feat(device-edge): add canonical core channel deployment

2026-08-11 20:00:58 +03:00
parent 1124c15216
commit 6461e7fca8
8 changed files with 877 additions and 14 deletions
@@ -0,0 +1,54 @@
+{
+  "schemaVersion": "nodedc.device-edge-vps.core-channel.v1",
+  "mode": "provider-neutral-core-initiated-mtls-http2",
+  "status": "closed-tracker-ingress",
+  "authority": "DCPLATFORM-21/DCPLATFORM-76/ADR-0001",
+  "component": "device-edge-vps",
+  "phase": "core-channel",
+  "runtimeHost": "koffyvngij",
+  "runtimeUser": "nodedc-channel",
+  "runtimeService": "nodedc-device-edge-channel.service",
+  "runtime": "accepted-node-v22.23.2-no-docker",
+  "publicIngress": "tcp/8443-mtls-only",
+  "health": "127.0.0.1:18222",
+  "trackerIngress": "disabled",
+  "rawDeviceTcp9921": "closed",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "privateKeyBoundary": "runner-managed-host-local-only",
+  "peerTrustPrerequisite": "exact-pinned-self-signed-core-certificate-and-fingerprint",
+  "tls": "TLSv1.3+h2+mutual-authentication",
+  "resourceCeilings": {
+    "memory": "128M",
+    "swap": "0",
+    "cpu": "50%",
+    "tasks": 64,
+    "openFiles": 1024
+  },
+  "preserved": [
+    "management-ssh-key",
+    "accepted-node-runtime",
+    "foundation-source",
+    "gelios-production-path"
+  ],
+  "forbidden": [
+    "vps-initiated-synology-connection",
+    "generic-tcp-forwarding",
+    "tailscale-ssh-backhaul",
+    "docker",
+    "public-health",
+    "tracker-tcp/9921"
+  ],
+  "acceptance": [
+    "exact-non-root-runtime-identity",
+    "tls13-h2-mutual-authentication",
+    "edge-server-and-core-client-self-signed-identities-mutually-pinned",
+    "core-initiated-channel-accepted",
+    "unknown-core-certificate-rejected",
+    "public-8443-only-beside-management-ssh",
+    "tracker-tcp-9921-closed",
+    "loopback-health-contract",
+    "resource-ceilings-present"
+  ],
+  "rollback": "close-8443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
+}