feature/SP-7564, VMs types are divided into trusted and untrusted

[Villain88]

Summary by CodeRabbit

• New Features

  • Added debug and release build options with distinct runtime configurations.
  • Debug builds enable serial console access; release builds disable it.
  • Network security settings now distinguish trusted and untrusted environments.
  • SSH access is enabled only for untrusted network configurations.

• Updates

  • Node.js builds now use version 24.
  • PKI components have been updated to newer versions.
  • Build documentation now includes the new build-type option and examples.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fa1d5319-9dda-4299-af3d-ec1999935ab9

📥 Commits

Reviewing files that changed from the base of the PR and between 5439667 and 4429370.

📒 Files selected for processing (8)

• .github/workflows/build-sp-vm.yml
• README.md
• src/Dockerfile
• src/rootfs/files/configs/pki-service/conf/pki-authority-template.yaml
• src/rootfs/files/configs/pki-service/scripts/pki_configure_helper.py
• src/rootfs/files/configs/pki-service/systemd/pki-authority-sync.service
• src/rootfs/files/configs/usr/local/bin/hardening-vm.sh
• src/rootfs/files/scripts/install_nodejs.sh

💤 Files with no reviewable changes (1)

• src/rootfs/files/configs/pki-service/conf/pki-authority-template.yaml

---

Walkthrough

The PR adds debug/release build propagation, conditional VM login and serial-console configuration, explicit Swarm network-type generation and validation, network-aware PKI and SSH behavior, updated PKI component versions, and Node.js 24 installation.

Changes

Build and network configuration

Layer / File(s)	Summary
Image build profiles and conditional assembly .github/workflows/build-sp-vm.yml, README.md, src/Dockerfile, src/rootfs/files/scripts/install_nodejs.sh	Build inputs now propagate debug or release into image versions and Docker arguments. The Dockerfile configures login, serial console, Swarm network type, PKI component versions, and Node.js 24 installation according to the build configuration.
Network-aware PKI and SSH behavior src/rootfs/files/configs/pki-service/..., src/rootfs/files/configs/usr/local/bin/hardening-vm.sh	PKI configuration validates network and CPU types, PKI synchronization receives the network-type file, and SSH is enabled only for untrusted networks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BuildWorkflow
  participant Dockerfile
  participant SwarmNetworkTypeFile
  participant PKIConfiguration
  participant VMHardening
  BuildWorkflow->>Dockerfile: Pass build type and image version
  Dockerfile->>SwarmNetworkTypeFile: Write trusted or untrusted
  SwarmNetworkTypeFile->>PKIConfiguration: Provide network type
  PKIConfiguration->>PKIConfiguration: Validate network and CPU compatibility
  SwarmNetworkTypeFile->>VMHardening: Provide network type
  VMHardening->>VMHardening: Enable SSH only for untrusted

Loading

Suggested reviewers: AgentRX

Poem

I’m a rabbit with builds in my den,
Debug and release now hop in again.
Trusted paths guard, untrusted paths gleam,
PKI follows the network stream.
Node twenty-four joins the dream!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: splitting VM types into trusted and untrusted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/SP-7564

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}