feat: establish standalone Device Core repository

services/device-edge-backhaul/Dockerfile

@@ -0,0 +1,9 @@
+FROM alpine:3.22
+
+RUN apk add --no-cache openssh-client-default netcat-openbsd \
+  && addgroup -g 1000 edge-backhaul \
+  && adduser -D -H -u 1000 -G edge-backhaul -s /sbin/nologin edge-backhaul
+
+USER 1000:1000
+
+ENTRYPOINT ["/usr/bin/ssh"]

services/device-edge-backhaul/test/source.test.mjs

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const devicePlane = resolve(here, "../../..");
+
+test("edge backhaul is key-only, pinned and never host-published", async () => {
+  const compose = await readFile(
+    resolve(devicePlane, "docker-compose.device-edge.backhaul.yml"),
+    "utf8",
+  );
+  const descriptor = JSON.parse(await readFile(
+    resolve(devicePlane, "deployment/device-edge-backhaul-v1.json"),
+    "utf8",
+  ));
+
+  assert.match(compose, /StrictHostKeyChecking=yes/);
+  assert.match(compose, /UserKnownHostsFile=\/run\/trust\/known_hosts/);
+  assert.match(compose, /PasswordAuthentication=no/);
+  assert.match(compose, /KbdInteractiveAuthentication=no/);
+  assert.match(compose, /ExitOnForwardFailure=yes/);
+  assert.match(compose, /ProxyCommand=nc -X 5 -x nodedc-device-edge-tailnet-1:1055/);
+  assert.match(compose, /\.\.\/secrets\/backhaul\/id_ed25519/);
+  assert.doesNotMatch(compose, /\.\.\/keys\/edge-to-synology/);
+  assert.match(compose, /0\.0\.0\.0:19921:127\.0\.0\.1:9921/);
+  assert.doesNotMatch(compose, /^\s+ports:/m);
+  assert.doesNotMatch(compose, /0\.0\.0\.0:9921/);
+  assert.equal(descriptor.hostPortPublication, "disabled");
+  assert.equal(descriptor.deviceIngress, "disabled");
+  assert.equal(descriptor.commandTransport, "disabled");
+});