增加ssh

增加deploy下细分的tcp、tls、ssh

deploy/bird/Dockerfile

@@ -0,0 +1,10 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bird2 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]

deploy/bird/README.md

@@ -0,0 +1,75 @@
+# BIRD Minimal RTR Client Config
+
+This folder provides a minimal BIRD setup for black-box interop testing
+against this repository's RTR server defaults.
+
+Server defaults in this repo:
+- TCP: `0.0.0.0:323`
+- TLS: `0.0.0.0:324`
+
+## Files
+
+- `Dockerfile`: builds a minimal BIRD2 runtime image.
+- `bird.conf.example`: sample `/etc/bird/bird.conf`.
+- `bird.conf.tls.example`: sample TLS/mTLS `/etc/bird/bird.conf`.
+- `entrypoint.sh`: starts BIRD in foreground mode.
+- `docker-compose.yml`: one-click local TCP test client.
+- `docker-compose.tls.yml`: compose override for TLS/mTLS.
+
+By default, the container prints periodic RPKI protocol snapshots to logs
+every 5 seconds.
+
+## Docker quick start
+
+From repository root:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up --build
+```
+
+Use another terminal to inspect:
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+If protocol state is `up`, the RTR client path is working.
+
+Detached mode:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up -d --build
+docker logs -f bird-rpki-client
+```
+
+Stop:
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml down
+```
+
+## TLS/mTLS quick start
+
+```bash
+docker compose \
+  -f deploy/bird/docker-compose.yml \
+  -f deploy/bird/docker-compose.tls.yml \
+  up --build
+```
+
+In detached mode, observe with:
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+## Notes
+
+- This setup targets RTR over TCP (`remote "127.0.0.1" port 323`).
+- `network_mode: host` expects your RTR server to be reachable at
+  `127.0.0.1:323` from the Docker host.
+- TLS override mounts `../../certs` into `/etc/bird/certs`.
+- Observation is controlled by env vars:
+  `OBSERVE_INTERVAL` (seconds, default `5`) and `OBSERVE_PROTO`.
+- If your environment does not support Docker host networking, switch to a
+  bridge network and replace `remote` addresses accordingly.

deploy/bird/README.zh.md

@@ -0,0 +1,63 @@
+# BIRD 最小化 RTR 客户端配置
+
+本目录提供一个最小化 BIRD 配置，用于和本仓库 RTR Server 做黑盒互通测试。
+
+本仓库默认 RTR 监听地址：
+- TCP: `0.0.0.0:323`
+- TLS: `0.0.0.0:324`
+
+## 文件说明
+
+- `Dockerfile`: 构建最小 BIRD2 运行镜像。
+- `bird.conf.example`: `/etc/bird/bird.conf` 的 TCP 示例。
+- `bird.conf.tls.example`: `/etc/bird/bird.conf` 的 TLS/mTLS 示例。
+- `entrypoint.sh`: 前台启动 BIRD。
+- `docker-compose.yml`: TCP 一键启动。
+- `docker-compose.tls.yml`: TLS/mTLS 覆盖文件。
+
+容器默认每 5 秒向日志输出一次 RPKI 协议状态快照。
+
+## Docker 快速启动（TCP）
+
+在仓库根目录执行：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up --build
+```
+
+另开一个终端查看日志：
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+如果协议状态显示 `up`，说明 RTR 客户端链路正常。
+
+后台模式：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml up -d --build
+docker logs -f bird-rpki-client
+```
+
+停止：
+
+```bash
+docker compose -f deploy/bird/docker-compose.yml down
+```
+
+## TLS/mTLS 快速启动
+
+```bash
+docker compose \
+  -f deploy/bird/docker-compose.yml \
+  -f deploy/bird/docker-compose.tls.yml \
+  up --build
+```
+
+## 说明
+
+- 当前 compose 使用 `network_mode: host`，要求容器可通过 `127.0.0.1` 访问宿主机 RTR Server。
+- TLS 覆盖文件会把 `../../certs` 挂载到容器内 `/etc/bird/certs`。
+- 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `5`）和 `OBSERVE_PROTO`。
+- 若你运行在 Docker Desktop（非 Linux 原生 host network 场景），建议改为自定义 bridge 网络并把 `remote` 地址改成可达的 server 容器名或宿主地址。

deploy/bird/bird.conf.example

@@ -0,0 +1,15 @@
+log stderr all;
+router id 192.0.2.2;
+
+roa4 table rtr_roa_v4;
+roa6 table rtr_roa_v6;
+
+protocol device {
+}
+
+protocol rpki rpki_tcp {
+  roa4 { table rtr_roa_v4; };
+  roa6 { table rtr_roa_v6; };
+
+  remote "127.0.0.1" port 323;
+}

deploy/bird/bird.conf.tls.example

@@ -0,0 +1,21 @@
+log stderr all;
+router id 192.0.2.2;
+
+roa4 table rtr_roa_v4;
+roa6 table rtr_roa_v6;
+
+protocol device {
+}
+
+protocol rpki rpki_tls {
+  roa4 { table rtr_roa_v4; };
+  roa6 { table rtr_roa_v6; };
+
+  remote "127.0.0.1" port 324;
+
+  transport tls {
+    ca file "/etc/bird/certs/client-ca.crt";
+    cert file "/etc/bird/certs/client-good.crt";
+    key file "/etc/bird/certs/client-good.key";
+  };
+}

deploy/bird/docker-compose.tls.yml

@@ -0,0 +1,7 @@
+services:
+  bird-rpki-client:
+    environment:
+      OBSERVE_PROTO: rpki_tls
+    volumes:
+      - ./bird.conf.tls.example:/etc/bird/bird.conf:ro
+      - ../../certs:/etc/bird/certs:ro

deploy/bird/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  bird-rpki-client:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: bird-rpki-client
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      OBSERVE_INTERVAL: "5"
+      OBSERVE_PROTO: rpki_tcp
+    volumes:
+      - ./bird.conf.example:/etc/bird/bird.conf:ro

deploy/bird/entrypoint.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /run/bird
+
+SOCK_PATH="/run/bird/bird.ctl"
+PROTO="${OBSERVE_PROTO:-rpki_tcp}"
+INTERVAL="${OBSERVE_INTERVAL:-5}"
+
+bird -f -c /etc/bird/bird.conf -s "$SOCK_PATH" &
+BIRD_PID="$!"
+
+sleep 1
+
+case "$INTERVAL" in
+  ''|*[!0-9]*)
+    INTERVAL=0
+    ;;
+esac
+
+if [ "$INTERVAL" -gt 0 ]; then
+  while kill -0 "$BIRD_PID" 2>/dev/null; do
+    echo "==== $(date -u +"%Y-%m-%dT%H:%M:%SZ") RPKI snapshot ($PROTO) ===="
+    birdc -s "$SOCK_PATH" show protocols all "$PROTO" || true
+    birdc -s "$SOCK_PATH" show roa count || true
+    sleep "$INTERVAL"
+  done
+fi
+
+wait "$BIRD_PID"