Deployment (Docker Compose)

This project runs src/main.rs as a long-running server that:

loads latest .ccr from a configured directory,
applies optional SLURM filtering,
starts RTR server.

The container runs rpki directly as PID 1.

Files

deploy/server/Dockerfile
deploy/server/docker-compose.yml

Runtime Paths in Container

CCR directory: /app/data
RocksDB directory: /app/rtr-db
SLURM directory: /app/slurm
Report directory: /app/report
TLS cert directory (optional): /app/certs

Path Configuration via `.env`

RPKI_RTR_CCR_HOST_DIR: host CCR directory mounted into container
RPKI_RTR_SLURM_HOST_DIR: host SLURM directory mounted into container
RPKI_RTR_CCR_DIR: in-container CCR directory path
RPKI_RTR_SLURM_DIR: in-container SLURM directory path
RPKI_RTR_DB_HOST_DIR: host RocksDB directory
RPKI_RTR_LOG_HOST_DIR: host log directory
RPKI_RTR_REPORT_HOST_DIR: host directory receiving rtr-server.json
RPKI_RTR_DB_PATH: in-container RocksDB directory
RPKI_RTR_REPORT_DIR: in-container report directory

Runtime Configuration via `.env`

Core: RPKI_RTR_STRICT_CCR_VALIDATION, RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS, RPKI_RTR_MAX_DELTA, RPKI_RTR_MAX_CONCURRENT_HANDSHAKES, RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS, RPKI_RTR_REPORT_HISTORY_LIMIT, RPKI_RTR_TIMEZONE, RUST_LOG
TCP mode: RPKI_RTR_MAX_CONNECTIONS
TLS mode: RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH, RPKI_RTR_TLS_CERT_PATH, RPKI_RTR_TLS_KEY_PATH, RPKI_RTR_TLS_CLIENT_CA_PATH, RPKI_RTR_TLS_CERTS_HOST_DIR
SSH mode: RPKI_RTR_SSH_HOST_PORT, RPKI_RTR_SSH_CONTAINER_PORT, RPKI_RTR_SSH_AUTH_MODE, RPKI_RTR_SSH_USERNAME, RPKI_RTR_SSH_SUBSYSTEM_NAME, RPKI_RTR_SSH_HOST_KEY_PATH, RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH, RPKI_RTR_SSH_KEYS_VOLUME, RPKI_RTR_SSH_CERTS_HOST_DIR

Start

docker compose -f deploy/server/docker-compose.yml up -d --build

Stop

docker compose -f deploy/server/docker-compose.yml down

Logs

docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr

Runtime Report

The server writes split JSON reports. Each report file uses a local-time timestamp suffix and each category keeps RPKI_RTR_REPORT_HISTORY_LIMIT files, defaulting to 10.

rtr-source-*.json: CCR and SLURM source metadata, latest refresh status, data quality counts, cache snapshot counts, and delta counts. Written on startup and source refresh events.
rtr-clients-*.json: active client connection counts and counts by transport (tcp, tls, ssh). Written on startup, whenever the active connection count changes.
rtr-runtime-*.json: service start time, uptime, process RSS, and non-sensitive runtime configuration. Written on startup and every RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS, defaulting to 300 seconds.

Timestamps in logs and report JSON files use RPKI_RTR_TIMEZONE, which defaults to Asia/Shanghai. Use IANA timezone names such as Asia/Shanghai, Europe/London, America/New_York, or UTC; Shanghai is accepted as a convenience alias for Asia/Shanghai.

3.1 KiB Raw Blame History