feat(device-edge): add isolated B2 ingress domain

2026-08-04 11:39:01 +03:00
parent b1a5a26b9a
commit 3bb5e6dc27
35 changed files with 5790 additions and 19 deletions
@@ -0,0 +1,39 @@
+services:
+  device-backhaul-target:
+    image: nodedc/device-backhaul-target:local
+    pull_policy: never
+    restart: unless-stopped
+    network_mode: host
+    read_only: true
+    tmpfs:
+      - /run:size=8m,mode=0755
+      - /tmp:size=8m,mode=1777
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/backhaul-target/ssh_host_ed25519_key
+        target: /run/nodedc-secrets/ssh_host_ed25519_key
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/backhaul-target/authorized_keys
+        target: /run/nodedc-secrets/authorized_keys
+        read_only: true
+        bind:
+          create_host_path: false
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - SETGID
+      - SETUID
+      - SYS_CHROOT
+    healthcheck:
+      test: ["CMD", "nc", "-z", "-w", "3", "127.0.0.1", "2222"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 10s