增加环境变量

2026-05-18 11:42:33 +08:00
parent a11f2bc864
commit cdf9372929
18 changed files with 210 additions and 89 deletions
--- a/deploy/server/.env
+++ b/deploy/server/.env
@@ -1,8 +1,40 @@
-# Host directory containing CCR files to mount into the server container.
+# Data source directories on host.
 RPKI_RTR_CCR_HOST_DIR=../../data
+RPKI_RTR_SLURM_HOST_DIR=../../data

-# In-container directory used by rpki_rtr as CCR input directory.
+# In-container data source directories.
 RPKI_RTR_CCR_DIR=/app/data
+RPKI_RTR_SLURM_DIR=/app/slurm

-# Max retained delta count in RTR cache.
+# Persistent directories on host.
+RPKI_RTR_DB_HOST_DIR=../../rtr-db
+RPKI_RTR_LOG_HOST_DIR=../../logs/server
+
+# In-container runtime paths.
+RPKI_RTR_DB_PATH=/app/rtr-db
+
+# Core runtime knobs.
+RPKI_RTR_STRICT_CCR_VALIDATION=false
+RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS=300
 RPKI_RTR_MAX_DELTA=10
+RPKI_RTR_MAX_CONNECTIONS=100000
+RPKI_RTR_MAX_CONCURRENT_HANDSHAKES=128
+RUST_LOG=info
+
+# TLS mode knobs.
+RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH=false
+RPKI_RTR_TLS_CERT_PATH=/app/certs/server-dns.crt
+RPKI_RTR_TLS_KEY_PATH=/app/certs/server-dns.key
+RPKI_RTR_TLS_CLIENT_CA_PATH=/app/certs/client-ca.crt
+RPKI_RTR_TLS_CERTS_HOST_DIR=../../tests/fixtures/tls
+
+# SSH mode knobs.
+RPKI_RTR_SSH_HOST_PORT=2222
+RPKI_RTR_SSH_CONTAINER_PORT=22
+RPKI_RTR_SSH_AUTH_MODE=key
+RPKI_RTR_SSH_USERNAME=rpki-rtr
+RPKI_RTR_SSH_SUBSYSTEM_NAME=rpki-rtr
+RPKI_RTR_SSH_HOST_KEY_PATH=/host-ssh/ssh_host_ed25519_key
+RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH=/app/certs/rtr-authorized_keys
+RPKI_RTR_SSH_KEYS_VOLUME=/etc/ssh:/host-ssh:ro
+RPKI_RTR_SSH_CERTS_HOST_DIR=../../certs
--- a/deploy/server/DEPLOYMENT.md
+++ b/deploy/server/DEPLOYMENT.md
@@ -20,6 +20,23 @@ The container runs `rpki` directly as PID 1.
 - SLURM directory: `/app/slurm`
 - TLS cert directory (optional): `/app/certs`

+## Path Configuration via `.env`
+
+- `RPKI_RTR_CCR_HOST_DIR`: host CCR directory mounted into container
+- `RPKI_RTR_SLURM_HOST_DIR`: host SLURM directory mounted into container
+- `RPKI_RTR_CCR_DIR`: in-container CCR directory path
+- `RPKI_RTR_SLURM_DIR`: in-container SLURM directory path
+- `RPKI_RTR_DB_HOST_DIR`: host RocksDB directory
+- `RPKI_RTR_LOG_HOST_DIR`: host log directory
+- `RPKI_RTR_DB_PATH`: in-container RocksDB directory
+
+## Runtime Configuration via `.env`
+
+- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RUST_LOG`
+- TCP mode: `RPKI_RTR_MAX_CONNECTIONS`
+- TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR`
+- SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
+
 ## Start

 ```bash
--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -24,21 +24,21 @@ services:
      RPKI_RTR_SSH_AUTH_MODE: "${RPKI_RTR_SSH_AUTH_MODE:-key}"
      # Optional: enable password authentication in addition to publickey
      # RPKI_RTR_SSH_PASSWORD: "test-password"
-      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_DB_PATH: "${RPKI_RTR_DB_PATH:-/app/rtr-db}"
      RPKI_RTR_CCR_DIR: "${RPKI_RTR_CCR_DIR:-/app/data}"
-      RPKI_RTR_SLURM_DIR: "/app/slurm"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
-      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+      RPKI_RTR_SLURM_DIR: "${RPKI_RTR_SLURM_DIR:-/app/slurm}"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
-      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "128"
-      RUST_LOG: "info"
+      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
-      - ../../rtr-db:/app/rtr-db
-      - ../../data:/app/slurm:ro
+      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
      - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro}
-      - ../../certs:/app/certs:ro
-      - ../../logs/server:/app/logs
+      - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs}:/app/certs:ro
+      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
    networks:
      - rpki_net

--- a/deploy/server/docker-compose.tcp.yml
+++ b/deploy/server/docker-compose.tcp.yml
@@ -14,20 +14,20 @@ services:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_ENABLE_SSH: "false"
      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
-      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_DB_PATH: "${RPKI_RTR_DB_PATH:-/app/rtr-db}"
      RPKI_RTR_CCR_DIR: "${RPKI_RTR_CCR_DIR:-/app/data}"
-      RPKI_RTR_SLURM_DIR: "/app/slurm"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
-      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "60"
+      RPKI_RTR_SLURM_DIR: "${RPKI_RTR_SLURM_DIR:-/app/slurm}"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-60}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
-      RPKI_RTR_MAX_CONNECTIONS: "100000"
-      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "128"
-      RUST_LOG: "info"
+      RPKI_RTR_MAX_CONNECTIONS: "${RPKI_RTR_MAX_CONNECTIONS:-100000}"
+      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
-      - ../../rtr-db:/app/rtr-db
-      - ../../data:/app/slurm:ro
-      - ../../logs/server:/app/logs
+      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
    networks:
      - rpki_net

--- a/deploy/server/docker-compose.tls.yml
+++ b/deploy/server/docker-compose.tls.yml
@@ -16,24 +16,24 @@ services:
      RPKI_RTR_ENABLE_SSH: "false"
      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
      RPKI_RTR_TLS_ADDR: "0.0.0.0:324"
-      RPKI_RTR_TLS_CERT_PATH: "/app/certs/server-dns.crt"
-      RPKI_RTR_TLS_KEY_PATH: "/app/certs/server-dns.key"
-      RPKI_RTR_TLS_CLIENT_CA_PATH: "/app/certs/client-ca.crt"
-      RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH: "false"
-      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_TLS_CERT_PATH: "${RPKI_RTR_TLS_CERT_PATH:-/app/certs/server-dns.crt}"
+      RPKI_RTR_TLS_KEY_PATH: "${RPKI_RTR_TLS_KEY_PATH:-/app/certs/server-dns.key}"
+      RPKI_RTR_TLS_CLIENT_CA_PATH: "${RPKI_RTR_TLS_CLIENT_CA_PATH:-/app/certs/client-ca.crt}"
+      RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH: "${RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH:-false}"
+      RPKI_RTR_DB_PATH: "${RPKI_RTR_DB_PATH:-/app/rtr-db}"
      RPKI_RTR_CCR_DIR: "${RPKI_RTR_CCR_DIR:-/app/data}"
-      RPKI_RTR_SLURM_DIR: "/app/slurm"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
-      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+      RPKI_RTR_SLURM_DIR: "${RPKI_RTR_SLURM_DIR:-/app/slurm}"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
-      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "128"
-      RUST_LOG: "info"
+      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RUST_LOG: "${RUST_LOG:-info}"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
-      - ../../rtr-db:/app/rtr-db
-      - ../../data:/app/slurm:ro
-      - ../../tests/fixtures/tls:/app/certs:ro
-      - ../../logs/server:/app/logs
+      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro
+      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
    networks:
      - rpki_net

--- a/deploy/server/docker-compose.yml
+++ b/deploy/server/docker-compose.yml
@@ -17,14 +17,14 @@ services:
      RPKI_RTR_ENABLE_TLS: "false"
      RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
      RPKI_RTR_TLS_ADDR: "0.0.0.0:324"
-      RPKI_RTR_DB_PATH: "/app/rtr-db"
+      RPKI_RTR_DB_PATH: "${RPKI_RTR_DB_PATH:-/app/rtr-db}"
      RPKI_RTR_CCR_DIR: "${RPKI_RTR_CCR_DIR:-/app/data}"
-      RPKI_RTR_SLURM_DIR: "/app/slurm"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "false"
-      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "300"
+      RPKI_RTR_SLURM_DIR: "${RPKI_RTR_SLURM_DIR:-/app/slurm}"
+      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
+      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
-      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "128"
-      RUST_LOG: "info"
+      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
+      RUST_LOG: "${RUST_LOG:-info}"
      # SSH mode example:
      # RPKI_RTR_ENABLE_SSH: "true"
      # RPKI_RTR_SSH_ADDR: "0.0.0.0:22"
@@ -37,9 +37,9 @@ services:
      # RPKI_RTR_SSH_PASSWORD: "test-password"
    volumes:
      - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
-      - ../../rtr-db:/app/rtr-db
-      - ../../data:/app/slurm:ro
-      - ../../logs/server:/app/logs
+      - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
+      - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}:ro
+      - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
      # TLS mode example:
      # - ../../certs:/app/certs:ro
    networks: