feat: establish standalone Device Core repository

2026-08-21 11:51:21 +03:00
commit e0bac205d0
244 changed files with 51962 additions and 0 deletions
@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const devicePlaneRoot = resolve(
+  dirname(fileURLToPath(import.meta.url)),
+  "../../..",
+);
+
+test("single-NIC ingress source has no host publication and a fixed ipvlan", async () => {
+  const baseline = await readFile(
+    resolve(devicePlaneRoot, "docker-compose.device-edge.yml"),
+    "utf8",
+  );
+  const ingress = await readFile(
+    resolve(devicePlaneRoot, "docker-compose.device-edge.ingress.yml"),
+    "utf8",
+  );
+
+  assert.match(
+    baseline,
+    /DEVICE_EDGE_RELAY_HEALTH_HOST: 127\.0\.0\.1/,
+  );
+  assert.doesNotMatch(baseline, /^\s+ports:/m);
+  assert.doesNotMatch(baseline, /device-edge-control/);
+
+  for (const required of [
+    'DEVICE_EDGE_RELAY_INGRESS_ENABLED: "true"',
+    "DEVICE_EDGE_RELAY_UPSTREAM_HOST: device-edge-backhaul",
+    'DEVICE_EDGE_RELAY_UPSTREAM_PORT: "19921"',
+    "name: nodedc-device-edge-ingress",
+    "driver: ipvlan",
+    "parent: enp1s0f0",
+    "ipvlan_mode: l2",
+    "ipv4_address: 192.168.71.253",
+    "subnet: 192.168.68.0/22",
+    "gateway: 192.168.68.1",
+    "gw_priority: 100",
+    "DEVICE_EDGE_RELAY_SOURCE_POLICY: public-ipv4-only",
+    'DEVICE_EDGE_RELAY_MAX_TRACKED_SOURCE_ADDRESSES: "2048"',
+    'DEVICE_EDGE_RELAY_MAX_BYTES_PER_DIRECTION: "262144"',
+  ]) {
+    assert.ok(ingress.includes(required), `missing ingress boundary: ${required}`);
+  }
+
+  for (const forbidden of [
+    "ports:",
+    "network_mode: host",
+    "privileged: true",
+    "DEVICE_EDGE_RELAY_COMMAND",
+    "0.0.0.0:9921:9921",
+  ]) {
+    assert.ok(
+      !ingress.includes(forbidden),
+      `forbidden ingress boundary: ${forbidden}`,
+    );
+  }
+});
+
+test("ingress descriptor keeps address approval and router exposure gated", async () => {
+  const descriptor = JSON.parse(await readFile(
+    resolve(
+      devicePlaneRoot,
+      "deployment/device-edge-ingress-ipvlan-v1.json",
+    ),
+    "utf8",
+  ));
+
+  assert.equal(descriptor.component, "device-edge");
+  assert.deepEqual(descriptor.selectedServices, ["device-edge-relay"]);
+  assert.deepEqual(
+    descriptor.preservedServices,
+    ["device-edge-backhaul", "tailnet"],
+  );
+  assert.equal(descriptor.ingressIpv4Approval, "approved-outside-dhcp-pool");
+  assert.equal(descriptor.hostPortPublication, "disabled");
+  assert.equal(descriptor.healthPublication, "disabled");
+  assert.equal(descriptor.privateUpstream, "device-edge-backhaul:19921");
+  assert.equal(descriptor.protocolInspection, "gateway-owned");
+  assert.equal(descriptor.discoveryLifecycle, "quarantine");
+  assert.equal(descriptor.commandTransport, "disabled");
+  assert.equal(descriptor.gelios, "untouched");
+  assert.equal(descriptor.amneziaHostFullTunnel, "preserved");
+  assert.equal(descriptor.routerNatFirewall, "separate-manual-gate");
+});
+
+test("admission-gate descriptor pins the fail-closed relay boundary", async () => {
+  const descriptor = JSON.parse(await readFile(
+    resolve(
+      devicePlaneRoot,
+      "deployment/device-edge-admission-gate-v1.json",
+    ),
+    "utf8",
+  ));
+
+  assert.equal(
+    descriptor.schemaVersion,
+    "nodedc.device-edge.admission-gate.v1",
+  );
+  assert.equal(descriptor.sourceAdmission, "public-ipv4-only");
+  assert.equal(descriptor.maxTrackedSourceAddresses, 2048);
+  assert.equal(descriptor.maxBytesPerDirection, 262144);
+  assert.equal(descriptor.hostPortPublication, "disabled");
+  assert.equal(descriptor.healthPublication, "disabled");
+  assert.equal(descriptor.commandTransport, "disabled");
+  assert.equal(descriptor.gelios, "untouched");
+  assert.equal(descriptor.routerNatFirewall, "separate-manual-gate");
+});