fix(device-plane): split edge channel bootstrap

2026-08-11 23:27:16 +03:00
parent bb0724c52c
commit d641744dca
8 changed files with 1298 additions and 113 deletions
@@ -0,0 +1,33 @@
+{
+  "schemaVersion": "nodedc.device-plane.device-edge-core-channel-bootstrap.v1",
+  "transitionId": "__PATCH_ID__",
+  "action": "activate",
+  "managerPredecessor": {
+    "patchId": "device-manager-release-20260811-010",
+    "artifactSha256": "d4132993216eb674967dc6fc65d9670cfc2a9efdf46186ca019030f259de2d0e"
+  },
+  "failedPredecessor": {
+    "patchId": "device-manager-release-20260811-016",
+    "artifactSha256": "590405821b95b54088f926e0d3b2cdf9c704b339f6749da500c2bb64fe0e952d",
+    "backupId": "device-plane-device-manager-release-20260811-016-20260811-215941",
+    "invalidCoreCertificateSha256Fingerprint": "56:16:E0:3A:F4:03:85:FD:42:86:85:AF:2A:AF:1E:90:16:C8:F7:91:7C:AD:02:7D:B7:C2:ED:07:06:56:81:F6"
+  },
+  "service": "device-control-core",
+  "composeActivation": "dedicated-additive-override",
+  "identity": "runner-managed-host-local-private-key-public-certificate-export",
+  "identityRecovery": "exact-invalid-unexported-failed-predecessor-only",
+  "tlsPurpose": "clientAuth",
+  "direction": "core-initiated",
+  "publicIngress": "none-on-synology",
+  "edgeRegistrations": "preserved",
+  "commandTransport": "disabled",
+  "gelios": "untouched",
+  "preservedServices": [
+    "device-manager",
+    "device-gateway",
+    "device-postgres",
+    "device-backhaul-target"
+  ],
+  "healthGate": "bounded-container-grace+core-edge-contract",
+  "rollback": "restore-source-and-preapply-core-runtime"
+}
@@ -0,0 +1,36 @@
+services:
+  device-control-core:
+    environment:
+      DEVICE_EDGE_CHANNEL_ENABLED: "true"
+      DEVICE_EDGE_CHANNEL_CORE_KEY_FILE: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
+      DEVICE_EDGE_CHANNEL_CORE_CERTIFICATE_FILE: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
+      DEVICE_EDGE_CHANNEL_TRUST_ROOT: /run/nodedc-secrets/device-edge-channel/peers
+      DEVICE_EDGE_CHANNEL_MAX_EDGES: "32"
+      DEVICE_EDGE_CHANNEL_RECONCILE_INTERVAL_MS: "15000"
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-private-key.pem
+        target: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-certificate.pem
+        target: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/peers
+        target: /run/nodedc-secrets/device-edge-channel/peers
+        read_only: true
+        bind:
+          create_host_path: false
+    networks:
+      - device-plane-egress
+
+networks:
+  device-plane-egress:
+    name: nodedc-device-plane-egress
+    driver: bridge
+    internal: false
@@ -3,12 +3,6 @@ services:
    environment:
      DEVICE_MANAGEMENT_API_ENABLED: "true"
      DEVICE_MANAGEMENT_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
-      DEVICE_EDGE_CHANNEL_ENABLED: "true"
-      DEVICE_EDGE_CHANNEL_CORE_KEY_FILE: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
-      DEVICE_EDGE_CHANNEL_CORE_CERTIFICATE_FILE: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
-      DEVICE_EDGE_CHANNEL_TRUST_ROOT: /run/nodedc-secrets/device-edge-channel/peers
-      DEVICE_EDGE_CHANNEL_MAX_EDGES: "32"
-      DEVICE_EDGE_CHANNEL_RECONCILE_INTERVAL_MS: "15000"
    volumes:
      - type: bind
        source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
@@ -16,26 +10,6 @@ services:
        read_only: true
        bind:
          create_host_path: false
-      - type: bind
-        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-private-key.pem
-        target: /run/nodedc-secrets/device-edge-channel/core-private-key.pem
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-certificate.pem
-        target: /run/nodedc-secrets/device-edge-channel/core-certificate.pem
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/peers
-        target: /run/nodedc-secrets/device-edge-channel/peers
-        read_only: true
-        bind:
-          create_host_path: false
-    networks:
-      - device-plane-egress

  device-manager:
    image: nodedc/device-manager:local
@@ -97,10 +71,6 @@ services:
      start_period: 10s

 networks:
-  device-plane-egress:
-    name: nodedc-device-plane-egress
-    driver: bridge
-    internal: false
  platform-edge:
    external: true
    name: nodedc-platform_edge