增加ssh
增加deploy下细分的tcp、tls、ssh
This commit is contained in:
xiuting.xu
@@ -2,8 +2,25 @@ FROM rust:1.89-bookworm AS builder
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
RUN set -eux; \
|
||||
cat > /etc/apt/sources.list.d/debian.sources <<'EOF'
|
||||
Types: deb
|
||||
URIs: http://mirrors.tuna.tsinghua.edu.cn/debian
|
||||
Suites: bookworm bookworm-updates
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
|
||||
|
||||
Types: deb
|
||||
URIs: http://mirrors.tuna.tsinghua.edu.cn/debian-security
|
||||
Suites: bookworm-security
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
|
||||
EOF
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
&& apt-get install -y --fix-missing --no-install-recommends \
|
||||
-o Acquire::Retries=10 \
|
||||
-o Acquire::http::Timeout=60 \
|
||||
build-essential \
|
||||
cmake \
|
||||
pkg-config \
|
||||
@@ -19,8 +36,27 @@ RUN cargo build --release --bin rpki
|
||||
|
||||
FROM debian:bookworm-slim AS runtime
|
||||
|
||||
RUN set -eux; \
|
||||
cat > /etc/apt/sources.list.d/debian.sources <<'EOF'
|
||||
Types: deb
|
||||
URIs: http://mirrors.tuna.tsinghua.edu.cn/debian
|
||||
Suites: bookworm bookworm-updates
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
|
||||
|
||||
Types: deb
|
||||
URIs: http://mirrors.tuna.tsinghua.edu.cn/debian-security
|
||||
Suites: bookworm-security
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
|
||||
EOF
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends ca-certificates supervisor \
|
||||
&& apt-get install -y --fix-missing --no-install-recommends \
|
||||
-o Acquire::Retries=10 \
|
||||
-o Acquire::http::Timeout=60 \
|
||||
ca-certificates \
|
||||
supervisor \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /app
|
||||
@@ -28,7 +64,7 @@ WORKDIR /app
|
||||
COPY --from=builder /build/target/release/rpki /usr/local/bin/rpki
|
||||
COPY deploy/server/supervisord.conf /etc/supervisor/conf.d/rpki-rtr.conf
|
||||
|
||||
RUN mkdir -p /app/data /app/rtr-db /app/certs /app/slurm /var/log/supervisor
|
||||
RUN mkdir -p /app/data /app/rtr-db /app/certs /app/slurm /app/logs /var/log/supervisor
|
||||
|
||||
ENV RPKI_RTR_ENABLE_TLS=false \
|
||||
RPKI_RTR_TCP_ADDR=0.0.0.0:323 \
|
||||
@@ -41,4 +77,4 @@ ENV RPKI_RTR_ENABLE_TLS=false \
|
||||
|
||||
EXPOSE 323 324
|
||||
|
||||
CMD ["supervisord", "-n", "-c", "/etc/supervisor/conf.d/rpki-rtr.conf"]
|
||||
CMD ["supervisord", "-n", "-c", "/etc/supervisor/conf.d/rpki-rtr.conf"]
|
||||
35
deploy/server/docker-compose.ssh.yml
Normal file
35
deploy/server/docker-compose.ssh.yml
Normal file
@@ -0,0 +1,35 @@
|
||||
version: "3.9"
|
||||
|
||||
services:
|
||||
rpki-rtr:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: deploy/server/Dockerfile
|
||||
image: rpki-rtr:latest
|
||||
container_name: rpki-rtr-ssh
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "323:323"
|
||||
- "${RPKI_RTR_SSH_PORT:-22}:${RPKI_RTR_SSH_PORT:-22}"
|
||||
environment:
|
||||
RPKI_RTR_ENABLE_TLS: "false"
|
||||
RPKI_RTR_ENABLE_SSH: "true"
|
||||
RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
|
||||
RPKI_RTR_SSH_ADDR: "0.0.0.0:${RPKI_RTR_SSH_PORT:-22}"
|
||||
RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_rsa_key"
|
||||
RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
|
||||
RPKI_RTR_SSH_USERNAME: "rpki-rtr"
|
||||
RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
|
||||
# Optional: enable password authentication in addition to publickey
|
||||
# RPKI_RTR_SSH_PASSWORD: "test-password"
|
||||
RPKI_RTR_DB_PATH: "/app/rtr-db"
|
||||
RPKI_RTR_CCR_DIR: "/app/data"
|
||||
RPKI_RTR_SLURM_DIR: "/app/slurm"
|
||||
RPKI_RTR_STRICT_CCR_VALIDATION: "false"
|
||||
RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
|
||||
volumes:
|
||||
- ../../data:/app/data:ro
|
||||
- ../../rtr-db:/app/rtr-db
|
||||
- ../../data:/app/slurm:ro
|
||||
- ../../certs:/app/certs:ro
|
||||
- ../../logs/server:/app/logs
|
||||
27
deploy/server/docker-compose.tcp.yml
Normal file
27
deploy/server/docker-compose.tcp.yml
Normal file
@@ -0,0 +1,27 @@
|
||||
version: "3.9"
|
||||
|
||||
services:
|
||||
rpki-rtr:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: deploy/server/Dockerfile
|
||||
image: rpki-rtr:latest
|
||||
container_name: rpki-rtr-tcp
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "323:323"
|
||||
environment:
|
||||
RPKI_RTR_ENABLE_TLS: "false"
|
||||
RPKI_RTR_ENABLE_SSH: "false"
|
||||
RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
|
||||
RPKI_RTR_DB_PATH: "/app/rtr-db"
|
||||
RPKI_RTR_CCR_DIR: "/app/data"
|
||||
RPKI_RTR_SLURM_DIR: "/app/slurm"
|
||||
RPKI_RTR_STRICT_CCR_VALIDATION: "false"
|
||||
RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
|
||||
RPKI_RTR_MAX_CONNECTIONS: "100000"
|
||||
volumes:
|
||||
- ../../data:/app/data:ro
|
||||
- ../../rtr-db:/app/rtr-db
|
||||
- ../../data:/app/slurm:ro
|
||||
- ../../logs/server:/app/logs
|
||||
32
deploy/server/docker-compose.tls.yml
Normal file
32
deploy/server/docker-compose.tls.yml
Normal file
@@ -0,0 +1,32 @@
|
||||
version: "3.9"
|
||||
|
||||
services:
|
||||
rpki-rtr:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: deploy/server/Dockerfile
|
||||
image: rpki-rtr:latest
|
||||
container_name: rpki-rtr-tls
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "323:323"
|
||||
- "324:324"
|
||||
environment:
|
||||
RPKI_RTR_ENABLE_TLS: "true"
|
||||
RPKI_RTR_ENABLE_SSH: "false"
|
||||
RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
|
||||
RPKI_RTR_TLS_ADDR: "0.0.0.0:324"
|
||||
RPKI_RTR_TLS_CERT_PATH: "/app/certs/server-dns.crt"
|
||||
RPKI_RTR_TLS_KEY_PATH: "/app/certs/server-dns.key"
|
||||
RPKI_RTR_TLS_CLIENT_CA_PATH: "/app/certs/client-ca.crt"
|
||||
RPKI_RTR_DB_PATH: "/app/rtr-db"
|
||||
RPKI_RTR_CCR_DIR: "/app/data"
|
||||
RPKI_RTR_SLURM_DIR: "/app/slurm"
|
||||
RPKI_RTR_STRICT_CCR_VALIDATION: "false"
|
||||
RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
|
||||
volumes:
|
||||
- ../../data:/app/data:ro
|
||||
- ../../rtr-db:/app/rtr-db
|
||||
- ../../data:/app/slurm:ro
|
||||
- ../../tests/fixtures/tls:/app/certs:ro
|
||||
- ../../logs/server:/app/logs
|
||||
@@ -11,6 +11,8 @@ services:
|
||||
ports:
|
||||
- "323:323"
|
||||
- "324:324"
|
||||
# SSH mode example:
|
||||
# - "22:22"
|
||||
environment:
|
||||
RPKI_RTR_ENABLE_TLS: "false"
|
||||
RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
|
||||
@@ -20,9 +22,21 @@ services:
|
||||
RPKI_RTR_SLURM_DIR: "/app/slurm"
|
||||
RPKI_RTR_STRICT_CCR_VALIDATION: "false"
|
||||
RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
|
||||
RUST_LOG: "info"
|
||||
# SSH mode example:
|
||||
# RPKI_RTR_ENABLE_SSH: "true"
|
||||
# RPKI_RTR_SSH_ADDR: "0.0.0.0:22"
|
||||
# RPKI_RTR_SSH_PORT: "22"
|
||||
# RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_ed25519_key"
|
||||
# RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
|
||||
# RPKI_RTR_SSH_USERNAME: "rpki-rtr"
|
||||
# RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
|
||||
# Optional: enable password auth in addition to publickey
|
||||
# RPKI_RTR_SSH_PASSWORD: "test-password"
|
||||
volumes:
|
||||
- ../../data:/app/data:ro
|
||||
- ../../rtr-db:/app/rtr-db
|
||||
- ../../data:/app/slurm:ro
|
||||
- ../../logs/server:/app/logs
|
||||
# TLS mode example:
|
||||
# - ../../certs:/app/certs:ro
|
||||
|
||||
@@ -12,7 +12,9 @@ startretries=3
|
||||
stopsignal=TERM
|
||||
stopasgroup=true
|
||||
killasgroup=true
|
||||
stdout_logfile=/dev/fd/1
|
||||
stdout_logfile_maxbytes=0
|
||||
stderr_logfile=/dev/fd/2
|
||||
stderr_logfile_maxbytes=0
|
||||
stdout_logfile=/app/logs/rpki-rtr.stdout.log
|
||||
stdout_logfile_maxbytes=50MB
|
||||
stdout_logfile_backups=10
|
||||
stderr_logfile=/app/logs/rpki-rtr.stderr.log
|
||||
stderr_logfile_maxbytes=50MB
|
||||
stderr_logfile_backups=10
|
||||
|
||||
Reference in New Issue
Block a user