增加rtr一些必要的api接口

2026-06-23 17:04:00 +08:00
parent 303bdffd97
commit b105b3b7d0
41 changed files with 3078 additions and 1735 deletions
--- a/deploy/server/.env
+++ b/deploy/server/.env
@@ -24,6 +24,8 @@ RPKI_RTR_TIMEZONE=Asia/Shanghai
 RPKI_RTR_MAX_DELTA=10
 RPKI_RTR_MAX_CONNECTIONS=100000
 RPKI_RTR_MAX_CONCURRENT_HANDSHAKES=128
+RPKI_RTR_ADMIN_ADDR=0.0.0.0:8323
+RPKI_RTR_ADMIN_TOKEN=qwert
 RUST_LOG=info

 # TLS mode knobs.
--- a/deploy/server/DEPLOYMENT.md
+++ b/deploy/server/DEPLOYMENT.md
@@ -29,13 +29,13 @@ The container runs `rpki` directly as PID 1.
 - `RPKI_RTR_SLURM_DIR`: in-container SLURM directory path
 - `RPKI_RTR_DB_HOST_DIR`: host RocksDB directory
 - `RPKI_RTR_LOG_HOST_DIR`: host log directory
- `RPKI_RTR_REPORT_HOST_DIR`: host directory receiving `rtr-server.json`
+- `RPKI_RTR_REPORT_HOST_DIR`: host directory receiving split RTR JSON reports
 - `RPKI_RTR_DB_PATH`: in-container RocksDB directory
 - `RPKI_RTR_REPORT_DIR`: in-container report directory

 ## Runtime Configuration via `.env`

- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RUST_LOG`
+- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG`
 - TCP mode: `RPKI_RTR_MAX_CONNECTIONS`
 - TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR`
 - SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
@@ -58,6 +58,16 @@ docker compose -f deploy/server/docker-compose.yml down
 docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr
 ```

+The admin API can also stream the redirected log file:
+
+```bash
+curl -N "http://127.0.0.1:8323/admin/rtr/logs/tail?stream=stdout&lines=200" \
+  -H "Authorization: Bearer $RPKI_RTR_ADMIN_TOKEN"
+```
+
+It reads `/app/logs/${HOSTNAME}.stdout.log` or `.stderr.log` by default. Set
+`RPKI_RTR_LOG_DIR` and `RPKI_RTR_LOG_NAME` to override that lookup.
+
 ## Runtime Report

 The server writes split JSON reports. Each report file uses a local-time
@@ -78,3 +88,12 @@ Timestamps in logs and report JSON files use `RPKI_RTR_TIMEZONE`, which
 defaults to `Asia/Shanghai`. Use IANA timezone names such as `Asia/Shanghai`,
 `Europe/London`, `America/New_York`, or `UTC`; `Shanghai` is accepted as a
 convenience alias for `Asia/Shanghai`.
+
+## Runtime Admin Config
+
+The admin endpoint is disabled by default. Set `RPKI_RTR_ADMIN_ADDR` to enable
+`POST /admin/rtr/config`. If the address is not loopback, `RPKI_RTR_ADMIN_TOKEN`
+must also be set and requests must include `Authorization: Bearer <token>`.
+
+The endpoint accepts partial JSON updates. See `docs/rtr-admin-api.md` for the
+complete request/response schema, examples, and runtime apply semantics.
--- a/deploy/server/Dockerfile
+++ b/deploy/server/Dockerfile
@@ -75,7 +75,9 @@ ENV RPKI_RTR_ENABLE_TLS=false \
    RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300 \
    RPKI_RTR_REPORT_HISTORY_LIMIT=10 \
    RPKI_RTR_REFRESH_INTERVAL_SECS=300 \
-    RPKI_RTR_STRICT_CCR_VALIDATION=false
+    RPKI_RTR_STRICT_CCR_VALIDATION=false \
+    RPKI_RTR_ADMIN_ADDR="" \
+    RPKI_RTR_ADMIN_TOKEN=""

 EXPOSE 323 324

--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -11,6 +11,7 @@ services:
    ports:
      - "323:323"
      - "${RPKI_RTR_SSH_HOST_PORT:-2222}:${RPKI_RTR_SSH_CONTAINER_PORT:-22}"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "true"
@@ -35,11 +36,13 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro}
      - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs}:/app/certs:ro
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
--- a/deploy/server/docker-compose.tcp.yml
+++ b/deploy/server/docker-compose.tcp.yml
@@ -10,6 +10,7 @@ services:
    restart: no
    ports:
      - "323:323"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "false"
@@ -26,11 +27,13 @@ services:
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONNECTIONS: "${RPKI_RTR_MAX_CONNECTIONS:-100000}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
    networks:
--- a/deploy/server/docker-compose.tls.yml
+++ b/deploy/server/docker-compose.tls.yml
@@ -9,6 +9,7 @@ services:
    ports:
 #      - "323:323"
      - "324:324"
+      - "8323:8323"
    environment:
      RPKI_RTR_ENABLE_TLS: "true"
      RPKI_RTR_ENABLE_SSH: "false"
@@ -29,11 +30,13 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
--- a/deploy/server/docker-compose.yml
+++ b/deploy/server/docker-compose.yml
@@ -11,6 +11,7 @@ services:
    ports:
      - "323:323"
      - "324:324"
+      - "8323:8323"
      # SSH mode example:
      # - "22:22"
    environment:
@@ -28,6 +29,8 @@ services:
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RPKI_RTR_ADMIN_ADDR: "${RPKI_RTR_ADMIN_ADDR:-}"
+      RPKI_RTR_ADMIN_TOKEN: "${RPKI_RTR_ADMIN_TOKEN:-}"
      RUST_LOG: "${RUST_LOG:-info}"
      # SSH mode example:
      # RPKI_RTR_ENABLE_SSH: "true"
@@ -42,7 +45,7 @@ services:
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
-      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
      # TLS mode example: