feat(device-edge): add isolated B2 ingress domain

2026-08-04 11:39:01 +03:00
parent b1a5a26b9a
commit 3bb5e6dc27
35 changed files with 5790 additions and 19 deletions
@@ -0,0 +1,25 @@
+{
+  "schemaVersion": "nodedc.device-edge.backhaul.v1",
+  "mode": "private-tailnet-ssh-local-forward",
+  "runtimeHost": "ndcmini12",
+  "selectedServices": [
+    "device-edge-backhaul"
+  ],
+  "preservedServices": [
+    "device-edge-relay",
+    "tailnet"
+  ],
+  "tailnetSocksTarget": "nodedc-device-edge-tailnet-1:1055",
+  "sshTarget": "100.109.216.21:2222",
+  "sshUser": "device-backhaul",
+  "localForward": "0.0.0.0:19921",
+  "permittedRemoteTarget": "127.0.0.1:9921",
+  "hostPortPublication": "disabled",
+  "deviceIngress": "disabled",
+  "protocolInspection": "disabled",
+  "commandTransport": "disabled",
+  "privateKey": "runtime-only-read-only",
+  "knownHosts": "runner-prepared-exact-ed25519",
+  "routerNatFirewall": "unchanged",
+  "gelios": "untouched"
+}
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "nodedc.device-edge.ingress-ipvlan.v1",
+  "mode": "single-nic-ipvlan-b2-relay-only",
+  "runtimeHost": "ndcmini12",
+  "component": "device-edge",
+  "selectedServices": [
+    "device-edge-relay"
+  ],
+  "preservedServices": [
+    "device-edge-backhaul",
+    "tailnet"
+  ],
+  "composeProject": "nodedc-device-edge",
+  "composeFiles": [
+    "docker-compose.device-edge.yml",
+    "docker-compose.device-edge.ingress.yml"
+  ],
+  "parentInterface": "enp1s0f0",
+  "lanSubnet": "192.168.68.0/22",
+  "lanGateway": "192.168.68.1",
+  "ingressIpv4": "192.168.71.253",
+  "ingressIpv4Approval": "approved-outside-dhcp-pool",
+  "ingressNetwork": "nodedc-device-edge-ingress",
+  "deviceTcpListen": "192.168.71.253:9921",
+  "hostPortPublication": "disabled",
+  "healthPublication": "disabled",
+  "privateUpstream": "device-edge-backhaul:19921",
+  "protocolInspection": "gateway-owned",
+  "identityTrust": "claimed-not-ownership-proof",
+  "discoveryLifecycle": "quarantine",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "amneziaHostFullTunnel": "preserved",
+  "routerNatFirewall": "separate-manual-gate",
+  "rollback": "restore-predecessor-relay-remove-unused-ingress-network"
+}
@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "nodedc.device-plane.b2-discovery-loopback-recovery.v1",
+  "mode": "failed-b2-loopback-build-reconciliation",
+  "failedPatchId": "device-plane-b2-discovery-loopback-20260801-003",
+  "failedArtifactSha256": "7273c5bf67fe6bc1f1da66ad726009240d39ee3aee58201b96c23d6f707a3d84",
+  "failedBackupId": "device-plane-device-plane-b2-discovery-loopback-20260801-003-20260802-154311",
+  "sourceAction": "publish-reconciliation-marker-only",
+  "runtimeAction": "read-only-acceptance",
+  "preservedServices": [
+    "device-control-core",
+    "device-gateway",
+    "device-postgres"
+  ],
+  "expectedLoopbackPorts": [
+    "127.0.0.1:18120:18120",
+    "127.0.0.1:18121:18121"
+  ],
+  "closedPort": "127.0.0.1:9921/tcp",
+  "databaseVolume": "nodedc-device-plane-postgres-data",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "rollback": "marker-only-runtime-unchanged"
+}
@@ -0,0 +1,36 @@
+{
+  "schemaVersion": "nodedc.device-plane.backhaul-target-tailnet-serve.v1",
+  "mode": "failed-backhaul-target-to-loopback-tailnet-serve",
+  "failedPatchId": "device-plane-backhaul-target-20260803-001",
+  "failedArtifactSha256": "ed0bda4110a756c32be68990e2e0f647409d5a77eec7e26c18502bafbdc1bb76",
+  "failedBackupId": "device-plane-device-plane-backhaul-target-20260803-001-20260804-035519",
+  "predecessorPatchId": "device-plane-b2-discovery-loopback-20260803-006",
+  "predecessorArtifactSha256": "25f9e9e55e283e9b7bb5e128ff14a244f848b1c063acca9724a23206131c9adf",
+  "sourceAction": "publish-loopback-backhaul-target-source",
+  "runtimeAction": "build-create-target-and-register-private-tailnet-serve",
+  "composeOverlay": "docker-compose.device-plane.backhaul-target.yml",
+  "selectedServices": [
+    "device-backhaul-target"
+  ],
+  "preservedServices": [
+    "device-control-core",
+    "device-gateway",
+    "device-postgres"
+  ],
+  "loopbackListenAddress": "127.0.0.1",
+  "listenPort": 2222,
+  "tailnetAddress": "100.109.216.21",
+  "tailnetExposure": "tailscale-serve-private",
+  "tailscaleServeTarget": "tcp://127.0.0.1:2222",
+  "permittedTarget": "127.0.0.1:9921",
+  "networkMode": "host",
+  "dockerPortPublication": "disabled",
+  "routerNatFirewall": "unchanged",
+  "edgePublicIngress": "disabled",
+  "funnel": "disabled",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "databaseVolume": "nodedc-device-plane-postgres-data",
+  "runtimeTrust": "runner-managed",
+  "rollback": "remove-tailnet-serve-target-and-restore-source"
+}