rpki/rpki-client repository overview

⁠rpki-client

⁠About

The OpenBSD rpki-client⁠ is a free, easy-to-use implementation of the Resource Public Key Infrastructure (RPKI) for Relying Parties (RP) to facilitate validation of the Route Origin of a BGP announcement. The program queries the RPKI repository system, downloads and validates Route Origin Authorisations (ROAs) and finally outputs Validated ROA Payloads (VRPs) in the configuration format of OpenBGPD, BIRD, and also as CSV or JSON objects for consumption by other routing stacks.

Source files and build instructions for the Docker images can be found at https://github.com/rpki-client/rpki-client-container⁠.

⁠Tags

• 9.0, latest
• edge

⁠Usage

The Docker image automatically refreshs the Validated ROA Payloads (VRPs) hourly. It may be started using:

docker run --name rpki-client \
           --volume /path/to/rpki-client/tals/arin.tal:/etc/tals/arin.tal \
           --volume /path/to/rpki-client/output:/var/lib/rpki-client \
           --volume /path/to/rpki-client/cache:/var/cache/rpki-client \
           --detach rpki/rpki-client:latest

⁠Volumes

• /etc/tals - Directory for Trust Anchor Location (TAL) files that rpki-client will load by default. ARIN TAL must be downloaded separately⁠ in RFC 7730 format, because the ARIN Relying Party Agreement (RPA) must be accepted.
• /var/lib/rpki-client - Directory where rpki-client will write the output files. By default BIRD and OpenBGPD compatible outputs as well as CSV and JSON formats are generated.
• /var/cache/rpki-client - Directory where rpki-client will store the cached repository data. To speed-up the performance, persistent storage is recommented.

While none of the volumes is required, meaningful usage requires at least persistent storage for /var/lib/rpki-client and the ARIN TAL.

⁠Environment Variables

• TZ - Time zone according to IANA's time zone database, e.g. Europe/Amsterdam, defaults to UTC.
• ONESHOT - Set to true to run rpki-client only once instead of periodically, defaults to false.
• WAIT - Seconds to wait before restarting after rpki-client exited successfully, defaults to 600.

⁠Exposed Ports

• 9099 - TCP port⁠ for optional rpki-client output in OpenMetrics format via HTTP endpoint /metrics.

⁠License

This project is licensed under the ISC License - see the LICENSE⁠ file for details.

As with all Docker images, these also contain other software under other licenses (such as BusyBox, HAProxy, OpenSSL etc. from the base distribution, along with any direct or indirect dependencies of the contained rpki-client).

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.