# rpki-explorer standalone stack

One container running the RPKI Explorer web UI plus the query backend
(`rpki_query_service` in watch mode, spawning `rpki_query_indexer`), deployed
next to a running ours-RP soak. It mounts the soak outputs **read-only** and
keeps only the latest `RETAIN_RUNS` indexed runs.

```text
browser ──ssh -L──► 127.0.0.1:9517 ──► container
                                        ├─ nginx :8080  (dist + /api/v1/ proxy)
                                        └─ rpki_query_service :9557
                                             ├─ /data/query-db        (host bind mount, rw, reused on restart)
                                             ├─ /soak/db/repo-bytes.db (ro)
                                             └─ /soak/runs             (ro, watched)
```

## Prerequisites

- Docker with the compose plugin (`docker compose version`) on the target host.
- A running soak whose `runs/` directories contain `report.json` (and
  `run-summary.json` once finished) — only completed runs get indexed.

## Build (local machine, same arch as the target)

```bash
deploy/rpki-explorer/build_image.sh
# tarball + provenance land in target/rpki-explorer-image/
```

The build runs entirely inside Docker (rust release binaries + vite build),
so no local toolchain version requirements apply.

## Transfer and deploy (remote host)

```bash
cat target/rpki-explorer-image/rpki-explorer-<tag>.tar.gz | ssh root@<host> 'gunzip | docker load'

ssh root@<host>
mkdir -p /root/rpki128_explorer
cd /root/rpki128_explorer
# place docker-compose.yml and .env here (see .env.example)
docker compose up -d
docker logs -f rpki-explorer
```

On first boot the entrypoint computes
`--watch-min-run-seq = latest_completed - RETAIN_RUNS + 1` so exactly the
latest `RETAIN_RUNS` completed runs are backfilled. On later boots the
existing query-db drives continuation — the index built earlier is reused, no
re-backfill happens.

## Access

```bash
ssh -L 9517:127.0.0.1:9517 root@<host>
# open http://127.0.0.1:9517
```

The stack binds loopback only; there is no authentication or TLS.

## Upgrade

Rebuild the image with a new tag, transfer and `docker load`, update
`IMAGE_TAG` in `.env`, then `docker compose up -d`. The query-db on the host
is preserved.

## Rollback / removal

```bash
docker compose down
# keep /root/rpki128_explorer/query-db to reuse the index later, or delete it
# to force a fresh backfill of the latest RETAIN_RUNS runs.
```

The soak stack is never touched; removing the explorer stack has no effect on
it.