SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(device-plane): constrain B2 discovery to loopback

Browse Source
This commit is contained in:
Codex
2026-07-26 01:05:14 +03:00
parent 2b1795509b
commit a3308c9b3d
6 changed files with 42 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
device-plane/deployment/device-plane-b2-discovery-ingress-v1.json
+3 -3
View File
@@ -1,9 +1,9 @@
{
"schemaVersion": "nodedc.device-plane.b2-discovery-ingress.v1",
"mode": "verified-b2-discovery-only",
"mode": "verified-b2-loopback-discovery-only",
"predecessorPatchId": "device-plane-foundation-network-publication-20260725-003",
"predecessorArtifactSha256": "6fdd5a12c310786db1753882fc1378184fe378d2cc533633a8c73c951521b7bf",
"sourceAction": "publish-verified-b2-discovery-ingress-source",
"sourceAction": "publish-verified-b2-loopback-discovery-source",
"runtimeAction": "build-and-recreate-stateless-services",
"selectedServices": [
"device-control-core",
@@ -17,7 +17,7 @@
"publishedPorts": [
"127.0.0.1:18120:18120",
"127.0.0.1:18121:18121",
"0.0.0.0:9921:9921/tcp"
"127.0.0.1:9921:9921/tcp"
],
"protocolProfile": "arusnavi.b2.internal.v1",
"framingSpecification": "arusnavi.internal.protocol-sheet.gid-12.v1",
device-plane/docker-compose.device-plane.yml
+3 -3
View File
@@ -100,8 +100,8 @@ services:
DEVICE_GATEWAY_HEALTH_HOST: 0.0.0.0
DEVICE_GATEWAY_HEALTH_PORT: "18121"
DEVICE_GATEWAY_LISTEN_ENABLED: "true"
DEVICE_GATEWAY_PUBLIC_INGRESS_ENABLED: "true"
DEVICE_GATEWAY_TCP_HOST: 0.0.0.0
DEVICE_GATEWAY_PUBLIC_INGRESS_ENABLED: "false"
DEVICE_GATEWAY_TCP_HOST: 127.0.0.1
DEVICE_GATEWAY_TCP_PORT: "9921"
DEVICE_GATEWAY_CORE_URL: http://device-control-core:18120
DEVICE_GATEWAY_CORE_TOKEN_FILE: /run/nodedc-secrets/gateway-core-token
@@ -120,7 +120,7 @@ services:
create_host_path: false
ports:
- "127.0.0.1:18121:18121"
- "0.0.0.0:9921:9921"
- "127.0.0.1:9921:9921"
networks:
- device-plane-private
- device-plane-control
device-plane/docs/IMPLEMENTATION_BASELINE.md
+9 -7
View File
@@ -193,10 +193,12 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
through the standalone root administrative gate.
3. Plan/apply the exact discovery-ingress artifact and independently prove:
Core/Gateway/PostgreSQL health, PostgreSQL generation preservation,
`0.0.0.0:9921` publication, verified framing, quarantine-only Core ingest and
disabled command transport.
4. Only after runtime acceptance, allow TCP 9921 in DSM firewall and configure
WAN-to-NAS TCP forwarding. Keep the HTTP(S) Reverse Proxy out of this path.
5. Add the NDC route to one approved B2 free server slot while preserving
Gelios, then prove HEADER/discovery/PACKAGE acknowledgement. Claim and
tenant assignment remain a later explicit platform-admin operation.
`127.0.0.1:9921` loopback-only publication, verified framing,
quarantine-only Core ingest and disabled command transport.
4. Do not publish raw device TCP from the multi-service Synology. Design and
independently review an isolated edge/DMZ/VPS ingress with no lateral NAS
access, explicit firewall/NAT evidence, acceptance and rollback.
5. Only after that separate edge gate, add the NDC route to one approved B2
free server slot while preserving Gelios, then prove
HEADER/discovery/PACKAGE acknowledgement. Claim and tenant assignment
remain a later explicit platform-admin operation.