feat(device-edge): add canonical core channel deployment

2026-08-11 20:00:58 +03:00
parent 1124c15216
commit 6461e7fca8
8 changed files with 877 additions and 14 deletions
@@ -0,0 +1,26 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 8443 ct state new limit rate 120/minute burst 120 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,50 @@
+[Unit]
+Description=NODE.DC provider-neutral Device Edge Core channel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=nodedc-channel
+Group=nodedc-channel
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node --jitless /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
+Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
+Environment=DEVICE_EDGE_CHANNEL_PORT=8443
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_PORT=18222
+Environment=DEVICE_EDGE_CHANNEL_CONFIG_FILE=/var/lib/nodedc-b2-vps/channel-trust/runtime.json
+Environment=DEVICE_EDGE_CHANNEL_KEY_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-private-key.pem
+Environment=DEVICE_EDGE_CHANNEL_CERTIFICATE_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-certificate.pem
+Environment=DEVICE_EDGE_CHANNEL_CORE_TRUST_FILE=/var/lib/nodedc-b2-vps/channel-trust/core-certificate.pem
+Restart=always
+RestartSec=2
+TimeoutStartSec=20
+TimeoutStopSec=15
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_INET AF_INET6
+CapabilityBoundingSet=
+AmbientCapabilities=
+UMask=0077
+MemoryMax=128M
+MemorySwapMax=0
+CPUQuota=50%
+TasksMax=64
+LimitNOFILE=1024
+
+[Install]
+WantedBy=multi-user.target