SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(device-edge): standardize Core channel on mTLS 443

Browse Source
This commit is contained in:
Codex
2026-08-12 01:43:04 +03:00
parent 2eb6116880
commit c2d06bddc7
15 changed files with 51 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/build-device-edge-vps-artifact.mjs
+4 -2
View File
@@ -152,7 +152,7 @@ try {
publicIngress: phase === "relay"
? "tcp/9921"
: phase === "core-channel"
? "tcp/8443-mtls-only"
? "tcp/443-mtls-only"
: "disabled",
commandTransport: "disabled",
gelios: "untouched",
@@ -264,7 +264,9 @@ async function assertBoundary() {
"User=nodedc-channel",
"ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
"MemoryDenyWriteExecute=no",
"tcp dport 8443",
"CapabilityBoundingSet=CAP_NET_BIND_SERVICE",
"AmbientCapabilities=CAP_NET_BIND_SERVICE",
"tcp dport 443",
"MemoryMax=128M",
"MemorySwapMax=0",
"CPUQuota=50%",
infra/deploy-runner/nodedc-b2-vps-deploy
+12 -10
View File
@@ -101,7 +101,7 @@ CHANNEL_CERTIFICATE = CHANNEL_TRUST_ROOT / "edge-certificate.pem"
CHANNEL_CORE_CERTIFICATE = CHANNEL_TRUST_ROOT / "core-certificate.pem"
CHANNEL_RUNTIME_CONFIG = CHANNEL_TRUST_ROOT / "runtime.json"
CHANNEL_HEALTH_PORT = 18222
CHANNEL_PUBLIC_PORT = 8443
CHANNEL_PUBLIC_PORT = 443
FOUNDATION_ENTRIES = (
"vps/config/00-nodedc-b2-vps.conf",
@@ -196,15 +196,15 @@ PHASE_FILE_SHA256 = {
"services/device-edge-channel/package.json":
"bdf502be43b62bdd6db05b022a532d93ba954277ac5143d6058d2f27f6a2e9d2",
"services/device-edge-channel/src/runtime.mjs":
"cbb07f7e644a68e9c8c36c1c2ecf0224c06c46c08c49339d62637b10a1495501",
"74f8f8dbaf144fed8443e83af1ae116f1465e5378f839e92d8b25f55655893ec",
"services/device-edge-channel/src/server.mjs":
"ea891634a18efb9eb44f17b56c95ba97527215c4d0a6147cc2b7bad1d7356e36",
"a82057218bb368ab926404f90a19cc17c0359b57dc890f38a1324ab8c497c17b",
"vps/config/nftables-core-channel.conf":
"1a04a5450042e80b8a20da3c6634dd6bc68693f191a463ba9a62984279d81d0c",
"075b47ad2972161cac4d91cf77afb82eb078067ef50a5f9a933a13159af8bf48",
"vps/systemd/nodedc-device-edge-channel.service":
"afb2842db18d1863b2a089b4e89693f1ec17c78921457774ac9652f26b804856",
"a677598a1d1fa66cdc577ef8bb862756abd7725e62b662b2106f01780f59a767",
"deployment/device-edge-vps-core-channel-v1.json":
"938f6f7959b78e6be3a6e91a54dca2922fbd813f1a33dca5cebe0dc256a83a14",
"ecbd66404d197f6d939736bbc1c28cc1e7091781639ffb78d2199a8db2b3ccd2",
},
}
@@ -559,7 +559,7 @@ def assert_runtime_reconciliation_predecessor(foundation_record):
if (
"policy drop" not in nft
or "tcp dport 22" not in nft
or "tcp dport 8443" in nft
or "tcp dport 443" in nft
or "tcp dport 9921" in nft
):
die("runtime reconciliation firewall predecessor mismatch")
@@ -1322,7 +1322,7 @@ def validate_core_channel_runtime():
nft = run(["/usr/sbin/nft", "list", "table", "inet", "nodedc_b2_vps"]).stdout
if (
"policy drop" not in nft
or "tcp dport 8443" not in nft
or "tcp dport 443" not in nft
or "tcp dport 9921" in nft
):
die("VPS Core channel firewall contract mismatch")
@@ -1330,12 +1330,14 @@ def validate_core_channel_runtime():
"/usr/bin/systemctl",
"show",
"nodedc-device-edge-channel.service",
"--property=User,Group,NoNewPrivileges,MemoryMax,MemorySwapMax,CPUQuotaPerSecUSec,TasksMax,LimitNOFILE",
"--property=User,Group,NoNewPrivileges,CapabilityBoundingSet,AmbientCapabilities,MemoryMax,MemorySwapMax,CPUQuotaPerSecUSec,TasksMax,LimitNOFILE",
]).stdout
for required in (
"User=nodedc-channel",
"Group=nodedc-channel",
"NoNewPrivileges=yes",
"CapabilityBoundingSet=cap_net_bind_service",
"AmbientCapabilities=cap_net_bind_service",
"MemoryMax=134217728",
"MemorySwapMax=0",
"TasksMax=64",
@@ -1498,7 +1500,7 @@ def plan_artifact(artifact_argument: str):
print("services=nodedc-b2-relay")
print(f"relay_runtime_identity={RELAY_USER}:no-credentials")
else:
print("public_core_channel=155.212.211.15:8443/tcp:tls13-mtls-h2")
print("public_core_channel=155.212.211.15:443/tcp:tls13-mtls-h2")
print(f"health=127.0.0.1:{CHANNEL_HEALTH_PORT}")
print("public_b2_ingress=disabled")
print("tracker_tcp_9921=closed")
infra/deploy-runner/test_device_edge_vps_artifact.py
+10 -2
View File
@@ -261,7 +261,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
rendered,
)
self.assertIn(
"public_core_channel=155.212.211.15:8443/tcp:tls13-mtls-h2",
"public_core_channel=155.212.211.15:443/tcp:tls13-mtls-h2",
rendered,
)
self.assertIn("tracker_tcp_9921=closed", rendered)
@@ -402,7 +402,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
self.assertIn("tcp dport 22", foundation)
self.assertNotIn("tcp dport 9921", foundation)
self.assertIn("tcp dport 9921", relay)
self.assertIn("tcp dport 8443", channel)
self.assertIn("tcp dport 443", channel)
self.assertNotIn("tcp dport 9921", channel)
self.assertIn("PasswordAuthentication no", sshd)
self.assertIn("AllowTcpForwarding no", sshd)
@@ -424,6 +424,14 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
channel_unit,
)
self.assertIn("MemoryDenyWriteExecute=no", channel_unit)
self.assertIn(
"CapabilityBoundingSet=CAP_NET_BIND_SERVICE",
channel_unit,
)
self.assertIn(
"AmbientCapabilities=CAP_NET_BIND_SERVICE",
channel_unit,
)
self.assertNotIn("--jitless", channel_unit)
self.assertIn("MemoryMax=128M", channel_unit)
self.assertIn("MemorySwapMax=0", channel_unit)