117 lines
4.6 KiB
Plaintext
117 lines
4.6 KiB
Plaintext
# ours RP Docker installer configuration
|
|
# `build_docker_installer_package.sh` rewrites package-specific placeholders
|
|
# when producing amd64/arm64 release packages.
|
|
# 中文说明见 docs/README.zh-CN.md。English guide: docs/README.en.md
|
|
# Every assignment is a required non-empty configuration key with a package
|
|
# default. During upgrade: .env.example < reused old .env < command environment.
|
|
|
|
# Package metadata and architecture guardrails.
|
|
PACKAGE_ARCH=__PACKAGE_ARCH__
|
|
PACKAGE_PLATFORM=__PACKAGE_PLATFORM__
|
|
ALLOW_CROSS_ARCH=0
|
|
|
|
# Compose project name.
|
|
COMPOSE_PROJECT_NAME=ours-rp-__PACKAGE_ARCH__-installer
|
|
|
|
# Runtime image rebuilt from the current source commit while packaging.
|
|
RPKI_IMAGE=__RUNTIME_IMAGE__
|
|
RPKI_PLATFORM=__PACKAGE_PLATFORM__
|
|
|
|
# Metrics image rebuilt from the current source commit while packaging.
|
|
METRICS_IMAGE=__METRICS_IMAGE__
|
|
METRICS_PLATFORM=__PACKAGE_PLATFORM__
|
|
|
|
# Restart policy for the soak container. Production default keeps the daemon alive.
|
|
# For finite acceptance tests such as MAX_RUNS=3, set SOAK_RESTART_POLICY=no to avoid an extra restarted run.
|
|
SOAK_RESTART_POLICY=unless-stopped
|
|
|
|
# Host-side persistent data directory. All state/runs/logs/monitoring data are bind-mounted here.
|
|
HOST_DATA_DIR=__HOST_DATA_DIR__
|
|
|
|
# RIR list. Options: afrinic,apnic,arin,lacnic,ripe
|
|
RIRS=afrinic,apnic,arin,lacnic,ripe
|
|
|
|
# Negative MAX_RUNS means keep running forever. Default production interval is 10 minutes.
|
|
MAX_RUNS=-1
|
|
INTERVAL_SECS=600
|
|
RETAIN_RUNS=100
|
|
|
|
# TAL/TA input mode:
|
|
# file-with-ta: use packaged fixture TAL + TA only.
|
|
# file-live-ta: use packaged fixture TAL; snapshot waits for live TA refresh, delta refreshes TA in background.
|
|
# url: pass TAL URL to child process.
|
|
TAL_INPUT_MODE=file-live-ta
|
|
LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1
|
|
LIVE_TA_REFRESH_CONNECT_TIMEOUT_SECS=15
|
|
LIVE_TA_REFRESH_MAX_TIME_SECS=120
|
|
|
|
# Sync and runtime behavior.
|
|
RSYNC_SCOPE=module-root
|
|
DISABLE_COMPETING_RPS=0
|
|
RUN_ROOT=/var/lib/ours-rp
|
|
DB_DIR=/var/lib/ours-rp/state/db
|
|
RSYNC_MIRROR_ROOT=/var/lib/ours-rp/state/rsync-mirror
|
|
# 每轮完成并复制出正式 run 产物后清理 tmp/daemon-run_*，避免长跑占满磁盘。
|
|
CLEAN_TMP_AFTER_RUN=1
|
|
OUTPUT_COMPACT_REPORT=1
|
|
ALLOW_RSYNC_MIRROR_REUSE=1
|
|
FAILURE_SNAPSHOT_RESET=1
|
|
# Periodic snapshot reset of active state DB.
|
|
# 0: keep existing behavior.
|
|
# 1: after one successful snapshot, allow at most N successful delta runs;
|
|
# the next run is forced to snapshot and active state/db is rebuilt from empty.
|
|
# Lifecycle run state is persisted independently at:
|
|
# ${HOST_DATA_DIR}/state/run-lifecycle-state.json
|
|
# It is not affected by run retention or state/db reset.
|
|
PERIODIC_SNAPSHOT_RESET=0
|
|
PERIODIC_SNAPSHOT_MAX_DELTAS=100
|
|
DB_STATS_EXACT_EVERY=0
|
|
|
|
# Resource certificate validation mode passed to the rpki child process.
|
|
# Options: validation-update-03 | rfc6487
|
|
RESOURCE_VALIDATION_MODE=validation-update-03
|
|
|
|
# Validation and performance options aligned with current optimized soak defaults.
|
|
ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE=1
|
|
RPKI_ANALYZE=1
|
|
RPKI_EXTRA_ARGS="--enable-transport-request-prefetch --enable-publication-point-validation-cache --enable-roa-validation-cache --parallel-max-repo-sync-workers-global 4 --parallel-phase2-object-workers 4 --memory-trim-after-validation"
|
|
|
|
# Progress logs.
|
|
RPKI_PROGRESS_LOG=1
|
|
RPKI_PROGRESS_SLOW_SECS=20
|
|
RPKI_PROGRESS_STAGE_FRESH_SLOW_MS=2000
|
|
RPKI_PROGRESS_PP_CONTROL_SLOW_MS=200
|
|
RPKI_PROGRESS_PP_CACHE_SLOW_MS=100
|
|
RPKI_PROGRESS_CONTROL_LOOP_SLOW_MS=2000
|
|
|
|
# Metrics sidecar.
|
|
METRICS_INSTANCE=__PACKAGE_ARCH__-installer
|
|
METRICS_PORT=9556
|
|
METRICS_POLL_SECS=10
|
|
# CCR rpki-client format check: the artifact-metrics container runs
|
|
# `rpki-client -f result.ccr` once for every newly completed run and exports
|
|
# ours_rp_ccr_format_check_* metrics. The binary is packaged inside the
|
|
# metrics image; adjust only when deliberately testing another binary.
|
|
CCR_CHECK_BIN=/opt/ours-rp/bin/rpki-client
|
|
CCR_CHECK_TIMEOUT_SECS=120
|
|
# Optional external RTR report directory produced by a separately deployed RTR service.
|
|
# Default points to an installer-managed empty fallback directory. To enable real RTR
|
|
# metrics, set this to the host-side report directory, for example:
|
|
# RTR_REPORT_DIR=/root/rpki/report
|
|
RTR_REPORT_DIR=__HOST_DATA_DIR__/empty-rtr-report
|
|
RTR_REPORT_CONTAINER_DIR=/var/lib/ours-rp/rtr-report
|
|
|
|
# Prometheus / Grafana.
|
|
# Monitor images are packaged as docker-save archives and loaded by install.sh.
|
|
MONITOR_PLATFORM=__PACKAGE_PLATFORM__
|
|
PROMETHEUS_IMAGE=prom/prometheus:v2.55.1
|
|
GRAFANA_IMAGE=grafana/grafana:11.3.1
|
|
PROMETHEUS_PORT=9090
|
|
PROMETHEUS_RETENTION=7d
|
|
GRAFANA_PORT=3000
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=admin
|
|
|
|
# First snapshot waiting timeout used by start.sh.
|
|
FIRST_RUN_WAIT_TIMEOUT_SECS=7200
|