feat(device-plane): accept core edge transport ADR

2026-08-10 16:40:48 +03:00
parent 07224c6f0d
commit bf0bc50abb
27 changed files with 5034 additions and 26 deletions
@@ -0,0 +1,16 @@
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin prohibit-password
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+GatewayPorts no
+PermitTunnel no
+PermitUserEnvironment no
+MaxAuthTries 3
+LoginGraceTime 20
+ClientAliveInterval 60
+ClientAliveCountMax 3
+UseDNS no
@@ -0,0 +1,23 @@
+Host device-backhaul-target
+  HostName 100.109.216.21
+  Port 2222
+  User device-backhaul
+  AddressFamily inet
+  IdentityFile /var/lib/nodedc-b2-vps/trust/backhaul_ed25519
+  IdentitiesOnly yes
+  PreferredAuthentications publickey
+  PasswordAuthentication no
+  KbdInteractiveAuthentication no
+  StrictHostKeyChecking yes
+  UserKnownHostsFile /var/lib/nodedc-b2-vps/trust/backhaul_known_hosts
+  GlobalKnownHostsFile /dev/null
+  ProxyCommand /usr/bin/nc -X 5 -x 127.0.0.1:1055 %h %p
+  LocalForward 127.0.0.1:19921 127.0.0.1:9921
+  ExitOnForwardFailure yes
+  ServerAliveInterval 30
+  ServerAliveCountMax 3
+  TCPKeepAlive yes
+  ClearAllForwardings no
+  RequestTTY no
+  SessionType none
+  LogLevel VERBOSE
@@ -0,0 +1,22 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,24 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 9921 ct state new limit rate over 300/second drop
+    tcp dport 9921 accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,33 @@
+[Unit]
+Description=NODE.DC B2 VPS encrypted private backhaul
+After=network-online.target nodedc-b2-tailscaled.service
+Wants=network-online.target
+Requires=nodedc-b2-tailscaled.service
+
+[Service]
+Type=simple
+User=nodedc-backhaul
+Group=nodedc-backhaul
+ExecStart=/usr/bin/ssh -N -F /opt/nodedc-b2-vps/config/backhaul_ssh_config device-backhaul-target
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+MemoryMax=64M
+TasksMax=32
+LimitNOFILE=1024
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,48 @@
+[Unit]
+Description=NODE.DC B2 VPS bounded raw TCP relay
+After=network-online.target nodedc-b2-backhaul.service
+Wants=network-online.target
+Requires=nodedc-b2-backhaul.service
+
+[Service]
+Type=simple
+User=nodedc-relay
+Group=nodedc-relay
+WorkingDirectory=/opt/nodedc-b2-vps
+Environment=DEVICE_EDGE_RELAY_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_EDGE_RELAY_HEALTH_PORT=18221
+Environment=DEVICE_EDGE_RELAY_INGRESS_ENABLED=true
+Environment=DEVICE_EDGE_RELAY_TCP_HOST=0.0.0.0
+Environment=DEVICE_EDGE_RELAY_TCP_PORT=9921
+Environment=DEVICE_EDGE_RELAY_UPSTREAM_HOST=127.0.0.1
+Environment=DEVICE_EDGE_RELAY_UPSTREAM_PORT=19921
+Environment=DEVICE_EDGE_RELAY_MAX_SESSIONS=128
+Environment=DEVICE_EDGE_RELAY_MAX_SESSIONS_PER_ADDRESS=16
+Environment=DEVICE_EDGE_RELAY_MAX_CONNECTIONS_PER_MINUTE_PER_ADDRESS=60
+Environment=DEVICE_EDGE_RELAY_MAX_TRACKED_SOURCE_ADDRESSES=4096
+Environment=DEVICE_EDGE_RELAY_MAX_BYTES_PER_DIRECTION=67108864
+Environment=DEVICE_EDGE_RELAY_SESSION_TIMEOUT_MS=300000
+Environment=DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-relay/src/server.mjs
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+MemoryMax=192M
+TasksMax=64
+LimitNOFILE=4096
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,36 @@
+[Unit]
+Description=NODE.DC B2 VPS private Tailscale transport
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+User=nodedc-edge
+Group=nodedc-edge
+RuntimeDirectory=nodedc-b2-vps
+RuntimeDirectoryMode=0750
+StateDirectory=nodedc-b2-vps/tailscale
+StateDirectoryMode=0700
+ExecStart=/opt/nodedc-b2-vps/runtime/tailscale/tailscaled --state=/var/lib/nodedc-b2-vps/tailscale/tailscaled.state --socket=/run/nodedc-b2-vps/tailscaled.sock --tun=userspace-networking --socks5-server=127.0.0.1:1055
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+MemoryMax=160M
+TasksMax=96
+LimitNOFILE=8192
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target