feat(device-edge): open bounded tracker ingress

2026-08-12 15:10:27 +03:00
parent 6fd172ecc5
commit 606872edcc
9 changed files with 717 additions and 3 deletions
@@ -0,0 +1,69 @@
+{
+  "schemaVersion": "nodedc.device-edge-vps.tracker-ingress.v1",
+  "mode": "provider-neutral-allowlisted-adapter-ingress-over-accepted-core-channel",
+  "status": "active-tracker-ingress",
+  "authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
+  "component": "device-edge-vps",
+  "phase": "tracker-ingress",
+  "runtimeHost": "koffyvngij",
+  "predecessorPatch": "device-edge-vps-tailscale-retirement-20260812-011",
+  "predecessorArtifactSha256": "e7b61ec9c83122fa5631467010eff871b98935746df6a1326b6ff6bb9713d877",
+  "runtimeUser": "nodedc-channel",
+  "runtimeService": "nodedc-device-edge-channel.service",
+  "runtimeComposition": "single-process-core-channel-plus-universal-device-gateway",
+  "publicIngress": "tcp/443-mtls-core-channel+tcp/9921-tracker-telemetry",
+  "trackerIngress": "enabled:allowlisted-adapters-only",
+  "initialAdapterProfile": "arusnavi.b2.internal.v1",
+  "acknowledgementBoundary": "tracker-ack-only-after-core-durable-acceptance",
+  "health": "127.0.0.1:18222",
+  "adapterHealth": "127.0.0.1:18221",
+  "rawDeviceTcp9921": "public-telemetry-ingest",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "tailscale": "absent",
+  "dataBoundary": "no-vps-database-no-business-logic-no-synology-route",
+  "resourceCeilings": {
+    "memory": "192M",
+    "swap": "0",
+    "cpu": "75%",
+    "tasks": 128,
+    "openFiles": 1024,
+    "sessions": 128,
+    "sessionsPerAddress": 16,
+    "connectionsPerMinutePerAddress": 60,
+    "sessionBufferBytes": 65536,
+    "aggregateBufferBytes": 33554432
+  },
+  "preserved": [
+    "management-ssh-key",
+    "accepted-node-runtime",
+    "accepted-core-channel-trust-and-registration",
+    "retired-tailnet-boundary",
+    "gelios-production-path"
+  ],
+  "forbidden": [
+    "vps-initiated-synology-connection",
+    "generic-tcp-forwarding",
+    "tailscale-runtime",
+    "docker",
+    "public-health",
+    "vps-database",
+    "vps-business-logic",
+    "unregistered-adapter",
+    "device-command"
+  ],
+  "acceptance": [
+    "exact-tailscale-retirement-011-predecessor",
+    "single-non-root-edge-process",
+    "core-channel-remains-accepted",
+    "public-tracker-tcp-9921-listening",
+    "adapter-profile-allowlisted",
+    "bounded-session-and-buffer-limits",
+    "tracker-ack-after-core-acceptance",
+    "tailscale-remains-absent",
+    "no-vps-to-synology-route",
+    "command-transport-disabled",
+    "gelios-untouched"
+  ],
+  "rollback": "close-9921-restore-exact-tailscale-retirement-011-source-unit-firewall-and-accepted-core-channel-runtime"
+}