SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(device-plane): constrain B2 discovery to loopback

Browse Source
This commit is contained in:
Codex
2026-07-26 01:05:14 +03:00
parent 2b1795509b
commit a3308c9b3d
6 changed files with 42 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
device-plane/docs/IMPLEMENTATION_BASELINE.md
+9 -7
View File
@@ -193,10 +193,12 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
through the standalone root administrative gate.
3. Plan/apply the exact discovery-ingress artifact and independently prove:
Core/Gateway/PostgreSQL health, PostgreSQL generation preservation,
`0.0.0.0:9921` publication, verified framing, quarantine-only Core ingest and
disabled command transport.
4. Only after runtime acceptance, allow TCP 9921 in DSM firewall and configure
WAN-to-NAS TCP forwarding. Keep the HTTP(S) Reverse Proxy out of this path.
5. Add the NDC route to one approved B2 free server slot while preserving
Gelios, then prove HEADER/discovery/PACKAGE acknowledgement. Claim and
tenant assignment remain a later explicit platform-admin operation.
`127.0.0.1:9921` loopback-only publication, verified framing,
quarantine-only Core ingest and disabled command transport.
4. Do not publish raw device TCP from the multi-service Synology. Design and
independently review an isolated edge/DMZ/VPS ingress with no lateral NAS
access, explicit firewall/NAT evidence, acceptance and rollback.
5. Only after that separate edge gate, add the NDC route to one approved B2
free server slot while preserving Gelios, then prove
HEADER/discovery/PACKAGE acknowledgement. Claim and tenant assignment
remain a later explicit platform-admin operation.