159 lines
4.7 KiB
Markdown
159 lines
4.7 KiB
Markdown
# ours RP Docker Installer Guide (`__PACKAGE_ARCH__` / `__PACKAGE_PLATFORM__`)
|
|
|
|
## Goal
|
|
|
|
This package deploys ours RP on Linux servers whose host architecture matches the packaged installer metadata, using Docker Compose and continuous all-five RIR validation.
|
|
|
|
The package includes four architecture-matched images: ours RP runtime, artifact metrics, Prometheus, and Grafana. Deployment does not need to pull application images on the target host. Runtime state, run artifacts, logs, Prometheus data and Grafana data are persisted through host bind mounts.
|
|
|
|
By default the host architecture must match `PACKAGE_ARCH` from `PACKAGE-MANIFEST.env`. If you intentionally want to run this package on a different host architecture through QEMU/binfmt, set:
|
|
|
|
```bash
|
|
ALLOW_CROSS_ARCH=1
|
|
```
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
tar -xzf ours-rp-docker-installer-__PACKAGE_ARCH__-*.tar.gz
|
|
cd ours-rp-docker-installer-__PACKAGE_ARCH__-*
|
|
|
|
./install.sh
|
|
cp .env.example .env # install.sh creates .env automatically if missing
|
|
vim .env
|
|
./start.sh
|
|
./status.sh
|
|
```
|
|
|
|
Defaults:
|
|
|
|
- `PACKAGE_ARCH=__PACKAGE_ARCH__`
|
|
- `PACKAGE_PLATFORM=__PACKAGE_PLATFORM__`
|
|
- `RIRS=afrinic,apnic,arin,lacnic,ripe`
|
|
- `MAX_RUNS=-1`
|
|
- `INTERVAL_SECS=600`
|
|
- `TAL_INPUT_MODE=file-live-ta`
|
|
- `LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1`
|
|
- `PERIODIC_SNAPSHOT_RESET=0`
|
|
- `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
|
|
- `HOST_DATA_DIR=__HOST_DATA_DIR__`
|
|
- `SOAK_RESTART_POLICY=unless-stopped`
|
|
- `RPKI_IMAGE=ours-rp-runtime-__PACKAGE_ARCH__:dev`
|
|
- `METRICS_IMAGE=ours-rp-metrics-__PACKAGE_ARCH__:dev`
|
|
- `METRICS_PLATFORM=__PACKAGE_PLATFORM__`
|
|
- `MONITOR_PLATFORM=__PACKAGE_PLATFORM__`
|
|
- `ALLOW_CROSS_ARCH=0`
|
|
|
|
## First Start Semantics
|
|
|
|
If there is no successful run under `HOST_DATA_DIR/runs`, `start.sh` starts the core `ours-rp-soak` service first and waits for the first snapshot to succeed before starting metrics, Prometheus and Grafana.
|
|
|
|
Container/image mapping:
|
|
|
|
- `ours-rp-soak` uses `RPKI_IMAGE`
|
|
- `artifact-metrics` uses `METRICS_IMAGE`
|
|
- `prometheus` / `grafana` use their monitor images
|
|
|
|
The first snapshot refreshes live TA certificates before starting the RP process.
|
|
|
|
## Architecture Guardrails
|
|
|
|
The key scripts read:
|
|
|
|
- `PACKAGE_ARCH` / `PACKAGE_PLATFORM` from `.env`
|
|
- `PACKAGE-MANIFEST.env`
|
|
- the current host `uname -m`
|
|
|
|
Default behavior:
|
|
|
|
1. matching host and package architectures: run natively;
|
|
2. mismatched host and package architectures: fail with an explicit error;
|
|
3. only when `ALLOW_CROSS_ARCH=1` is set do the scripts attempt to enable matching `binfmt/qemu`.
|
|
|
|
That means an `arm64` package on an `x86_64` host does not silently switch to emulation by default.
|
|
|
|
## Ports
|
|
|
|
Default ports:
|
|
|
|
- metrics: `http://<host>:9556/metrics`
|
|
- Prometheus: `http://<host>:9090`
|
|
- Grafana: `http://<host>:3000`
|
|
|
|
Grafana credentials come from `.env`:
|
|
|
|
```bash
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=admin
|
|
```
|
|
|
|
Change the password and restrict public access for production deployments.
|
|
|
|
## Data Directory
|
|
|
|
Default host directory:
|
|
|
|
```text
|
|
__HOST_DATA_DIR__/
|
|
state/
|
|
runs/
|
|
logs/
|
|
tmp/
|
|
prometheus/
|
|
grafana/
|
|
```
|
|
|
|
Each `runs/run_XXXX/` directory contains `report.json`, `result.ccr`, `input.cir`, `vrps.csv`, `vaps.csv`, `stage-timing.json`, logs and metadata.
|
|
|
|
## Periodic Snapshot Reset
|
|
|
|
New knobs:
|
|
|
|
```bash
|
|
PERIODIC_SNAPSHOT_RESET=0
|
|
PERIODIC_SNAPSHOT_MAX_DELTAS=100
|
|
```
|
|
|
|
Semantics:
|
|
|
|
- disabled by default, keeping previous behavior unchanged;
|
|
- when enabled, one successful snapshot is followed by at most `N` successful delta runs;
|
|
- after the threshold is reached, the next run is forced to snapshot;
|
|
- before that forced snapshot, only the active `state/db` is reset, while `runs/`, `logs/`, `state/rsync-mirror`, `.env`, and Prometheus/Grafana data are preserved;
|
|
- the counter is persisted independently in `HOST_DATA_DIR/state/run-lifecycle-state.json`, so it does not depend on retained `runs/` history;
|
|
- if that lifecycle file is corrupt, it is backed up as `run-lifecycle-state.json.corrupt.<timestamp>.<pid>` before best-effort bootstrap from retained runs;
|
|
- after a successful forced snapshot, the old DB staging is deleted so disk usage does not keep growing elsewhere.
|
|
|
|
Check the latest `run-meta.json` for:
|
|
|
|
- `sync_mode`
|
|
- `snapshot_reason`
|
|
- `periodic_snapshot_delta_count`
|
|
- `periodic_snapshot_forced`
|
|
- `reset_db_cleanup_status`
|
|
|
|
## Common Commands
|
|
|
|
```bash
|
|
./status.sh
|
|
./logs.sh ours-rp-soak --tail 200
|
|
./restart.sh
|
|
./stop.sh
|
|
./cleanup.sh --keep-runs 100 --execute
|
|
./uninstall.sh
|
|
```
|
|
|
|
For finite acceptance tests, for example `MAX_RUNS=3`, also set:
|
|
|
|
```bash
|
|
SOAK_RESTART_POLICY=no
|
|
```
|
|
|
|
Otherwise Compose `unless-stopped` will restart the container after it exits successfully.
|
|
|
|
`uninstall.sh` keeps data by default. Use the following only when you really want to delete `HOST_DATA_DIR`:
|
|
|
|
```bash
|
|
./uninstall.sh --purge-data
|
|
```
|