增加rtr一些必要的api接口

2026-06-23 17:04:00 +08:00
parent 303bdffd97
commit b105b3b7d0
41 changed files with 3078 additions and 1735 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -40,6 +40,30 @@ docker compose -f deploy/server/docker-compose.yml down
 docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr
 ```

+报告文件：
+
+- `report/rtr-source-*.json`：CCR/SLURM source、fingerprint、refresh 状态、数据质量、cache snapshot/delta 统计。
+- `report/rtr-clients-*.json`：client 连接数和连接方式统计，启动时和连接变化时写入。
+- `report/rtr-runtime-*.json`：进程 RSS、服务状态、当前生效 runtime configuration，启动时和周期性写入。
+
+Admin config 接口默认关闭。需要运行中动态修改 `max_delta`、delta 裁剪策略、refresh/report interval、timezone 或 RTR timing 时，设置：
+
+```env
+RPKI_RTR_ADMIN_ADDR=127.0.0.1:8323
+RPKI_RTR_ADMIN_TOKEN=change-me
+```
+
+调用示例：
+
+```bash
+curl -X POST http://127.0.0.1:8323/admin/rtr/config \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer change-me" \
+  -d '{"max_delta": 6, "prune_delta_by_snapshot_size": true}'
+```
+
+完整 API 说明见 `docs/rtr-admin-api.md`，更完整的 server 配置见 `deploy/server/DEPLOYMENT.md`。
+
 ---

 ## 2) Debug Client
--- a/deploy/rpki-rs-client/Dockerfile
+++ b/deploy/rpki-rs-client/Dockerfile
@@ -1,24 +0,0 @@
-FROM rust:1.89-bookworm AS builder
-
-WORKDIR /build
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends clang libclang-dev pkg-config \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY Cargo.toml Cargo.lock ./
-COPY src ./src
-
-RUN cargo build --release --bin rpki_rs_test_client
-
-FROM debian:bookworm-slim AS runtime
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-COPY --from=builder /build/target/release/rpki_rs_test_client /usr/local/bin/rpki_rs_test_client
-
-ENTRYPOINT ["/usr/local/bin/rpki_rs_test_client"]
--- a/deploy/rpki-rs-client/docker-compose.yml
+++ b/deploy/rpki-rs-client/docker-compose.yml
@@ -1,11 +0,0 @@
-services:
-  rpki-rs-test-client:
-    build:
-      context: ../..
-      dockerfile: deploy/rpki-rs-client/Dockerfile
-    image: rpki-rs-test-client:latest
-    container_name: rpki-rs-test-client
-    network_mode: host
-    command: ["127.0.0.1:323", "2", "serial", "--steps", "2", "--follow"]
-    stdin_open: true
-    tty: true
--- a/deploy/server/.env
+++ b/deploy/server/.env
@@ -24,6 +24,8 @@ RPKI_RTR_TIMEZONE=Asia/Shanghai
 RPKI_RTR_MAX_DELTA=10
 RPKI_RTR_MAX_CONNECTIONS=100000
 RPKI_RTR_MAX_CONCURRENT_HANDSHAKES=128
+RPKI_RTR_ADMIN_ADDR=0.0.0.0:8323
+RPKI_RTR_ADMIN_TOKEN=qwert
 RUST_LOG=info

 # TLS mode knobs.
--- a/deploy/server/DEPLOYMENT.md
+++ b/deploy/server/DEPLOYMENT.md
@@ -29,13 +29,13 @@ The container runs `rpki` directly as PID 1.
 - `RPKI_RTR_SLURM_DIR`: in-container SLURM directory path
 - `RPKI_RTR_DB_HOST_DIR`: host RocksDB directory
 - `RPKI_RTR_LOG_HOST_DIR`: host log directory
- `RPKI_RTR_REPORT_HOST_DIR`: host directory receiving `rtr-server.json`
+- `RPKI_RTR_REPORT_HOST_DIR`: host directory receiving split RTR JSON reports
 - `RPKI_RTR_DB_PATH`: in-container RocksDB directory
 - `RPKI_RTR_REPORT_DIR`: in-container report directory

 ## Runtime Configuration via `.env`

- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RUST_LOG`
+- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG`
 - TCP mode: `RPKI_RTR_MAX_CONNECTIONS`
 - TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR`
 - SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
@@ -58,6 +58,16 @@ docker compose -f deploy/server/docker-compose.yml down
 docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr
 ```

+The admin API can also stream the redirected log file:
+
+```bash
+curl -N "http://127.0.0.1:8323/admin/rtr/logs/tail?stream=stdout&lines=200" \
+  -H "Authorization: Bearer $RPKI_RTR_ADMIN_TOKEN"
+```
+
+It reads `/app/logs/${HOSTNAME}.stdout.log` or `.stderr.log` by default. Set
+`RPKI_RTR_LOG_DIR` and `RPKI_RTR_LOG_NAME` to override that lookup.
+
 ## Runtime Report

 The server writes split JSON reports. Each report file uses a local-time
@@ -78,3 +88,12 @@ Timestamps in logs and report JSON files use `RPKI_RTR_TIMEZONE`, which
 defaults to `Asia/Shanghai`. Use IANA timezone names such as `Asia/Shanghai`,
 `Europe/London`, `America/New_York`, or `UTC`; `Shanghai` is accepted as a
 convenience alias for `Asia/Shanghai`.
+
+## Runtime Admin Config
+
+The admin endpoint is disabled by default. Set `RPKI_RTR_ADMIN_ADDR` to enable
+`POST /admin/rtr/config`. If the address is not loopback, `RPKI_RTR_ADMIN_TOKEN`
+must also be set and requests must include `Authorization: Bearer <token>`.
+
+The endpoint accepts partial JSON updates. See `docs/rtr-admin-api.md` for the
+complete request/response schema, examples, and runtime apply semantics.
--- a/deploy/server/Dockerfile
+++ b/deploy/server/Dockerfile
@@ -75,7 +75,9 @@ ENV RPKI_RTR_ENABLE_TLS=false \
    RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300 \
    RPKI_RTR_REPORT_HISTORY_LIMIT=10 \
    RPKI_RTR_REFRESH_INTERVAL_SECS=300 \
-    RPKI_RTR_STRICT_CCR_VALIDATION=false
+    RPKI_RTR_STRICT_CCR_VALIDATION=false \
+    RPKI_RTR_ADMIN_ADDR="" \
+    RPKI_RTR_ADMIN_TOKEN=""

 EXPOSE 323 324

--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -11,6 +11,7 @@ services:
    ports:
      - "323:323"
      - "${RPKI_RTR_SSH_HOST_PORT:-2222}:${RPKI_RTR_SSH_CONTAINER_PORT:-22}"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "true"
@@ -35,11 +36,13 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro}
      - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs}:/app/certs:ro
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
--- a/deploy/server/docker-compose.tcp.yml
+++ b/deploy/server/docker-compose.tcp.yml
@@ -10,6 +10,7 @@ services:
    restart: no
    ports:
      - "323:323"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "false"
@@ -26,11 +27,13 @@ services:
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONNECTIONS: "${RPKI_RTR_MAX_CONNECTIONS:-100000}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
    networks:
--- a/deploy/server/docker-compose.tls.yml
+++ b/deploy/server/docker-compose.tls.yml
@@ -9,6 +9,7 @@ services:
    ports:
 #      - "323:323"
      - "324:324"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "true"
      RPKI_RTR_ENABLE_SSH: "false"
@@ -29,11 +30,13 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
--- a/deploy/server/docker-compose.yml
+++ b/deploy/server/docker-compose.yml
@@ -11,6 +11,7 @@ services:
    ports:
      - "323:323"
      - "324:324"
+      - "8323:8323"
      # SSH mode example:
      # - "22:22"
    environment:
@@ -28,6 +29,8 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
      # SSH mode example:
      # RPKI_RTR_ENABLE_SSH: "true"
@@ -42,7 +45,7 @@ services:
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
      # TLS mode example: