feat(device-edge): add isolated B2 ingress domain

2026-08-04 11:39:01 +03:00
parent b1a5a26b9a
commit 3bb5e6dc27
35 changed files with 5790 additions and 19 deletions
@@ -20,6 +20,56 @@ The runner accepts data-only app-overlay artifacts from:
 /volume1/docker/nodedc-deploy/inbox
 ```

+## Dedicated Device Edge runner
+
+The Debian Device Edge is a separate root-owned deployment domain. It does not
+use the Synology runner, inbox, state or backup tree. Its live runner and fixed
+roots are:
+
+```text
+/usr/local/sbin/nodedc-edge-deploy
+/home/ndcsudo/nodedc-device-edge/deploy/inbox
+/home/ndcsudo/nodedc-device-edge/source
+/var/lib/nodedc-edge-deploy
+```
+
+`nodedc-edge-deploy` accepts only `component=device-edge`, validates an exact
+five-entry payload and can build/recreate only `device-edge-relay`. The existing
+`device-edge-backhaul` and `tailnet` containers are identity-snapshotted before
+the transition and must remain byte-for-byte runtime-equivalent through apply
+or automatic rollback. It has no registry entry in the Synology runner.
+
+The first ingress transition uses a Docker IPvlan L2 address on the Mini's
+single Ethernet parent. It publishes no Docker host port and preserves the
+Amnezia host full tunnel; only the relay container receives a LAN-routable
+address. The fixed IPv4 is a runner/Compose/descriptor constant:
+`192.168.71.253`. Router evidence on 2026-08-04 proves the Deco DHCP pool is
+`192.168.68.50` through `192.168.71.250`, so the address is explicitly outside
+the pool. Router port-forwarding/firewall remains a separate manual gate.
+
+Build and test the transition source:
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 \
+  python3 infra/deploy-runner/test_device_edge_ingress_artifact.py
+npm test --prefix device-plane
+```
+
+After the fixed address is approved, build the production artifact with a fresh
+transition id, stage it into the Edge inbox, then use only the canonical pair:
+
+```bash
+sudo /usr/local/sbin/nodedc-edge-deploy plan \
+  /home/ndcsudo/nodedc-device-edge/deploy/inbox/<artifact>.tgz
+sudo /usr/local/sbin/nodedc-edge-deploy apply \
+  /home/ndcsudo/nodedc-device-edge/deploy/inbox/<artifact>.tgz
+```
+
+The apply acceptance checks the exact IPvlan parent/subnet/gateway/address,
+absence of host port publication, internal relay health, private backhaul
+reachability, preserved VPN routes and unchanged backhaul/tailnet container
+identity. Gelios and Device Plane command transport are outside this domain.
+
 Supported components in this source:

 - `engine`