Rayhaan JaufeerallyandClaude Fable 5.1
fd496d26bf
Preparing to run ferrix next to BIRD on the production router. - build: the config proto is now parsed in pure Rust, so building needs no `protoc` binary. It previously worked only where one happened to be installed; the Dockerfile in this repo could not have built. - peers gain `local_address`, the source IP for connections we open (and therefore the next hop we advertise). When both speakers share a host the OS would otherwise pick an arbitrary local address and the peer, which identifies us by address, would refuse the session. Address-family mismatches are rejected at config load; an address the host lacks shows up as the peer's backoff reason. - docs/lab/prod/on-router: static musl cross-build instructions, config, hardened systemd unit (unprivileged, SIGTERM gives BIRD a Cease), loopback addresses for networkd, the BIRD stanza for a same-host multihop session, and reverse-proxy examples with TLS and a password, since the API has no authentication. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
29 lines
934 B
Protocol Buffer Text Format
29 lines
934 B
Protocol Buffer Text Format
# ferrix_bgp running on the production router itself, next to BIRD.
|
|
router_id: "10.255.0.2"
|
|
local_asn: 4200000001
|
|
|
|
# Unused in practice (BIRD is passive and we dial it), but a listener is
|
|
# required. 179 belongs to BIRD, so take another port on our own address.
|
|
listen_endpoints { address: "fd00:179::2" port: 9179 }
|
|
|
|
peers {
|
|
name: "pr01-bird"
|
|
endpoint { address: "fd00:179::1" port: 179 }
|
|
# BIRD recognises its neighbour by source address. Both addresses live on
|
|
# this host, so say which one is ours.
|
|
local_address: "fd00:179::2"
|
|
remote_asn: 210036
|
|
hold_time_seconds: 90
|
|
}
|
|
connect_retry_seconds: 5
|
|
collision_detect_established_state: true
|
|
|
|
local_route_policy {
|
|
allowed_prefixes: "2a0d:d741::/40"
|
|
max_routes_per_owner: 1
|
|
}
|
|
|
|
# Loopback only. Students reach it through the reverse proxy, which adds TLS
|
|
# and a password; the API itself has neither.
|
|
http_endpoint { address: "127.0.0.1" port: 8080 }
|