": 60,
|
||||
"sessionBufferBytes": 65536,
|
||||
"aggregateBufferBytes": 33554432
|
||||
},
|
||||
"preserved": [
|
||||
"management-ssh-key",
|
||||
"accepted-node-runtime",
|
||||
"accepted-core-channel-trust-and-registration",
|
||||
"retired-tailnet-boundary",
|
||||
"gelios-production-path"
|
||||
],
|
||||
"forbidden": [
|
||||
"vps-initiated-synology-connection",
|
||||
"generic-tcp-forwarding",
|
||||
"tailscale-runtime",
|
||||
"docker",
|
||||
"public-health",
|
||||
"vps-database",
|
||||
"vps-business-logic",
|
||||
"unregistered-adapter",
|
||||
"device-command"
|
||||
],
|
||||
"acceptance": [
|
||||
"exact-tailscale-retirement-011-predecessor",
|
||||
"single-non-root-edge-process",
|
||||
"core-channel-remains-accepted",
|
||||
"public-tracker-tcp-9921-listening",
|
||||
"adapter-profile-allowlisted",
|
||||
"bounded-session-and-buffer-limits",
|
||||
"tracker-ack-after-core-acceptance",
|
||||
"tailscale-remains-absent",
|
||||
"no-vps-to-synology-route",
|
||||
"command-transport-disabled",
|
||||
"gelios-untouched"
|
||||
],
|
||||
"rollback": "close-9921-restore-exact-tailscale-retirement-011-source-unit-firewall-and-accepted-core-channel-runtime"
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-control-plane-reconciliation.v1",
|
||||
"mode": "failed-control-plane-baseline-adoption",
|
||||
"failedPatchId": "device-manager-control-plane-20260810-001",
|
||||
"failedArtifactSha256": "50e275c1085286bcb3bb2b273aefc8bbba70f446ca2c7bd464dc745710a291a6",
|
||||
"backupId": "device-plane-device-manager-control-plane-20260810-001-20260811-000321",
|
||||
"sourceAction": "publish-reconciliation-marker-only",
|
||||
"runtimeAction": "read-only-acceptance",
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"absentService": "device-manager",
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"publicIngress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "marker-only-runtime-unchanged"
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-control-plane.v1",
|
||||
"action": "activate",
|
||||
"service": "device-manager",
|
||||
"publicIngress": "reverse-proxy-only",
|
||||
"deviceCoreManagementApi": "file-token-authenticated",
|
||||
"launcherTrust": "file-token-scoped-to-device-core-handoff",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched"
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-control-plane-v2-reconciliation.v1",
|
||||
"mode": "failed-v2-control-plane-baseline-adoption",
|
||||
"failedPatchId": "device-manager-control-plane-20260811-003",
|
||||
"failedArtifactSha256": "ba29618ffbfed55448768794f28b18dda439ddb39a1d2a4f1dece19de7f29990",
|
||||
"backupId": "device-plane-device-manager-control-plane-20260811-003-20260811-012505",
|
||||
"failureClass": "deterministic-runtime-module-resolution",
|
||||
"missingModule": "/packages/external-provider-contract/src/credential-reference.mjs",
|
||||
"correctiveAction": "runtime-local-contract-adapter+staged-module-import-gate",
|
||||
"sourceAction": "publish-reconciliation-marker-only",
|
||||
"runtimeAction": "read-only-acceptance",
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres",
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"absentService": "device-manager",
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"publicIngress": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "marker-only-runtime-unchanged"
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-control-plane.v2",
|
||||
"action": "activate",
|
||||
"predecessor": {
|
||||
"patchId": "device-manager-control-plane-reconciliation-20260811-002",
|
||||
"artifactSha256": "dd86dd58e4f649db0981db5089e003caf3961356179f2abb514662351487e1e6",
|
||||
"mode": "failed-control-plane-baseline-adoption"
|
||||
},
|
||||
"service": "device-manager",
|
||||
"publicIngress": "reverse-proxy-only",
|
||||
"deviceCoreManagementApi": "file-token-authenticated",
|
||||
"launcherTrust": "file-token-scoped-to-device-core-handoff",
|
||||
"healthGate": "bounded-container-grace+core-contract",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-reconciled-baseline"
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-release.v1",
|
||||
"releaseId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"predecessor": {
|
||||
"kind": "release",
|
||||
"patchId": "device-manager-release-20260811-010",
|
||||
"artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
|
||||
},
|
||||
"service": "device-manager",
|
||||
"publicIngress": "reverse-proxy-only",
|
||||
"deviceCoreManagementApi": "file-token-authenticated",
|
||||
"launcherTrust": "file-token-scoped-to-device-core-handoff",
|
||||
"healthGate": "bounded-container-grace+core-contract",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-preapply-snapshot"
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-release.v2",
|
||||
"releaseId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"predecessor": {
|
||||
"kind": "release",
|
||||
"patchId": "device-manager-release-20260811-010",
|
||||
"artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
|
||||
},
|
||||
"service": "device-manager",
|
||||
"publicIngress": "reverse-proxy-only",
|
||||
"deviceCoreManagementApi": "file-token-authenticated",
|
||||
"launcherTrust": "file-token-scoped-to-device-core-handoff",
|
||||
"edgeChannel": "core-initiated-pinned-mtls-enabled-zero-or-more-registered-edges",
|
||||
"edgeChannelIdentity": "runner-managed-host-local-private-key-public-certificate-export",
|
||||
"edgeChannelEgress": "dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-8443-registration-policy",
|
||||
"healthGate": "bounded-container-grace+core-contract",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-preapply-snapshot"
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.device-manager-release.v3",
|
||||
"releaseId": "__PATCH_ID__",
|
||||
"action": "upgrade",
|
||||
"predecessor": {
|
||||
"kind": "release",
|
||||
"patchId": "device-manager-release-20260811-010",
|
||||
"artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
|
||||
},
|
||||
"controlCorePredecessor": {
|
||||
"patchId": "device-control-core-release-v2-20260812-025",
|
||||
"artifactSha256": "c61b1f0de1bae23de0caa7289036865ea419ff5705611416f736ca929d1592db"
|
||||
},
|
||||
"edgeChannelPredecessor": {
|
||||
"patchId": "device-edge-core-channel-upgrade-v4-20260812-023",
|
||||
"artifactSha256": "c10d5b6b7d55ab239f85b6c8130e34ce9f84985e3b46e6e5534733156c7982fc"
|
||||
},
|
||||
"service": "device-manager",
|
||||
"publicIngress": "reverse-proxy-only",
|
||||
"deviceCoreManagementApi": "file-token-authenticated",
|
||||
"launcherTrust": "file-token-scoped-to-device-core-handoff",
|
||||
"edgeChannel": "preserve-active-v4-core-initiated-pinned-mtls",
|
||||
"edgeChannelIdentity": "reuse-runner-managed-host-local-private-key-public-certificate-export",
|
||||
"edgeChannelEgress": "preserve-dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-443-only",
|
||||
"healthGate": "bounded-container-grace+core-contract",
|
||||
"commandTransport": "typed-service-ping-v1",
|
||||
"commandCatalog": "allowlisted-adapter-typed-commands-only",
|
||||
"credentialBoundary": "transient-core-memory-then-single-pinned-mtls-command-envelope-to-edge-never-persisted-never-logged-never-returned",
|
||||
"gelios": "untouched-legacy-only",
|
||||
"rollback": "restore-preapply-snapshot"
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.b2-discovery-ingress.v1",
|
||||
"mode": "verified-b2-loopback-discovery-only",
|
||||
"predecessorPatchId": "device-plane-foundation-network-publication-20260725-003",
|
||||
"predecessorArtifactSha256": "6fdd5a12c310786db1753882fc1378184fe378d2cc533633a8c73c951521b7bf",
|
||||
"sourceAction": "publish-verified-b2-loopback-discovery-source",
|
||||
"runtimeAction": "build-and-recreate-stateless-services",
|
||||
"selectedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-postgres"
|
||||
],
|
||||
"privateNetwork": "nodedc-device-plane-private",
|
||||
"controlNetwork": "nodedc-device-plane-control",
|
||||
"publishedPorts": [
|
||||
"127.0.0.1:18120:18120",
|
||||
"127.0.0.1:18121:18121",
|
||||
"127.0.0.1:9921:9921/tcp"
|
||||
],
|
||||
"protocolProfile": "arusnavi.b2.internal.v1",
|
||||
"framingSpecification": "arusnavi.internal.protocol-sheet.gid-12.v1",
|
||||
"identityTrust": "claimed-not-ownership-proof",
|
||||
"discoveryLifecycle": "quarantine",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"rollback": "restore-source-and-predecessor-stateless-runtime"
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.b2-discovery-loopback-recovery.v1",
|
||||
"mode": "failed-b2-loopback-build-reconciliation",
|
||||
"failedPatchId": "device-plane-b2-discovery-loopback-20260801-003",
|
||||
"failedArtifactSha256": "7273c5bf67fe6bc1f1da66ad726009240d39ee3aee58201b96c23d6f707a3d84",
|
||||
"failedBackupId": "device-plane-device-plane-b2-discovery-loopback-20260801-003-20260802-154311",
|
||||
"sourceAction": "publish-reconciliation-marker-only",
|
||||
"runtimeAction": "read-only-acceptance",
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres"
|
||||
],
|
||||
"expectedLoopbackPorts": [
|
||||
"127.0.0.1:18120:18120",
|
||||
"127.0.0.1:18121:18121"
|
||||
],
|
||||
"closedPort": "127.0.0.1:9921/tcp",
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "marker-only-runtime-unchanged"
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.backhaul-target-tailnet-serve.v1",
|
||||
"mode": "failed-backhaul-target-to-loopback-tailnet-serve",
|
||||
"failedPatchId": "device-plane-backhaul-target-20260803-001",
|
||||
"failedArtifactSha256": "ed0bda4110a756c32be68990e2e0f647409d5a77eec7e26c18502bafbdc1bb76",
|
||||
"failedBackupId": "device-plane-device-plane-backhaul-target-20260803-001-20260804-035519",
|
||||
"predecessorPatchId": "device-plane-b2-discovery-loopback-20260803-006",
|
||||
"predecessorArtifactSha256": "25f9e9e55e283e9b7bb5e128ff14a244f848b1c063acca9724a23206131c9adf",
|
||||
"sourceAction": "publish-loopback-backhaul-target-source",
|
||||
"runtimeAction": "build-create-target-and-register-private-tailnet-serve",
|
||||
"composeOverlay": "docker-compose.device-plane.backhaul-target.yml",
|
||||
"selectedServices": [
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres"
|
||||
],
|
||||
"loopbackListenAddress": "127.0.0.1",
|
||||
"listenPort": 2222,
|
||||
"tailnetAddress": "100.109.216.21",
|
||||
"tailnetExposure": "tailscale-serve-private",
|
||||
"tailscaleServeTarget": "tcp://127.0.0.1:2222",
|
||||
"permittedTarget": "127.0.0.1:9921",
|
||||
"networkMode": "host",
|
||||
"dockerPortPublication": "disabled",
|
||||
"routerNatFirewall": "unchanged",
|
||||
"edgePublicIngress": "disabled",
|
||||
"funnel": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"runtimeTrust": "runner-managed",
|
||||
"rollback": "remove-tailnet-serve-target-and-restore-source"
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.backhaul-vps-enrollment.v1",
|
||||
"mode": "rotate-backhaul-client-mini-to-vps",
|
||||
"predecessorPatchId": "device-plane-backhaul-target-tailnet-serve-20260804-002",
|
||||
"predecessorArtifactSha256": "219408705dd4d80a962ed00eeb53a69df0b9ab6458443734d5c9cd1d1f795eba",
|
||||
"sourceAction": "publish-vps-enrollment-marker-only",
|
||||
"runtimeAction": "rotate-authorized-key-and-recreate-backhaul-target",
|
||||
"selectedServices": [
|
||||
"device-backhaul-target"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres"
|
||||
],
|
||||
"previousEnrollment": "device-edge-backhaul.pub",
|
||||
"nextEnrollment": "device-edge-vps-backhaul.pub",
|
||||
"nextKeyFingerprint": "SHA256:HHTiDYiCRxSiKjBLCip6JMSzGfLGrDz5g8SIkosJcVw",
|
||||
"permittedTarget": "127.0.0.1:9921",
|
||||
"tailnetAddress": "100.109.216.21",
|
||||
"dockerPortPublication": "disabled",
|
||||
"routerNatFirewall": "unchanged",
|
||||
"edgePublicIngress": "disabled",
|
||||
"funnel": "disabled",
|
||||
"commandTransport": "disabled",
|
||||
"gelios": "untouched",
|
||||
"rollback": "restore-previous-authorized-key-and-recreate-target"
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.foundation-network-publication.v1",
|
||||
"mode": "failed-foundation-network-publication-correction",
|
||||
"failedRecoveryPatchId": "device-plane-foundation-recovery-20260725-002",
|
||||
"failedRecoveryArtifactSha256": "9183cc385142584bfd12510bb0a3e6b833b2fd26607436f2486a564c628ea1bf",
|
||||
"failedRecoveryBackupId": "device-plane-device-plane-foundation-recovery-20260725-002-20260725-232447",
|
||||
"sourceAction": "publish-network-corrected-foundation-source",
|
||||
"runtimeAction": "recreate-stateless-services-no-build",
|
||||
"selectedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway"
|
||||
],
|
||||
"preservedServices": [
|
||||
"device-postgres"
|
||||
],
|
||||
"privateNetwork": "nodedc-device-plane-private",
|
||||
"controlNetwork": "nodedc-device-plane-control",
|
||||
"publishedLoopbackPorts": [
|
||||
"127.0.0.1:18120:18120",
|
||||
"127.0.0.1:18121:18121"
|
||||
],
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"rollback": "restore-partial-source-and-internal-only-stateless-runtime"
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.foundation-recovery.v1",
|
||||
"mode": "failed-foundation-live-runtime-adoption",
|
||||
"failedPatchId": "device-plane-foundation-20260725-001",
|
||||
"failedArtifactSha256": "23d428de547854ad8b1a026671e2f850386ab0be98bde80f016f1e9db631ee24",
|
||||
"backupId": "device-plane-device-plane-foundation-20260725-001-20260725-223441",
|
||||
"sourceAction": "publish-exact-failed-artifact-source",
|
||||
"runtimeAction": "read-only-acceptance",
|
||||
"preservedServices": [
|
||||
"device-control-core",
|
||||
"device-gateway",
|
||||
"device-postgres"
|
||||
],
|
||||
"databaseVolume": "nodedc-device-plane-postgres-data",
|
||||
"rollback": "source-only-runtime-unchanged"
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-plane.postgres-bootstrap.v1",
|
||||
"service": "device-postgres",
|
||||
"volume": "nodedc-device-plane-postgres-data",
|
||||
"mode": "create-if-absent",
|
||||
"ordinaryApplicationSelection": "forbidden",
|
||||
"rollbackVolumePolicy": "preserve"
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"schemaVersion": "nodedc.device-edge.superseded-transport.v1",
|
||||
"status": "frozen",
|
||||
"frozenAt": "2026-08-10",
|
||||
"authority": "DCPLATFORM-76/ADR-0001",
|
||||
"reason": "The public VPS must not initiate a private connection to Synology.",
|
||||
"successor": "nodedc.device-edge.core-channel.v1",
|
||||
"forbiddenForNewPlanOrApply": [
|
||||
"nodedc.device-edge-vps.backhaul.v1",
|
||||
"nodedc.device-edge-vps.relay.v1:privateUpstream=127.0.0.1:19921",
|
||||
"nodedc.device-plane.backhaul-vps-enrollment.v1",
|
||||
"tailscale-userspace-key-only-ssh-local-forward",
|
||||
"rotate-backhaul-client-mini-to-vps"
|
||||
],
|
||||
"historicalSource": [
|
||||
"deployment/device-edge-vps-backhaul-v1.json",
|
||||
"deployment/device-edge-vps-relay-v1.json",
|
||||
"deployment/device-plane-backhaul-vps-enrollment-v1.json",
|
||||
"deployment/tailscale-device-edge-policy.hujson",
|
||||
"vps/config/backhaul_ssh_config",
|
||||
"vps/systemd/nodedc-b2-backhaul.service",
|
||||
"vps/systemd/nodedc-b2-relay.service",
|
||||
"infra/deploy-runner/build-device-edge-vps-artifact.mjs:backhaul|relay",
|
||||
"infra/deploy-runner/build-device-plane-backhaul-vps-enrollment-artifact.mjs",
|
||||
"infra/deploy-runner/nodedc-b2-vps-deploy:backhaul|relay"
|
||||
],
|
||||
"testOnlyReconstruction": {
|
||||
"environment": "NODEDC_ALLOW_SUPERSEDED_TRANSPORT",
|
||||
"value": "test-only",
|
||||
"deployCandidate": false
|
||||
},
|
||||
"runtimeMutationInPhase0": false
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
// NODE.DC tailnet policy: user devices retain self-access while the public
|
||||
// Robot2B Device Edge VPS receives one purpose-bound egress grant.
|
||||
{
|
||||
"tagOwners": {
|
||||
"tag:device-edge-vps": ["autogroup:admin"],
|
||||
},
|
||||
|
||||
"hosts": {
|
||||
"device-plane-backhaul": "100.109.216.21",
|
||||
"nodedc-admin-macbook": "100.114.248.4",
|
||||
"nodedc-device-edge": "100.64.19.31",
|
||||
},
|
||||
|
||||
"grants": [
|
||||
// Preserve unrestricted connectivity only between devices owned by the
|
||||
// same authenticated tailnet member. Tagged service nodes are excluded.
|
||||
{
|
||||
"src": ["autogroup:member"],
|
||||
"dst": ["autogroup:self"],
|
||||
"ip": ["*"],
|
||||
},
|
||||
|
||||
// The public VPS can reach exactly the private SSH forwarding target.
|
||||
{
|
||||
"src": ["tag:device-edge-vps"],
|
||||
"dst": ["device-plane-backhaul"],
|
||||
"ip": ["tcp:2222"],
|
||||
},
|
||||
],
|
||||
|
||||
// Preserve the existing Tailscale SSH policy for user-owned devices.
|
||||
"ssh": [
|
||||
{
|
||||
"action": "check",
|
||||
"src": ["autogroup:member"],
|
||||
"dst": ["autogroup:self"],
|
||||
"users": ["autogroup:nonroot", "root"],
|
||||
},
|
||||
],
|
||||
|
||||
// These assertions are evaluated by Tailscale before every policy save.
|
||||
"tests": [
|
||||
{
|
||||
"src": "tag:device-edge-vps",
|
||||
"proto": "tcp",
|
||||
"accept": ["device-plane-backhaul:2222"],
|
||||
"deny": [
|
||||
"device-plane-backhaul:22",
|
||||
"device-plane-backhaul:5001",
|
||||
"nodedc-admin-macbook:22",
|
||||
"nodedc-device-edge:22",
|
||||
],
|
||||
},
|
||||
],
|
||||
}
|
||||
Reference in New Issue
Block a user