优化部署

2026-05-12 15:23:09 +08:00
parent a4d674190a
commit 4c6b441753
18 changed files with 273 additions and 69 deletions
--- a/deploy/client/.env
+++ b/deploy/client/.env
@@ -0,0 +1,17 @@
+# Target RTR server address for client compose files
+# TCP example: 10.0.0.12:323
+# TLS example: rpki.example.com:324
+# SSH example: 10.0.0.12:22
+RPKI_RTR_SERVER_ADDR=rpki-rtr-tcp:323
+
+# TLS server name used by --server-name in TLS mode
+# Must match server certificate SAN dNSName.
+RPKI_RTR_TLS_SERVER_NAME=localhost
+
+# SSH mode examples:
+# RPKI_RTR_SERVER_ADDR=10.0.0.12:2222
+# RPKI_RTR_CLIENT_KEYS_VOLUME=../../certs:/app/certs:ro
+# RPKI_RTR_CLIENT_KEY_PATH=/app/certs/rtr-client.key
+# RPKI_RTR_SSH_SERVER_PUBKEY_PATH=/app/certs/ssh_host_rsa_key.pub
+# RPKI_RTR_SSH_USERNAME=rpki-rtr
+# RPKI_RTR_SSH_PASSWORD=your-password
--- a/deploy/client/docker-compose.clients.yml
+++ b/deploy/client/docker-compose.clients.yml
@@ -3,7 +3,7 @@ version: "3.9"
 services:
  rtr-client-1:
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
@@ -12,7 +12,7 @@ services:

  rtr-client-2:
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
@@ -21,7 +21,7 @@ services:

  rtr-client-3:
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
@@ -30,7 +30,7 @@ services:

  rtr-client-4:
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
@@ -39,7 +39,7 @@ services:

  rtr-client-5:
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
--- a/deploy/client/docker-compose.ssh.password.yml
+++ b/deploy/client/docker-compose.ssh.password.yml
@@ -0,0 +1,36 @@
+version: "3.9"
+
+services:
+  rtr-debug-client:
+    build:
+      context: ../..
+      dockerfile: deploy/client/Dockerfile
+    image: rpki-rtr-debug-client:latest
+    command:
+      [
+        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
+        "2",
+        "reset",
+        "--ssh",
+        "--ssh-user",
+        "${RPKI_RTR_SSH_USERNAME:-rpki-rtr}",
+        "--ssh-password",
+        "${RPKI_RTR_SSH_PASSWORD}",
+        "--ssh-server-key",
+        "${RPKI_RTR_SSH_SERVER_PUBKEY_PATH:-/app/certs/ssh_host_rsa_key.pub}",
+        "--keep-after-error",
+        "--summary-only"
+      ]
+    volumes:
+      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro}
+      - ../../logs/client:/app/logs
+    restart: no
+    stdin_open: true
+    tty: true
+    networks:
+      - rpki_net
+
+networks:
+  rpki_net:
+    name: rpki_net
+    driver: bridge
--- a/deploy/client/docker-compose.ssh.yml
+++ b/deploy/client/docker-compose.ssh.yml
@@ -8,21 +8,21 @@ services:
    image: rpki-rtr-debug-client:latest
    command:
      [
-        "rpki-rtr-ssh:${RPKI_RTR_SSH_PORT:-22}",
+        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
        "2",
        "reset",
        "--ssh",
        "--ssh-user",
-        "rpki-rtr",
+        "${RPKI_RTR_SSH_USERNAME:-rpki-rtr}",
        "--ssh-key",
-        "/app/certs/rtr-client.key",
+        "${RPKI_RTR_CLIENT_KEY_PATH:-/app/certs/rtr-client.key}",
        "--ssh-server-key",
-        "/app/certs/ssh_host_rsa_key.pub",
+        "${RPKI_RTR_SSH_SERVER_PUBKEY_PATH:-/app/certs/ssh_host_rsa_key.pub}",
        "--keep-after-error",
        "--summary-only"
      ]
    volumes:
-      - ../../certs:/app/certs:ro
+      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro}
      - ../../logs/client:/app/logs
    restart: no
    stdin_open: true
--- a/deploy/client/docker-compose.tcp.yml
+++ b/deploy/client/docker-compose.tcp.yml
@@ -4,7 +4,7 @@ services:
      context: ../..
      dockerfile: deploy/client/Dockerfile
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
--- a/deploy/client/docker-compose.tls.yml
+++ b/deploy/client/docker-compose.tls.yml
@@ -8,14 +8,14 @@ services:
    image: rpki-rtr-debug-client:latest
    command:
      [
-        "rpki-rtr-tls:324",
+        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tls:324}",
        "2",
        "reset",
        "--tls",
        "--ca-cert",
        "/app/certs/client-ca.crt",
        "--server-name",
-        "localhost",
+        "${RPKI_RTR_TLS_SERVER_NAME:-localhost}",
        "--client-cert",
        "/app/certs/client-good.crt",
        "--client-key",
--- a/deploy/client/docker-compose.yml
+++ b/deploy/client/docker-compose.yml
@@ -4,7 +4,7 @@ services:
      context: ../..
      dockerfile: deploy/client/Dockerfile
    image: rpki-rtr-debug-client:latest
-    command: ["rpki-rtr-tcp:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "2", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ../../logs/client:/app/logs
    restart: no
--- a/deploy/server/Dockerfile
+++ b/deploy/server/Dockerfile
@@ -32,7 +32,7 @@ RUN apt-get update \
 COPY Cargo.toml Cargo.lock ./
 COPY src ./src

-RUN cargo build --release --bin rpki
+RUN cargo build --release --bin rpki_rtr

 FROM debian:bookworm-slim AS runtime

@@ -60,7 +60,7 @@ RUN apt-get update \

 WORKDIR /app

-COPY --from=builder /build/target/release/rpki /usr/local/bin/rpki
+COPY --from=builder /build/target/release/rpki_rtr /usr/local/bin/rpki_rtr
 COPY --chmod=755 deploy/server/entrypoint.sh /usr/local/bin/rpki-rtr-entrypoint.sh

 RUN mkdir -p /app/data /app/rtr-db /app/certs /app/slurm /app/logs
--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -10,16 +10,18 @@ services:
    restart: no
    ports:
      - "323:323"
-      - "${RPKI_RTR_SSH_HOST_PORT:-2222}:22"
+      - "${RPKI_RTR_SSH_HOST_PORT:-2222}:${RPKI_RTR_SSH_CONTAINER_PORT:-22}"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "true"
      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
-      RPKI_RTR_SSH_ADDR: "0.0.0.0:22"
-      RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_rsa_key"
-      RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
-      RPKI_RTR_SSH_USERNAME: "rpki-rtr"
-      RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
+      RPKI_RTR_SSH_ADDR: "0.0.0.0:${RPKI_RTR_SSH_CONTAINER_PORT:-22}"
+      RPKI_RTR_SSH_HOST_KEY_PATH: "${RPKI_RTR_SSH_HOST_KEY_PATH:-/host-ssh/ssh_host_ed25519_key}"
+      RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "${RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH:-/app/certs/rtr-authorized_keys}"
+      RPKI_RTR_SSH_USERNAME: "${RPKI_RTR_SSH_USERNAME:-rpki-rtr}"
+      RPKI_RTR_SSH_SUBSYSTEM_NAME: "${RPKI_RTR_SSH_SUBSYSTEM_NAME:-rpki-rtr}"
+      # SSH auth mode: key | password | both
+      RPKI_RTR_SSH_AUTH_MODE: "${RPKI_RTR_SSH_AUTH_MODE:-key}"
      # Optional: enable password authentication in addition to publickey
      # RPKI_RTR_SSH_PASSWORD: "test-password"
      RPKI_RTR_DB_PATH: "/app/rtr-db"
@@ -33,6 +35,7 @@ services:
      - ../../data:/app/data:ro
      - ../../rtr-db:/app/rtr-db
      - ../../data:/app/slurm:ro
+      - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro}
      - ../../certs:/app/certs:ro
      - ../../logs/server:/app/logs
    networks:
--- a/deploy/server/entrypoint.sh
+++ b/deploy/server/entrypoint.sh
@@ -7,4 +7,4 @@ log_name="${HOSTNAME:-rpki-rtr}"
 stdout_log="/app/logs/${log_name}.stdout.log"
 stderr_log="/app/logs/${log_name}.stderr.log"

-exec /usr/local/bin/rpki "$@" >>"$stdout_log" 2>>"$stderr_log"
+exec /usr/local/bin/rpki_rtr "$@" >>"$stdout_log" 2>>"$stderr_log"