rpki/deploy/arm64-installer/docs/README.en.md

ours RP Docker Installer Guide (__PACKAGE_ARCH__ / __PACKAGE_PLATFORM__)

Goal

This package deploys ours RP on Linux servers whose host architecture matches the packaged installer metadata, using Docker Compose and continuous all-five RIR validation.

The package includes four architecture-matched images: ours RP runtime, artifact metrics, Prometheus, and Grafana. Deployment does not need to pull application images on the target host. Runtime state, run artifacts, logs, Prometheus data and Grafana data are persisted through host bind mounts.

By default the host architecture must match PACKAGE_ARCH from PACKAGE-MANIFEST.env. If you intentionally want to run this package on a different host architecture through QEMU/binfmt, set:

ALLOW_CROSS_ARCH=1

Quick Start

tar -xzf ours-rp-docker-installer-__PACKAGE_ARCH__-*.tar.gz
cd ours-rp-docker-installer-__PACKAGE_ARCH__-*

./install.sh
cp .env.example .env   # install.sh creates .env automatically if missing
vim .env
./start.sh
./status.sh

Defaults:

• PACKAGE_ARCH=__PACKAGE_ARCH__
• PACKAGE_PLATFORM=__PACKAGE_PLATFORM__
• RIRS=afrinic,apnic,arin,lacnic,ripe
• MAX_RUNS=-1
• INTERVAL_SECS=600
• TAL_INPUT_MODE=file-live-ta
• LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1
• PERIODIC_SNAPSHOT_RESET=0
• PERIODIC_SNAPSHOT_MAX_DELTAS=100
• HOST_DATA_DIR=__HOST_DATA_DIR__
• SOAK_RESTART_POLICY=unless-stopped
• RPKI_IMAGE=ours-rp-runtime-__PACKAGE_ARCH__:dev
• METRICS_IMAGE=ours-rp-metrics-__PACKAGE_ARCH__:dev
• METRICS_PLATFORM=__PACKAGE_PLATFORM__
• MONITOR_PLATFORM=__PACKAGE_PLATFORM__
• ALLOW_CROSS_ARCH=0

First Start Semantics

If there is no successful run under HOST_DATA_DIR/runs, start.sh starts the core ours-rp-soak service first and waits for the first snapshot to succeed before starting metrics, Prometheus and Grafana.

Container/image mapping:

• ours-rp-soak uses RPKI_IMAGE
• artifact-metrics uses METRICS_IMAGE
• prometheus / grafana use their monitor images

The first snapshot refreshes live TA certificates before starting the RP process.

Architecture Guardrails

The key scripts read:

• PACKAGE_ARCH / PACKAGE_PLATFORM from .env
• PACKAGE-MANIFEST.env
• the current host uname -m

Default behavior:

1. matching host and package architectures: run natively;
2. mismatched host and package architectures: fail with an explicit error;
3. only when ALLOW_CROSS_ARCH=1 is set do the scripts attempt to enable matching binfmt/qemu.

That means an arm64 package on an x86_64 host does not silently switch to emulation by default.

Ports

Default ports:

• metrics: http://<host>:9556/metrics
• Prometheus: http://<host>:9090
• Grafana: http://<host>:3000

Grafana credentials come from .env:

GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=admin

Change the password and restrict public access for production deployments.

Data Directory

Default host directory:

__HOST_DATA_DIR__/
  state/
  runs/
  logs/
  tmp/
  prometheus/
  grafana/

Each runs/run_XXXX/ directory contains report.json, result.ccr, input.cir, vrps.csv, vaps.csv, stage-timing.json, logs and metadata.

Periodic Snapshot Reset

New knobs:

PERIODIC_SNAPSHOT_RESET=0
PERIODIC_SNAPSHOT_MAX_DELTAS=100

Semantics:

• disabled by default, keeping previous behavior unchanged;
• when enabled, one successful snapshot is followed by at most N successful delta runs;
• after the threshold is reached, the next run is forced to snapshot;
• before that forced snapshot, only the active state/db is reset, while runs/, logs/, state/rsync-mirror, .env, and Prometheus/Grafana data are preserved;
• the counter is persisted independently in HOST_DATA_DIR/state/run-lifecycle-state.json, so it does not depend on retained runs/ history;
• if that lifecycle file is corrupt, it is backed up as run-lifecycle-state.json.corrupt.<timestamp>.<pid> before best-effort bootstrap from retained runs;
• after a successful forced snapshot, the old DB staging is deleted so disk usage does not keep growing elsewhere.

Check the latest run-meta.json for:

• sync_mode
• snapshot_reason
• periodic_snapshot_delta_count
• periodic_snapshot_forced
• reset_db_cleanup_status

Common Commands

./status.sh
./logs.sh ours-rp-soak --tail 200
./restart.sh
./stop.sh
./cleanup.sh --keep-runs 100 --execute
./uninstall.sh

For finite acceptance tests, for example MAX_RUNS=3, also set:

SOAK_RESTART_POLICY=no

Otherwise Compose unless-stopped will restart the container after it exits successfully.

uninstall.sh keeps data by default. Use the following only when you really want to delete HOST_DATA_DIR:

./uninstall.sh --purge-data