add scripts

2026-07-14 14:44:40 +08:00 · 2026-07-14 14:44:40 +08:00 · 490b79f22c
commit 490b79f22c
parent e2bdcd3820
47 changed files with 1569 additions and 514 deletions
--- a/README.client.md
+++ b/README.client.md
@ -37,6 +37,14 @@
 ./deploy/server/build-run.sh up --mode ssh
 ```
 TLS/SSH 所需的本地开发证书和密钥可以通过脚本生成：
 ```bash
 bash scripts/generate-certs.sh
 ```
 已有 `certs/` 时使用 `--force` 覆盖。脚本生成的 `certs/tls` 和 `certs/ssh` 文件名与本仓库 compose 默认配置一致。
 Client 连接地址不要求固定在某个 Docker 网络里。`deploy/client` 的 TCP/TLS/SSH 模式分别通过 `RPKI_RTR_TCP_SERVER_ADDR`、`RPKI_RTR_TLS_SERVER_ADDR`、`RPKI_RTR_SSH_SERVER_ADDR` 指定 server 地址。`deploy/bird` 通过 `RPKI_BIRD_RPKI_HOST`/`RPKI_BIRD_RPKI_PORT` 指定 TCP server 地址，通过 `RPKI_BIRD_SSH_RPKI_HOST`/`RPKI_RTR_SSH_PORT` 指定 SSH server 地址。示例 compose 里的默认值只是为了和本仓库 server compose 直接联调。
 `deploy/frr` 示例默认连接 `127.0.0.1:323`，可以通过 `RPKI_FRR_RPKI_HOST`/`RPKI_FRR_RPKI_PORT` 覆盖。
@ -213,7 +221,7 @@ SSH 模式默认读取 `certs/ssh` 目录下的 key，并使用 `bird.conf.ssh.t
 | --- | --- | --- |
 | `RPKI_BIRD_SSH_RPKI_HOST` | `rpki-rtr` | SSH RTR server 主机名 |
 | `RPKI_RTR_SSH_PORT` | `22` | SSH RTR server 端口 |
-| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录 |
+| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录，复用 `rtr-client.key` |
 ## 如何判断 Client 正常
--- a/README.md
+++ b/README.md
@ -19,6 +19,7 @@
 - [构建与测试](#构建与测试)
 - [数据输入](#数据输入)
 - [快速启动](#快速启动)
  - [前置数据生成](#前置数据生成)
  - [Docker 运行](#docker-运行)
  - [跨架构构建](#跨架构构建)
 - [传输模式](#传输模式)
@ -77,6 +78,33 @@ cargo run --bin rpki_rtr
 ## 快速启动
 ### 前置数据生成
 TLS/mTLS 或 SSH transport 需要本地证书和密钥。开发和 Docker 联调可用脚本生成 compose 默认引用的最小文件集：
 ```bash
 bash scripts/10_generate-certs.sh
 ```
 如需覆盖已有 `certs/` 内容：
 ```bash
 bash scripts/10_generate-certs.sh --force
 ```
 `10_generate-certs.sh` 常用参数：
 | 参数 | 说明 |
 | --- | --- |
 | `--out-dir DIR` | 指定输出目录，默认生成到 `./certs`。 |
 | `--server-dns NAME` | 指定 TLS server 证书的 dNSName SAN，默认 `localhost`。 |
 | `--tls-only` | 只生成 `certs/tls` 下的 TLS 证书和私钥。 |
 | `--ssh-only` | 只生成 `certs/ssh` 下的 SSH host key、client key 和 `authorized_keys`。 |
 | `--force` | 覆盖已有文件。未指定时，如果目标文件已存在会直接报错退出。 |
 | `-h`, `--help` | 查看脚本帮助。 |
 TLS server name 默认是 `localhost`。如果需要其它 DNS 名称，需要同时设置 `scripts/10_generate-certs.sh --server-dns <name>` 和 client 的 `RPKI_RTR_TLS_SERVER_NAME=<name>`。
 ### Docker 运行
 推荐使用 `deploy/server/build-run.sh` 和 `deploy/client/build-run.sh` 分别管理 server 与 debug client：
--- a/certs/ssh/_probe_key
+++ b/certs/ssh/_probe_key
@ -1,8 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABChIc/mh2
 2ZlTnDw27U26Q9AAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIHh6RLKV3/Dd8Ku0
 PB+lLBZo6E+EXJ2WYLYjIzVU/5t9AAAAoLzKj5jOlcoxcNfmUjP4KnfUEQ0wB2dhwpmzym
 p7kqtBnTd7q1VZ+tszUyOEEAwvWChWPsQ5qcFkrXlI12NJVl0bv4XHXXXCoUzTuzasQhWg
 ajws+FR9McWjTwYbuxPK8nZlRMGKVv3KTEb7IKzPiB1/+XVKRQCVyzhfJCFJTSIwL66KbP
 knSamwB5g59wp8xcjPmdecqba6a7wTeHy21cg=
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/_probe_key.pub
+++ b/certs/ssh/_probe_key.pub
@ -1 +0,0 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHh6RLKV3/Dd8Ku0PB+lLBZo6E+EXJ2WYLYjIzVU/5t9 xuxiuting@LAPTOP-A2IH6TNR
--- a/certs/ssh/bird-rtr-client-rsa.pem
+++ b/certs/ssh/bird-rtr-client-rsa.pem
@ -1,39 +0,0 @@
 -----BEGIN RSA PRIVATE KEY-----
 MIIG4wIBAAKCAYEAvA91otbecwZFtDiZcV2m/A8RP9C+r1DmaDi/1tBaqleNRt3W
 UCdMPEF5NGCBWq/52tWwL3rBXEEp0gcEHYoTZ5djAlAjLaQphbFGQU/h3WWDEVOl
 GFnGCc4DP26SRp/oC01QpOlgT9Z/m2xkMZGhZo9oR2v7+ARmF9Qrxlj9HjuDWmZI
 Onl5DGXmbI0sBOs1PMtOvmU2aJNKVU3hD335Z0J9c5NubuQQtS/vl0XJQYgbCMh9
 4BlbEBppJ6LyzcILbUAfayl2U9sQGErf9CjkwOuITpRBO+f10BQSpGjznRYCX4Yf
 71lhH1ri6lOKhupOW1wgC6kkQTcvI9hub1ePLtmOiWUCfnrc2eZljNssqKWYC9+5
 v9Ya6+aikSlOheUoMJP1C50PTMnMqRfNGLn3yFKTT/CaQBw1TMO/+Rfsb80Oj9O3
 yF9zCHTFrUsYn9T2tupRi/aYWfLe3ckqTBLLhSWLfiY9S49U/fdP5Sk8l4JsAyxE
 9oH6RokJIrZxR09pAgMBAAECggGABSIjOvtEWLLwjFC+3YGUg+JcZ+0d22FpB1TE
 kHZLrJqAXybB3sUSghLjyP/OYB2YGMwG8mYr04XC1g++IhlJWiVKJ6oXf7uGAkx6
 Z2DTwJbwsDR5N/QxYUX36uTCMOkqAhmi7HwjVnfmL/r83tPZFO3ase0QacQi+PO1
 cIVa1BcEnknW9GOpn81DRYNyqBK3N2OG+3r99HZQITUjl32VOnyYjzhUcMn1wSBf
 w6BnyTZleISn159m5TEMsu8yKKwrLDNe5pyXjLk1HpU8fDo/CoDq+i4KJ2V2Ns4j
 +zg2EMqW1EQNI/BYDtOYlL+m5dGEST50Oqq7OiopvchKjIkvgFr+08vlyCyjbryv
 DF5B6VEkk1iEacDKK/NyHdjXPmGBvlEeBixOOpS5dBb6m0KPx9C9jTi/tTRBnH4t
 7qAko/LoYfBgjyRqDyqeUKrvVp/3NOmkQefaHttr9abhotjmtGqAvJfN1VfFY5e1
 s6Ga7yJno5tyS7RArw3OA6t2n2S1AoHBAN8mMuuZQL5xNY2bpn5O9u19QaoG3rRR
 Ma6nEO2QPxM+hB8QR2fYAZwgHr38B+keodf/Xe02Xkf+urd2t+eHpoMbzZeEopaM
 hNDEo1mYaIl0lgQLy1RzpvfV0B+gy808FOut6YDESyJ4sxGuP3E7CIn+QfFh9Uht
 6I/ZyDfM87Q2LlP8ES/EecHfVO97l1gOJ5T9j1bnTTVgM4zJqAWiqlLyUcS56sos
 7NPZbYF81ViR4BI/3rthtoUUY8hoSmfXFQKBwQDXvt8oC3Inmr729nrsZCb72fbG
 8T9DieUW8MCAwvv4c1DEA2aATgLpidH+NJJyCsR7Ph05AvcSpiUgyF25TeTliBZu
 YUaUDE8JuTFTEcjkqpPj62MX8C8J3DjN0TG0fI1ltousef+Ind64Fdh2kPKl2YfE
 F/95pc+/y0VbXl8rcQyYCQuo+4ooBIbq1BhprzKC6Tdg2HsvCYrz3EzOJHHD/iLZ
 jlHjXAeKo0MjVyDRDy3ollxDg7a1ESGwewVGrAUCgcEAkyeLmNY9XdkmKbYlO1Iz
 gDWDoe5Z2qtYigZeIWtoTPaDBkEj9ZT6qsx7uWmEhfTPYbNja1TZI70VwHqnmCVa
 Z0dkcrDiz0jnJQ0nc6QP++VIMG7erVh/GRyE3Paar0MZwLm1LFdF/Pt/iv9PkwoM
 /YMQVW/14sen/4Tshe/AHm1Ea9nkM43rhTATwMHN8iGTdKspZXOu9K32ELfC98Rn
 cb+esI6yCJVLsADIOAXsYzX/f8lixksPo/7oNnaf6o5pAoHAcxBooknge0DsAnkY
 vET6Ca6JEDeQfyvnU+HZOZNEoZCXDcOmgl2Y7gdESSiuxkX53qUVHtf3ACo+eQqD
 +hWSM9zt4bbd1o3uBYiQxvYgR9y1/YQIGLdPzxl17kdZFCKtowbF3Zo/cBSKuXFl
 Pm82CsBGyY3nAnEtqOP3vLBLX7bueZOxdVGasJchgdLWpl77OJi7oVoz8LVNN5xS
 FkuXpWlAGvntsK3fk9BZOVr5tKY83OR8lsGDy3Q0nJQwDy4lAoHAOqqDBGbV9oMZ
 kBMnntl9FNE8h/UoprFEQKEAsU5Vbx7hrPkLGmgO6pWQceFPYXTdu2u8ictWCBoP
 aogdoEsD59A6XHQ28OqMuf41njNc6E6kVBoFq9j9+for8EQsx5iH6Azd+rV67hxW
 esLGn7H+P55t5s7/KgPOn2fZI4cHScvEJxNZMqqoUsq488by0Obf0qYmwpKh3HE3
 1wybZj9ZTTFTDwqpyrWBUF2BLf/LGlalcrbbiYIHa1L8i5Gy6u6y
 -----END RSA PRIVATE KEY-----
--- a/certs/ssh/bird-rtr-client-rsa.pem.pub
+++ b/certs/ssh/bird-rtr-client-rsa.pem.pub
--- a/certs/ssh/bird-rtr-client.key
+++ b/certs/ssh/bird-rtr-client.key
@ -1,39 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAaTeJ0Al
 IMgPHrgsaVr3RlAAAAGAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDQGmbM6oQ3
 HYuaghpNTbIfOQQqC7m0vX5dUqcDlhlMyntyHAQOCzV8M5jbr2REeyTw60XXEezvb05mRm
 4NKQXJGsBR+/n5ZgvxpSFfso9ZBTTflEwBgBSQdoz/abWXe2inJ1MATu2An1vIAERQO/Gv
 V9HYcLgF3sZ9T6X6yvVUt5TKWaQ2wNKQb3KNTpnBzrK74gkUaDj1HUt/DeVk42L80boycK
 Zq2/jkHb4U6ThRXof7NJzgpHMgtMbCwAsN68fY4iIIN1046TIGHwy0sJaYrRDVzpWFLRS+
 hc68g5MWbhtiUFGGVjjMkUbSwegorB6hRxEyMYjn1bhLuUhiMVJkF552Y4Dwu7D1zRd4qk
 6ZL3nlEOCNsLTo+HIFCP0XUodaWdx2WJKZlpUpjzN7JF3MXqY0/xEgLNlL/SLSB1tod1PW
 fKfF7WDYluZJNCPv3V4296vcpG/VNBVew6ODRFT1WTQhVPenJLHuxZrOTg3sbGMXrsY8Lh
 JjQtVTY4ijvRkAAAWQANIwKXD3+y7RY6XFUvYSm6PGQbgfWO7NNR20whNld5pAHWzSamI5
 hNil50ZlYqfrfcZ8Gfhc3i9Td7ATd2h7ZBMTmkKMOzssTldTuKg13dc0r+Nk80o6PyT4SR
 YyHRVEk2Y9IeEtwjFaR50VlVY+qmLx6dzgN0tDDdb0Nenb4g1qkIjgepLu6b2KH1wznZGM
 feJPHQwfPi3RYnUquFnpfdOLdseDQS7EVLfoK/jg5lMjxGMXgptN00fOH6M2oEYaDbQK6S
 GnROKBUu5mBFPDgidahwlIkaBJ7/HAiTFhQLo75AZSEDPOOveGkW+0DJPlqw1f5a4k2jRQ
 1+wNbceuj5Zm9uw1EPzZpEQ42+DaQK3Ze5aRdm/AovykLwdmk29LK5WiGgyfsYZILq3UOB
 IBAq+Mg/ePgoQDH6raQnPvwO4+2cKmMhBFu4Ck+af8fPyRfMYvjFSxxDE7kUoSuWUb1WRP
 ZK95yf0BrUd8E6LqVp9476UuvrkG9wm8HMlI5Q+uksQ5tZPHCNGzIOKgDP1V7RsTWlYX9n
 2eJqfUq1zgP2sfVUrLehxCn9uLHBzzjIq/RPQIhBFNnT8RgBRBGm6Q+LrhkkDCsA3hzuys
 9ja+cypw6uSxGe6Q7l832PEggKaMJy54ZExosVOdXi8vxJgKSzhIuWSjIslHBPv4A1L4vd
 9heimddR6Lm1eIqzyen0y45oHDcbj4+R9vSUd4LH4jT24EzsAU7SY8Y+qLhRk67AZqx+z8
 3w3pHnMJNzfo4RUn261LhkyXbr5Tgk9EUBaSTjRkBgRwXDuf5AJ7lgCzEfxaQl24Fe7Q9m
 ufvfk5uiL9dNXWOCYk9zvdbLVLA8c0pyB+wKKOCWDJlaJpkwSNbch1JO5Sk+mTXrRDll3m
 xGK9ARaKfAH5+oRVqHS+5I4tBwFLG+DQL7ktj0YRvu+c1spVzFiiwf4MkOe1Hs/EmQfKEP
 BWUq1uAZhVDS2TeUQwkjR5//eGkSMvE4d9HJnTQTDZk07kv1FvpJ271MWXrln94c/tvKuh
 9Ef34IkMFG6O9uJ2Uu7/U5FSyGuyfeg/7Rffl4jnPDaJnjA0I8QMpjiqckkXIzSP2k0ZtP
 WodpqzBUeRKeJiawkf5kVa0cW0Fq+pW7dlO9b38ufpgcuiV/EadlsVY3qfBhDOpdiGwAob
 ER9pW4Z6Bnl+8ci1U3f7P8PrNiYGm1g8wTgNYCrOSU1JuLoI1y//OZT9u7gpXwsrazjcWU
 hrTXQje273IiB/yosJrtqhJkmAKYDrgb45Pe0a2J0voIHY5jsF7MNlFlJb/zVZvBn8vWpA
 QYXKnq0Agx97UMwyKaYvm/v0UTJZgS1Jd5owY1jwwGubBIt58VRfX6++EJ3QY+EslYvCN0
 BzBV4B+a8WhuGsF7x6Rlv8ei1+hEW3FFHsL4KBjy0e38yvVkYHlND+oxBvawxsikdNwL/2
 g4LfKSVEysjbRSd+UVqVYlBLnmfio7E7sbShp7TgmV7BBsE+9N1PEKRX02QUlhXYqLensx
 3vhOrFcEGvdji8qYAnxK0aGLuMwG/czHjD7tD6xUjjzxVLv9qY9pHX9WxRxYDNyoSX65lj
 EbqpcPe4QrDypTvNKEeZ4w0FEsYP4J0O6ZDXuBoQnSqsbFkvEP3lCf0ezq8jfJn5K0BBkH
 auJpHWx9g8+U+3vKMj4+00fHtp8v0hMMCOzGy8Ol2yS5x6z3Or0HkYzbcMMZvkUNk+z47c
 bHFgdUC/lqc9UrhleAWwkEc9l3qoA61nz7B2jAmZhlNBKFPiIZn2TG7xy4CITDV46j+j92
 y8/hyJDEB0yxx2O/zZKhkEf/N/bAlhIo/8dsjMCMBgE0X+sdpQCfZ+k/dQnAlvWRYhLrkr
 tO97CdjmrFG+AR8pwNqjvJnH9fw=
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/bird-rtr-client.key.pub
+++ b/certs/ssh/bird-rtr-client.key.pub
@ -1 +0,0 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGmbM6oQ3HYuaghpNTbIfOQQqC7m0vX5dUqcDlhlMyntyHAQOCzV8M5jbr2REeyTw60XXEezvb05mRm4NKQXJGsBR+/n5ZgvxpSFfso9ZBTTflEwBgBSQdoz/abWXe2inJ1MATu2An1vIAERQO/GvV9HYcLgF3sZ9T6X6yvVUt5TKWaQ2wNKQb3KNTpnBzrK74gkUaDj1HUt/DeVk42L80boycKZq2/jkHb4U6ThRXof7NJzgpHMgtMbCwAsN68fY4iIIN1046TIGHwy0sJaYrRDVzpWFLRS+hc68g5MWbhtiUFGGVjjMkUbSwegorB6hRxEyMYjn1bhLuUhiMVJkF552Y4Dwu7D1zRd4qk6ZL3nlEOCNsLTo+HIFCP0XUodaWdx2WJKZlpUpjzN7JF3MXqY0/xEgLNlL/SLSB1tod1PWfKfF7WDYluZJNCPv3V4296vcpG/VNBVew6ODRFT1WTQhVPenJLHuxZrOTg3sbGMXrsY8LhJjQtVTY4ijvRk= bird-rtr-client
--- a/certs/ssh/bird-rtr-client.pem
+++ b/certs/ssh/bird-rtr-client.pem
@ -1,40 +0,0 @@
 -----BEGIN PRIVATE KEY-----
 MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQC9gxH/EK68bxW8
 dKY/cTV54Ek4VV2lCMv9pcrSwi4w2tg1Vu4uMYizyWxkRpT3gI5NexNu/d2riAvT
 LFEJTuD2eaCWa4PuuVpKVNvCjhAXYhu+E0X0QZj3iDdmtSQioEGcYBzvFeADjp8R
 /JMv8RTDZVEuIZGSS5e7xmZQ45CvWBcrD9EstaOX3oA9reYm3ucE2wHGS8tEXFLi
 k3qh52l3trKY0b+Hkd26P7BreoELPegQK/Cek9KJBtp9rRvRuOuzx5VixnLIgyz9
 TII+1O3x3c3hHullKQ3DSl6CDHpNnujPetvPbldIwUR1GfkjG/AxKjHtc2yZ915X
 fFi/qaMc6ehmPKO+t3geEjcL6W4sArzs8xkYs204daz1f9/CLtpJVBhsUNkhoz1l
 RbnaqZr8LuwjlujX3te0UltX3u7D00gKUwRZHw8GE1ksIO2USvZaTggscBykJzq7
 oG6FvrNy/L8htHWEzDlJZKDUriR6ZxaufcRwK3RFGx0307NQCVECAwEAAQKCAYAG
 uKo33As8fOqeEFuQmrbpM4yZQkLT3n3gqUOKKc+qVSqvqp2ANyrIaJuO62dvZ0h0
 xEmWSUv2QFkeBF9752eoajwpNZc8bWe/xOZ17iSxNZ4zBbs4jGaM2fCQFJrbXQhy
 r8B69NFJAwMOh+EfBUuFmhdw3cksUYDITMM2eXm5VFQfB3y1W5xZn6838M3dwVBb
 flp/4lKLYkRgy5cA/MSDdc/8Bk1nFSPybf2XdET1JX0QbMSIFUlVaZAwfqYi0C6B
 RH9xpiihYlgwbVtElMsIqh3ExgB3OlhjliYacWQvxhi5fRJdUT5TYiTpCmaIsg1C
 GWXtZADClrzL2rdvkrVUo4KHg1jSc/sxh/LaN061JdGuDxs2O0mg1CzwmWeCG8xy
 0BWPzNruUDM30IV6klMW2vZvYMiDZqjN+fW0qiP3NYgqNBPQLBoW2Jh3Xy9jYsaV
 AisxEzGRDXNOsTvKhcxPOV+0APyhZdVB70pbZwO13iWhjZqZWYrUAqkYsLlnhAEC
 gcEA4r3pdzKeBpGR5Y6htmhW3U0Vi5hiKBBa3PZALebsk0W9VIumPRB7H3D+Ydmh
 /alEQV7QBFojfA5LFmHqJ0Wf35zZ7r7oQv4aowY6ppLexjGeqolAxeMmXluSQjOd
 gnOaVcWjEeyvtV1M2/7rmLAzWPlbCemByJRWHWjRBc1UU+yXG+zRHzvOwStzdfLB
 YG12RAXa+fyHLm5544HnVJ3kzhlAK5QAJ+yqBp3lUingbUvV4fMmlMD+P9SBnDiO
 4WtRAoHBANX3Uv7vwERx/Xho1+9v3iotTRYgJKsMRJraWs+4nR17WpT9kiBugKMg
 6PKaTOuk3ylPZIWji9KCEX7qkrA4ME1pkELG0A9GQXaSE7MCLQzZxOkMBQeMdiSe
 GgJhNtyyuL7rzLfkoAWm+xEFknv7rCaKxGaD6Be2Fmk+vSYgkUxsaVf+egRNM6L7
 4V1kpeyBf4FLOX3odwx0zON1eCvYc6sa4BoibRZx0YGhvE0Elze7QUXGzbd+3zId
 2+46hyE+AQKBwQDY0p6E26R9x4pqqEA/u/sE2Ie329pRUYJyNhEdU+v60P/B72Di
 l/YFFPpM+96KQOkCUfY9kyzHnqtzFeLh9xRwsv877NcR6QfzySsgyuW5RQ3jKikE
 krjIFm0AXXdLndyCFOJha6KCnlu3LEiC1Evl012ZVvBCrIbEzMzE7ZqsPlwp2gYI
 BhsqYbCho6gD2+jyF19VGoTyg7aPNlPOeMapxz+z7G1RwGC+vxLhxSXVnmVDEk9c
 hEkdJMtkZjlLmmECgcBqBltnHrCcegvLDdDqwflJ1xbavuTMqZCZV1gmlGmugUCa
 kahGT9uIejdUeCdjoVg/5Sp/mlIf5vn6dQxpK/6rbYLhxBi3aO3pbms6ifp+4q5T
 ePRJEE4+yOVEhp2j8R/g44GXIkA1bM/+WE+FBmoA00SNNBHfJgim8ELUUNEPGK1+
 wAgAd6z9t2iuWcBqmKTxEbCUdov/bSVWFRCOUXzHrdKcwLBjrdTOMrHXTE4OfMjU
 ZbXsln7NG8SuoOvzCgECgcAjE6ZtIW1bnbCzGOCLzbVw4AxeLuKMhwxF26k04JBJ
 Yo1+vPw1skQYxelNxShHb1oUK2BsrRSYMVjKGg/rdFWng+vHWl2Ff2hj1pI0Pn5d
 n8/vLTDKf0SrRXXNDK+rB70TUqis8zvLb8EACuvlL0YHiAtcWFC9GT9XQMmFbyn1
 PI14Wbzk+0TYs1UQ9FNd4IWL8IbDxxCzFGAUs2g+nYXuRQv/1juZGfsUXlrQZG9O
 qD4S5Fez6uDBzHtzJjKizWw=
 -----END PRIVATE KEY-----
--- a/certs/ssh/bird-rtr-client.pem.pub
+++ b/certs/ssh/bird-rtr-client.pem.pub
--- a/certs/ssh/rtr-authorized_keys
+++ b/certs/ssh/rtr-authorized_keys
@ -1,5 +0,0 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9MkggFr9ic5Ply9tPzsldgut9WAb0bgdDomFtBezDC4rzi/8vWUhzZv+lezWnyKYnMPHe80FEZ8+5QrNjS2GV6KMDxQZN7Wr4Lzh+eQv3hcT+TG6CUa7KjXvuq8P6UYGW9LCn8d36YGmxXkbEtUJlmA2dRemx6xlrpXavCaXLgTph+3eoe2mWTMukwHjzuu4PXhElfCFGZnTMXAkjimCfrH+11YMb1NpMosm/8H8aYZZGAkGPljKAjOLPwAXgn77hoIlRKlslesCmTBJCnmyp/0raIXAW3nkuMnkW9ORdt1Ti7yXsRv+flFBhFh7hM9SfqgbMAkDem1TugDTFTBRkiesh2Y+sQbgk0YO2T5PF+NVLZuuTssog3JyMbRYADZGjzdnvVSG4ICR+1fVehelOnMo1tgSsk3M8WkM5wgfn5HATYcBXaiHo97Q0CHzGKI4KrOqvTc4Bb/uh0VQIecpQajGuZqsWDlxkwk1hd1/s84Qo6kk/iZWKk+S+8uXlHRc= xuxiuting@LAPTOP-A2IH6TNR
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9gxH/EK68bxW8dKY/cTV54Ek4VV2lCMv9pcrSwi4w2tg1Vu4uMYizyWxkRpT3gI5NexNu/d2riAvTLFEJTuD2eaCWa4PuuVpKVNvCjhAXYhu+E0X0QZj3iDdmtSQioEGcYBzvFeADjp8R/JMv8RTDZVEuIZGSS5e7xmZQ45CvWBcrD9EstaOX3oA9reYm3ucE2wHGS8tEXFLik3qh52l3trKY0b+Hkd26P7BreoELPegQK/Cek9KJBtp9rRvRuOuzx5VixnLIgyz9TII+1O3x3c3hHullKQ3DSl6CDHpNnujPetvPbldIwUR1GfkjG/AxKjHtc2yZ915XfFi/qaMc6ehmPKO+t3geEjcL6W4sArzs8xkYs204daz1f9/CLtpJVBhsUNkhoz1lRbnaqZr8LuwjlujX3te0UltX3u7D00gKUwRZHw8GE1ksIO2USvZaTggscBykJzq7oG6FvrNy/L8htHWEzDlJZKDUriR6ZxaufcRwK3RFGx0307NQCVE=
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8D3Wi1t5zBkW0OJlxXab8DxE/0L6vUOZoOL/W0FqqV41G3dZQJ0w8QXk0YIFar/na1bAvesFcQSnSBwQdihNnl2MCUCMtpCmFsUZBT+HdZYMRU6UYWcYJzgM/bpJGn+gLTVCk6WBP1n+bbGQxkaFmj2hHa/v4BGYX1CvGWP0eO4NaZkg6eXkMZeZsjSwE6zU8y06+ZTZok0pVTeEPfflnQn1zk25u5BC1L++XRclBiBsIyH3gGVsQGmknovLNwgttQB9rKXZT2xAYSt/0KOTA64hOlEE75/XQFBKkaPOdFgJfhh/vWWEfWuLqU4qG6k5bXCALqSRBNy8j2G5vV48u2Y6JZQJ+etzZ5mWM2yyopZgL37m/1hrr5qKRKU6F5Sgwk/ULnQ9MycypF80YuffIUpNP8JpAHDVMw7/5F+xvzQ6P07fIX3MIdMWtSxif1Pa26lGL9phZ8t7dySpMEsuFJYt+Jj1Lj1T990/lKTyXgmwDLET2gfpGiQkitnFHT2k=
--- a/certs/ssh/rtr-client.key
+++ b/certs/ssh/rtr-client.key
@ -1,38 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 NhAAAAAwEAAQAAAYEAvTJIIBa/YnOT5cvbT87JXYLrfVgG9G4HQ6JhbQXswwuK84v/L1lI
 c2b/pXs1p8imJzDx3vNBRGfPuUKzY0thleijA8UGTe1q+C84fnkL94XE/kxuglGuyo177q
 vD+lGBlvSwp/Hd+mBpsV5GxLVCZZgNnUXpsesZa6V2rwmly4E6Yft3qHtplkzLpMB487ru
 D14RJXwhRmZ0zFwJI4pgn6x/tdWDG9TaTKLJv/B/GmGWRgJBj5YygIziz8AF4J++4aCJUS
 pbJXrApkwSQp5sqf9K2iFwFt55LjJ5FvTkXbdU4u8l7Eb/n5RQYRYe4TPUn6oGzAJA3ptU
 7oA0xUwUZInrIdmPrEG4JNGDtk+TxfjVS2brk7LKINycjG0WAA2Ro83Z71UhuCAkftX1Xo
 XpTpzKNbYErJNzPFpDOcIH5+RwE2HAV2oh6Pe0NAh8xiiOCqzqr03OAW/7odFUCHnKUGox
 rmarFg5cZMJNYXdf7POEKOpJP4mVipPkvvLl5R0XAAAFkHgpYu14KWLtAAAAB3NzaC1yc2
 EAAAGBAL0ySCAWv2Jzk+XL20/OyV2C631YBvRuB0OiYW0F7MMLivOL/y9ZSHNm/6V7NafI
 picw8d7zQURnz7lCs2NLYZXoowPFBk3tavgvOH55C/eFxP5MboJRrsqNe+6rw/pRgZb0sK
 fx3fpgabFeRsS1QmWYDZ1F6bHrGWuldq8JpcuBOmH7d6h7aZZMy6TAePO67g9eESV8IUZm
 dMxcCSOKYJ+sf7XVgxvU2kyiyb/wfxphlkYCQY+WMoCM4s/ABeCfvuGgiVEqWyV6wKZMEk
 KebKn/StohcBbeeS4yeRb05F23VOLvJexG/5+UUGEWHuEz1J+qBswCQN6bVO6ANMVMFGSJ
 6yHZj6xBuCTRg7ZPk8X41Utm65OyyiDcnIxtFgANkaPN2e9VIbggJH7V9V6F6U6cyjW2BK
 yTczxaQznCB+fkcBNhwFdqIej3tDQIfMYojgqs6q9NzgFv+6HRVAh5ylBqMa5mqxYOXGTC
 TWF3X+zzhCjqST+JlYqT5L7y5eUdFwAAAAMBAAEAAAGAPmfEdJksPZwj74tjZpqtvuN9K5
 YKjTtxt/RqsFxg8SDwj07hOEv54t7Zekr+sr4zWAAD9+dC4v5e/RusMhdeM+VNR+QIJVIn
 k3934fepY9bC2KJ7XQ72Wad7dok/lmSmGxXQ40SbVIfStQeEzkN/iCU0cGjsIZyLgP9N+4
 RyJIMWr9UTbgZvGH1yOoCmJLbG6Vi8zSF5lFAdPH8rIIb3QhPS+DZaDacS7m5Pn7kDI7+G
 oscBuwvu0oomEiKjjakC6xcI1pcH/qNjP1LVhiS6qtERQLAfKGeAQiM44lsqK018fRazMf
 UujVvlafZ/92o+SEwh4e5+oS6rY+aLHoeslGN+BxEsHpyyszl3w4hRRR9XQK9Te/pWGWer
 fFRiJLNlkd0pkYJguT9xTdiDC5KMyJeUhNrdcOn1Df1o3T3uqdZIaFfiGUKsruOovSIgwG
 iYAKCb7b3zHfWDorP2g0Ckd87DKC3J8C6vXKJd/EO2ex+EkJWammeUwdW4mExniY+RAAAA
 wD2jFsuvpecZ/MB89WG7uMVJP7eoBJrPKYfODUR1YHkxUwmEqC1jaIR07qP6EaI5P58vaG
 ai7Hdp7SXidn0zeGAUFZCw8TyA9UsHWshk1ydJkspuch22VBOzgmAe2A7Rw317yqL7if9I
 zYOs7ce9Epnr+qSjNCD1oRw88kwKOLxV19ty3pfp/nhu4TKzzZDJChL/h9/ZQ02ED9l6KS
 ZnX/7C/f8lPMfWxJGshLJnhXvNB6wbAF06/wIRlA9IT0XFWgAAAMEA3aZyJel9M+flKiAD
 sruAfbx39zpJSpizA5rI+y8UFmD4bQ7gwAnHY9+8kzQhFjLSXQ+np5T8mvCii7uxh9j406
 je2/UD5ZS7vmwcC+MoqCxvNL0kVF9FdoNmejUWqZ59Ig9p48AxVe2jG3+Rea1X45C45/1X
 FucDsf5i5Nf7lAqEhM2vIuyKEWu8BSkMY84E4RTtt5S55BcGqritsUYJn/QP4DNzBo9WQd
 61qg7Ve5rMEtSq+UV/Aj4x7qMbBI0PAAAAwQDahEsvkMwQuhHAPfPnn+580SuQ7KwIMyZY
 BtFnIEvQfWKBU1c5kcHoeIPFZ5Bql2aVbL2AuRl+MGRoZ8wYK/rqUytjeRi0aq0IQgH8WW
 PK4bL1RbHwZdyEMc/6CbAA5pd7bFQKopEmf0Md2QC2M/nwS4TAVDDQepdCzQJ9W+EzJI+L
 fvJdihyB1psCLkCd7elGGnBbbTqUjAPNJJio8wZUdD/f1ZEd4KKw1joX/+c4FoLdXlpVci
 dO+ciUfrz8f3kAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/rtr-client.key.pub
+++ b/certs/ssh/rtr-client.key.pub
@ -1 +0,0 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9MkggFr9ic5Ply9tPzsldgut9WAb0bgdDomFtBezDC4rzi/8vWUhzZv+lezWnyKYnMPHe80FEZ8+5QrNjS2GV6KMDxQZN7Wr4Lzh+eQv3hcT+TG6CUa7KjXvuq8P6UYGW9LCn8d36YGmxXkbEtUJlmA2dRemx6xlrpXavCaXLgTph+3eoe2mWTMukwHjzuu4PXhElfCFGZnTMXAkjimCfrH+11YMb1NpMosm/8H8aYZZGAkGPljKAjOLPwAXgn77hoIlRKlslesCmTBJCnmyp/0raIXAW3nkuMnkW9ORdt1Ti7yXsRv+flFBhFh7hM9SfqgbMAkDem1TugDTFTBRkiesh2Y+sQbgk0YO2T5PF+NVLZuuTssog3JyMbRYADZGjzdnvVSG4ICR+1fVehelOnMo1tgSsk3M8WkM5wgfn5HATYcBXaiHo97Q0CHzGKI4KrOqvTc4Bb/uh0VQIecpQajGuZqsWDlxkwk1hd1/s84Qo6kk/iZWKk+S+8uXlHRc= xuxiuting@LAPTOP-A2IH6TNR
--- a/certs/ssh/rtr-client.pem
+++ b/certs/ssh/rtr-client.pem
@ -1,38 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 NhAAAAAwEAAQAAAYEAvTJIIBa/YnOT5cvbT87JXYLrfVgG9G4HQ6JhbQXswwuK84v/L1lI
 c2b/pXs1p8imJzDx3vNBRGfPuUKzY0thleijA8UGTe1q+C84fnkL94XE/kxuglGuyo177q
 vD+lGBlvSwp/Hd+mBpsV5GxLVCZZgNnUXpsesZa6V2rwmly4E6Yft3qHtplkzLpMB487ru
 D14RJXwhRmZ0zFwJI4pgn6x/tdWDG9TaTKLJv/B/GmGWRgJBj5YygIziz8AF4J++4aCJUS
 pbJXrApkwSQp5sqf9K2iFwFt55LjJ5FvTkXbdU4u8l7Eb/n5RQYRYe4TPUn6oGzAJA3ptU
 7oA0xUwUZInrIdmPrEG4JNGDtk+TxfjVS2brk7LKINycjG0WAA2Ro83Z71UhuCAkftX1Xo
 XpTpzKNbYErJNzPFpDOcIH5+RwE2HAV2oh6Pe0NAh8xiiOCqzqr03OAW/7odFUCHnKUGox
 rmarFg5cZMJNYXdf7POEKOpJP4mVipPkvvLl5R0XAAAFkHgpYu14KWLtAAAAB3NzaC1yc2
 EAAAGBAL0ySCAWv2Jzk+XL20/OyV2C631YBvRuB0OiYW0F7MMLivOL/y9ZSHNm/6V7NafI
 picw8d7zQURnz7lCs2NLYZXoowPFBk3tavgvOH55C/eFxP5MboJRrsqNe+6rw/pRgZb0sK
 fx3fpgabFeRsS1QmWYDZ1F6bHrGWuldq8JpcuBOmH7d6h7aZZMy6TAePO67g9eESV8IUZm
 dMxcCSOKYJ+sf7XVgxvU2kyiyb/wfxphlkYCQY+WMoCM4s/ABeCfvuGgiVEqWyV6wKZMEk
 KebKn/StohcBbeeS4yeRb05F23VOLvJexG/5+UUGEWHuEz1J+qBswCQN6bVO6ANMVMFGSJ
 6yHZj6xBuCTRg7ZPk8X41Utm65OyyiDcnIxtFgANkaPN2e9VIbggJH7V9V6F6U6cyjW2BK
 yTczxaQznCB+fkcBNhwFdqIej3tDQIfMYojgqs6q9NzgFv+6HRVAh5ylBqMa5mqxYOXGTC
 TWF3X+zzhCjqST+JlYqT5L7y5eUdFwAAAAMBAAEAAAGAPmfEdJksPZwj74tjZpqtvuN9K5
 YKjTtxt/RqsFxg8SDwj07hOEv54t7Zekr+sr4zWAAD9+dC4v5e/RusMhdeM+VNR+QIJVIn
 k3934fepY9bC2KJ7XQ72Wad7dok/lmSmGxXQ40SbVIfStQeEzkN/iCU0cGjsIZyLgP9N+4
 RyJIMWr9UTbgZvGH1yOoCmJLbG6Vi8zSF5lFAdPH8rIIb3QhPS+DZaDacS7m5Pn7kDI7+G
 oscBuwvu0oomEiKjjakC6xcI1pcH/qNjP1LVhiS6qtERQLAfKGeAQiM44lsqK018fRazMf
 UujVvlafZ/92o+SEwh4e5+oS6rY+aLHoeslGN+BxEsHpyyszl3w4hRRR9XQK9Te/pWGWer
 fFRiJLNlkd0pkYJguT9xTdiDC5KMyJeUhNrdcOn1Df1o3T3uqdZIaFfiGUKsruOovSIgwG
 iYAKCb7b3zHfWDorP2g0Ckd87DKC3J8C6vXKJd/EO2ex+EkJWammeUwdW4mExniY+RAAAA
 wD2jFsuvpecZ/MB89WG7uMVJP7eoBJrPKYfODUR1YHkxUwmEqC1jaIR07qP6EaI5P58vaG
 ai7Hdp7SXidn0zeGAUFZCw8TyA9UsHWshk1ydJkspuch22VBOzgmAe2A7Rw317yqL7if9I
 zYOs7ce9Epnr+qSjNCD1oRw88kwKOLxV19ty3pfp/nhu4TKzzZDJChL/h9/ZQ02ED9l6KS
 ZnX/7C/f8lPMfWxJGshLJnhXvNB6wbAF06/wIRlA9IT0XFWgAAAMEA3aZyJel9M+flKiAD
 sruAfbx39zpJSpizA5rI+y8UFmD4bQ7gwAnHY9+8kzQhFjLSXQ+np5T8mvCii7uxh9j406
 je2/UD5ZS7vmwcC+MoqCxvNL0kVF9FdoNmejUWqZ59Ig9p48AxVe2jG3+Rea1X45C45/1X
 FucDsf5i5Nf7lAqEhM2vIuyKEWu8BSkMY84E4RTtt5S55BcGqritsUYJn/QP4DNzBo9WQd
 61qg7Ve5rMEtSq+UV/Aj4x7qMbBI0PAAAAwQDahEsvkMwQuhHAPfPnn+580SuQ7KwIMyZY
 BtFnIEvQfWKBU1c5kcHoeIPFZ5Bql2aVbL2AuRl+MGRoZ8wYK/rqUytjeRi0aq0IQgH8WW
 PK4bL1RbHwZdyEMc/6CbAA5pd7bFQKopEmf0Md2QC2M/nwS4TAVDDQepdCzQJ9W+EzJI+L
 fvJdihyB1psCLkCd7elGGnBbbTqUjAPNJJio8wZUdD/f1ZEd4KKw1joX/+c4FoLdXlpVci
 dO+ciUfrz8f3kAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/ssh_host_rsa_key
+++ b/certs/ssh/ssh_host_rsa_key
@ -1,38 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 NhAAAAAwEAAQAAAYEA08poqyD9GeB7YdNabpl6cFff3yHu7/E6usvW9/BY05HjYVDWSUCB
 tLLI+1Z2w00/8BuOKECZ8ExSfMWyMHWDQWc2wXL8ZYZPQjzqOCWXNsNt9DXMin7DGS3Lg4
 DCssl3m3cMMRkQcaKlGbdOLMJayt3ABHf+lovRK8D9U6eGACsX4+F7zoSb5lhNauIrH329
 sxKq5HF8nKgQECivc4zvsUBdFXxSak3nNRmA+Sc58IwBf8liv+exWYHUCrh/Y3Q7s8pE5e
 xvPdbkpESk2ze7sIarZ5E3q4FYZP7w6Mc/BJ9BVz+YmkIVcDtm0wwGMFL56bfx2l87GgZR
 mHjWV+6vnXC6ikH3KJI+yCqhiL1rUoaVgWCpHsUsF6ZHlZP9Go0QH3ZAo0pDGnqxJJPZa2
 zUOaF6xxF3IUOtZ/oMZGNqX+WuiXKuqTMLcL7NcT+WQXYk1zRcHW9CJ8XmCl4xSymEA7kI
 7ObGwJ1Vfi/ocIUjgtMxdYOWaGYAuFp0aY4/nv3tAAAFkKmSKaOpkimjAAAAB3NzaC1yc2
 EAAAGBANPKaKsg/Rnge2HTWm6ZenBX398h7u/xOrrL1vfwWNOR42FQ1klAgbSyyPtWdsNN
 P/AbjihAmfBMUnzFsjB1g0FnNsFy/GWGT0I86jgllzbDbfQ1zIp+wxkty4OAwrLJd5t3DD
 EZEHGipRm3TizCWsrdwAR3/paL0SvA/VOnhgArF+Phe86Em+ZYTWriKx99vbMSquRxfJyo
 EBAor3OM77FAXRV8UmpN5zUZgPknOfCMAX/JYr/nsVmB1Aq4f2N0O7PKROXsbz3W5KREpN
 s3u7CGq2eRN6uBWGT+8OjHPwSfQVc/mJpCFXA7ZtMMBjBS+em38dpfOxoGUZh41lfur51w
 uopB9yiSPsgqoYi9a1KGlYFgqR7FLBemR5WT/RqNEB92QKNKQxp6sSST2Wts1DmhescRdy
 FDrWf6DGRjal/lrolyrqkzC3C+zXE/lkF2JNc0XB1vQifF5gpeMUsphAO5COzmxsCdVX4v
 6HCFI4LTMXWDlmhmALhadGmOP5797QAAAAMBAAEAAAGARE9apyeCux/ua8URu+6A0U9mg7
 +cI4P431rzwRCidcruPesm0oWd0DyCGp7uu1tlLfqVRWJgxGK5kEjrijm81hGGVarSwaQq
 WEDxgp6NQTqTclsP1/O+1ZYxt/6FzcixbVFee0+MQDqnab331vPw+NHBJy/Uy5XZJ3Wdv6
 eeztsXX4bQufGHnyoH/ltocUXLM8DnobsA6D5EwBF/VZO1k8QgwddRdbwewL+zG6mNRIrD
 yQWZdjAywZ3gWHzdiaRpLtwIqqVq6q+2nphu41sJTKbU9ZrDLz4YZ4eawPloeukTq+mChS
 UyYK4gomNUG1RugeQNiGW1SG/fDMMVWzYDxmnKxBrVvv/J1AHhyQbScjDjGLxo9aG5A2XJ
 8kfZbkgTsfUP0IhmOFOK2KlRiZDuSGBNGgrEWxzpA/G4T5WGzBDT2pvW6yn5BQDCzpMwy6
 sNiB3cdWNHGyy4Gu/c2Owljb0RukXsfkFN5oaj4fXo2E+Yymm7qTUuPVDgay3/W1cBAAAA
 wEL4j23iXytSSR5U5x0XvVKobDwM+SgOJ1OKhm9FsXmPBDnT/3FzNJ6dZNVYYPtM5Pbal5
 J6soTlHwsHvEJxakrH0B9WqKAhShpJ/pC3UIpxaHAWQ5bk9Z3mBfwSargUFUZDz+hoCEFR
 ZwdSU9LI8vK/nk4urhxMi7BjAHh/acRo5AoOVk9zDTq4FhvwtQG0P6HKZoHLcLKh7Hxm0e
 OPhiWwfXt5TQSgAI4kIKy3UOwxFgsNsI5JLFMWuZ8KUdFCaQAAAMEA8+cTAauvEmDHlg+D
 1KtlbxT96lN2RRruvRO/VxAomP8ZLPV4/9EpS6oTYaWve1TibD1HgJ5k22BBBGOAbEuhz2
 jBxIL2JaGUNmWR1Tofe7s+VY/AKbepwBmTxelyIhbhAcXToFjUIS3398+bxbiSYEU3hmAA
 EmeHui5kZYRcU3Lxv24qfdc9tjaAm3i4OIlhv+QPteJRWB54pdVuYaIZDsSp9mC4BzVNmN
 hJiJ4gB+JEigfp30200Q69soM4umnNAAAAwQDeS5i0cChxeppZ3RbOecZuNE3t09L18nFv
 h8KBXQ/UBt/Z6ElUWME/YATJ4eNUp+/VzyhxmMDzt3yG+k182qe6on4Q73MGgZ+l2mc6TL
 sgN/WoqT0H0P7N3QFqvIsKqH4zHcQFYwx6sgEvCppI7dWP1xkBedjXw6hL7j3poXp+lfT3
 XVGt1J6hMvgXUiyl+xAHjXnH7qU1oTw6Bn/O8hWylFBXSzzdVGjI+NYAzg4vAB+XecJx4V
 gOi7X82F9oRKEAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/ssh_host_rsa_key.pub
+++ b/certs/ssh/ssh_host_rsa_key.pub
@ -1 +0,0 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0= xuxiuting@LAPTOP-A2IH6TNR
--- a/certs/ssh/ssh_known_hosts
+++ b/certs/ssh/ssh_known_hosts
@ -1,2 +0,0 @@
 host.docker.internal ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0=
 [host.docker.internal]:22 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0=
--- a/certs/ssh/testkey
+++ b/certs/ssh/testkey
@ -1,8 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAo7qsNAU
 RiW+8UlbN+a34gAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIMSj2JT9F+tcY/IA
 /qQda0zzC5B768tkm4JwwBHI/dtnAAAAoEVxoJY8k0yGG43sZ9YchTOlEiVpSF3rw0i1Ce
 lqjCx5RrtYMMmnZCIw4oo4kp6ATlluqGoR58BkJPhTW4i/pGH7sqJHltFNhFAu2VMNOlhp
 Eu5WDTotsDpDX7J5A9Lmc5zMdCvoRr+FUd314N7N/5GV4yyUiXlunMFbtgt6QBzYvakqqv
 pIWhsfz3mBe+oenAFpXkrdkQe6Jsy88ZVwVyI=
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/testkey.pub
+++ b/certs/ssh/testkey.pub
@ -1 +0,0 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSj2JT9F+tcY/IA/qQda0zzC5B768tkm4JwwBHI/dtn xuxiuting@LAPTOP-A2IH6TNR
--- a/certs/ssh/testkey3
+++ b/certs/ssh/testkey3
@ -1,8 +0,0 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABACsU5bHT
 9Ps+FePAk6wYjzAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIADxGbVl4d3SirJF
 LBUz7CnzNZMWCDc9iL8BmxjIYGpNAAAAoPryTWyd3TszwaRBXRTGSxvAKW8Um9VYdphhFr
 CkePw369/VBarJJmRqUO6lPG3WfCyVG3N3yW+05Y0dVy53G885GWEoQQoy93Q3JY6dfQa4
 soxlJSROPz/I0X30gq/p5jR6WFHCWUcEZ61BkHhUW8c1R9vtmlBdsTbtbhJWczeKrbyj+p
 UcFxN6YEoXl39c9GbCCyd785cgTof4rmEDvQ0=
 -----END OPENSSH PRIVATE KEY-----
--- a/certs/ssh/testkey3.pub
+++ b/certs/ssh/testkey3.pub
@ -1 +0,0 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADxGbVl4d3SirJFLBUz7CnzNZMWCDc9iL8BmxjIYGpN xuxiuting@LAPTOP-A2IH6TNR
--- a/certs/tls/client-ca.crt
+++ b/certs/tls/client-ca.crt
@ -1,19 +0,0 @@
 -----BEGIN CERTIFICATE-----
 MIIDGzCCAgOgAwIBAgIUKCaM+eEU12YVn/tC6MEBYPj50oIwDQYJKoZIhvcNAQEL
 BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDQy
 OFoXDTM2MDMyMDA4MDQyOFowHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENB
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmS+gsRZXPaG20Ra2te7
 WVeqyeFX2lV/RvNsT3WW+EtwuTN2aFJ/pBgSCqgCaFocU5IcgfScybQrjmTWeEot
 D0F1OOW/TihlBsrU3BS8vOZ4KTuwB9eOgpt7FL8CxLetjNWxZKBsvJMauOUYFLCt
 DN+78EDqrZ2VyJPfa+7dJKS/JoRgs/WFjvAeb5x1UpKPf/gp1Ji+Vj92Ux9znYF1
 2Zfs77NsLdwcqyMVj7cb1nucutNf/vMqNi+BoSwC/tQkflda9bLUwto/ZfFPsCFw
 Ptjwiwm+IGNAKG8r1ujaUVDtxc+NliuAbHERBgZGtYpAE6u28+d8cUAyGGQFNGqb
 uQIDAQABo1MwUTAdBgNVHQ4EFgQUtiTCqdhd2TwFc7JZGWkF8BEcMJwwHwYDVR0j
 BBgwFoAUtiTCqdhd2TwFc7JZGWkF8BEcMJwwDwYDVR0TAQH/BAUwAwEB/zANBgkq
 hkiG9w0BAQsFAAOCAQEATr0wChmDvmw51RQ0kOFP1l3n+O1n/U0xR39YApnmdhtk
 MyO9gNyqxdUWj4QaRkswr5iMyjsLrT3lYWGfh7oHlhIgkXEy5OK548rhj/PA6d5U
 M7DDGI06EFfYXcC57Cx1y8Egd9gfkfPk0ned/TG+/dYtyb7sBiIKrOiDExbfZ53U
 mNtfsdptBoOjee4KggplfVhkUopyO0KKD7twq4dvWgzWZHv7m5wrQA8GP8W4JpPP
 ZAs8cOLfq4cxAwYFXEaf0x7is2u9KdagPqXkiPMeC8fOHWyRCR7sKN4Dnh57ruqq
 mQXil9GGFfkDA/bh6+Rs93Yll7yYyA3xif6fSBmgUg==
 -----END CERTIFICATE-----
--- a/certs/tls/client-good.crt
+++ b/certs/tls/client-good.crt
@ -1,20 +0,0 @@
 -----BEGIN CERTIFICATE-----
 MIIDMjCCAhqgAwIBAgIUTLfIortKKjsYovPDuDVnUR8i2YMwDQYJKoZIhvcNAQEL
 BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDUw
 MFoXDTM2MDMyMDA4MDUwMFowHzEdMBsGA1UEAwwUUlRSIFRlc3QgQ2xpZW50IEdv
 b2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUjnhxQxKUNLjGN6mu
 /VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEiSxVt
 8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo2Ga/
 +eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAjpLZd
 oEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3Jz7D
 QfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi9sqL
 y7UlAgMBAAGjaDBmMA8GA1UdEQQIMAaHBH8AAAEwEwYDVR0lBAwwCgYIKwYBBQUH
 AwIwHQYDVR0OBBYEFJy0O+AR5EdWrUr2UHtPCUVTrRiEMB8GA1UdIwQYMBaAFLYk
 wqnYXdk8BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQB8eavz/Pk3oJBh
 sgy4ve6nLAqKGcD+zSoBxw/ErZaDNdUZZaFKT9nypfi39jkfjU+CIfhczCs5Cknk
 EDqYtp1BXkY+auKeYRkoaCKv+ucnIc6JZ70NOQGdDNzU4eb9tVA9Py0j5VzvxWR1
 yl6vHTc3tTA873RRezvUe+SQDwR+x2dxZ0O0MFZR4CTaTeR+fpD4bE9mBcYN1KVk
 HdA7USCwOZ0qE+aHTegM4pgGrpHYS5yBpUFADqfJl1yBnnqc10zkphoy6dRsbVuN
 NkDostGbbfGdGjEPs6i1TMsDTVyOo4nsHACk4q4m/IEVBkiMwxmwyhK1EEWQmQpy
 h0CqAs3Z
 -----END CERTIFICATE-----
--- a/certs/tls/client-good.key
+++ b/certs/tls/client-good.key
@ -1,28 +0,0 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDUjnhxQxKUNLjG
 N6mu/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEi
 SxVt8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo
 2Ga/+eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAj
 pLZdoEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3
 Jz7DQfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi
 9sqLy7UlAgMBAAECggEALmsOkm17WTJKR79QJw7dS0qEjgmk1qIXRkhYns01vyCt
 mcv7NYyHQrRmPKV73Is04HwWjLJYdQ5E8KBFBcV4tgezN4WY0BHL7txu3sGCu58/
 2mmYHcriNs/QIF8HNSocH0ZrVBCngFHv5tWbWsFPJh2oCz5FyM41OpQqoQ9f0ZoA
 PKq3m7dNidFmlQPhhJ9KeLYwDfzTRy4sWBDrgZFDQ6ut9nO8/JpJvxZCSnOdbW1T
 6pYk3uAKKcmrcdI2fsg7u0J1zkrkDnRdrDv1QCY/h1UXvR4KuMeYRylHWJpOKUiR
 asxpJO+lh7TmDaEIqO+dSmTHawcKDYuIp0EV4/x7AQKBgQD/cgMhx97bJ3ym0ucc
 xtt10jo0NTW7SJIXx/eUdBQNA3aGWfsqLrBI5qKrXLxTXF/vAs3LWHiHF6EgRxW/
 7RbO+NZzAGxg53Y3PMqZ4AQbOm2JCIgT9ZhQc55+qowdtrts3njL+ayy3vWh3nPt
 G78+rs4ZLCHhEutbkKqU7S3XSQKBgQDVBJ5l9d1QcqFqYnlmyhgfwJwpxo4N2dJR
 18pCow8Mp8S9ROJx3OF4yNTRa6ipnX0oGdgchT63jXBDoKot3/4tqbjYj/Y3MmKL
 crZ7dZEiAqkqE975qUfSlQS6BtknRKduzQzAJAKz0A+JbPIisPHIrBnG2PH9h2XA
 TjA2rHRi/QKBgDIp65+IpqUW/g2swSIPky1yGWgDQwgCWl49MMuAeCeOFIqRxRcl
 kAzg7fUFAx7Dtzsyq8NRHmo5I7U5AHZuUtpWV5bB8IafLcHvOEI7kdLfCH+uozp4
 Mm8qJWfuihGTvv7EOaik4VtHGamuC8n2dvoSTfr3hbezhXC32ifg4+2xAoGATbjp
 snoKzheFHbPgZ8jFFJDKadOwcQ1Q19vMSJQGIa/08Ln5hWH6Qn/EZsTJPVnhGIiV
 eZKEV6SbmZE9ho97xl1uvFWKmIkhu4+XVWSIF8iwwFGPwbgqJIOKvfVRtioujRbz
 2AdLlSANCy9dCZtWHMnufccaRE7qqUfd/5TcwmECgYA5md1JZ+p+0yTkjNf4McCe
 mpZiXXaM8uC3/XiWlfcw3ag88H0XCqt2UPcX03MC9ZzywfTdoEHhPRfr48uRiH7K
 Pi1T8E2E0GkSfk6zh6wJm8Kmm9+VJd2rUFrb35xDMUfjpS228oH9UBQtwaAV+jmy
 q/APoG+aWt5YIeYElx9mzA==
 -----END PRIVATE KEY-----
--- a/certs/tls/server-dns.crt
+++ b/certs/tls/server-dns.crt
@ -1,19 +0,0 @@
 -----BEGIN CERTIFICATE-----
 MIIDLDCCAhSgAwIBAgIUU9TJAAXI1pavsowFKFye0t8gdz4wDQYJKoZIhvcNAQEL
 BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyNDAyMzA0
 N1oXDTM2MDMyMTAyMzA0N1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkq
 hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzXLZ2ZeySuuzCDEPXsHMym0py7Tuwizu
 5a4AKQt+7d8b51x22W+I6ZQXYOCUml+C0PGs5TfQDXs0VbYj08flVxw9732FPqzp
 PhkZJlEbnu7+nEW4mb+aM+pnPnW7iLeCvePGXicYO9YctQNA9Onxe+63QtEi2OtO
 24wlqreToA2qQ7UOeNbpcY5p9psgXt9wW+8rq1gXmKsci8DV//1MessDTTX4tgIh
 lOvKBIqx2E2kIIbZ6BwB7veKCkwqrFeVKzmwCXfkVQZkyfxKTBOvf3VFssnFJ7Ld
 dYuAMTpl9jCHkNykGNlc0a9ohglEvAjqwgpUdMcuzMMR8Kf0DjqZqwIDAQABo20w
 azAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD
 VR0OBBYEFOYSmMCX8XUYA9jMGY2M1v5/xaimMB8GA1UdIwQYMBaAFLYkwqnYXdk8
 BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQArYXsdMl+vPyTyv/oRzCo0
 mWyVO3RZPPRJSrrMz4UjtVMIfq6pnV+AXPEcWL/zEfQNcRPjsJeezkG66AZbI+ug
 fur90YVDhWfOgde4E3cVhZz90aM/jcRMVvwNj0XiaX4JpxsVhv5T4LC80aXm0r02
 YfJyqwtNaZlKDntaW56q7nD5eaoqmYa+ogpdqwCIfGvManfRH6v6xmzgQRKnD1lc
 LZPDZ9dmkQg2N/vdZfVUpB2+EZYF/9BuIvJyGKNYBjJiQGv2kbaFUl13mw7D/yGP
 Zytpu5AIPl6ScYog8x6dSJMiYM+hO1bD9qOU0Kq48PaLQoQ4poYo7zdbiB8TZaKC
 -----END CERTIFICATE-----
--- a/certs/tls/server-dns.key
+++ b/certs/tls/server-dns.key
@ -1,28 +0,0 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDNctnZl7JK67MI
 MQ9ewczKbSnLtO7CLO7lrgApC37t3xvnXHbZb4jplBdg4JSaX4LQ8azlN9ANezRV
 tiPTx+VXHD3vfYU+rOk+GRkmURue7v6cRbiZv5oz6mc+dbuIt4K948ZeJxg71hy1
 A0D06fF77rdC0SLY607bjCWqt5OgDapDtQ541ulxjmn2myBe33Bb7yurWBeYqxyL
 wNX//Ux6ywNNNfi2AiGU68oEirHYTaQghtnoHAHu94oKTCqsV5UrObAJd+RVBmTJ
 /EpME69/dUWyycUnst11i4AxOmX2MIeQ3KQY2VzRr2iGCUS8COrCClR0xy7MwxHw
 p/QOOpmrAgMBAAECggEAKOWyBCS0c0GUNA9AFgbSM4Gjjk+IL9MuAz6t/X2yWLvP
 HDFF32bahFTcioZqToiwy9MwLbj8i5J5Co7lduUV/E887Q25lo5pJ9lrLjt7GhpN
 SOKAKur/UVJaFw7ss/yD5DURafCyXEb1E/t/1ME1NwyAIqbrHu9IlV/Cp8c/dd6n
 BUZHKN38Fs8riUOTW4BwAA1dV0k+g8bKb0byR5WmXbXqWG/XjfUKcI4Dg9ILsTwG
 QgI/nzRyAV2unVcdNhM4pMTJ4U4x1Dh/rsWyQ4b206namkpfaIH7j8ovRY2OHhzT
 EuCbn1Cpfmxp68hRrvMIhLvqVkXOSWzKOkHZba/qYQKBgQD0m3WJu5UHXip14gY/
 SmDm3vEcFjVZa+BmQtojs32ZfT/b1H5U+mfhXlVi0yf7B7nitQ9zOA7A2C8cxdtr
 X9zd81MHLc7yUEOAlHBqSfBX/DyF1iRsdM7GYYxrsaECM7NIDukDR1Q/DvMZodRx
 iVpRkNP3s87a1/QwvDKrwOPcCQKBgQDXBH1IZWcl1mrGgfAI7r5wXIJo0IrTlUcT
 4nFSNv5YnrhnRzmLDRqxwlUs4II87nzsqv7OYryAg4n8us+X6XQv0hvTKcHsM7tl
 vAO2EeQIER71tEg45HhmAXo2X2bE5kNMTr4COlb8k6R6r5K2F4yVMZim4qPcMYAK
 tNRXf9JdEwKBgQDEjpOxvPmxdPrbxWfNvgAGJYpMTpBKLgShSAEwhRBdoacKCEQI
 FzwYfoxQoGtVLk0yHtqudJJuZondLiT2sI60D85dS3MrhlHn5eA7mPS4Tyl3Rq/4
 Mxjhkwuakp9WPKNJOSoHB29sSKASrdcf8QaR2rZqKqQDeVtxOhnhqFuxuQKBgHrk
 8/53BteXj/vZtKpGWs658UebOl3oinGREZgeGo3oWhmdmgQh/0nueuRlhcrxvLFA
 otavlHIXvLyYwaJgKqpSetjcmxw4DTn+llhwLVd3Aa0J1+W8oBwdaA6/xGtx+LEa
 qHt5gNJoSLBevYoaN53mdQudqm5mVHrKFDvWsRPFAoGBALAkJiXM4y+aTcwREjnO
 CgebDRru37mprDW2PDa4vpTydxIcXZukTEZqXbVnXNDY/Gkyv06jYoY2R7mzbgfl
 7RJIFAQffkzoeFadQZqimIAN3sQ6RRzNqmAlS2D6zjylX7N2rDiPcS3LtrJZHEyk
 gTFx7+6gjfPNqPiAB5su0IJm
 -----END PRIVATE KEY-----
--- a/deploy/bird/README.md
+++ b/deploy/bird/README.md
@ -83,7 +83,7 @@ docker logs -f bird-rpki-client
  `OBSERVE_INTERVAL` (seconds, used when `OBSERVE_MODE=interval`),
  and `OBSERVE_PROTO`.
 - SSH mode mounts `../../certs/ssh` into `/config/ssh` and expects:
-  `bird-rtr-client.pem` and `ssh_host_rsa_key.pub`.
+  `rtr-client.key` and `ssh_host_rsa_key.pub`.
 - Entrypoint auto-generates `/run/bird/known_hosts` from
  `/config/ssh/ssh_host_rsa_key.pub` for BIRD SSH host-key verification.
 - If your environment does not support Docker host networking, switch to a
--- a/deploy/bird/README.zh.md
+++ b/deploy/bird/README.zh.md
@ -74,7 +74,7 @@ docker logs -f bird-rpki-client
 - 当前 compose 使用 `network_mode: host`，默认通过 `host.docker.internal` 访问 server。
 - 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `30`）和 `OBSERVE_PROTO`。
 - SSH 模式会将 `../../certs/ssh` 挂载到容器 `/config/ssh`，并使用：
-  `bird-rtr-client.pem`、`ssh_host_rsa_key.pub`。
+  `rtr-client.key`、`ssh_host_rsa_key.pub`。
 - 入口脚本会基于 `/config/ssh/ssh_host_rsa_key.pub` 自动生成
  `/run/bird/known_hosts`，用于 BIRD 的 SSH 主机密钥校验。
 - 如果你运行在 Docker Desktop（非 Linux 原生 host network 场景），建议改为自定义 bridge 网络并将 `remote` 地址改成可达的 server 容器名或宿主机地址。
--- a/deploy/bird/_debug_ssh.conf
+++ b/deploy/bird/_debug_ssh.conf
@ -25,7 +25,7 @@ protocol rpki rpki_ssh {
  transport ssh {
    user "rpki-rtr";
-    bird private key "/config/ssh/bird-rtr-client-rsa.pem";
+    bird private key "/config/ssh/rtr-client.key";
    remote public key "/run/bird/known_hosts";
  };
 }
--- a/deploy/bird/bird.conf.ssh.example
+++ b/deploy/bird/bird.conf.ssh.example
@ -24,7 +24,7 @@ protocol rpki rpki_ssh {
  transport ssh {
    user "rpki-rtr";
-    bird private key "/config/ssh/bird-rtr-client-rsa.pem";
+    bird private key "/config/ssh/rtr-client.key";
    remote public key "/run/bird/known_hosts";
  };
 }
--- a/deploy/bird/bird.conf.ssh.template
+++ b/deploy/bird/bird.conf.ssh.template
@ -24,7 +24,7 @@ protocol rpki rpki_ssh {
  transport ssh {
    user "rpki-rtr";
-    bird private key "/config/ssh/bird-rtr-client-rsa.pem";
+    bird private key "/config/ssh/rtr-client.key";
    remote public key "/run/bird/known_hosts";
  };
 }
--- a/deploy/client/.env
+++ b/deploy/client/.env
@ -1,4 +1,7 @@
 # Target RTR server addresses for client compose files
 # RPKI_RTR_CLIENT_IMAGE=rpki-rtr-debug-client-arm64:v1.2
 RPKI_RTR_CLIENT_IMAGE=rpki-rtr-debug-client-amd64:v1.2
 # TCP example: 10.0.0.12:323
 # TLS example: rpki.example.com:324
 # SSH example: 10.0.0.12:22
--- a/deploy/server/.env
+++ b/deploy/server/.env
@ -1,3 +1,7 @@
 # Core runtime knobs.
 # RPKI_RTR_SERVER_IMAGE=rpki-rtr-arm64:v1.2
 RPKI_RTR_SERVER_IMAGE=rpki-rtr-amd64:v1.2
 # Data source directories on host.
 RPKI_RTR_CCR_HOST_DIR=../../data
 RPKI_RTR_SLURM_HOST_DIR=../../data
@ -11,7 +15,6 @@ RPKI_RTR_REPORT_HOST_DIR=../../report
 RPKI_RTR_DB_PATH=/app/rtr-db
 RPKI_RTR_REPORT_DIR=/app/report
 # Core runtime knobs.
 # Persistent directories on host.
 RPKI_RTR_DB_HOST_DIR=../../rtr-db
 RPKI_RTR_LOG_HOST_DIR=../../logs/server
--- a/scripts/00_0_install.sh
+++ b/scripts/00_0_install.sh
@ -0,0 +1,203 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 IMAGE_DIR="${ROOT_DIR}/images"
 SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env"
 CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env"
 SERVER_TAR="${RPKI_RTR_SERVER_IMAGE_TAR:-}"
 CLIENT_TAR="${RPKI_RTR_CLIENT_IMAGE_TAR:-}"
 CONSOLE_TAR="${RPKI_RTR_CONSOLE_IMAGE_TAR:-}"
 usage() {
  cat <<'EOF'
 Usage: scripts/00_0_install.sh [options]
 Load offline Docker image tarballs from ./images, then run scripts/00_1_pre_check.sh.
 Options:
  --server-tar FILE    Server image tarball. Env: RPKI_RTR_SERVER_IMAGE_TAR
  --client-tar FILE    Debug client image tarball. Env: RPKI_RTR_CLIENT_IMAGE_TAR
  --console-tar FILE   Console image tarball. Env: RPKI_RTR_CONSOLE_IMAGE_TAR
  -h, --help           Show this help.
 Default tarballs under ./images:
  server:  rpki-rtr-*.tar, excluding rpki-rtr-debug-client-*.tar
  client:  rpki-rtr-debug-client-*.tar
  console: rpki-console-ui-*.tar
 EOF
 }
 log() {
  printf '[00_install] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[00_install] ERROR: %s\n' "$*" >&2
  exit 1
 }
 set_env_var() {
  local env_file="$1"
  local key="$2"
  local value="$3"
  local tmp_file
  [ -f "${env_file}" ] || die "env file not found: ${env_file}"
  tmp_file="${env_file}.tmp.$$"
  awk -v key="${key}" -v value="${value}" '
    BEGIN { done = 0 }
    $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" {
      if (!done) {
        print key "=" value
        done = 1
      }
      next
    }
    { print }
    END {
      if (!done) {
        print key "=" value
      }
    }
  ' "${env_file}" >"${tmp_file}"
  mv "${tmp_file}" "${env_file}"
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --server-tar)
      [ "$#" -ge 2 ] || die "--server-tar requires a value"
      SERVER_TAR="$2"
      shift 2
      ;;
    --client-tar)
      [ "$#" -ge 2 ] || die "--client-tar requires a value"
      CLIENT_TAR="$2"
      shift 2
      ;;
    --console-tar)
      [ "$#" -ge 2 ] || die "--console-tar requires a value"
      CONSOLE_TAR="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 resolve_tar() {
  local path="$1"
  if [ -f "${path}" ]; then
    cd "$(dirname "${path}")" && printf '%s/%s\n' "$(pwd -P)" "$(basename "${path}")"
    return 0
  fi
  if [ -f "${ROOT_DIR}/${path}" ]; then
    cd "$(dirname "${ROOT_DIR}/${path}")" && printf '%s/%s\n' "$(pwd -P)" "$(basename "${path}")"
    return 0
  fi
  return 1
 }
 load_image() {
  local label="$1"
  local tar_path="$2"
  local output image
  [ -f "${tar_path}" ] || die "${label} image tarball not found: ${tar_path}"
  output="$(docker load -i "${tar_path}" 2>&1)" || {
    printf '%s\n' "${output}" >&2
    die "failed to load ${label} image from ${tar_path}"
  }
  printf '%s\n' "${output}" >&2
  image="$(printf '%s\n' "${output}" | sed -n 's/^Loaded image: //p' | tail -n 1)"
  [ -n "${image}" ] || die "cannot determine ${label} image name from docker load output"
  printf '%s\n' "${image}"
 }
 find_single_tar() {
  local label="$1"
  local include_pattern="$2"
  local exclude_pattern="${3:-}"
  local matches=()
  local file
  while IFS= read -r -d '' file; do
    matches+=("${file}")
  done < <(
    if [ -n "${exclude_pattern}" ]; then
      find "${IMAGE_DIR}" -maxdepth 1 -type f -name "${include_pattern}" ! -name "${exclude_pattern}" -print0 | sort -z
    else
      find "${IMAGE_DIR}" -maxdepth 1 -type f -name "${include_pattern}" -print0 | sort -z
    fi
  )
  case "${#matches[@]}" in
    0)
      die "no ${label} image tarball found under ${IMAGE_DIR} matching ${include_pattern}"
      ;;
    1)
      printf '%s\n' "${matches[0]}"
      ;;
    *)
      printf '[00_install] ERROR: multiple %s image tarballs found:\n' "${label}" >&2
      printf '  %s\n' "${matches[@]}" >&2
      die "please specify --${label}-tar or RPKI_RTR_${label^^}_IMAGE_TAR"
      ;;
  esac
 }
 stage "Checking Docker"
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 [ -d "${IMAGE_DIR}" ] || die "image directory not found: ${IMAGE_DIR}"
 [ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}"
 if [ -n "${SERVER_TAR}" ]; then
  SERVER_TAR="$(resolve_tar "${SERVER_TAR}")" || die "server image tarball not found: ${SERVER_TAR}"
 else
  SERVER_TAR="$(find_single_tar server 'rpki-rtr-*.tar' 'rpki-rtr-debug-client-*.tar')"
 fi
 if [ -n "${CLIENT_TAR}" ]; then
  CLIENT_TAR="$(resolve_tar "${CLIENT_TAR}")" || die "client image tarball not found: ${CLIENT_TAR}"
 else
  CLIENT_TAR="$(find_single_tar client 'rpki-rtr-debug-client-*.tar')"
 fi
 if [ -n "${CONSOLE_TAR}" ]; then
  CONSOLE_TAR="$(resolve_tar "${CONSOLE_TAR}")" || die "console image tarball not found: ${CONSOLE_TAR}"
 else
  CONSOLE_TAR="$(find_single_tar console 'rpki-console-ui-*.tar')"
 fi
 stage "Loading Docker Images"
 SERVER_IMAGE="$(load_image server "${SERVER_TAR}")"
 CLIENT_IMAGE="$(load_image client "${CLIENT_TAR}")"
 CONSOLE_IMAGE="$(load_image console "${CONSOLE_TAR}")"
 stage "Updating Deploy Env"
 set_env_var "${SERVER_ENV_FILE}" RPKI_RTR_SERVER_IMAGE "${SERVER_IMAGE}"
 set_env_var "${CONSOLE_ENV_FILE}" RPKI_CONSOLE_UI_IMAGE "${CONSOLE_IMAGE}"
 stage "Running Pre-Check"
 RPKI_RTR_SERVER_IMAGE="${SERVER_IMAGE}" \
 RPKI_RTR_CLIENT_IMAGE="${CLIENT_IMAGE}" \
 bash "${SCRIPT_DIR}/00_1_pre_check.sh" || die "pre-check failed"
 stage "Install Finished"
--- a/scripts/00_1_pre_check.sh
+++ b/scripts/00_1_pre_check.sh
@ -0,0 +1,155 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR:-${ROOT_DIR}/.precheck}"
 PRECHECK_ENV_FILE="${PRECHECK_ENV_FILE:-${PRECHECK_WORK_DIR}/precheck.env}"
 PRECHECK_WAIT_SECS="${PRECHECK_WAIT_SECS:-60}"
 KEEP_PRECHECK="${KEEP_PRECHECK:-0}"
 log() {
  printf '[00_1_pre_check] %s\n' "$*"
 }
 stage() {
  printf '\n====== %s ======\n' "$*"
 }
 die() {
  printf '[00_1_pre_check] ERROR: %s\n' "$*" >&2
  exit 1
 }
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 stage "Preparing Pre-Check Data"
 bash "${SCRIPT_DIR}/00_2_pre_check_prepare.sh" || die "prepare step failed"
 set -a
 # shellcheck disable=SC1090
 . "${PRECHECK_ENV_FILE}"
 set +a
 ADMIN_PORT="${RPKI_RTR_ADMIN_ADDR##*:}"
 ADMIN_TOKEN="${RPKI_RTR_ADMIN_TOKEN}"
 server_compose() {
  "${COMPOSE_BIN[@]}" --env-file "${PRECHECK_ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${PRECHECK_SERVER_COMPOSE_FILE}" "$@"
 }
 client_compose() {
  "${COMPOSE_BIN[@]}" --env-file "${PRECHECK_ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${PRECHECK_CLIENT_COMPOSE_FILE}" "$@"
 }
 cleanup() {
  KEEP_PRECHECK="${KEEP_PRECHECK}" PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR}" PRECHECK_ENV_FILE="${PRECHECK_ENV_FILE}" \
    bash "${SCRIPT_DIR}/00_3_pre_check_cleanup.sh"
 }
 trap cleanup EXIT
 http_get() {
  local host="$1"
  local port="$2"
  local path="$3"
  local token="$4"
  exec 3<>"/dev/tcp/${host}/${port}" || return 1
  printf 'GET %s HTTP/1.1\r\nHost: %s:%s\r\nAuthorization: Bearer %s\r\nConnection: close\r\n\r\n' \
    "${path}" "${host}" "${port}" "${token}" >&3
  cat <&3
  exec 3>&-
 }
 wait_for_admin_health() {
  local deadline=$((SECONDS + PRECHECK_WAIT_SECS))
  local response
  log "waiting for server health"
  while [ "${SECONDS}" -lt "${deadline}" ]; do
    response="$(http_get 127.0.0.1 "${ADMIN_PORT}" /admin/rtr/health "${ADMIN_TOKEN}" 2>/dev/null || true)"
    if printf '%s' "${response}" | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"'; then
      log "admin health check passed"
      return 0
    fi
    if [ "$(server_compose ps -q rpki-rtr | wc -l | tr -d ' ')" = "0" ]; then
      server_compose logs rpki-rtr || true
      die "server container is not running"
    fi
    sleep 1
  done
  server_compose logs rpki-rtr || true
  die "admin health check did not pass within ${PRECHECK_WAIT_SECS}s"
 }
 wait_for_client_eod() {
  local deadline=$((SECONDS + PRECHECK_WAIT_SECS))
  local log_file
  log "waiting for client response"
  while [ "${SECONDS}" -lt "${deadline}" ]; do
    for log_file in "${PRECHECK_WORK_DIR}"/logs/client/*.stdout.log; do
      [ -f "${log_file}" ] || continue
      if grep -q 'EndOfData:' "${log_file}" && grep -q 'summary[[:space:]]*:' "${log_file}"; then
        log "client received EndOfData and payload summary"
        return 0
      fi
      if grep -qi 'Error Report' "${log_file}"; then
        cat "${log_file}" >&2
        die "client received RTR Error Report"
      fi
    done
    sleep 1
  done
  find "${PRECHECK_WORK_DIR}/logs/client" -type f -maxdepth 1 -print -exec cat {} \; >&2 || true
  die "client did not receive EndOfData and summary within ${PRECHECK_WAIT_SECS}s"
 }
 assert_no_error_logs() {
  local bad
  log "checking logs"
  bad="$(find "${PRECHECK_WORK_DIR}/logs" -type f -name '*.log' -print0 \
    | xargs -0 grep -Ein 'panic|failed|RTR admin config server exited|Error Report' 2>/dev/null || true)"
  if [ -n "${bad}" ]; then
    printf '%s\n' "${bad}" >&2
    die "error pattern found in pre-check logs"
  fi
 }
 assert_report_written() {
  local deadline=$((SECONDS + PRECHECK_WAIT_SECS))
  log "waiting for source report"
  while [ "${SECONDS}" -lt "${deadline}" ]; do
    if find "${PRECHECK_WORK_DIR}/report" -type f -name 'rtr-source-*.json' | grep -q .; then
      log "source report written"
      return 0
    fi
    sleep 1
  done
  die "server did not write rtr-source report within ${PRECHECK_WAIT_SECS}s"
 }
 stage "Starting RTR Server"
 server_compose up -d --no-build rpki-rtr
 wait_for_admin_health
 assert_report_written
 stage "Starting Debug Client"
 client_compose up -d --no-build rtr-debug-client
 wait_for_client_eod
 assert_no_error_logs
 stage "Pre-Check Passed"
--- a/scripts/00_2_generate_ccr.sh
+++ b/scripts/00_2_generate_ccr.sh
@ -0,0 +1,54 @@
 #!/usr/bin/env bash
 set -euo pipefail
 OUT_PATH="${1:-}"
 usage() {
  cat <<'EOF'
 Usage: scripts/00_2_generate_ccr.sh OUT.ccr
 Generate a small deterministic CCR snapshot for pre-check.
 This script writes a fixed base64-encoded CCR fixture and does not require Python.
 The generated snapshot contains:
  - VRP: 10.0.0.0/24 maxLen 24 AS65001
  - VRP: 10.0.1.0/24 maxLen 24 AS65003
  - VRP: 2001:db8:1::/48 maxLen 48 AS65002
  - ASPA: customer AS65010 providers AS65011, AS65012, AS65013
  - ASPA: customer AS65020 provider AS65021
 EOF
 }
 die() {
  printf '[00_2_generate_ccr] ERROR: %s\n' "$*" >&2
  exit 1
 }
 if [ "${OUT_PATH}" = "-h" ] || [ "${OUT_PATH}" = "--help" ]; then
  usage
  exit 0
 fi
 [ -n "${OUT_PATH}" ] || die "missing OUT.ccr"
 mkdir -p "$(dirname "${OUT_PATH}")"
 decode_base64() {
  if command -v base64 >/dev/null 2>&1; then
    base64 -d
    return
  fi
  if command -v openssl >/dev/null 2>&1; then
    openssl base64 -d
    return
  fi
  die "base64 or openssl command is required to write CCR fixture"
 }
 cat <<'EOF' | decode_base64 >"${OUT_PATH}"
 MIIBAwYLKoZIhvcNAQkQATaggfMwgfACAQAwDQYJYIZIAWUDBAIBBQAYDzIwMjYwNDAzMDAwMjAx
 WqJ9MHswVzAaAgMA/ekwEzARBAIAATALMAkDBAAKAAACARgwGgIDAP3rMBMwEQQCAAEwCzAJAwQA
 CgABAgEYMB0CAwD96jAWMBQEAgACMA4wDAMHACABDbgAAQIBMAQgsUgCHfy5AJcFp5RymOD0HuGO
 wfhoWpll90ugYECGQPSjTDBKMCYwFgIDAP3yMA8CAwD98wIDAP30AgMA/fUwDAIDAP38MAUCAwD9
 /QQgRPxVPOOUsUuuV4tZ8BG5PHNtKiaEr23Ird+yNxlWJ+w=
 EOF
--- a/scripts/00_2_pre_check_prepare.sh
+++ b/scripts/00_2_pre_check_prepare.sh
@ -0,0 +1,96 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR:-${ROOT_DIR}/.precheck}"
 PRECHECK_PROJECT="${PRECHECK_PROJECT:-rpki-precheck}"
 PRECHECK_ADMIN_TOKEN="${PRECHECK_ADMIN_TOKEN:-rpki-precheck-token}"
 PRECHECK_PROTOCOL_VERSION="${PRECHECK_PROTOCOL_VERSION:-2}"
 PRECHECK_SERVER_IMAGE="${PRECHECK_SERVER_IMAGE:-${RPKI_RTR_SERVER_IMAGE:-rpki-rtr-arm64:v1.2}}"
 PRECHECK_CLIENT_IMAGE="${PRECHECK_CLIENT_IMAGE:-${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client-arm64:v1.2}}"
 log() {
  printf '[00_1_pre_check_prepare] %s\n' "$*"
 }
 die() {
  printf '[00_1_pre_check_prepare] ERROR: %s\n' "$*" >&2
  exit 1
 }
 abs_dir() {
  local path="$1"
  mkdir -p "${path}"
  cd "${path}" && pwd -P
 }
 [ -f "${SCRIPT_DIR}/00_2_generate_ccr.sh" ] || die "missing ${SCRIPT_DIR}/00_2_generate_ccr.sh"
 rm -rf "${PRECHECK_WORK_DIR}"
 mkdir -p \
  "${PRECHECK_WORK_DIR}/ccr" \
  "${PRECHECK_WORK_DIR}/slurm" \
  "${PRECHECK_WORK_DIR}/db" \
  "${PRECHECK_WORK_DIR}/logs/server" \
  "${PRECHECK_WORK_DIR}/logs/client" \
  "${PRECHECK_WORK_DIR}/report"
 bash "${SCRIPT_DIR}/00_2_generate_ccr.sh" \
  "${PRECHECK_WORK_DIR}/ccr/20260403T000201Z-precheck.ccr"
 cat >"${PRECHECK_WORK_DIR}/slurm/precheck.slurm" <<'EOF'
 {
  "slurmVersion": 2,
  "validationOutputFilters": {
    "prefixFilters": [],
    "bgpsecFilters": [],
    "aspaFilters": []
  },
  "locallyAddedAssertions": {
    "prefixAssertions": [
      {
        "prefix": "203.0.113.0/24",
        "maxPrefixLength": 24,
        "asn": 64496,
        "comment": "pre-check local assertion"
      }
    ],
    "bgpsecAssertions": [],
    "aspaAssertions": []
  }
 }
 EOF
 PRECHECK_WORK_DIR_ABS="$(abs_dir "${PRECHECK_WORK_DIR}")"
 cat >"${PRECHECK_WORK_DIR}/precheck.env" <<EOF
 PRECHECK_WORK_DIR=${PRECHECK_WORK_DIR_ABS}
 PRECHECK_PROJECT=${PRECHECK_PROJECT}
 RPKI_RTR_SERVER_IMAGE=${PRECHECK_SERVER_IMAGE}
 RPKI_RTR_CLIENT_IMAGE=${PRECHECK_CLIENT_IMAGE}
 PRECHECK_SERVER_COMPOSE_FILE=${ROOT_DIR}/deploy/server/docker-compose.tcp.yml
 PRECHECK_CLIENT_COMPOSE_FILE=${ROOT_DIR}/deploy/client/docker-compose.tcp.yml
 RPKI_RTR_CCR_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/ccr
 RPKI_RTR_SLURM_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/slurm
 RPKI_RTR_DB_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/db
 RPKI_RTR_LOG_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/logs/server
 RPKI_RTR_CLIENT_LOG_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/logs/client
 RPKI_RTR_REPORT_HOST_DIR=${PRECHECK_WORK_DIR_ABS}/report
 RPKI_RTR_CCR_DIR=/app/data
 RPKI_RTR_SLURM_DIR=/app/slurm
 RPKI_RTR_DB_PATH=/app/rtr-db
 RPKI_RTR_REPORT_DIR=/app/report
 RPKI_RTR_ADMIN_ADDR=0.0.0.0:8323
 RPKI_RTR_ADMIN_TOKEN=${PRECHECK_ADMIN_TOKEN}
 RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=5
 RPKI_RTR_REPORT_HISTORY_LIMIT=3
 RPKI_RTR_TIMEZONE=Asia/Shanghai
 RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS=30
 RPKI_RTR_MAX_DELTA=10
 RPKI_RTR_MAX_CONNECTIONS=32
 RPKI_RTR_MAX_CONCURRENT_HANDSHAKES=8
 RPKI_RTR_TCP_SERVER_ADDR=rpki-rtr:323
 RPKI_RTR_PROTOCOL_VERSION=${PRECHECK_PROTOCOL_VERSION}
 RUST_LOG=info
 EOF
--- a/scripts/00_3_pre_check_cleanup.sh
+++ b/scripts/00_3_pre_check_cleanup.sh
@ -0,0 +1,56 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR:-${ROOT_DIR}/.precheck}"
 ENV_FILE="${PRECHECK_ENV_FILE:-${PRECHECK_WORK_DIR}/precheck.env}"
 KEEP_PRECHECK="${KEEP_PRECHECK:-0}"
 if [ -f "${ENV_FILE}" ]; then
  set -a
  # shellcheck disable=SC1090
  . "${ENV_FILE}"
  set +a
 fi
 PRECHECK_PROJECT="${PRECHECK_PROJECT:-rpki-precheck}"
 PRECHECK_SERVER_COMPOSE_FILE="${PRECHECK_SERVER_COMPOSE_FILE:-${ROOT_DIR}/deploy/server/docker-compose.tcp.yml}"
 PRECHECK_CLIENT_COMPOSE_FILE="${PRECHECK_CLIENT_COMPOSE_FILE:-${ROOT_DIR}/deploy/client/docker-compose.tcp.yml}"
 COMPOSE_BIN=()
 log() {
  printf '[00_1_pre_check_cleanup] %s\n' "$*"
 }
 compose_run() {
  local compose_file="$1"
  shift
  if [ "${#COMPOSE_BIN[@]}" -eq 0 ]; then
    if docker compose version >/dev/null 2>&1; then
      COMPOSE_BIN=(docker compose)
    elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
      COMPOSE_BIN=(docker-compose)
    else
      return 0
    fi
  fi
  "${COMPOSE_BIN[@]}" --env-file "${ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${compose_file}" "$@"
 }
 if command -v docker >/dev/null 2>&1; then
  log "stopping pre-check client compose stack"
  [ -f "${PRECHECK_CLIENT_COMPOSE_FILE}" ] && compose_run "${PRECHECK_CLIENT_COMPOSE_FILE}" down --remove-orphans >/dev/null 2>&1 || true
  log "stopping pre-check server compose stack"
  [ -f "${PRECHECK_SERVER_COMPOSE_FILE}" ] && compose_run "${PRECHECK_SERVER_COMPOSE_FILE}" down --remove-orphans >/dev/null 2>&1 || true
 fi
 if [ "${KEEP_PRECHECK}" = "1" ]; then
  log "KEEP_PRECHECK=1, preserving ${PRECHECK_WORK_DIR}"
 else
  rm -rf "${PRECHECK_WORK_DIR}"
  log "removed ${PRECHECK_WORK_DIR}"
 fi
--- a/scripts/01_start.sh
+++ b/scripts/01_start.sh
@ -0,0 +1,159 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 COMMON_ENV_FILE="${ROOT_DIR}/environment"
 SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env"
 CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env"
 CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml"
 MODE="${RPKI_RTR_SERVER_MODE:-tcp}"
 COMPOSE_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}"
 CONSOLE_COMPOSE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}"
 usage() {
  cat <<'EOF'
 Usage: scripts/01_start.sh [options]
 Read root ./environment, update deploy/server/.env, then start the RTR server and console.
 Options:
  --env FILE     Common env file. Default: ./environment
  --mode MODE    Server mode: tcp|tls|ssh|base. Default: tcp
  -h, --help     Show this help.
 EOF
 }
 log() {
  printf '[01_start] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[01_start] ERROR: %s\n' "$*" >&2
  exit 1
 }
 set_env_var() {
  local env_file="$1"
  local key="$2"
  local value="$3"
  local tmp_file
  tmp_file="${env_file}.tmp.$$"
  awk -v key="${key}" -v value="${value}" '
    BEGIN { done = 0 }
    $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" {
      if (!done) {
        print key "=" value
        done = 1
      }
      next
    }
    { print }
    END {
      if (!done) {
        print key "=" value
      }
    }
  ' "${env_file}" >"${tmp_file}"
  mv "${tmp_file}" "${env_file}"
 }
 compose_file_for_mode() {
  case "$1" in
    tcp) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tcp.yml" ;;
    tls) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tls.yml" ;;
    ssh) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.ssh.yml" ;;
    base) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.yml" ;;
    *) die "unsupported mode '$1', expected tcp|tls|ssh|base" ;;
  esac
 }
 update_env_from_common() {
  local target_env_file="$1"
  local updated_count=0
  local line key value
  while IFS= read -r line || [ -n "${line}" ]; do
    case "${line}" in
      ''|\#*) continue ;;
      *=*)
        key="${line%%=*}"
        value="${line#*=}"
        set_env_var "${target_env_file}" "${key}" "${value}"
        updated_count=$((updated_count + 1))
        ;;
    esac
  done <"${COMMON_ENV_FILE}"
  printf '%s\n' "${updated_count}"
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --env)
      [ "$#" -ge 2 ] || die "--env requires a value"
      COMMON_ENV_FILE="$2"
      shift 2
      ;;
    --mode)
      [ "$#" -ge 2 ] || die "--mode requires a value"
      MODE="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 SERVER_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")"
 stage "Checking Docker"
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 [ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}"
 [ -f "${SERVER_COMPOSE_FILE}" ] || die "server compose file not found: ${SERVER_COMPOSE_FILE}"
 [ -f "${CONSOLE_ENV_FILE}" ] || die "console env file not found: ${CONSOLE_ENV_FILE}"
 [ -f "${CONSOLE_COMPOSE_FILE}" ] || die "console compose file not found: ${CONSOLE_COMPOSE_FILE}"
 if [ -f "${COMMON_ENV_FILE}" ]; then
  stage "Reading Environment"
  server_updated_count="$(update_env_from_common "${SERVER_ENV_FILE}")"
  log "updated ${server_updated_count} server env variable(s)"
 else
  stage "Reading Environment"
  log "environment file not found, skip env update"
 fi
 stage "Starting RTR Server"
 log "starting docker compose service: rpki-rtr"
 "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${SERVER_COMPOSE_FILE}" up -d --no-build rpki-rtr
 log "checking server compose status"
 "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${SERVER_COMPOSE_FILE}" ps rpki-rtr
 stage "Starting Console"
 log "starting docker compose service: rpki-console-ui"
 "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_COMPOSE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" up -d --no-build rpki-console-ui
 log "checking console compose status"
 "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_COMPOSE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" ps rpki-console-ui
 stage "Start Finished"
--- a/scripts/02_self_check.sh
+++ b/scripts/02_self_check.sh
@ -0,0 +1,184 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env"
 CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env"
 SERVER_COMPOSE_FILE="${ROOT_DIR}/deploy/server/docker-compose.tcp.yml"
 CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml"
 SERVER_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}"
 CONSOLE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}"
 WAIT_SECS="${RPKI_SELF_CHECK_WAIT_SECS:-60}"
 usage() {
  cat <<'EOF'
 Usage: scripts/02_self_check.sh [options]
 Check whether the RTR server and console started by scripts/01_start.sh are healthy.
 Options:
  --wait SECS    Wait timeout for each check. Default: 60
  -h, --help     Show this help.
 EOF
 }
 log() {
  printf '[02_self_check] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[02_self_check] ERROR: %s\n' "$*" >&2
  exit 1
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --wait)
      [ "$#" -ge 2 ] || die "--wait requires a value"
      WAIT_SECS="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 [ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}"
 [ -f "${SERVER_COMPOSE_FILE}" ] || die "server compose file not found: ${SERVER_COMPOSE_FILE}"
 [ -f "${CONSOLE_ENV_FILE}" ] || die "console env file not found: ${CONSOLE_ENV_FILE}"
 [ -f "${CONSOLE_COMPOSE_FILE}" ] || die "console compose file not found: ${CONSOLE_COMPOSE_FILE}"
 set -a
 # shellcheck disable=SC1090
 . "${SERVER_ENV_FILE}"
 # shellcheck disable=SC1090
 . "${CONSOLE_ENV_FILE}"
 set +a
 RTR_PORT="${RPKI_RTR_TCP_HOST_PORT:-323}"
 ADMIN_PORT="${RPKI_RTR_ADMIN_ADDR##*:}"
 ADMIN_PORT="${ADMIN_PORT:-8323}"
 ADMIN_TOKEN="${RPKI_RTR_ADMIN_TOKEN:-}"
 CONSOLE_PORT="${RPKI_CONSOLE_UI_PORT:-5173}"
 server_compose() {
  "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${SERVER_PROJECT}" -f "${SERVER_COMPOSE_FILE}" "$@"
 }
 console_compose() {
  "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" "$@"
 }
 container_running() {
  local compose_kind="$1"
  local service="$2"
  local cid state
  if [ "${compose_kind}" = "server" ]; then
    cid="$(server_compose ps -q "${service}" 2>/dev/null || true)"
  else
    cid="$(console_compose ps -q "${service}" 2>/dev/null || true)"
  fi
  [ -n "${cid}" ] || return 1
  state="$(docker inspect -f '{{.State.Running}}' "${cid}" 2>/dev/null || true)"
  [ "${state}" = "true" ]
 }
 tcp_open() {
  local host="$1"
  local port="$2"
  if command -v nc >/dev/null 2>&1; then
    nc -z "${host}" "${port}" >/dev/null 2>&1
    return
  fi
  (exec 3<>"/dev/tcp/${host}/${port}") >/dev/null 2>&1
 }
 http_get() {
  local url="$1"
  local token="${2:-}"
  if command -v curl >/dev/null 2>&1; then
    if [ -n "${token}" ]; then
      curl -fsS -H "Authorization: Bearer ${token}" "${url}"
    else
      curl -fsS "${url}"
    fi
    return
  fi
  die "curl command is required for HTTP health checks"
 }
 wait_until() {
  local label="$1"
  shift
  local deadline=$((SECONDS + WAIT_SECS))
  while [ "${SECONDS}" -lt "${deadline}" ]; do
    if "$@"; then
      log "${label}: ok"
      return 0
    fi
    sleep 1
  done
  die "${label}: failed after ${WAIT_SECS}s"
 }
 show_command() {
  printf '[02_self_check] check command: %s\n' "$*" >&2
 }
 check_admin_health() {
  local body
  body="$(http_get "http://127.0.0.1:${ADMIN_PORT}/admin/rtr/health" "${ADMIN_TOKEN}" 2>/dev/null || true)"
  printf '%s' "${body}" | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"'
 }
 check_console_http() {
  http_get "http://127.0.0.1:${CONSOLE_PORT}/" >/dev/null 2>&1
 }
 stage "Checking Containers"
 show_command "${COMPOSE_BIN[*]} --env-file ${SERVER_ENV_FILE} -p ${SERVER_PROJECT} -f ${SERVER_COMPOSE_FILE} ps -q rpki-rtr && docker inspect"
 wait_until "server container" container_running server rpki-rtr
 show_command "${COMPOSE_BIN[*]} --env-file ${CONSOLE_ENV_FILE} -p ${CONSOLE_PROJECT} -f ${CONSOLE_COMPOSE_FILE} ps -q rpki-console-ui && docker inspect"
 wait_until "console container" container_running console rpki-console-ui
 stage "Checking Server"
 show_command "tcp connect 127.0.0.1:${RTR_PORT}"
 wait_until "RTR port ${RTR_PORT}" tcp_open 127.0.0.1 "${RTR_PORT}"
 show_command "curl -fsS -H 'Authorization: Bearer <token>' http://127.0.0.1:${ADMIN_PORT}/admin/rtr/health"
 wait_until "Admin health" check_admin_health
 stage "Checking Console"
 show_command "tcp connect 127.0.0.1:${CONSOLE_PORT}"
 wait_until "Console port ${CONSOLE_PORT}" tcp_open 127.0.0.1 "${CONSOLE_PORT}"
 show_command "curl -fsS http://127.0.0.1:${CONSOLE_PORT}/"
 wait_until "Console HTTP" check_console_http
 stage "Self-Check Passed"
--- a/scripts/03_shutdown.sh
+++ b/scripts/03_shutdown.sh
@ -0,0 +1,92 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env"
 CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env"
 MODE="${RPKI_RTR_SERVER_MODE:-tcp}"
 SERVER_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}"
 CONSOLE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}"
 usage() {
  cat <<'EOF'
 Usage: scripts/03_shutdown.sh [options]
 Stop services started by scripts/01_start.sh.
 Options:
  --mode MODE    Server mode: tcp|tls|ssh|base. Default: tcp
  -h, --help     Show this help.
 EOF
 }
 log() {
  printf '[03_shutdown] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[03_shutdown] ERROR: %s\n' "$*" >&2
  exit 1
 }
 compose_file_for_mode() {
  case "$1" in
    tcp) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tcp.yml" ;;
    tls) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tls.yml" ;;
    ssh) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.ssh.yml" ;;
    base) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.yml" ;;
    *) die "unsupported mode '$1', expected tcp|tls|ssh|base" ;;
  esac
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --mode)
      [ "$#" -ge 2 ] || die "--mode requires a value"
      MODE="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 SERVER_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")"
 CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml"
 stage "Checking Docker"
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 stage "Stopping Console"
 if [ -f "${CONSOLE_ENV_FILE}" ] && [ -f "${CONSOLE_COMPOSE_FILE}" ]; then
  "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" down --remove-orphans
 else
  log "console compose/env not found, skip"
 fi
 stage "Stopping RTR Server"
 if [ -f "${SERVER_ENV_FILE}" ] && [ -f "${SERVER_COMPOSE_FILE}" ]; then
  "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${SERVER_PROJECT}" -f "${SERVER_COMPOSE_FILE}" down --remove-orphans
 else
  log "server compose/env not found, skip"
 fi
 stage "Shutdown Finished"
--- a/scripts/10_generate_certs.sh
+++ b/scripts/10_generate_certs.sh
@ -0,0 +1,303 @@
 #!/usr/bin/env bash
 set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 OUT_DIR="${ROOT_DIR}/certs"
 TLS_DIR="${OUT_DIR}/tls"
 SSH_DIR="${OUT_DIR}/ssh"
 SERVER_DNS="localhost"
 FORCE=0
 DO_TLS=1
 DO_SSH=1
 usage() {
  cat <<'USAGE'
 Generate local development TLS certificates and SSH keys for RTR Docker deploys.
 Usage:
  scripts/10_generate-certs.sh [options]
 Options:
  --out-dir DIR          Output directory, default: ./certs
  --server-dns NAME      TLS server dNSName SAN, default: localhost
  --tls-only             Generate only TLS files
  --ssh-only             Generate only SSH files
  --force                Overwrite existing files
  -h, --help             Show this help
 Generated TLS files:
  certs/tls/client-ca.crt
  certs/tls/client-ca.key
  certs/tls/server-dns.crt
  certs/tls/server-dns.key
  certs/tls/client-good.crt
  certs/tls/client-good.key
 Generated SSH files:
  certs/ssh/ssh_host_rsa_key
  certs/ssh/ssh_host_rsa_key.pub
  certs/ssh/rtr-client.key
  certs/ssh/rtr-client.key.pub
  certs/ssh/rtr-authorized_keys
 USAGE
 }
 die() {
  echo "error: $*" >&2
  exit 1
 }
 info() {
  echo "[generate-certs] $*"
 }
 need_cmd() {
  command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"
 }
 run_quiet() {
  local log_file
  log_file="$(mktemp)"
  if "$@" >"${log_file}" 2>&1; then
    rm -f "${log_file}"
    return 0
  fi
  cat "${log_file}" >&2
  rm -f "${log_file}"
  return 1
 }
 ensure_abs_out_dir() {
  case "${OUT_DIR}" in
    /*) ;;
    [A-Za-z]:*) ;;
    *) OUT_DIR="${ROOT_DIR}/${OUT_DIR}" ;;
  esac
  TLS_DIR="${OUT_DIR}/tls"
  SSH_DIR="${OUT_DIR}/ssh"
 }
 check_overwrite() {
  local path="$1"
  if [[ -e "${path}" && "${FORCE}" != "1" ]]; then
    die "${path} already exists; rerun with --force to overwrite"
  fi
 }
 write_tls_config_files() {
  local tmp_dir="$1"
  cat >"${tmp_dir}/ca.cnf" <<'EOF'
 [ req ]
 distinguished_name = req_distinguished_name
 prompt = no
 [ req_distinguished_name ]
 CN = rpki-rtr-client-ca
 EOF
  cat >"${tmp_dir}/server.cnf" <<EOF
 [ req ]
 distinguished_name = req_distinguished_name
 prompt = no
 [ req_distinguished_name ]
 CN = ${SERVER_DNS}
 EOF
  cat >"${tmp_dir}/client.cnf" <<'EOF'
 [ req ]
 distinguished_name = req_distinguished_name
 prompt = no
 [ req_distinguished_name ]
 CN = rpki-rtr-client
 EOF
  cat >"${tmp_dir}/server.ext" <<EOF
 basicConstraints=CA:FALSE
 keyUsage=digitalSignature,keyEncipherment
 extendedKeyUsage=serverAuth
 subjectAltName=DNS:${SERVER_DNS}
 EOF
  cat >"${tmp_dir}/client.ext" <<'EOF'
 basicConstraints=CA:FALSE
 keyUsage=digitalSignature,keyEncipherment
 extendedKeyUsage=clientAuth
 EOF
 }
 generate_tls() {
  need_cmd openssl
  mkdir -p "${TLS_DIR}"
  info "generating TLS certificates in ${TLS_DIR}"
  info "TLS server dNSName SAN: ${SERVER_DNS}"
  local files=(
    "${TLS_DIR}/client-ca.crt"
    "${TLS_DIR}/client-ca.key"
    "${TLS_DIR}/server-dns.crt"
    "${TLS_DIR}/server-dns.key"
    "${TLS_DIR}/client-good.crt"
    "${TLS_DIR}/client-good.key"
  )
  for file in "${files[@]}"; do
    check_overwrite "${file}"
  done
  local tmp_dir
  tmp_dir="$(mktemp -d)"
  write_tls_config_files "${tmp_dir}"
  run_quiet openssl genrsa -out "${TLS_DIR}/client-ca.key" 2048
  info "created TLS CA key: ${TLS_DIR}/client-ca.key"
  run_quiet openssl req -x509 -new -nodes \
    -config "${tmp_dir}/ca.cnf" \
    -key "${TLS_DIR}/client-ca.key" \
    -sha256 -days 3650 \
    -out "${TLS_DIR}/client-ca.crt"
  info "created TLS CA cert: ${TLS_DIR}/client-ca.crt"
  run_quiet openssl genrsa -out "${TLS_DIR}/server-dns.key" 2048
  info "created TLS server key: ${TLS_DIR}/server-dns.key"
  run_quiet openssl req -new \
    -config "${tmp_dir}/server.cnf" \
    -key "${TLS_DIR}/server-dns.key" \
    -out "${tmp_dir}/server-dns.csr"
  run_quiet openssl x509 -req \
    -in "${tmp_dir}/server-dns.csr" \
    -CA "${TLS_DIR}/client-ca.crt" \
    -CAkey "${TLS_DIR}/client-ca.key" \
    -CAcreateserial \
    -out "${TLS_DIR}/server-dns.crt" \
    -days 3650 -sha256 \
    -extfile "${tmp_dir}/server.ext"
  info "created TLS server cert: ${TLS_DIR}/server-dns.crt"
  run_quiet openssl genrsa -out "${TLS_DIR}/client-good.key" 2048
  info "created TLS client key: ${TLS_DIR}/client-good.key"
  run_quiet openssl req -new \
    -config "${tmp_dir}/client.cnf" \
    -key "${TLS_DIR}/client-good.key" \
    -out "${tmp_dir}/client-good.csr"
  run_quiet openssl x509 -req \
    -in "${tmp_dir}/client-good.csr" \
    -CA "${TLS_DIR}/client-ca.crt" \
    -CAkey "${TLS_DIR}/client-ca.key" \
    -CAcreateserial \
    -out "${TLS_DIR}/client-good.crt" \
    -days 3650 -sha256 \
    -extfile "${tmp_dir}/client.ext"
  info "created TLS client cert: ${TLS_DIR}/client-good.crt"
  rm -f "${TLS_DIR}/client-ca.srl"
  rm -rf "${tmp_dir}"
  chmod 600 "${TLS_DIR}"/*.key
  chmod 644 "${TLS_DIR}"/*.crt
 }
 generate_ssh_key() {
  local path="$1"
  local comment="$2"
  check_overwrite "${path}"
  check_overwrite "${path}.pub"
  rm -f "${path}" "${path}.pub"
  run_quiet ssh-keygen -q -t rsa -b 3072 -m PEM -N "" -C "${comment}" -f "${path}"
 }
 generate_ssh() {
  need_cmd ssh-keygen
  mkdir -p "${SSH_DIR}"
  info "generating SSH keys in ${SSH_DIR}"
  generate_ssh_key "${SSH_DIR}/ssh_host_rsa_key" "rpki-rtr-host"
  info "created SSH host key: ${SSH_DIR}/ssh_host_rsa_key"
  generate_ssh_key "${SSH_DIR}/rtr-client.key" "rpki-rtr-debug-client"
  info "created SSH client key: ${SSH_DIR}/rtr-client.key"
  check_overwrite "${SSH_DIR}/rtr-authorized_keys"
  cp "${SSH_DIR}/rtr-client.key.pub" "${SSH_DIR}/rtr-authorized_keys"
  info "created SSH authorized_keys: ${SSH_DIR}/rtr-authorized_keys"
  chmod 600 \
    "${SSH_DIR}/ssh_host_rsa_key" \
    "${SSH_DIR}/rtr-client.key"
  chmod 644 "${SSH_DIR}"/*.pub "${SSH_DIR}/rtr-authorized_keys"
 }
 while [[ $# -gt 0 ]]; do
  case "$1" in
    --out-dir)
      [[ $# -ge 2 ]] || die "--out-dir requires a value"
      OUT_DIR="$2"
      shift 2
      ;;
    --server-dns)
      [[ $# -ge 2 ]] || die "--server-dns requires a value"
      SERVER_DNS="$2"
      shift 2
      ;;
    --tls-only)
      DO_TLS=1
      DO_SSH=0
      shift
      ;;
    --ssh-only)
      DO_TLS=0
      DO_SSH=1
      shift
      ;;
    --force)
      FORCE=1
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 ensure_abs_out_dir
 if [[ "${DO_TLS}" == "1" ]]; then
  generate_tls
 fi
 if [[ "${DO_SSH}" == "1" ]]; then
  generate_ssh
 fi
 info "done"
 info "generated files under ${OUT_DIR}"
 if [[ "${DO_TLS}" == "1" ]]; then
  cat <<EOF
 TLS files:
  ${TLS_DIR}/client-ca.crt
  ${TLS_DIR}/server-dns.crt
  ${TLS_DIR}/server-dns.key
  ${TLS_DIR}/client-good.crt
  ${TLS_DIR}/client-good.key
  ${TLS_DIR}/client-ca.key  (local signing key; not mounted by compose)
 EOF
 fi
 if [[ "${DO_SSH}" == "1" ]]; then
  cat <<EOF
 SSH files:
  ${SSH_DIR}/ssh_host_rsa_key
  ${SSH_DIR}/ssh_host_rsa_key.pub
  ${SSH_DIR}/rtr-client.key
  ${SSH_DIR}/rtr-client.key.pub
  ${SSH_DIR}/rtr-authorized_keys
 EOF
 fi
--- a/scripts/11_start_client.sh
+++ b/scripts/11_start_client.sh
@ -0,0 +1,136 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 COMMON_ENV_FILE="${ROOT_DIR}/environment.client"
 CLIENT_ENV_FILE="${ROOT_DIR}/deploy/client/.env"
 MODE="${RPKI_RTR_CLIENT_MODE:-tcp}"
 COMPOSE_PROJECT="${RPKI_RTR_CLIENT_COMPOSE_PROJECT:-rpki-rtr-client}"
 usage() {
  cat <<'EOF'
 Usage: scripts/11_start_client.sh [options]
 Read root ./environment.client, update deploy/client/.env, then start the RTR debug client.
 Options:
  --mode MODE    Client mode: tcp|tls|ssh. Default: tcp
  --env FILE     Client common env file. Default: ./environment.client
  -h, --help     Show this help.
 EOF
 }
 log() {
  printf '[11_start_client] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[11_start_client] ERROR: %s\n' "$*" >&2
  exit 1
 }
 set_env_var() {
  local env_file="$1"
  local key="$2"
  local value="$3"
  local tmp_file
  tmp_file="${env_file}.tmp.$$"
  awk -v key="${key}" -v value="${value}" '
    BEGIN { done = 0 }
    $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" {
      if (!done) {
        print key "=" value
        done = 1
      }
      next
    }
    { print }
    END {
      if (!done) {
        print key "=" value
      }
    }
  ' "${env_file}" >"${tmp_file}"
  mv "${tmp_file}" "${env_file}"
 }
 compose_file_for_mode() {
  case "$1" in
    tcp) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tcp.yml" ;;
    tls) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tls.yml" ;;
    ssh) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.ssh.yml" ;;
    *) die "unsupported mode '$1', expected tcp|tls|ssh" ;;
  esac
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --mode)
      [ "$#" -ge 2 ] || die "--mode requires a value"
      MODE="$2"
      shift 2
      ;;
    --env)
      [ "$#" -ge 2 ] || die "--env requires a value"
      COMMON_ENV_FILE="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 CLIENT_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")"
 stage "Checking Docker"
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 [ -f "${CLIENT_ENV_FILE}" ] || die "deploy client env file not found: ${CLIENT_ENV_FILE}"
 [ -f "${CLIENT_COMPOSE_FILE}" ] || die "client compose file not found: ${CLIENT_COMPOSE_FILE}"
 stage "Reading Client Environment"
 if [ -f "${COMMON_ENV_FILE}" ]; then
  updated_count=0
  while IFS= read -r line || [ -n "${line}" ]; do
    case "${line}" in
      ''|\#*) continue ;;
      *=*)
        key="${line%%=*}"
        value="${line#*=}"
        set_env_var "${CLIENT_ENV_FILE}" "${key}" "${value}"
        updated_count=$((updated_count + 1))
        ;;
    esac
  done <"${COMMON_ENV_FILE}"
  log "updated ${updated_count} client env variable(s)"
 else
  log "environment.client file not found, skip env update"
 fi
 stage "Starting RTR Debug Client"
 log "mode: ${MODE}"
 "${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" up -d --no-build rtr-debug-client
 log "checking client compose status"
 "${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" ps rtr-debug-client
 stage "Client Started"
--- a/scripts/12_shutdown_client.sh
+++ b/scripts/12_shutdown_client.sh
@ -0,0 +1,82 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 CLIENT_ENV_FILE="${ROOT_DIR}/deploy/client/.env"
 MODE="${RPKI_RTR_CLIENT_MODE:-tcp}"
 COMPOSE_PROJECT="${RPKI_RTR_CLIENT_COMPOSE_PROJECT:-rpki-rtr-client}"
 usage() {
  cat <<'EOF'
 Usage: scripts/12_shutdown_client.sh [options]
 Stop the RTR debug client started by scripts/11_start_client.sh.
 Options:
  --mode MODE    Client mode: tcp|tls|ssh. Default: tcp
  -h, --help     Show this help.
 EOF
 }
 log() {
  printf '[12_shutdown_client] %s\n' "$*" >&2
 }
 stage() {
  printf '\n====== %s ======\n' "$*" >&2
 }
 die() {
  printf '[12_shutdown_client] ERROR: %s\n' "$*" >&2
  exit 1
 }
 compose_file_for_mode() {
  case "$1" in
    tcp) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tcp.yml" ;;
    tls) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tls.yml" ;;
    ssh) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.ssh.yml" ;;
    *) die "unsupported mode '$1', expected tcp|tls|ssh" ;;
  esac
 }
 while [ "$#" -gt 0 ]; do
  case "$1" in
    --mode)
      [ "$#" -ge 2 ] || die "--mode requires a value"
      MODE="$2"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      die "unknown option: $1"
      ;;
  esac
 done
 CLIENT_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")"
 stage "Checking Docker"
 command -v docker >/dev/null 2>&1 || die "docker command not found"
 if docker compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then
  COMPOSE_BIN=(docker-compose)
 else
  die "docker compose is not available"
 fi
 stage "Stopping RTR Debug Client"
 log "mode: ${MODE}"
 if [ -f "${CLIENT_ENV_FILE}" ] && [ -f "${CLIENT_COMPOSE_FILE}" ]; then
  "${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" down --remove-orphans
 else
  log "client compose/env not found, skip"
 fi
 stage "Client Shutdown Finished"
--- a/scripts/start-rtr-server-tcp.sh
+++ b/scripts/start-rtr-server-tcp.sh
@ -1,34 +0,0 @@
 #!/usr/bin/env sh
 set -eu
 : "${RPKI_RTR_ENABLE_TLS:=false}"
 : "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}"
 export RPKI_RTR_ENABLE_TLS
 export RPKI_RTR_TCP_ADDR
 : "${RPKI_RTR_DB_PATH:=./rtr-db}"
 : "${RPKI_RTR_CCR_DIR:=./data}"
 export RPKI_RTR_DB_PATH
 export RPKI_RTR_CCR_DIR
 : "${RPKI_RTR_MAX_DELTA:=100}"
 : "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}"
 : "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}"
 : "${RPKI_RTR_TIMING_RETRY_SECS:=600}"
 : "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}"
 : "${RPKI_RTR_MAX_CONNECTIONS:=512}"
 : "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}"
 export RPKI_RTR_MAX_DELTA
 export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS
 export RPKI_RTR_TIMING_REFRESH_SECS
 export RPKI_RTR_TIMING_RETRY_SECS
 export RPKI_RTR_TIMING_EXPIRE_SECS
 export RPKI_RTR_MAX_CONNECTIONS
 export RPKI_RTR_NOTIFY_QUEUE_SIZE
 : "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}"
 : "${RPKI_RTR_WARN_INSECURE_TCP:=true}"
 export RPKI_RTR_TCP_KEEPALIVE_SECS
 export RPKI_RTR_WARN_INSECURE_TCP
 cargo run
--- a/scripts/start-rtr-server-tls.sh
+++ b/scripts/start-rtr-server-tls.sh
@ -1,45 +0,0 @@
 #!/usr/bin/env sh
 set -eu
 : "${RPKI_RTR_ENABLE_TLS:=true}"
 : "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}"
 : "${RPKI_RTR_TLS_ADDR:=0.0.0.0:324}"
 export RPKI_RTR_ENABLE_TLS
 export RPKI_RTR_TCP_ADDR
 export RPKI_RTR_TLS_ADDR
 : "${RPKI_RTR_DB_PATH:=./rtr-db}"
 : "${RPKI_RTR_CCR_DIR:=./data}"
 export RPKI_RTR_DB_PATH
 export RPKI_RTR_CCR_DIR
 : "${RPKI_RTR_TLS_CERT_PATH:=./certs/server-dns.crt}"
 : "${RPKI_RTR_TLS_KEY_PATH:=./certs/server-dns.key}"
 : "${RPKI_RTR_TLS_CLIENT_CA_PATH:=./certs/client-ca.crt}"
 export RPKI_RTR_TLS_CERT_PATH
 export RPKI_RTR_TLS_KEY_PATH
 export RPKI_RTR_TLS_CLIENT_CA_PATH
 : "${RPKI_RTR_MAX_DELTA:=100}"
 : "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}"
 : "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}"
 : "${RPKI_RTR_TIMING_RETRY_SECS:=600}"
 : "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}"
 : "${RPKI_RTR_MAX_CONNECTIONS:=512}"
 : "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}"
 export RPKI_RTR_MAX_DELTA
 export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS
 export RPKI_RTR_TIMING_REFRESH_SECS
 export RPKI_RTR_TIMING_RETRY_SECS
 export RPKI_RTR_TIMING_EXPIRE_SECS
 export RPKI_RTR_MAX_CONNECTIONS
 export RPKI_RTR_NOTIFY_QUEUE_SIZE
 : "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}"
 : "${RPKI_RTR_WARN_INSECURE_TCP:=true}"
 : "${RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN:=true}"
 export RPKI_RTR_TCP_KEEPALIVE_SECS
 export RPKI_RTR_WARN_INSECURE_TCP
 export RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN
 cargo run
--- a/scripts/start-rtr-server.sh
+++ b/scripts/start-rtr-server.sh
@ -1,45 +0,0 @@
 #!/usr/bin/env sh
 set -eu
 : "${RPKI_RTR_ENABLE_TLS:=true}"
 : "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}"
 : "${RPKI_RTR_TLS_ADDR:=0.0.0.0:324}"
 export RPKI_RTR_ENABLE_TLS
 export RPKI_RTR_TCP_ADDR
 export RPKI_RTR_TLS_ADDR
 : "${RPKI_RTR_DB_PATH:=./rtr-db}"
 : "${RPKI_RTR_CCR_DIR:=./data}"
 export RPKI_RTR_DB_PATH
 export RPKI_RTR_CCR_DIR
 : "${RPKI_RTR_TLS_CERT_PATH:=./certs/server-dns.crt}"
 : "${RPKI_RTR_TLS_KEY_PATH:=./certs/server-dns.key}"
 : "${RPKI_RTR_TLS_CLIENT_CA_PATH:=./certs/client-ca.crt}"
 export RPKI_RTR_TLS_CERT_PATH
 export RPKI_RTR_TLS_KEY_PATH
 export RPKI_RTR_TLS_CLIENT_CA_PATH
 : "${RPKI_RTR_MAX_DELTA:=100}"
 : "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}"
 : "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}"
 : "${RPKI_RTR_TIMING_RETRY_SECS:=600}"
 : "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}"
 : "${RPKI_RTR_MAX_CONNECTIONS:=512}"
 : "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}"
 export RPKI_RTR_MAX_DELTA
 export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS
 export RPKI_RTR_TIMING_REFRESH_SECS
 export RPKI_RTR_TIMING_RETRY_SECS
 export RPKI_RTR_TIMING_EXPIRE_SECS
 export RPKI_RTR_MAX_CONNECTIONS
 export RPKI_RTR_NOTIFY_QUEUE_SIZE
 : "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}"
 : "${RPKI_RTR_WARN_INSECURE_TCP:=true}"
 : "${RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN:=true}"
 export RPKI_RTR_TCP_KEEPALIVE_SECS
 export RPKI_RTR_WARN_INSECURE_TCP
 export RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN
 cargo run
		`@ -1 +0,0 @@`
			`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHh6RLKV3/Dd8Ku0PB+lLBZo6E+EXJ2WYLYjIzVU/5t9 xuxiuting@LAPTOP-A2IH6TNR`
		`@ -1 +0,0 @@`
			ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGmbM6oQ3HYuaghpNTbIfOQQqC7m0vX5dUqcDlhlMyntyHAQOCzV8M5jbr2REeyTw60XXEezvb05mRm4NKQXJGsBR+/n5ZgvxpSFfso9ZBTTflEwBgBSQdoz/abWXe2inJ1MATu2An1vIAERQO/GvV9HYcLgF3sZ9T6X6yvVUt5TKWaQ2wNKQb3KNTpnBzrK74gkUaDj1HUt/DeVk42L80boycKZq2/jkHb4U6ThRXof7NJzgpHMgtMbCwAsN68fY4iIIN1046TIGHwy0sJaYrRDVzpWFLRS+hc68g5MWbhtiUFGGVjjMkUbSwegorB6hRxEyMYjn1bhLuUhiMVJkF552Y4Dwu7D1zRd4qk6ZL3nlEOCNsLTo+HIFCP0XUodaWdx2WJKZlpUpjzN7JF3MXqY0/xEgLNlL/SLSB1tod1PWfKfF7WDYluZJNCPv3V4296vcpG/VNBVew6ODRFT1WTQhVPenJLHuxZrOTg3sbGMXrsY8LhJjQtVTY4ijvRk= bird-rtr-client
		`@ -1 +0,0 @@`
			ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9MkggFr9ic5Ply9tPzsldgut9WAb0bgdDomFtBezDC4rzi/8vWUhzZv+lezWnyKYnMPHe80FEZ8+5QrNjS2GV6KMDxQZN7Wr4Lzh+eQv3hcT+TG6CUa7KjXvuq8P6UYGW9LCn8d36YGmxXkbEtUJlmA2dRemx6xlrpXavCaXLgTph+3eoe2mWTMukwHjzuu4PXhElfCFGZnTMXAkjimCfrH+11YMb1NpMosm/8H8aYZZGAkGPljKAjOLPwAXgn77hoIlRKlslesCmTBJCnmyp/0raIXAW3nkuMnkW9ORdt1Ti7yXsRv+flFBhFh7hM9SfqgbMAkDem1TugDTFTBRkiesh2Y+sQbgk0YO2T5PF+NVLZuuTssog3JyMbRYADZGjzdnvVSG4ICR+1fVehelOnMo1tgSsk3M8WkM5wgfn5HATYcBXaiHo97Q0CHzGKI4KrOqvTc4Bb/uh0VQIecpQajGuZqsWDlxkwk1hd1/s84Qo6kk/iZWKk+S+8uXlHRc= xuxiuting@LAPTOP-A2IH6TNR
		`@ -1 +0,0 @@`
			ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0= xuxiuting@LAPTOP-A2IH6TNR
		`@ -1,2 +0,0 @@`
			host.docker.internal ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0=
			[host.docker.internal]:22 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0=
		`@ -1 +0,0 @@`
			`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSj2JT9F+tcY/IA/qQda0zzC5B768tkm4JwwBHI/dtn xuxiuting@LAPTOP-A2IH6TNR`
		`@ -1 +0,0 @@`
			`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADxGbVl4d3SirJFLBUz7CnzNZMWCDc9iL8BmxjIYGpN xuxiuting@LAPTOP-A2IH6TNR`