增加ssh

增加deploy下细分的tcp、tls、ssh
2026-04-22 16:02:42 +08:00
parent 99250f8aa9
commit b60d579a38
37 changed files with 2951 additions and 636 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -166,3 +166,43 @@ docker compose -f deploy/frr/docker-compose.yml down
 ```bash
 docker compose -f deploy/frr/docker-compose.yml logs -f frr-rpki-client
 ```
+
+---
+
+## 5) BIRD Client
+
+路径:
+- `deploy/bird/Dockerfile`
+- `deploy/bird/docker-compose.yml`
+- `deploy/bird/docker-compose.tls.yml`
+- `deploy/bird/bird.conf.example`
+- `deploy/bird/bird.conf.tls.example`
+- `deploy/bird/README.md`
+- `deploy/bird/README.zh.md`
+
+启动:
+```bash
+docker compose -f deploy/bird/docker-compose.yml up --build
+```
+
+观察活动:
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+停止:
+```bash
+docker compose -f deploy/bird/docker-compose.yml down
+```
+
+日志:
+```bash
+docker compose -f deploy/bird/docker-compose.yml logs -f bird-rpki-client
+```
+
+TLS/mTLS:
+```bash
+docker compose -f deploy/bird/docker-compose.yml -f deploy/bird/docker-compose.tls.yml up --build
+docker logs -f bird-rpki-client
+```
--- a/deploy/bird/Dockerfile
+++ b/deploy/bird/Dockerfile
@@ -0,0 +1,10 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bird2 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]
--- a/deploy/bird/README.md
+++ b/deploy/bird/README.md
@@ -0,0 +1,75 @@
+# BIRD Minimal RTR Client Config
+
+This folder provides a minimal BIRD setup for black-box interop testing
+against this repository's RTR server defaults.
+
+Server defaults in this repo:
+- TCP: `0.0.0.0:323`
+- TLS: `0.0.0.0:324`
+
+## Files
+
+- `Dockerfile`: builds a minimal BIRD2 runtime image.
+- `bird.conf.example`: sample `/etc/bird/bird.conf`.
+- `bird.conf.tls.example`: sample TLS/mTLS `/etc/bird/bird.conf`.
+- `entrypoint.sh`: starts BIRD in foreground mode.
+- `docker-compose.yml`: one-click local TCP test client.
+- `docker-compose.tls.yml`: compose override for TLS/mTLS.
+
+By default, the container prints periodic RPKI protocol snapshots to logs
+every 5 seconds.
+
+## Docker quick start
+
+From repository root:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up --build
+```
+
+Use another terminal to inspect:
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+If protocol state is `up`, the RTR client path is working.
+
+Detached mode:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up -d --build
+docker logs -f bird-rpki-client
+```
+
+Stop:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml down
+```
+
+## TLS/mTLS quick start
+
+```bash
+docker compose \
+  -f deploy/bird/docker-compose.yml \
+  -f deploy/bird/docker-compose.tls.yml \
+  up --build
+```
+
+In detached mode, observe with:
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+## Notes
+
+- This setup targets RTR over TCP (`remote "127.0.0.1" port 323`).
+- `network_mode: host` expects your RTR server to be reachable at
+  `127.0.0.1:323` from the Docker host.
+- TLS override mounts `../../certs` into `/etc/bird/certs`.
+- Observation is controlled by env vars:
+  `OBSERVE_INTERVAL` (seconds, default `5`) and `OBSERVE_PROTO`.
+- If your environment does not support Docker host networking, switch to a
+  bridge network and replace `remote` addresses accordingly.
--- a/deploy/bird/README.zh.md
+++ b/deploy/bird/README.zh.md
@@ -0,0 +1,63 @@
+# BIRD 最小化 RTR 客户端配置
+
+本目录提供一个最小化 BIRD 配置，用于和本仓库 RTR Server 做黑盒互通测试。
+
+本仓库默认 RTR 监听地址：
+- TCP: `0.0.0.0:323`
+- TLS: `0.0.0.0:324`
+
+## 文件说明
+
+- `Dockerfile`: 构建最小 BIRD2 运行镜像。
+- `bird.conf.example`: `/etc/bird/bird.conf` 的 TCP 示例。
+- `bird.conf.tls.example`: `/etc/bird/bird.conf` 的 TLS/mTLS 示例。
+- `entrypoint.sh`: 前台启动 BIRD。
+- `docker-compose.yml`: TCP 一键启动。
+- `docker-compose.tls.yml`: TLS/mTLS 覆盖文件。
+
+容器默认每 5 秒向日志输出一次 RPKI 协议状态快照。
+
+## Docker 快速启动（TCP）
+
+在仓库根目录执行：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up --build
+```
+
+另开一个终端查看日志：
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+如果协议状态显示 `up`，说明 RTR 客户端链路正常。
+
+后台模式：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up -d --build
+docker logs -f bird-rpki-client
+```
+
+停止：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml down
+```
+
+## TLS/mTLS 快速启动
+
+```bash
+docker compose \
+  -f deploy/bird/docker-compose.yml \
+  -f deploy/bird/docker-compose.tls.yml \
+  up --build
+```
+
+## 说明
+
+- 当前 compose 使用 `network_mode: host`，要求容器可通过 `127.0.0.1` 访问宿主机 RTR Server。
+- TLS 覆盖文件会把 `../../certs` 挂载到容器内 `/etc/bird/certs`。
+- 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `5`）和 `OBSERVE_PROTO`。
+- 若你运行在 Docker Desktop（非 Linux 原生 host network 场景），建议改为自定义 bridge 网络并把 `remote` 地址改成可达的 server 容器名或宿主地址。
--- a/deploy/bird/bird.conf.example
+++ b/deploy/bird/bird.conf.example
@@ -0,0 +1,15 @@
+log stderr all;
+router id 192.0.2.2;
+
+roa4 table rtr_roa_v4;
+roa6 table rtr_roa_v6;
+
+protocol device {
+}
+
+protocol rpki rpki_tcp {
+  roa4 { table rtr_roa_v4; };
+  roa6 { table rtr_roa_v6; };
+
+  remote "127.0.0.1" port 323;
+}
--- a/deploy/bird/bird.conf.tls.example
+++ b/deploy/bird/bird.conf.tls.example
@@ -0,0 +1,21 @@
+log stderr all;
+router id 192.0.2.2;
+
+roa4 table rtr_roa_v4;
+roa6 table rtr_roa_v6;
+
+protocol device {
+}
+
+protocol rpki rpki_tls {
+  roa4 { table rtr_roa_v4; };
+  roa6 { table rtr_roa_v6; };
+
+  remote "127.0.0.1" port 324;
+
+  transport tls {
+    ca file "/etc/bird/certs/client-ca.crt";
+    cert file "/etc/bird/certs/client-good.crt";
+    key file "/etc/bird/certs/client-good.key";
+  };
+}
--- a/deploy/bird/docker-compose.tls.yml
+++ b/deploy/bird/docker-compose.tls.yml
@@ -0,0 +1,7 @@
+services:
+  bird-rpki-client:
+    environment:
+      OBSERVE_PROTO: rpki_tls
+    volumes:
+      - ./bird.conf.tls.example:/etc/bird/bird.conf:ro
+      - ../../certs:/etc/bird/certs:ro
--- a/deploy/bird/docker-compose.yml
+++ b/deploy/bird/docker-compose.yml
@@ -0,0 +1,13 @@
+services:
+  bird-rpki-client:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: bird-rpki-client
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      OBSERVE_INTERVAL: "5"
+      OBSERVE_PROTO: rpki_tcp
+    volumes:
+      - ./bird.conf.example:/etc/bird/bird.conf:ro
--- a/deploy/bird/entrypoint.sh
+++ b/deploy/bird/entrypoint.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /run/bird
+
+SOCK_PATH="/run/bird/bird.ctl"
+PROTO="${OBSERVE_PROTO:-rpki_tcp}"
+INTERVAL="${OBSERVE_INTERVAL:-5}"
+
+bird -f -c /etc/bird/bird.conf -s "$SOCK_PATH" &
+BIRD_PID="$!"
+
+sleep 1
+
+case "$INTERVAL" in
+  ''|*[!0-9]*)
+    INTERVAL=0
+    ;;
+esac
+
+if [ "$INTERVAL" -gt 0 ]; then
+  while kill -0 "$BIRD_PID" 2>/dev/null; do
+    echo "==== $(date -u +"%Y-%m-%dT%H:%M:%SZ") RPKI snapshot ($PROTO) ===="
+    birdc -s "$SOCK_PATH" show protocols all "$PROTO" || true
+    birdc -s "$SOCK_PATH" show roa count || true
+    sleep "$INTERVAL"
+  done
+fi
+
+wait "$BIRD_PID"
--- a/deploy/client/Dockerfile
+++ b/deploy/client/Dockerfile
@@ -20,5 +20,8 @@ RUN apt-get update \
 WORKDIR /app

 COPY --from=builder /build/target/release/rtr_debug_client /usr/local/bin/rtr_debug_client
+COPY deploy/client/entrypoint.sh /usr/local/bin/rtr-debug-client-entrypoint.sh

-ENTRYPOINT ["/usr/local/bin/rtr_debug_client"]
+RUN chmod +x /usr/local/bin/rtr-debug-client-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/rtr-debug-client-entrypoint.sh"]
--- a/deploy/client/docker-compose.clients.yml
+++ b/deploy/client/docker-compose.clients.yml
@@ -5,28 +5,38 @@ services:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped

  rtr-client-2:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped

  rtr-client-3:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped

  rtr-client-4:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped

  rtr-client-5:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped
--- a/deploy/client/docker-compose.ssh.yml
+++ b/deploy/client/docker-compose.ssh.yml
@@ -0,0 +1,30 @@
+version: "3.9"
+
+services:
+  rtr-debug-client:
+    build:
+      context: ../..
+      dockerfile: deploy/client/Dockerfile
+    image: rpki-rtr-debug-client:latest
+    network_mode: host
+    command:
+      [
+        "127.0.0.1:${RPKI_RTR_SSH_PORT:-22}",
+        "2",
+        "reset",
+        "--ssh",
+        "--ssh-user",
+        "rpki-rtr",
+        "--ssh-key",
+        "/app/certs/rtr-client.key",
+        "--ssh-server-key",
+        "/app/certs/ssh_host_rsa_key.pub",
+        "--keep-after-error",
+        "--summary-only"
+      ]
+    volumes:
+      - ../../certs:/app/certs:ro
+      - ../../logs/client:/app/logs
+    restart: unless-stopped
+    stdin_open: true
+    tty: true
--- a/deploy/client/docker-compose.tcp.yml
+++ b/deploy/client/docker-compose.tcp.yml
@@ -0,0 +1,13 @@
+services:
+  rtr-debug-client:
+    build:
+      context: ../..
+      dockerfile: deploy/client/Dockerfile
+    image: rpki-rtr-debug-client:latest
+    network_mode: host
+    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
+    restart: no
+    stdin_open: true
+    tty: true
--- a/deploy/client/docker-compose.tls.yml
+++ b/deploy/client/docker-compose.tls.yml
@@ -0,0 +1,32 @@
+version: "3.9"
+
+services:
+  rtr-debug-client:
+    build:
+      context: ../..
+      dockerfile: deploy/client/Dockerfile
+    image: rpki-rtr-debug-client:latest
+    network_mode: host
+    command:
+      [
+        "127.0.0.1:324",
+        "2",
+        "reset",
+        "--tls",
+        "--ca-cert",
+        "/app/certs/client-ca.crt",
+        "--server-name",
+        "localhost",
+        "--client-cert",
+        "/app/certs/client-good.crt",
+        "--client-key",
+        "/app/certs/client-good.key",
+        "--keep-after-error",
+        "--summary-only"
+      ]
+    volumes:
+      - ../../tests/fixtures/tls:/app/certs:ro
+      - ../../logs/client:/app/logs
+    restart: unless-stopped
+    stdin_open: true
+    tty: true
--- a/deploy/client/docker-compose.yml
+++ b/deploy/client/docker-compose.yml
@@ -6,6 +6,8 @@ services:
    image: rpki-rtr-debug-client:latest
    network_mode: host
    command: ["127.0.0.1:323", "2", "reset", "--keep-after-error", "--summary-only"]
+    volumes:
+      - ../../logs/client:/app/logs
    restart: unless-stopped
    stdin_open: true
    tty: true
--- a/deploy/client/entrypoint.sh
+++ b/deploy/client/entrypoint.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /app/logs
+
+log_name="${HOSTNAME:-rtr-debug-client}"
+stdout_log="/app/logs/${log_name}.stdout.log"
+stderr_log="/app/logs/${log_name}.stderr.log"
+
+exec /usr/local/bin/rtr_debug_client "$@" >>"$stdout_log" 2>>"$stderr_log"
--- a/deploy/server/Dockerfile
+++ b/deploy/server/Dockerfile
@@ -2,8 +2,25 @@ FROM rust:1.89-bookworm AS builder

 WORKDIR /build

+RUN set -eux; \
+    cat > /etc/apt/sources.list.d/debian.sources <<'EOF'
+Types: deb
+URIs: http://mirrors.tuna.tsinghua.edu.cn/debian
+Suites: bookworm bookworm-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: http://mirrors.tuna.tsinghua.edu.cn/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
+
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
+    && apt-get install -y --fix-missing --no-install-recommends \
+        -o Acquire::Retries=10 \
+        -o Acquire::http::Timeout=60 \
        build-essential \
        cmake \
        pkg-config \
@@ -19,8 +36,27 @@ RUN cargo build --release --bin rpki

 FROM debian:bookworm-slim AS runtime

+RUN set -eux; \
+    cat > /etc/apt/sources.list.d/debian.sources <<'EOF'
+Types: deb
+URIs: http://mirrors.tuna.tsinghua.edu.cn/debian
+Suites: bookworm bookworm-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: http://mirrors.tuna.tsinghua.edu.cn/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
+
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates supervisor \
+    && apt-get install -y --fix-missing --no-install-recommends \
+        -o Acquire::Retries=10 \
+        -o Acquire::http::Timeout=60 \
+        ca-certificates \
+        supervisor \
    && rm -rf /var/lib/apt/lists/*

 WORKDIR /app
@@ -28,7 +64,7 @@ WORKDIR /app
 COPY --from=builder /build/target/release/rpki /usr/local/bin/rpki
 COPY deploy/server/supervisord.conf /etc/supervisor/conf.d/rpki-rtr.conf

-RUN mkdir -p /app/data /app/rtr-db /app/certs /app/slurm /var/log/supervisor
+RUN mkdir -p /app/data /app/rtr-db /app/certs /app/slurm /app/logs /var/log/supervisor

 ENV RPKI_RTR_ENABLE_TLS=false \
    RPKI_RTR_TCP_ADDR=0.0.0.0:323 \
@@ -41,4 +77,4 @@ ENV RPKI_RTR_ENABLE_TLS=false \

 EXPOSE 323 324

-CMD ["supervisord", "-n", "-c", "/etc/supervisor/conf.d/rpki-rtr.conf"]
+CMD ["supervisord", "-n", "-c", "/etc/supervisor/conf.d/rpki-rtr.conf"]
--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -0,0 +1,35 @@
+version: "3.9"
+
+services:
+  rpki-rtr:
+    build:
+      context: ../..
+      dockerfile: deploy/server/Dockerfile
+    image: rpki-rtr:latest
+    container_name: rpki-rtr-ssh
+    restart: unless-stopped
+    ports:
+      - "323:323"
+      - "${RPKI_RTR_SSH_PORT:-22}:${RPKI_RTR_SSH_PORT:-22}"
+    environment:
+      RPKI_RTR_ENABLE_TLS: "false"
+      RPKI_RTR_ENABLE_SSH: "true"
+      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
+      RPKI_RTR_SSH_ADDR: "0.0.0.0:${RPKI_RTR_SSH_PORT:-22}"
+      RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_rsa_key"
+      RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
+      RPKI_RTR_SSH_USERNAME: "rpki-rtr"
+      RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
+      # Optional: enable password authentication in addition to publickey
+      # RPKI_RTR_SSH_PASSWORD: "test-password"
+      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_CCR_DIR: "/app/data"
+      RPKI_RTR_SLURM_DIR: "/app/slurm"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+    volumes:
+      - ../../data:/app/data:ro
+      - ../../rtr-db:/app/rtr-db
+      - ../../data:/app/slurm:ro
+      - ../../certs:/app/certs:ro
+      - ../../logs/server:/app/logs
--- a/deploy/server/docker-compose.tcp.yml
+++ b/deploy/server/docker-compose.tcp.yml
@@ -0,0 +1,27 @@
+version: "3.9"
+
+services:
+  rpki-rtr:
+    build:
+      context: ../..
+      dockerfile: deploy/server/Dockerfile
+    image: rpki-rtr:latest
+    container_name: rpki-rtr-tcp
+    restart: unless-stopped
+    ports:
+      - "323:323"
+    environment:
+      RPKI_RTR_ENABLE_TLS: "false"
+      RPKI_RTR_ENABLE_SSH: "false"
+      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
+      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_CCR_DIR: "/app/data"
+      RPKI_RTR_SLURM_DIR: "/app/slurm"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+      RPKI_RTR_MAX_CONNECTIONS: "100000"
+    volumes:
+      - ../../data:/app/data:ro
+      - ../../rtr-db:/app/rtr-db
+      - ../../data:/app/slurm:ro
+      - ../../logs/server:/app/logs
--- a/deploy/server/docker-compose.tls.yml
+++ b/deploy/server/docker-compose.tls.yml
@@ -0,0 +1,32 @@
+version: "3.9"
+
+services:
+  rpki-rtr:
+    build:
+      context: ../..
+      dockerfile: deploy/server/Dockerfile
+    image: rpki-rtr:latest
+    container_name: rpki-rtr-tls
+    restart: unless-stopped
+    ports:
+      - "323:323"
+      - "324:324"
+    environment:
+      RPKI_RTR_ENABLE_TLS: "true"
+      RPKI_RTR_ENABLE_SSH: "false"
+      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
+      RPKI_RTR_TLS_ADDR: "0.0.0.0:324"
+      RPKI_RTR_TLS_CERT_PATH: "/app/certs/server-dns.crt"
+      RPKI_RTR_TLS_KEY_PATH: "/app/certs/server-dns.key"
+      RPKI_RTR_TLS_CLIENT_CA_PATH: "/app/certs/client-ca.crt"
+      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_CCR_DIR: "/app/data"
+      RPKI_RTR_SLURM_DIR: "/app/slurm"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+    volumes:
+      - ../../data:/app/data:ro
+      - ../../rtr-db:/app/rtr-db
+      - ../../data:/app/slurm:ro
+      - ../../tests/fixtures/tls:/app/certs:ro
+      - ../../logs/server:/app/logs
--- a/deploy/server/docker-compose.yml
+++ b/deploy/server/docker-compose.yml
@@ -11,6 +11,8 @@ services:
    ports:
      - "323:323"
      - "324:324"
+      # SSH mode example:
+      # - "22:22"
    environment:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
@@ -20,9 +22,21 @@ services:
      RPKI_RTR_SLURM_DIR: "/app/slurm"
      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+      RUST_LOG: "info"
+      # SSH mode example:
+      # RPKI_RTR_ENABLE_SSH: "true"
+      # RPKI_RTR_SSH_ADDR: "0.0.0.0:22"
+      # RPKI_RTR_SSH_PORT: "22"
+      # RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_ed25519_key"
+      # RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
+      # RPKI_RTR_SSH_USERNAME: "rpki-rtr"
+      # RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
+      # Optional: enable password auth in addition to publickey
+      # RPKI_RTR_SSH_PASSWORD: "test-password"
    volumes:
      - ../../data:/app/data:ro
      - ../../rtr-db:/app/rtr-db
      - ../../data:/app/slurm:ro
+      - ../../logs/server:/app/logs
      # TLS mode example:
      # - ../../certs:/app/certs:ro
--- a/deploy/server/supervisord.conf
+++ b/deploy/server/supervisord.conf
@@ -12,7 +12,9 @@ startretries=3
 stopsignal=TERM
 stopasgroup=true
 killasgroup=true
-stdout_logfile=/dev/fd/1
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/fd/2
-stderr_logfile_maxbytes=0
+stdout_logfile=/app/logs/rpki-rtr.stdout.log
+stdout_logfile_maxbytes=50MB
+stdout_logfile_backups=10
+stderr_logfile=/app/logs/rpki-rtr.stderr.log
+stderr_logfile_maxbytes=50MB
+stderr_logfile_backups=10