Server和client部署整理

README.client.md

@@ -0,0 +1,230 @@
+# RTR Client 使用说明
+
+本文说明仓库内三类 RTR Client 的用途、启动方式和验证命令：
+
+- `deploy/client`: 本仓库自带的 `rtr_debug_client`，适合做 RTR 协议调试、连通性检查和单次查询。
+- `deploy/frr`: FRR 作为黑盒 RTR Client，适合验证真实路由软件是否能消费 server 下发的 VRP。
+- `deploy/bird`: BIRD 作为黑盒 RTR Client，适合验证 TCP 或 SSH transport 下的 RPKI/ROA/ASPA 数据导入。
+
+以下命令默认从仓库根目录执行。
+
+## 目录
+
+- [前置条件](#前置条件)
+- [rtr_debug_client](#rtr_debug_client)
+  - [TCP](#tcp)
+  - [TLS/mTLS](#tlsmtls)
+  - [SSH](#ssh)
+  - [多客户端压测](#多客户端压测)
+- [FRR Client](#frr-client)
+- [BIRD Client](#bird-client)
+  - [TCP](#tcp-1)
+  - [SSH](#ssh-1)
+- [如何判断 Client 正常](#如何判断-client-正常)
+
+## 前置条件
+
+先启动 RTR Server。TCP 模式是最常用的本地验证方式：
+
+```bash
+./deploy/server/build-run.sh up --mode tcp
+```
+
+如果要测试 TLS 或 SSH，需要先启动对应 server 模式，并准备匹配的证书或 SSH key：
+
+```bash
+./deploy/server/build-run.sh up --mode tls
+./deploy/server/build-run.sh up --mode ssh
+```
+
+Client 连接地址不要求固定在某个 Docker 网络里。`deploy/client` 的 TCP/TLS/SSH 模式分别通过 `RPKI_RTR_TCP_SERVER_ADDR`、`RPKI_RTR_TLS_SERVER_ADDR`、`RPKI_RTR_SSH_SERVER_ADDR` 指定 server 地址。`deploy/bird` 通过 `RPKI_BIRD_RPKI_HOST`/`RPKI_BIRD_RPKI_PORT` 指定 TCP server 地址，通过 `RPKI_BIRD_SSH_RPKI_HOST`/`RPKI_RTR_SSH_PORT` 指定 SSH server 地址。示例 compose 里的默认值只是为了和本仓库 server compose 直接联调。
+
+`deploy/frr` 示例默认连接 `127.0.0.1:323`，可以通过 `RPKI_FRR_RPKI_HOST`/`RPKI_FRR_RPKI_PORT` 覆盖。
+
+## rtr_debug_client
+
+`rtr_debug_client` 是本仓库提供的调试客户端。它会发起 RTR Reset Query 或 Serial Query，并打印 server 返回的 PDU 摘要。Docker 配置默认执行：
+
+```text
+<server_addr> <protocol_version> reset --keep-after-error --summary-only
+```
+
+### TCP
+
+```bash
+./deploy/client/build-run.sh up --mode tcp
+./deploy/client/build-run.sh logs --mode tcp
+./deploy/client/build-run.sh down --mode tcp
+```
+
+默认连接 `rpki-rtr:323`，协议版本默认是 `2`。可以通过 `deploy/client/.env` 或环境变量覆盖：
+
+```bash
+RPKI_RTR_TCP_SERVER_ADDR=10.0.0.12:323 \
+RPKI_RTR_PROTOCOL_VERSION=2 \
+./deploy/client/build-run.sh up --mode tcp
+```
+
+### TLS/mTLS
+
+```bash
+./deploy/client/build-run.sh up --mode tls
+./deploy/client/build-run.sh logs --mode tls
+./deploy/client/build-run.sh down --mode tls
+```
+
+TLS 模式默认读取 `certs/tls` 下的示例证书，并使用 `localhost` 作为 server name。常用变量：
+
+| 变量 | 默认值 | 说明 |
+| --- | --- | --- |
+| `RPKI_RTR_TLS_SERVER_ADDR` | `rpki-rtr:324` | TLS RTR server 地址 |
+| `RPKI_RTR_TLS_SERVER_NAME` | `localhost` | 必须匹配 server 证书 SAN dNSName |
+| `RPKI_RTR_TLS_CA_CERT_PATH` | `/app/certs/client-ca.crt` | 容器内 CA 证书路径 |
+| `RPKI_RTR_TLS_CLIENT_CERT_PATH` | `/app/certs/client-good.crt` | 容器内 client 证书路径 |
+| `RPKI_RTR_TLS_CLIENT_KEY_PATH` | `/app/certs/client-good.key` | 容器内 client 私钥路径 |
+| `RPKI_RTR_TLS_CERTS_HOST_DIR` | `../../certs/tls` | 宿主机 TLS 证书目录 |
+
+### SSH
+
+```bash
+./deploy/client/build-run.sh up --mode ssh
+./deploy/client/build-run.sh logs --mode ssh
+./deploy/client/build-run.sh down --mode ssh
+```
+
+SSH 模式默认连接 `rpki-rtr-ssh:22`，使用 key 认证，并校验 server public key。常用变量：
+
+| 变量 | 默认值 | 说明 |
+| --- | --- | --- |
+| `RPKI_RTR_SSH_SERVER_ADDR` | `rpki-rtr:22` | SSH RTR server 地址 |
+| `RPKI_RTR_SSH_USERNAME` | `rpki-rtr` | SSH 用户名 |
+| `RPKI_RTR_CLIENT_KEYS_VOLUME` | `../../certs/ssh:/app/certs:ro` | 宿主机 SSH key 目录挂载 |
+| `RPKI_RTR_CLIENT_KEY_PATH` | `/app/certs/rtr-client.key` | 容器内 client 私钥 |
+| `RPKI_RTR_SSH_SERVER_PUBKEY_PATH` | `/app/certs/ssh_host_rsa_key.pub` | 容器内 server public key |
+
+### 多客户端压测
+
+`--clients multi` 会启动 5 个 TCP debug client，用于观察并发连接、client report 和 server 连接统计。
+
+```bash
+./deploy/client/build-run.sh up --mode tcp --clients multi
+./deploy/client/build-run.sh logs --mode tcp --clients multi
+./deploy/client/build-run.sh down --mode tcp --clients multi
+```
+
+## FRR Client
+
+FRR 示例用于验证标准路由软件能否通过 RTR over TCP 从 server 获取前缀验证数据。
+
+启动：
+
+```bash
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
+```
+
+默认连接 `127.0.0.1:323`。可以通过环境变量覆盖：
+
+```bash
+RPKI_FRR_RPKI_HOST=10.0.0.12 \
+RPKI_FRR_RPKI_PORT=323 \
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
+```
+
+验证连接和数据：
+
+```bash
+docker exec -it frr-rpki-client vtysh -c "show rpki configuration"
+docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection"
+docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table"
+```
+
+停止：
+
+```bash
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down
+```
+
+FRR 容器启动时会读取 `deploy/frr/frr.conf.template`，并生成 `/etc/frr/frr.conf`。模板中的 RTR cache 配置为：
+
+```text
+rpki cache tcp ${RPKI_FRR_RPKI_HOST} ${RPKI_FRR_RPKI_PORT} preference ${RPKI_FRR_RPKI_PREFERENCE}
+```
+
+如果需要调整 polling、timeout、BGP router-id 等其他 FRR 配置，可以修改 `deploy/frr/frr.conf.template`，或在 compose 中挂载自己的模板和 entrypoint。
+
+## BIRD Client
+
+BIRD 示例用于验证 BIRD 3.x 对 RTR v2、ROA 和 ASPA 的导入情况。容器启动后会周期性输出 RPKI 协议状态和表项摘要。
+
+### TCP
+
+启动：
+
+```bash
+docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml up -d --build
+```
+
+查看日志：
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+停止：
+
+```bash
+docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml down
+```
+
+默认连接 `rpki-rtr:323`。可以通过环境变量覆盖：
+
+```bash
+RPKI_BIRD_RPKI_HOST=10.0.0.12 \
+RPKI_BIRD_RPKI_PORT=323 \
+docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml up -d --build
+```
+
+### SSH
+
+先启动 server SSH 模式：
+
+```bash
+./deploy/server/build-run.sh up --mode ssh
+```
+
+再启动 BIRD SSH client：
+
+```bash
+docker compose --env-file deploy/bird/.env \
+  -f deploy/bird/docker-compose.yml \
+  -f deploy/bird/docker-compose.ssh.yml \
+  up -d --build
+```
+
+查看日志：
+
+```bash
+docker logs -f bird-rpki-client
+```
+
+SSH 模式默认读取 `certs/ssh` 目录下的 key，并使用 `bird.conf.ssh.template` 生成运行时配置。关键默认值：
+
+| 变量 | 默认值 | 说明 |
+| --- | --- | --- |
+| `RPKI_BIRD_SSH_RPKI_HOST` | `rpki-rtr` | SSH RTR server 主机名 |
+| `RPKI_RTR_SSH_PORT` | `22` | SSH RTR server 端口 |
+| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录 |
+
+## 如何判断 Client 正常
+
+- `rtr_debug_client`: 日志中能看到 Reset Query 成功、EndOfData 和 payload 统计。
+- FRR: `show rpki cache-connection` 显示已连接，`show rpki prefix-table` 有 VRP 条目。
+- BIRD: 日志中 RPKI protocol 状态为 `up`，ROA/ASPA 表项摘要不为空。
+
+如果 client 无法连接，优先检查：
+
+- server 是否按对应 transport 启动。
+- client 配置的 server 地址是否从当前容器或主机可达。
+- TLS 的 server name 是否匹配证书 SAN。
+- SSH 的用户名、client key 和 server public key 是否匹配。
+- `RPKI_RTR_PROTOCOL_VERSION` 或 BIRD 配置中的 `min version`/`max version` 是否和 server 能力一致。

README.md

@@ -12,6 +12,23 @@
 - 运行期管理：可选启用 HTTP Admin API，修改部分 runtime config、触发 source reload、管理 SLURM 文件。
 - 调试工具：`rtr_debug_client` 支持 TCP、TLS 和 SSH 连接 RTR server。
 
+## 目录
+
+- [协议参考](#协议参考)
+- [项目结构](#项目结构)
+- [构建与测试](#构建与测试)
+- [数据输入](#数据输入)
+- [快速启动](#快速启动)
+  - [Docker 运行](#docker-运行)
+  - [跨架构构建](#跨架构构建)
+- [传输模式](#传输模式)
+- [主要环境变量](#主要环境变量)
+- [运行报告](#运行报告)
+- [Admin API](#admin-api)
+- [调试客户端](#调试客户端)
+- [部署入口](#部署入口)
+- [开发说明](#开发说明)
+
 ## 协议参考
 
 - RTR: [RFC 6810](https://www.rfc-editor.org/rfc/rfc6810.html), [RFC 8210](https://www.rfc-editor.org/rfc/rfc8210.html)
@@ -73,7 +90,25 @@ chmod +x deploy/server/build-run.sh deploy/client/build-run.sh
 ./deploy/server/build-run.sh down
 ```
 
-更多 action、mode 和环境变量说明见 `deploy/README.md`。
+脚本常用参数：
+
+| 参数/变量 | server | client | 说明 |
+| --- | --- | --- | --- |
+| `--mode base|tcp|tls|ssh`, `MODE` | yes | yes | 选择 compose 模式，默认 `tcp`。 |
+| `--clients single|multi`, `CLIENTS` | no | yes | 单 client 或 5 client，默认 `single`。 |
+| `--no-build`, `BUILD=0` | yes | yes | 只运行已有镜像，不执行 compose build。 |
+| `--server-image TAG`, `SERVER_IMAGE` | yes | no | server 镜像名；会传给 compose 的 `RPKI_RTR_SERVER_IMAGE`。 |
+| `--client-image TAG`, `CLIENT_IMAGE` | no | yes | client 镜像名；会传给 compose 的 `RPKI_RTR_CLIENT_IMAGE`。 |
+| `--platform VALUE`, `TARGET_PLATFORM` | yes | yes | `buildx` 目标平台，默认 `linux/arm64`。 |
+| `--push`, `BUILDX_PUSH=1` | yes | yes | `buildx` 构建后推送到 registry；不设置时加载到本地 Docker。 |
+| `--skip-base-pull`, `SKIP_BASE_IMAGE_PULL=1` | yes | yes | 跳过 buildx 前的基础镜像预拉取。 |
+
+支持的 action 包括 `up`、`build`、`buildx`、`rebuild`、`down`/`stop`、`restart`、`logs`、`ps`。完整帮助见：
+
+```bash
+./deploy/server/build-run.sh --help
+./deploy/client/build-run.sh --help
+```
 
 ### 跨架构构建
 示例：x86 开发机本地构建 ARM 镜像，打包后传到 ARM 部署机。
@@ -171,16 +206,16 @@ TLS 相关路径：
 
 | 变量 | 默认值 |
 | --- | --- |
-| `RPKI_RTR_TLS_CERT_PATH` | `./certs/server.crt` |
+| `RPKI_RTR_TLS_CERT_PATH` | `./certs/tls/server-dns.crt` |
-| `RPKI_RTR_TLS_KEY_PATH` | `./certs/server.key` |
+| `RPKI_RTR_TLS_KEY_PATH` | `./certs/tls/server-dns.key` |
-| `RPKI_RTR_TLS_CLIENT_CA_PATH` | `./certs/client-ca.crt` |
+| `RPKI_RTR_TLS_CLIENT_CA_PATH` | `./certs/tls/client-ca.crt` |
 
 SSH 相关配置：
 
 | 变量 | 默认值 |
 | --- | --- |
-| `RPKI_RTR_SSH_HOST_KEY_PATH` | `./certs/ssh_host_ed25519_key` |
+| `RPKI_RTR_SSH_HOST_KEY_PATH` | `./certs/ssh/ssh_host_rsa_key` |
-| `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH` | `./certs/rtr-authorized_keys` |
+| `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH` | `./certs/ssh/rtr-authorized_keys` |
 | `RPKI_RTR_SSH_USERNAME` | `rpki-rtr` |
 | `RPKI_RTR_SSH_SUBSYSTEM_NAME` | `rpki-rtr` |
 | `RPKI_RTR_SSH_AUTH_MODE` | `key` |
@@ -242,6 +277,8 @@ curl -X POST http://127.0.0.1:8323/admin/rtr/config \
 
 `rtr_debug_client` 用于手动发起 Reset Query 或 Serial Query，并观察服务端返回的 PDU。
 
+RTR Client 的 Docker 调试、FRR/BIRD 互通验证和常用排障步骤见 `README.client.md`。
+
 TCP：
 
 ```bash
@@ -255,10 +292,10 @@ TLS：
 cargo run --bin rtr_debug_client -- \
   127.0.0.1:324 1 reset \
   --tls \
-  --ca-cert tests/fixtures/tls/client-ca.crt \
+  --ca-cert certs/tls/client-ca.crt \
   --server-name localhost \
-  --client-cert tests/fixtures/tls/client-good.crt \
+  --client-cert certs/tls/client-good.crt \
-  --client-key tests/fixtures/tls/client-good.key
+  --client-key certs/tls/client-good.key
 ```
 
 SSH：
@@ -268,8 +305,8 @@ cargo run --bin rtr_debug_client -- \
   127.0.0.1:22 1 reset \
   --ssh \
   --ssh-user rpki-rtr \
-  --ssh-key certs/rtr-client.key \
+  --ssh-key certs/ssh/rtr-client.key \
-  --ssh-server-key certs/ssh_host_rsa_key.pub
+  --ssh-server-key certs/ssh/ssh_host_rsa_key.pub
 ```
 
 SSH password auth 也已实现；SSH 模式下 `--ssh-key` 和 `--ssh-password` 二选一，同时必须通过 `--ssh-known-hosts` 或 `--ssh-server-key` 做 host key 校验。
@@ -289,6 +326,8 @@ SSH password auth 也已实现；SSH 模式下 `--ssh-key` 和 `--ssh-password`
 | FRR client | `deploy/frr/docker-compose.yml` |
 | BIRD client | `deploy/bird/docker-compose.yml` |
 
+RTR Client 统一使用说明见 `README.client.md`。
+
 通用操作：
 
 ```bash

certs/tls/client-ca.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGzCCAgOgAwIBAgIUKCaM+eEU12YVn/tC6MEBYPj50oIwDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDQy
+OFoXDTM2MDMyMDA4MDQyOFowHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENB
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmS+gsRZXPaG20Ra2te7
+WVeqyeFX2lV/RvNsT3WW+EtwuTN2aFJ/pBgSCqgCaFocU5IcgfScybQrjmTWeEot
+D0F1OOW/TihlBsrU3BS8vOZ4KTuwB9eOgpt7FL8CxLetjNWxZKBsvJMauOUYFLCt
+DN+78EDqrZ2VyJPfa+7dJKS/JoRgs/WFjvAeb5x1UpKPf/gp1Ji+Vj92Ux9znYF1
+2Zfs77NsLdwcqyMVj7cb1nucutNf/vMqNi+BoSwC/tQkflda9bLUwto/ZfFPsCFw
+Ptjwiwm+IGNAKG8r1ujaUVDtxc+NliuAbHERBgZGtYpAE6u28+d8cUAyGGQFNGqb
+uQIDAQABo1MwUTAdBgNVHQ4EFgQUtiTCqdhd2TwFc7JZGWkF8BEcMJwwHwYDVR0j
+BBgwFoAUtiTCqdhd2TwFc7JZGWkF8BEcMJwwDwYDVR0TAQH/BAUwAwEB/zANBgkq
+hkiG9w0BAQsFAAOCAQEATr0wChmDvmw51RQ0kOFP1l3n+O1n/U0xR39YApnmdhtk
+MyO9gNyqxdUWj4QaRkswr5iMyjsLrT3lYWGfh7oHlhIgkXEy5OK548rhj/PA6d5U
+M7DDGI06EFfYXcC57Cx1y8Egd9gfkfPk0ned/TG+/dYtyb7sBiIKrOiDExbfZ53U
+mNtfsdptBoOjee4KggplfVhkUopyO0KKD7twq4dvWgzWZHv7m5wrQA8GP8W4JpPP
+ZAs8cOLfq4cxAwYFXEaf0x7is2u9KdagPqXkiPMeC8fOHWyRCR7sKN4Dnh57ruqq
+mQXil9GGFfkDA/bh6+Rs93Yll7yYyA3xif6fSBmgUg==
+-----END CERTIFICATE-----

certs/tls/client-good.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMjCCAhqgAwIBAgIUTLfIortKKjsYovPDuDVnUR8i2YMwDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDUw
+MFoXDTM2MDMyMDA4MDUwMFowHzEdMBsGA1UEAwwUUlRSIFRlc3QgQ2xpZW50IEdv
+b2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUjnhxQxKUNLjGN6mu
+/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEiSxVt
+8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo2Ga/
++eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAjpLZd
+oEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3Jz7D
+QfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi9sqL
+y7UlAgMBAAGjaDBmMA8GA1UdEQQIMAaHBH8AAAEwEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwHQYDVR0OBBYEFJy0O+AR5EdWrUr2UHtPCUVTrRiEMB8GA1UdIwQYMBaAFLYk
+wqnYXdk8BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQB8eavz/Pk3oJBh
+sgy4ve6nLAqKGcD+zSoBxw/ErZaDNdUZZaFKT9nypfi39jkfjU+CIfhczCs5Cknk
+EDqYtp1BXkY+auKeYRkoaCKv+ucnIc6JZ70NOQGdDNzU4eb9tVA9Py0j5VzvxWR1
+yl6vHTc3tTA873RRezvUe+SQDwR+x2dxZ0O0MFZR4CTaTeR+fpD4bE9mBcYN1KVk
+HdA7USCwOZ0qE+aHTegM4pgGrpHYS5yBpUFADqfJl1yBnnqc10zkphoy6dRsbVuN
+NkDostGbbfGdGjEPs6i1TMsDTVyOo4nsHACk4q4m/IEVBkiMwxmwyhK1EEWQmQpy
+h0CqAs3Z
+-----END CERTIFICATE-----

certs/tls/client-good.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDUjnhxQxKUNLjG
+N6mu/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEi
+SxVt8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo
+2Ga/+eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAj
+pLZdoEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3
+Jz7DQfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi
+9sqLy7UlAgMBAAECggEALmsOkm17WTJKR79QJw7dS0qEjgmk1qIXRkhYns01vyCt
+mcv7NYyHQrRmPKV73Is04HwWjLJYdQ5E8KBFBcV4tgezN4WY0BHL7txu3sGCu58/
+2mmYHcriNs/QIF8HNSocH0ZrVBCngFHv5tWbWsFPJh2oCz5FyM41OpQqoQ9f0ZoA
+PKq3m7dNidFmlQPhhJ9KeLYwDfzTRy4sWBDrgZFDQ6ut9nO8/JpJvxZCSnOdbW1T
+6pYk3uAKKcmrcdI2fsg7u0J1zkrkDnRdrDv1QCY/h1UXvR4KuMeYRylHWJpOKUiR
+asxpJO+lh7TmDaEIqO+dSmTHawcKDYuIp0EV4/x7AQKBgQD/cgMhx97bJ3ym0ucc
+xtt10jo0NTW7SJIXx/eUdBQNA3aGWfsqLrBI5qKrXLxTXF/vAs3LWHiHF6EgRxW/
+7RbO+NZzAGxg53Y3PMqZ4AQbOm2JCIgT9ZhQc55+qowdtrts3njL+ayy3vWh3nPt
+G78+rs4ZLCHhEutbkKqU7S3XSQKBgQDVBJ5l9d1QcqFqYnlmyhgfwJwpxo4N2dJR
+18pCow8Mp8S9ROJx3OF4yNTRa6ipnX0oGdgchT63jXBDoKot3/4tqbjYj/Y3MmKL
+crZ7dZEiAqkqE975qUfSlQS6BtknRKduzQzAJAKz0A+JbPIisPHIrBnG2PH9h2XA
+TjA2rHRi/QKBgDIp65+IpqUW/g2swSIPky1yGWgDQwgCWl49MMuAeCeOFIqRxRcl
+kAzg7fUFAx7Dtzsyq8NRHmo5I7U5AHZuUtpWV5bB8IafLcHvOEI7kdLfCH+uozp4
+Mm8qJWfuihGTvv7EOaik4VtHGamuC8n2dvoSTfr3hbezhXC32ifg4+2xAoGATbjp
+snoKzheFHbPgZ8jFFJDKadOwcQ1Q19vMSJQGIa/08Ln5hWH6Qn/EZsTJPVnhGIiV
+eZKEV6SbmZE9ho97xl1uvFWKmIkhu4+XVWSIF8iwwFGPwbgqJIOKvfVRtioujRbz
+2AdLlSANCy9dCZtWHMnufccaRE7qqUfd/5TcwmECgYA5md1JZ+p+0yTkjNf4McCe
+mpZiXXaM8uC3/XiWlfcw3ag88H0XCqt2UPcX03MC9ZzywfTdoEHhPRfr48uRiH7K
+Pi1T8E2E0GkSfk6zh6wJm8Kmm9+VJd2rUFrb35xDMUfjpS228oH9UBQtwaAV+jmy
+q/APoG+aWt5YIeYElx9mzA==
+-----END PRIVATE KEY-----

certs/tls/server-dns.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDLDCCAhSgAwIBAgIUU9TJAAXI1pavsowFKFye0t8gdz4wDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyNDAyMzA0
+N1oXDTM2MDMyMTAyMzA0N1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzXLZ2ZeySuuzCDEPXsHMym0py7Tuwizu
+5a4AKQt+7d8b51x22W+I6ZQXYOCUml+C0PGs5TfQDXs0VbYj08flVxw9732FPqzp
+PhkZJlEbnu7+nEW4mb+aM+pnPnW7iLeCvePGXicYO9YctQNA9Onxe+63QtEi2OtO
+24wlqreToA2qQ7UOeNbpcY5p9psgXt9wW+8rq1gXmKsci8DV//1MessDTTX4tgIh
+lOvKBIqx2E2kIIbZ6BwB7veKCkwqrFeVKzmwCXfkVQZkyfxKTBOvf3VFssnFJ7Ld
+dYuAMTpl9jCHkNykGNlc0a9ohglEvAjqwgpUdMcuzMMR8Kf0DjqZqwIDAQABo20w
+azAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD
+VR0OBBYEFOYSmMCX8XUYA9jMGY2M1v5/xaimMB8GA1UdIwQYMBaAFLYkwqnYXdk8
+BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQArYXsdMl+vPyTyv/oRzCo0
+mWyVO3RZPPRJSrrMz4UjtVMIfq6pnV+AXPEcWL/zEfQNcRPjsJeezkG66AZbI+ug
+fur90YVDhWfOgde4E3cVhZz90aM/jcRMVvwNj0XiaX4JpxsVhv5T4LC80aXm0r02
+YfJyqwtNaZlKDntaW56q7nD5eaoqmYa+ogpdqwCIfGvManfRH6v6xmzgQRKnD1lc
+LZPDZ9dmkQg2N/vdZfVUpB2+EZYF/9BuIvJyGKNYBjJiQGv2kbaFUl13mw7D/yGP
+Zytpu5AIPl6ScYog8x6dSJMiYM+hO1bD9qOU0Kq48PaLQoQ4poYo7zdbiB8TZaKC
+-----END CERTIFICATE-----

certs/tls/server-dns.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDNctnZl7JK67MI
+MQ9ewczKbSnLtO7CLO7lrgApC37t3xvnXHbZb4jplBdg4JSaX4LQ8azlN9ANezRV
+tiPTx+VXHD3vfYU+rOk+GRkmURue7v6cRbiZv5oz6mc+dbuIt4K948ZeJxg71hy1
+A0D06fF77rdC0SLY607bjCWqt5OgDapDtQ541ulxjmn2myBe33Bb7yurWBeYqxyL
+wNX//Ux6ywNNNfi2AiGU68oEirHYTaQghtnoHAHu94oKTCqsV5UrObAJd+RVBmTJ
+/EpME69/dUWyycUnst11i4AxOmX2MIeQ3KQY2VzRr2iGCUS8COrCClR0xy7MwxHw
+p/QOOpmrAgMBAAECggEAKOWyBCS0c0GUNA9AFgbSM4Gjjk+IL9MuAz6t/X2yWLvP
+HDFF32bahFTcioZqToiwy9MwLbj8i5J5Co7lduUV/E887Q25lo5pJ9lrLjt7GhpN
+SOKAKur/UVJaFw7ss/yD5DURafCyXEb1E/t/1ME1NwyAIqbrHu9IlV/Cp8c/dd6n
+BUZHKN38Fs8riUOTW4BwAA1dV0k+g8bKb0byR5WmXbXqWG/XjfUKcI4Dg9ILsTwG
+QgI/nzRyAV2unVcdNhM4pMTJ4U4x1Dh/rsWyQ4b206namkpfaIH7j8ovRY2OHhzT
+EuCbn1Cpfmxp68hRrvMIhLvqVkXOSWzKOkHZba/qYQKBgQD0m3WJu5UHXip14gY/
+SmDm3vEcFjVZa+BmQtojs32ZfT/b1H5U+mfhXlVi0yf7B7nitQ9zOA7A2C8cxdtr
+X9zd81MHLc7yUEOAlHBqSfBX/DyF1iRsdM7GYYxrsaECM7NIDukDR1Q/DvMZodRx
+iVpRkNP3s87a1/QwvDKrwOPcCQKBgQDXBH1IZWcl1mrGgfAI7r5wXIJo0IrTlUcT
+4nFSNv5YnrhnRzmLDRqxwlUs4II87nzsqv7OYryAg4n8us+X6XQv0hvTKcHsM7tl
+vAO2EeQIER71tEg45HhmAXo2X2bE5kNMTr4COlb8k6R6r5K2F4yVMZim4qPcMYAK
+tNRXf9JdEwKBgQDEjpOxvPmxdPrbxWfNvgAGJYpMTpBKLgShSAEwhRBdoacKCEQI
+FzwYfoxQoGtVLk0yHtqudJJuZondLiT2sI60D85dS3MrhlHn5eA7mPS4Tyl3Rq/4
+Mxjhkwuakp9WPKNJOSoHB29sSKASrdcf8QaR2rZqKqQDeVtxOhnhqFuxuQKBgHrk
+8/53BteXj/vZtKpGWs658UebOl3oinGREZgeGo3oWhmdmgQh/0nueuRlhcrxvLFA
+otavlHIXvLyYwaJgKqpSetjcmxw4DTn+llhwLVd3Aa0J1+W8oBwdaA6/xGtx+LEa
+qHt5gNJoSLBevYoaN53mdQudqm5mVHrKFDvWsRPFAoGBALAkJiXM4y+aTcwREjnO
+CgebDRru37mprDW2PDa4vpTydxIcXZukTEZqXbVnXNDY/Gkyv06jYoY2R7mzbgfl
+7RJIFAQffkzoeFadQZqimIAN3sQ6RRzNqmAlS2D6zjylX7N2rDiPcS3LtrJZHEyk
+gTFx7+6gjfPNqPiAB5su0IJm
+-----END PRIVATE KEY-----

deploy/README.md

@@ -1,278 +0,0 @@
-# Deploy Layout
-
-`deploy/` 目录按角色拆分为四套部署与测试入口：
-
-- `server/`: 本仓库 RTR Server（`src/main.rs`）容器化部署
-- `client/`: 本仓库 `rtr_debug_client` 容器化部署
-- `frr/`: FRR 作为黑盒 RTR Client 的配置与 compose
-
----
-
-## 0) Build and Run Scripts
-
-`deploy/server/build-run.sh` 只管理 server，`deploy/client/build-run.sh` 只管理 debug client。两个脚本默认 action 都是 `up`，默认 mode 都是 `tcp`。
-
-常用命令：
-
-以下命令默认从仓库根目录执行。
-
-```bash
-chmod +x deploy/server/build-run.sh deploy/client/build-run.sh
-./deploy/server/build-run.sh up --mode tcp
-./deploy/client/build-run.sh up --mode tcp
-./deploy/client/build-run.sh up --clients multi
-./deploy/client/build-run.sh down
-./deploy/server/build-run.sh down
-```
-
-常用参数：
-
-| 参数/变量 | server | client | 说明 |
-| --- | --- | --- | --- |
-| `--mode base\|tcp\|tls\|ssh`, `MODE` | yes | yes | 选择 compose 模式，默认 `tcp`。 |
-| `--clients single\|multi`, `CLIENTS` | no | yes | 单 client 或 5 client，默认 `single`。 |
-| `--no-build`, `BUILD=0` | yes | yes | 只运行已有镜像，不执行 compose build。 |
-| `--server-image TAG`, `SERVER_IMAGE` | yes | no | server 镜像名；会传给 compose 的 `RPKI_RTR_SERVER_IMAGE`。 |
-| `--client-image TAG`, `CLIENT_IMAGE` | no | yes | client 镜像名；会传给 compose 的 `RPKI_RTR_CLIENT_IMAGE`。 |
-| `--platform VALUE`, `TARGET_PLATFORM` | yes | yes | `buildx` 目标平台，默认 `linux/arm64`。 |
-| `--push`, `BUILDX_PUSH=1` | yes | yes | `buildx` 构建后推送到 registry；不设置时加载到本地 Docker。 |
-| `--skip-base-pull`, `SKIP_BASE_IMAGE_PULL=1` | yes | yes | 跳过 buildx 前的基础镜像预拉取。 |
-
-支持的 action 包括 `up`、`build`、`buildx`、`rebuild`、`down`/`stop`、`restart`、`logs`、`ps`。完整帮助见：
-
-```bash
-./deploy/server/build-run.sh --help
-./deploy/client/build-run.sh --help
-```
-
-### x86 Build, ARM Deploy
-
-x86 开发机上用 Docker Buildx 分别构建 ARM server/client 镜像。不加 `--push` 时，脚本会把单平台镜像加载到本地 Docker，随后可用 `docker save` 打包传到 ARM 机器。buildx 前会自动按目标平台预拉取 `rust:1.89-bookworm` 和 `debian:bookworm-slim`。
-
-```bash
-docker buildx create --use --name rpki-builder
-docker buildx inspect --bootstrap
-
-./deploy/server/build-run.sh buildx \
-  --platform linux/arm64 \
-  --server-image rpki-rtr:arm64
-
-./deploy/client/build-run.sh buildx \
-  --platform linux/arm64 \
-  --client-image rpki-rtr-debug-client:arm64
-
-mkdir -p dist/images
-docker save rpki-rtr:arm64 -o dist/images/rpki-rtr-arm64.tar
-docker save rpki-rtr-debug-client:arm64 -o dist/images/rpki-rtr-debug-client-arm64.tar
-```
-
-把 tar 包传到 ARM 部署机：
-
-```bash
-scp dist/images/*.tar user@arm-host:/tmp/
-```
-
-ARM 部署机上加载镜像并运行，不再本地构建：
-
-```bash
-docker load -i /tmp/rpki-rtr-arm64.tar
-docker load -i /tmp/rpki-rtr-debug-client-arm64.tar
-
-SERVER_IMAGE=rpki-rtr:arm64 \
-BUILD=0 ./deploy/server/build-run.sh up --mode tcp
-
-CLIENT_IMAGE=rpki-rtr-debug-client:arm64 \
-BUILD=0 ./deploy/client/build-run.sh up --mode tcp
-```
-
-如果不使用脚本，也可以通过 compose 环境变量指定镜像：
-
-```bash
-export RPKI_RTR_SERVER_IMAGE=rpki-rtr:arm64
-docker compose --env-file deploy/server/.env \
-  -f deploy/server/docker-compose.tcp.yml up -d --no-build
-```
-
----
-
-## 1) Server
-
-路径：
-- `deploy/server/Dockerfile`
-- `deploy/server/docker-compose.yml`
-- `deploy/server/DEPLOYMENT.md`
-
-单独 build 镜像：
-
-```bash
-docker build -f deploy/server/Dockerfile -t rpki-rtr:latest .
-```
-
-启动：
-
-```bash
-docker compose -f deploy/server/docker-compose.yml up -d --build
-```
-
-停止：
-
-```bash
-docker compose -f deploy/server/docker-compose.yml down
-```
-
-日志：
-
-```bash
-docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr
-```
-
-报告文件：
-
-- `report/rtr-source-*.json`：CCR/SLURM source、fingerprint、refresh 状态、数据质量、cache snapshot/delta 统计。
-- `report/rtr-clients-*.json`：client 连接数和连接方式统计，启动时和连接变化时写入。
-- `report/rtr-runtime-*.json`：进程 RSS、服务状态、当前生效 runtime configuration，启动时和周期性写入。
-
-Admin config 接口默认关闭。需要运行中动态修改 `max_delta`、delta 裁剪策略、refresh/report interval、timezone 或 RTR timing 时，设置：
-
-```env
-RPKI_RTR_ADMIN_ADDR=127.0.0.1:8323
-RPKI_RTR_ADMIN_TOKEN=change-me
-```
-
-调用示例：
-
-```bash
-curl -X POST http://127.0.0.1:8323/admin/rtr/config \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer change-me" \
-  -d '{"max_delta": 6, "prune_delta_by_snapshot_size": true}'
-```
-
-完整 API 说明见 `docs/rtr-admin-api.md`，更完整的 server 配置见 `deploy/server/DEPLOYMENT.md`。
-
----
-
-## 2) Debug Client
-
-路径：
-- `deploy/client/Dockerfile`
-- `deploy/client/docker-compose.yml`
-- `deploy/client/docker-compose.clients.yml`
-
-单独 build 镜像：
-
-```bash
-docker build -f deploy/client/Dockerfile -t rpki-rtr-debug-client:latest .
-```
-
-单实例启动（交互调试）：
-
-```bash
-docker compose -f deploy/client/docker-compose.yml up --build
-```
-
-单实例停止：
-
-```bash
-docker compose -f deploy/client/docker-compose.yml down
-```
-
-单实例日志：
-
-```bash
-docker compose -f deploy/client/docker-compose.yml logs -f rtr-debug-client
-```
-
-多实例启动（5 个并发 client）：
-
-```bash
-docker compose -f deploy/client/docker-compose.clients.yml up -d
-```
-
-多实例停止：
-
-```bash
-docker compose -f deploy/client/docker-compose.clients.yml down
-```
-
-多实例日志：
-
-```bash
-docker compose -f deploy/client/docker-compose.clients.yml logs -f
-```
-
----
-
-## 3) FRR Client
-
-路径：
-- `deploy/frr/docker-compose.yml`
-- `deploy/frr/daemons.example`
-- `deploy/frr/frr.conf.example`
-- `deploy/frr/README.md`
-- `deploy/frr/README.zh.md`
-
-启动：
-
-```bash
-docker compose -f deploy/frr/docker-compose.yml up -d
-```
-
-检查连接：
-
-```bash
-docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection"
-docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table"
-```
-
-停止：
-
-```bash
-docker compose -f deploy/frr/docker-compose.yml down
-```
-
-日志：
-
-```bash
-docker compose -f deploy/frr/docker-compose.yml logs -f frr-rpki-client
-```
-
----
-
-## 4) BIRD Client
-
-路径:
-- `deploy/bird/Dockerfile`
-- `deploy/bird/docker-compose.yml`
-- `deploy/bird/docker-compose.tls.yml`
-- `deploy/bird/bird.conf.example`
-- `deploy/bird/bird.conf.tls.example`
-- `deploy/bird/README.md`
-- `deploy/bird/README.zh.md`
-
-启动:
-```bash
-docker compose -f deploy/bird/docker-compose.yml up --build
-```
-
-观察活动:
-
-```bash
-docker logs -f bird-rpki-client
-```
-
-停止:
-```bash
-docker compose -f deploy/bird/docker-compose.yml down
-```
-
-日志:
-```bash
-docker compose -f deploy/bird/docker-compose.yml logs -f bird-rpki-client
-```
-
-TLS/mTLS:
-```bash
-docker compose -f deploy/bird/docker-compose.yml -f deploy/bird/docker-compose.tls.yml up --build
-docker logs -f bird-rpki-client
-```

deploy/bird/.env

@@ -2,7 +2,7 @@
 RPKI_BIRD_VERSION=3.2.1
 
 # TCP mode target endpoint.
-RPKI_BIRD_RPKI_HOST=rpki-rtr-tcp
+RPKI_BIRD_RPKI_HOST=rpki-rtr
 RPKI_BIRD_RPKI_PORT=323
 
 # SSH mode target endpoint.
@@ -30,4 +30,4 @@ RPKI_BIRD_SHOW_ROA6=1
 
 # Host volume mounts.
 RPKI_BIRD_LOG_HOST_DIR=../../logs/bird
-RPKI_BIRD_SSH_CERTS_HOST_DIR=../../certs
+RPKI_BIRD_SSH_CERTS_HOST_DIR=../../certs/ssh

deploy/bird/README.md

@@ -82,7 +82,7 @@ docker logs -f bird-rpki-client
   `OBSERVE_DEBOUNCE_SECS` (default `1`),
   `OBSERVE_INTERVAL` (seconds, used when `OBSERVE_MODE=interval`),
   and `OBSERVE_PROTO`.
-- SSH mode mounts `../../certs` into `/config/ssh` and expects:
+- SSH mode mounts `../../certs/ssh` into `/config/ssh` and expects:
   `bird-rtr-client.pem` and `ssh_host_rsa_key.pub`.
 - Entrypoint auto-generates `/run/bird/known_hosts` from
   `/config/ssh/ssh_host_rsa_key.pub` for BIRD SSH host-key verification.

deploy/bird/README.zh.md

@@ -73,7 +73,7 @@ docker logs -f bird-rpki-client
 
 - 当前 compose 使用 `network_mode: host`，默认通过 `host.docker.internal` 访问 server。
 - 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `30`）和 `OBSERVE_PROTO`。
-- SSH 模式会将 `../../certs` 挂载到容器 `/config/ssh`，并使用：
+- SSH 模式会将 `../../certs/ssh` 挂载到容器 `/config/ssh`，并使用：
   `bird-rtr-client.pem`、`ssh_host_rsa_key.pub`。
 - 入口脚本会基于 `/config/ssh/ssh_host_rsa_key.pub` 自动生成
   `/run/bird/known_hosts`，用于 BIRD 的 SSH 主机密钥校验。

deploy/bird/docker-compose.ssh.yml

@@ -7,7 +7,7 @@ services:
       OBSERVE_PROTO: "rpki_ssh"
     volumes:
       - ./bird.conf.ssh.template:/config/bird.conf.ssh.template:ro
-      - ${RPKI_BIRD_SSH_CERTS_HOST_DIR:-../../certs}:/config/ssh:ro
+      - ${RPKI_BIRD_SSH_CERTS_HOST_DIR:-../../certs/ssh}:/config/ssh:ro
     networks:
       - rpki_net
 

deploy/bird/docker-compose.yml

@@ -10,7 +10,7 @@ services:
     environment:
       BIRD_CONFIG_TEMPLATE_PATH: "${RPKI_BIRD_CONFIG_TEMPLATE_PATH:-/config/bird.conf.template}"
 
-      RPKI_HOST: "${RPKI_BIRD_RPKI_HOST:-rpki-rtr-tcp}"
+      RPKI_HOST: "${RPKI_BIRD_RPKI_HOST:-rpki-rtr}"
       RPKI_PORT: "${RPKI_BIRD_RPKI_PORT:-323}"
 
       OBSERVE_PROTO: "${RPKI_BIRD_OBSERVE_PROTO:-rpki_tcp}"

deploy/client/.env

@@ -1,8 +1,10 @@
-# Target RTR server address for client compose files
+# Target RTR server addresses for client compose files
 # TCP example: 10.0.0.12:323
 # TLS example: rpki.example.com:324
 # SSH example: 10.0.0.12:22
-RPKI_RTR_SERVER_ADDR=rpki-rtr-tcp:323
+RPKI_RTR_TCP_SERVER_ADDR=rpki-rtr:323
+RPKI_RTR_TLS_SERVER_ADDR=rpki-rtr:324
+RPKI_RTR_SSH_SERVER_ADDR=rpki-rtr:22
 
 # RTR protocol version used as client command second argument (supported: 0,1,2)
 RPKI_RTR_PROTOCOL_VERSION=2
@@ -13,14 +15,14 @@ RPKI_RTR_TLS_SERVER_NAME=localhost
 RPKI_RTR_TLS_CA_CERT_PATH=/app/certs/client-ca.crt
 RPKI_RTR_TLS_CLIENT_CERT_PATH=/app/certs/client-good.crt
 RPKI_RTR_TLS_CLIENT_KEY_PATH=/app/certs/client-good.key
-RPKI_RTR_TLS_CERTS_HOST_DIR=../../tests/fixtures/tls
+RPKI_RTR_TLS_CERTS_HOST_DIR=../../certs/tls
 
 # Shared client logs mount on host.
 RPKI_RTR_CLIENT_LOG_HOST_DIR=../../logs/client
 
 # SSH mode examples:
-# RPKI_RTR_SERVER_ADDR=10.0.0.12:2222
+# RPKI_RTR_SSH_SERVER_ADDR=10.0.0.12:2222
-RPKI_RTR_CLIENT_KEYS_VOLUME=../../certs:/app/certs:ro
+RPKI_RTR_CLIENT_KEYS_VOLUME=../../certs/ssh:/app/certs:ro
 RPKI_RTR_CLIENT_KEY_PATH=/app/certs/rtr-client.key
 RPKI_RTR_SSH_SERVER_PUBKEY_PATH=/app/certs/ssh_host_rsa_key.pub
 RPKI_RTR_SSH_USERNAME=rpki-rtr

deploy/client/docker-compose.clients.yml

@@ -3,7 +3,7 @@ version: "3.9"
 services:
   rtr-client-1:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
@@ -12,7 +12,7 @@ services:
 
   rtr-client-2:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
@@ -21,7 +21,7 @@ services:
 
   rtr-client-3:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
@@ -30,7 +30,7 @@ services:
 
   rtr-client-4:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
@@ -39,7 +39,7 @@ services:
 
   rtr-client-5:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no

deploy/client/docker-compose.ssh.password.yml

@@ -8,7 +8,7 @@ services:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
     command:
       [
-        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
+        "${RPKI_RTR_SSH_SERVER_ADDR:-rpki-rtr:22}",
         "${RPKI_RTR_PROTOCOL_VERSION:-2}",
         "reset",
         "--ssh",
@@ -22,7 +22,7 @@ services:
         "--summary-only"
       ]
     volumes:
-      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro}
+      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs/ssh:/app/certs:ro}
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
     stdin_open: true

deploy/client/docker-compose.ssh.yml

@@ -8,7 +8,7 @@ services:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
     command:
       [
-        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
+        "${RPKI_RTR_SSH_SERVER_ADDR:-rpki-rtr:22}",
         "${RPKI_RTR_PROTOCOL_VERSION:-2}",
         "reset",
         "--ssh",
@@ -22,7 +22,7 @@ services:
         "--summary-only"
       ]
     volumes:
-      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro}
+      - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs/ssh:/app/certs:ro}
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
     stdin_open: true

deploy/client/docker-compose.tcp.yml

@@ -4,7 +4,7 @@ services:
       context: ../..
       dockerfile: deploy/client/Dockerfile
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no

deploy/client/docker-compose.tls.yml

@@ -8,7 +8,7 @@ services:
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
     command:
       [
-        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tls:324}",
+        "${RPKI_RTR_TLS_SERVER_ADDR:-rpki-rtr:324}",
         "${RPKI_RTR_PROTOCOL_VERSION:-2}",
         "reset",
         "--tls",
@@ -24,7 +24,7 @@ services:
         "--summary-only"
       ]
     volumes:
-      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro
+      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../certs/tls}:/app/certs:ro
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no
     stdin_open: true

deploy/client/docker-compose.yml

@@ -4,7 +4,7 @@ services:
       context: ../..
       dockerfile: deploy/client/Dockerfile
     image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
-    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
+    command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
     volumes:
       - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
     restart: no

deploy/frr/.env

@@ -0,0 +1,4 @@
+# RTR server endpoint used by deploy/frr/frr.conf.template.
+RPKI_FRR_RPKI_HOST=127.0.0.1
+RPKI_FRR_RPKI_PORT=323
+RPKI_FRR_RPKI_PREFERENCE=1

deploy/frr/README.md

@@ -15,7 +15,10 @@ Reference:
 ## Files
 
 - `daemons.example`: sample `/etc/frr/daemons`
-- `frr.conf.example`: sample `/etc/frr/frr.conf`
+- `frr.conf.example`: static sample `/etc/frr/frr.conf`
+- `frr.conf.template`: Docker template used to generate `/etc/frr/frr.conf`
+- `entrypoint.sh`: renders `frr.conf.template` from environment variables before starting FRR
+- `.env`: default Docker environment values
 
 ## How to apply on an FRR host
 
@@ -44,21 +47,32 @@ contains VRPs, the RTR client path is working.
 From repository root:
 
 ```bash
-docker compose -f deploy/frr/docker-compose.yml up -d
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
 docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection"
 docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table"
 ```
 
+The Docker example defaults to `127.0.0.1:323`. Override the RTR server
+endpoint with environment variables:
+
+```bash
+RPKI_FRR_RPKI_HOST=10.0.0.12 \
+RPKI_FRR_RPKI_PORT=323 \
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
+```
+
 Stop:
 
 ```bash
-docker compose -f deploy/frr/docker-compose.yml down
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down
 ```
 
 ## Notes
 
 - This setup targets RTR over TCP (`rpki cache tcp`).
+- Docker mode renders `frr.conf.template` into `/etc/frr/frr.conf` at startup.
 - Keep protocol-level conformance checks in Rust tests and
   `src/bin/rtr_debug_client`.
-- `network_mode: host` expects your RTR server to be reachable at
+- `network_mode: host` is kept for the minimal FRR container example, but the
-  `127.0.0.1:323` from the Docker host.
+  RTR server address is controlled by `RPKI_FRR_RPKI_HOST` and
+  `RPKI_FRR_RPKI_PORT`.

deploy/frr/README.zh.md

@@ -12,7 +12,10 @@
 ## 文件说明
 
 - `daemons.example`：示例 `/etc/frr/daemons`
-- `frr.conf.example`：示例 `/etc/frr/frr.conf`
+- `frr.conf.example`：静态示例 `/etc/frr/frr.conf`
+- `frr.conf.template`：Docker 启动时生成 `/etc/frr/frr.conf` 的模板
+- `entrypoint.sh`：启动 FRR 前根据环境变量渲染 `frr.conf.template`
+- `.env`：Docker 示例使用的默认环境变量
 
 ## 在 FRR 主机上应用
 
@@ -40,15 +43,23 @@ vtysh -c "show rpki prefix-table"
 在仓库根目录执行：
 
 ```bash
-docker compose -f deploy/frr/docker-compose.yml up -d
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
 docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection"
 docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table"
 ```
 
+Docker 示例默认连接 `127.0.0.1:323`。如果 RTR Server 在其他地址，可以通过环境变量覆盖：
+
+```bash
+RPKI_FRR_RPKI_HOST=10.0.0.12 \
+RPKI_FRR_RPKI_PORT=323 \
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d
+```
+
 停止：
 
 ```bash
-docker compose -f deploy/frr/docker-compose.yml down
+docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down
 ```
 
 ## 可测试范围
@@ -68,4 +79,5 @@ docker compose -f deploy/frr/docker-compose.yml down
 ## 说明
 
 - 当前示例主要针对 RTR over TCP（`rpki cache tcp`）
-- `network_mode: host` 模式下，容器内访问 `127.0.0.1:323` 指向 Docker Host，请确保本机 RTR Server 可达
+- Docker 模式会在启动时把 `frr.conf.template` 渲染为 `/etc/frr/frr.conf`
+- `network_mode: host` 仍用于最小化 FRR 容器示例，但 RTR Server 地址由 `RPKI_FRR_RPKI_HOST` 和 `RPKI_FRR_RPKI_PORT` 控制

deploy/frr/docker-compose.yml

@@ -5,6 +5,12 @@ services:
     restart: unless-stopped
     network_mode: host
     privileged: true
+    environment:
+      RPKI_FRR_RPKI_HOST: "${RPKI_FRR_RPKI_HOST:-127.0.0.1}"
+      RPKI_FRR_RPKI_PORT: "${RPKI_FRR_RPKI_PORT:-323}"
+      RPKI_FRR_RPKI_PREFERENCE: "${RPKI_FRR_RPKI_PREFERENCE:-1}"
+    entrypoint: ["/bin/sh", "/config/entrypoint.sh"]
     volumes:
-      - ./frr/daemons.example:/etc/frr/daemons:ro
+      - ./daemons.example:/etc/frr/daemons:ro
-      - ./frr/frr.conf.example:/etc/frr/frr.conf:ro
+      - ./frr.conf.template:/config/frr.conf.template:ro
+      - ./entrypoint.sh:/config/entrypoint.sh:ro

deploy/frr/entrypoint.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+
+: "${RPKI_FRR_RPKI_HOST:=127.0.0.1}"
+: "${RPKI_FRR_RPKI_PORT:=323}"
+: "${RPKI_FRR_RPKI_PREFERENCE:=1}"
+: "${RPKI_FRR_CONFIG_TEMPLATE_PATH:=/config/frr.conf.template}"
+: "${RPKI_FRR_CONFIG_PATH:=/etc/frr/frr.conf}"
+
+escape_sed() {
+  printf '%s' "$1" | sed 's/[&|\\]/\\&/g'
+}
+
+host="$(escape_sed "${RPKI_FRR_RPKI_HOST}")"
+port="$(escape_sed "${RPKI_FRR_RPKI_PORT}")"
+preference="$(escape_sed "${RPKI_FRR_RPKI_PREFERENCE}")"
+
+sed \
+  -e "s|\${RPKI_FRR_RPKI_HOST}|${host}|g" \
+  -e "s|\${RPKI_FRR_RPKI_PORT}|${port}|g" \
+  -e "s|\${RPKI_FRR_RPKI_PREFERENCE}|${preference}|g" \
+  "${RPKI_FRR_CONFIG_TEMPLATE_PATH}" > "${RPKI_FRR_CONFIG_PATH}"
+
+exec /usr/lib/frr/docker-start

deploy/frr/frr.conf.template

@@ -0,0 +1,22 @@
+frr version 10.2
+frr defaults traditional
+hostname rpki-lab
+service integrated-vtysh-config
+!
+debug rpki
+!
+rpki
+ rpki polling_period 10
+ rpki timeout 10
+ rpki retry_interval 10
+ rpki expire_interval 7200
+ rpki cache tcp ${RPKI_FRR_RPKI_HOST} ${RPKI_FRR_RPKI_PORT} preference ${RPKI_FRR_RPKI_PREFERENCE}
+ exit
+!
+router bgp 65001
+ bgp router-id 192.0.2.1
+ !
+ address-family ipv4 unicast
+ exit-address-family
+!
+line vty

deploy/server/.env

@@ -5,10 +5,6 @@ RPKI_RTR_SLURM_HOST_DIR=../../data
 # In-container data source directories.
 RPKI_RTR_CCR_DIR=/app/data
 RPKI_RTR_SLURM_DIR=/app/slurm
-
-# Persistent directories on host.
-RPKI_RTR_DB_HOST_DIR=../../rtr-db
-RPKI_RTR_LOG_HOST_DIR=../../logs/server
 RPKI_RTR_REPORT_HOST_DIR=../../report
 
 # In-container runtime paths.
@@ -16,6 +12,9 @@ RPKI_RTR_DB_PATH=/app/rtr-db
 RPKI_RTR_REPORT_DIR=/app/report
 
 # Core runtime knobs.
+# Persistent directories on host.
+RPKI_RTR_DB_HOST_DIR=../../rtr-db
+RPKI_RTR_LOG_HOST_DIR=../../logs/server
 RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS=300
 RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300
 RPKI_RTR_REPORT_HISTORY_LIMIT=10
@@ -32,7 +31,8 @@ RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH=false
 RPKI_RTR_TLS_CERT_PATH=/app/certs/server-dns.crt
 RPKI_RTR_TLS_KEY_PATH=/app/certs/server-dns.key
 RPKI_RTR_TLS_CLIENT_CA_PATH=/app/certs/client-ca.crt
-RPKI_RTR_TLS_CERTS_HOST_DIR=../../tests/fixtures/tls
+
+RPKI_RTR_TLS_CERTS_HOST_DIR=../../certs/tls
 
 # SSH mode knobs.
 RPKI_RTR_SSH_HOST_PORT=2222
@@ -40,7 +40,7 @@ RPKI_RTR_SSH_CONTAINER_PORT=22
 RPKI_RTR_SSH_AUTH_MODE=key
 RPKI_RTR_SSH_USERNAME=rpki-rtr
 RPKI_RTR_SSH_SUBSYSTEM_NAME=rpki-rtr
-RPKI_RTR_SSH_HOST_KEY_PATH=/host-ssh/ssh_host_ed25519_key
+RPKI_RTR_SSH_HOST_KEY_PATH=/app/certs/ssh_host_rsa_key
 RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH=/app/certs/rtr-authorized_keys
-RPKI_RTR_SSH_KEYS_VOLUME=/etc/ssh:/host-ssh:ro
+
-RPKI_RTR_SSH_CERTS_HOST_DIR=../../certs
+RPKI_RTR_SSH_CERTS_HOST_DIR=../../certs/ssh

deploy/server/DEPLOYMENT.md

@@ -38,7 +38,7 @@ The container runs `rpki` directly as PID 1.
 - Core: `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG`
 - TCP mode: `RPKI_RTR_MAX_CONNECTIONS`
 - TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR`
-- SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
+- SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
 
 ## Start
 

deploy/server/docker-compose.ssh.yml

@@ -17,7 +17,7 @@ services:
       RPKI_RTR_ENABLE_SSH: "true"
       RPKI_RTR_TCP_ADDR: "0.0.0.0:323"
       RPKI_RTR_SSH_ADDR: "0.0.0.0:${RPKI_RTR_SSH_CONTAINER_PORT:-22}"
-      RPKI_RTR_SSH_HOST_KEY_PATH: "${RPKI_RTR_SSH_HOST_KEY_PATH:-/host-ssh/ssh_host_ed25519_key}"
+      RPKI_RTR_SSH_HOST_KEY_PATH: "${RPKI_RTR_SSH_HOST_KEY_PATH:-/app/certs/ssh_host_rsa_key}"
       RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "${RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH:-/app/certs/rtr-authorized_keys}"
       RPKI_RTR_SSH_USERNAME: "${RPKI_RTR_SSH_USERNAME:-rpki-rtr}"
       RPKI_RTR_SSH_SUBSYSTEM_NAME: "${RPKI_RTR_SSH_SUBSYSTEM_NAME:-rpki-rtr}"
@@ -42,8 +42,7 @@ services:
       - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
       - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
       - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
-      - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro}
+      - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs/ssh}:/app/certs:ro
-      - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs}:/app/certs:ro
       - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
       - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
     networks:

deploy/server/docker-compose.tls.yml

@@ -36,7 +36,7 @@ services:
       - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro
       - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db}
       - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm}
-      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro
+      - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../certs/tls}:/app/certs:ro
       - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
       - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
     networks:

deploy/server/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       # RPKI_RTR_ENABLE_SSH: "true"
       # RPKI_RTR_SSH_ADDR: "0.0.0.0:22"
       # RPKI_RTR_SSH_PORT: "22"
-      # RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_ed25519_key"
+      # RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_rsa_key"
       # RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys"
       # RPKI_RTR_SSH_USERNAME: "rpki-rtr"
       # RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr"
@@ -48,7 +48,7 @@ services:
       - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs
       - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report}
       # TLS mode example:
-      # - ../../certs:/app/certs:ro
+      # - ../../certs/ssh:/app/certs:ro
     networks:
       - rpki_net
 

src/rtr/config.rs

@@ -94,11 +94,11 @@ impl Default for AppConfig {
             db_path: "./rtr-db".to_string(),
             ccr_dir: "./data".to_string(),
             slurm_dir: None,
-            tls_cert_path: "./certs/server.crt".to_string(),
+            tls_cert_path: "./certs/tls/server-dns.crt".to_string(),
-            tls_key_path: "./certs/server.key".to_string(),
+            tls_key_path: "./certs/tls/server-dns.key".to_string(),
-            tls_client_ca_path: "./certs/client-ca.crt".to_string(),
+            tls_client_ca_path: "./certs/tls/client-ca.crt".to_string(),
-            ssh_host_key_path: "./certs/ssh_host_ed25519_key".to_string(),
+            ssh_host_key_path: "./certs/ssh/ssh_host_rsa_key".to_string(),
-            ssh_authorized_keys_path: "./certs/rtr-authorized_keys".to_string(),
+            ssh_authorized_keys_path: "./certs/ssh/rtr-authorized_keys".to_string(),
             ssh_username: "rpki-rtr".to_string(),
             ssh_subsystem_name: "rpki-rtr".to_string(),
             ssh_auth_mode: SshAuthMode::Key,