SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(device-edge): open bounded tracker ingress

Browse Source
This commit is contained in:
Codex
2026-08-12 15:10:27 +03:00
parent 6fd172ecc5
commit 606872edcc
9 changed files with 717 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/test_device_edge_vps_artifact.py
+58
View File
@@ -99,6 +99,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
"relay",
"core-channel",
"tailscale-retirement",
"tracker-ingress",
):
with self.subTest(phase=phase), tempfile.TemporaryDirectory(
prefix=f"nodedc-vps-{phase}-"
@@ -178,6 +179,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
"relay",
"core-channel",
"tailscale-retirement",
"tracker-ingress",
):
result = self.build(
inbox,
@@ -361,6 +363,45 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
self.assertIn("command_transport=disabled", rendered)
self.assertIn("gelios=untouched", rendered)
def test_tracker_ingress_plan_is_single_process_bounded_and_command_free(self):
with tempfile.TemporaryDirectory(prefix="nodedc-vps-ingress-plan-") as directory:
inbox = Path(directory) / "inbox"
inbox.mkdir()
result = self.build(
inbox,
"tracker-ingress",
"device-edge-vps-tracker-ingress-plan-001",
)
self.assertEqual(result.returncode, 0, result.stderr)
artifact = Path(json.loads(result.stdout)["artifact"])
old_inbox = RUNNER.INBOX_ROOT
RUNNER.INBOX_ROOT = inbox
try:
with patch.object(RUNNER, "assert_root"), patch.object(
RUNNER,
"preflight",
return_value={"predecessor": "accepted-tailscale-retirement-011"},
), patch("builtins.print") as output:
RUNNER.plan_artifact(str(artifact))
finally:
RUNNER.INBOX_ROOT = old_inbox
rendered = "\n".join(
" ".join(str(arg) for arg in call.args)
for call in output.call_args_list
)
self.assertIn("phase=tracker-ingress", rendered)
self.assertIn("predecessor=accepted-tailscale-retirement-011", rendered)
self.assertIn(
"public_b2_ingress=155.212.211.15:9921/tcp:telemetry-only",
rendered,
)
self.assertIn("tracker_adapter=arusnavi-b2", rendered)
self.assertIn("tracker_ack=after-core-durable-acceptance-only", rendered)
self.assertIn("runtime_composition=single-non-root-process", rendered)
self.assertIn("tailscale=preserved:absent", rendered)
self.assertIn("command_transport=disabled", rendered)
self.assertIn("gelios=untouched", rendered)
def test_publish_payload_preserves_unselected_executable_modes(self):
with tempfile.TemporaryDirectory(prefix="nodedc-vps-publish-scope-") as directory:
root = Path(directory)
@@ -435,6 +476,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
foundation = (source_root / "vps/config/nftables-foundation.conf").read_text()
relay = (source_root / "vps/config/nftables-relay.conf").read_text()
channel = (source_root / "vps/config/nftables-core-channel.conf").read_text()
tracker = (source_root / "vps/config/nftables-tracker-ingress.conf").read_text()
sshd = (source_root / "vps/config/00-nodedc-b2-vps.conf").read_text()
backhaul = (source_root / "vps/config/backhaul_ssh_config").read_text()
tailscale_unit = (
@@ -447,6 +489,9 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
channel_unit = (
source_root / "vps/systemd/nodedc-device-edge-channel.service"
).read_text()
tracker_unit = (
source_root / "vps/systemd/nodedc-device-edge-runtime.service"
).read_text()
self.assertIn("policy drop", foundation)
self.assertIn("tcp dport 22", foundation)
@@ -454,6 +499,8 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
self.assertIn("tcp dport 9921", relay)
self.assertIn("tcp dport 443", channel)
self.assertNotIn("tcp dport 9921", channel)
self.assertIn("tcp dport 443", tracker)
self.assertIn("tcp dport 9921", tracker)
self.assertIn("PasswordAuthentication no", sshd)
self.assertIn("AllowTcpForwarding no", sshd)
self.assertIn("StrictHostKeyChecking yes", backhaul)
@@ -490,6 +537,17 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
self.assertIn("LimitNOFILE=1024", channel_unit)
self.assertNotIn("LocalForward", channel_unit)
self.assertNotIn("DEVICE_EDGE_RELAY_UPSTREAM", channel_unit)
self.assertIn("User=nodedc-channel", tracker_unit)
self.assertIn("vps/edge-process/device-edge-runtime.mjs", tracker_unit)
self.assertIn("DEVICE_GATEWAY_TCP_PORT=9921", tracker_unit)
self.assertIn("DEVICE_GATEWAY_MAX_SESSIONS=128", tracker_unit)
self.assertIn("MemoryMax=192M", tracker_unit)
self.assertIn("MemorySwapMax=0", tracker_unit)
self.assertIn("CPUQuota=75%", tracker_unit)
self.assertIn("TasksMax=128", tracker_unit)
self.assertIn("LimitNOFILE=1024", tracker_unit)
self.assertNotIn("LocalForward", tracker_unit)
self.assertNotIn("DEVICE_EDGE_RELAY_UPSTREAM", tracker_unit)
def test_runner_has_registered_rollback_and_no_generic_latest(self):
source = RUNNER_PATH.read_text(encoding="utf-8")