Krill

https://krill.docs.nlnetlabs.nl/en/stable/
Admin
Krill is an open-source Resource Public Key Infrastructure (RPKI) daemon that provides a Certificate...
Tokens:52,048
Snippets:519
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install and Configure NGINX

Source: https://krill.docs.nlnetlabs.nl/en/stable/testbed.html

Installs the NGINX package and removes the default site configuration to prepare for the Krill proxy setup.

```bash
apt install nginx
cd /etc/nginx/sites-enabled
rm default
```

--------------------------------

### Install and Initialize SoftHSMv2

Source: https://krill.docs.nlnetlabs.nl/en/stable/hsm.html

Commands to install the SoftHSMv2 package and initialize a token on slot 0.

```bash
$ sudo apt install -y softhsm2
$ softhsm2-util --init-token --slot 0 --label "My token 1" --so-pin 1234 --pin 5678
```

--------------------------------

### Start Krill Daemon Script

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Example shell script to start the Krill daemon in the background.

```bash
#!/bin/bash
KRILL="krill"
DATA_DIR="/path/to/data"
KRILL_PID="$DATA_DIR/krill.pid"
CONF="$DATA_DIR/krill.conf"
SCRIPT_OUT="$DATA_DIR/krill.log"

nohup $KRILL -c $CONF >$SCRIPT_OUT 2>&1 &
echo $! > $KRILL_PID
```

--------------------------------

### Install Rust via rustup

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Use this command to install the Rust toolchain on UNIX-like systems.

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
```

--------------------------------

### Start and Monitor Krill Service

Source: https://krill.docs.nlnetlabs.nl/en/stable/testbed.html

Use systemctl to start the Krill service and journalctl to view the startup logs for verification.

```bash
root@krill-test-09-rc:/etc# systemctl start krill
root@krill-test-09-rc:/etc# journalctl -u krill
-- Logs begin at Thu 2021-04-01 11:23:39 UTC, end at Thu 2021-04-01 19:55:19 UTC. --
Apr 01 19:55:17 krill-test-09-rc systemd[1]: Starting Krill...
Apr 01 19:55:17 krill-test-09-rc systemd[1]: Started Krill.
Apr 01 19:55:17 krill-test-09-rc krill[35246]: 2021-04-01 19:55:17 [INFO] Krill uses configuration file: /etc/krill.conf
Apr 01 19:55:17 krill-test-09-rc krill[35246]: 2021-04-01 19:55:17 [INFO] Starting Krill v0.8.2-bis
Apr 01 19:55:17 krill-test-09-rc krill[35246]: 2021-04-01 19:55:17 [INFO] Krill uses service uri: https://localhost:3000/
Apr 01 19:55:17 krill-test-09-rc krill[35246]: 2021-04-01 19:55:17 [INFO] Enabling TESTBED mode - ONLY USE THIS FOR TESTING AND TRAINING!
Apr 01 19:55:17 krill-test-09-rc krill[35246]: 2021-04-01 19:55:17 [INFO] Initializing repository
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Creating embedded Trust Anchor
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to publisher '0', version: 1: id '0' version 'any' details 'Added publisher 'ta''
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'ta', version: 1: id 'ta' version 'any' details 'Update repo to server at: https://localhost:3000/rfc8181/ta/'
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'ta', version: 2: id 'ta' version 'any' details 'Turn into Trust Anchor'
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'ta', version: 3: id 'ta' version 'any' details 'Update received cert in RC '0', with resources 'asn: 1 blocks, v4: >
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Creating embedded Testbed CA
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to publisher '0', version: 2: id '0' version 'any' details 'Added publisher 'testbed''
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'testbed', version: 1: id 'testbed' version 'any' details 'Update repo to server at: https://localhost:3000/rfc8181/>
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] CA 'ta' process add child request: handle 'testbed' resources 'asn: AS0-AS4294967295, v4: 0.0.0.0/0, v6: ::/0'
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'ta', version: 4: id 'ta' version 'any' details 'Add child 'testbed' with RFC8183 key '98A7BBA3491C84000FADFF48AA53E>
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Sending command to CA 'testbed', version: 2: id 'testbed' version 'any' details 'Add parent 'ta' as 'RFC 6492 Parent''
Apr 01 19:55:18 krill-test-09-rc krill[35246]: 2021-04-01 19:55:18 [INFO] Upgraded Krill to version: 0.8.2-bis
Apr 01 19:55:19 krill-test-09-rc krill[35246]: 2021-04-01 19:55:19 [INFO] Will re-sync all CAs with their parents and repository after startup
```

--------------------------------

### Per-Publisher Metrics Example

Source: https://krill.docs.nlnetlabs.nl/en/stable/monitoring.html

Example output showing granular metrics for individual publishing CAs.

```text
# HELP krill_repo_objects number of objects in repository for publisher
# TYPE krill_repo_objects gauge
krill_repo_objects{publisher="ta"} 3
krill_repo_objects{publisher="mos-eisley"} 4
krill_repo_objects{publisher="testbed"} 5
krill_repo_objects{publisher="CA1"} 2
krill_repo_objects{publisher="CA2"} 2
krill_repo_objects{publisher="dummy_ca"} 0

# HELP krill_repo_size size of objects in bytes in repository for publisher
# TYPE krill_repo_size gauge
krill_repo_size{publisher="ta"} 7592
krill_repo_size{publisher="mos-eisley"} 10056
krill_repo_size{publisher="testbed"} 9988
krill_repo_size{publisher="CA1"} 3744
krill_repo_size{publisher="CA2"} 3744
krill_repo_size{publisher="dummy_ca"} 0

# HELP krill_repo_last_update unix timestamp in seconds of last update for publisher
# TYPE krill_repo_last_update gauge
krill_repo_last_update{publisher="ta"} 1631542801
krill_repo_last_update{publisher="mos-eisley"} 1631542802
krill_repo_last_update{publisher="testbed"} 1631542802
krill_repo_last_update{publisher="CA1"} 1631542801
krill_repo_last_update{publisher="CA2"} 1631542802
krill_repo_last_update{publisher="dummy_ca"} 1628062124
```

--------------------------------

### Install Krill

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Updates the package index and installs the Krill application.

```bash
sudo apt update
sudo apt install krill
```

--------------------------------

### Start Krill Service

Source: https://krill.docs.nlnetlabs.nl/en/stable/get-started.html

Launch the Krill application using a specific configuration file.

```bash
krill -c krill.conf
```

--------------------------------

### Install Rust on OpenBSD

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Use the package manager to install Rust on OpenBSD systems.

```shell
pkg_add rust
```

--------------------------------

### Install krillup on Debian

Source: https://krill.docs.nlnetlabs.nl/en/stable/upgrade.html

Command to install the krillup utility on Debian-based systems.

```bash
sudo apt install krillup
```

--------------------------------

### Install Krill on RHEL

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Commands to import the public key and install the Krill package via yum.

```bash
sudo rpm --import https://packages.nlnetlabs.nl/aptkey.asc
```

```bash
sudo yum install -y krill
```

--------------------------------

### View Krill Startup Logs

Source: https://krill.docs.nlnetlabs.nl/en/stable/docker.html

Example of the startup logs generated by the Docker Krill container, prefixed with docker-krill.

```text
docker-krill: Securing Krill daemon with token ba473bac-021c-4fc9-9946-6ec109befec3
docker-krill: Configuring /var/krill/data/krill.conf ..
docker-krill: Dumping /var/krill/data/krill.conf config file
...
docker-krill: End of dump
```

--------------------------------

### Install HTTPS support for apt

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Installs necessary packages to allow apt to use repositories over HTTPS.

```bash
sudo apt install \
  ca-certificates \
  curl \
  gnupg \
  lsb-release
```

--------------------------------

### Install OpenSSL Dependencies

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Install the necessary OpenSSL development headers and pkg-config on Debian-based systems.

```shell
apt install libssl-dev openssl pkg-config
```

--------------------------------

### Update Rust installation

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Run this command to update an existing Rust installation managed by rustup.

```bash
rustup update
```

--------------------------------

### Inspect Keys with pkcs11-tool

Source: https://krill.docs.nlnetlabs.nl/en/stable/hsm.html

Commands to install OpenSC and list keys stored in the SoftHSMv2 token.

```bash
$ sudo apt install -y opensc
$ pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so -O -p 5678
Using slot 0 with a present token (0x542bc831)
Public Key Object; RSA 2048 bits
  label:      Krill
  ID:         e83e96883ee73e69e0e57d54b6726c9d45f788c5
  Usage:      verify
  Access:     local
Public Key Object; RSA 2048 bits
  label:      Krill
  ID:         9ecd3796786c7a073d5384c155d8d475d103df74
  Usage:      verify
  Access:     local
...
```

--------------------------------

### Prometheus Metrics Output Example

Source: https://krill.docs.nlnetlabs.nl/en/stable/monitoring.html

Example of the gauge metrics exported by Krill, showing various RPKI states and ROA statuses per CA.

```text
# HELP krill_cas_bgp_announcements_valid number of announcements seen for CA resources with RPKI state VALID
# TYPE krill_cas_bgp_announcements_valid gauge
krill_cas_bgp_announcements_valid{ca="CA1"} 0
krill_cas_bgp_announcements_valid{ca="ca"} 2
krill_cas_bgp_announcements_valid{ca="CA2"} 0
krill_cas_bgp_announcements_valid{ca="testbed"} 0
krill_cas_bgp_announcements_valid{ca="ta"} 0
krill_cas_bgp_announcements_valid{ca="dummy_ca"} 0

# HELP krill_cas_bgp_announcements_invalid_asn number of announcements seen for CA resources with RPKI state INVALID (ASN mismatch)
# TYPE krill_cas_bgp_announcements_invalid_asn gauge
krill_cas_bgp_announcements_invalid_asn{ca="dummy_ca"} 0
krill_cas_bgp_announcements_invalid_asn{ca="testbed"} 0
krill_cas_bgp_announcements_invalid_asn{ca="CA2"} 0
krill_cas_bgp_announcements_invalid_asn{ca="CA1"} 0
krill_cas_bgp_announcements_invalid_asn{ca="ta"} 0
krill_cas_bgp_announcements_invalid_asn{ca="ca"} 1

# HELP krill_cas_bgp_announcements_invalid_length number of announcements seen for CA resources with RPKI state INVALID (prefix exceeds max length)
# TYPE krill_cas_bgp_announcements_invalid_length gauge
krill_cas_bgp_announcements_invalid_length{ca="testbed"} 0
krill_cas_bgp_announcements_invalid_length{ca="dummy_ca"} 0
krill_cas_bgp_announcements_invalid_length{ca="ta"} 0
krill_cas_bgp_announcements_invalid_length{ca="CA2"} 0
krill_cas_bgp_announcements_invalid_length{ca="ca"} 0
krill_cas_bgp_announcements_invalid_length{ca="CA1"} 0

# HELP krill_cas_bgp_announcements_not_found number of announcements seen for CA resources with RPKI state NOT FOUND (none of the CA's ROAs cover this)
# TYPE krill_cas_bgp_announcements_not_found gauge
krill_cas_bgp_announcements_not_found{ca="CA2"} 0
krill_cas_bgp_announcements_not_found{ca="ta"} 0
krill_cas_bgp_announcements_not_found{ca="ca"} 0
krill_cas_bgp_announcements_not_found{ca="dummy_ca"} 0
krill_cas_bgp_announcements_not_found{ca="CA1"} 5
krill_cas_bgp_announcements_not_found{ca="testbed"} 0

# HELP krill_cas_bgp_roas_too_permissive number of ROAs for this CA which allow excess announcements (0 may also indicate that no BGP info is available)
# TYPE krill_cas_bgp_roas_too_permissive gauge
krill_cas_bgp_roas_too_permissive{ca="ca"} 0
krill_cas_bgp_roas_too_permissive{ca="testbed"} 0
krill_cas_bgp_roas_too_permissive{ca="CA1"} 0
krill_cas_bgp_roas_too_permissive{ca="dummy_ca"} 0
krill_cas_bgp_roas_too_permissive{ca="ta"} 0
krill_cas_bgp_roas_too_permissive{ca="CA2"} 0

# HELP krill_cas_bgp_roas_redundant number of ROAs for this CA which are redundant (0 may also indicate that no BGP info is available)
# TYPE krill_cas_bgp_roas_redundant gauge
krill_cas_bgp_roas_redundant{ca="ta"} 0
krill_cas_bgp_roas_redundant{ca="testbed"} 0
krill_cas_bgp_roas_redundant{ca="ca"} 0
krill_cas_bgp_roas_redundant{ca="dummy_ca"} 0
krill_cas_bgp_roas_redundant{ca="CA1"} 0
krill_cas_bgp_roas_redundant{ca="CA2"} 0

# HELP krill_cas_bgp_roas_stale number of ROAs for this CA for which no announcements are seen (0 may also indicate that no BGP info is available)
# TYPE krill_cas_bgp_roas_stale gauge
krill_cas_bgp_roas_stale{ca="CA1"} 0
krill_cas_bgp_roas_stale{ca="CA2"} 0
krill_cas_bgp_roas_stale{ca="ca"} 0
krill_cas_bgp_roas_stale{ca="ta"} 0
krill_cas_bgp_roas_stale{ca="testbed"} 0
krill_cas_bgp_roas_stale{ca="dummy_ca"} 0

# HELP krill_cas_bgp_roas_total total number of ROAs for this CA
# TYPE krill_cas_bgp_roas_stale gauge
krill_cas_bgp_roas_total{ca="dummy_ca"} 0
krill_cas_bgp_roas_total{ca="ca"} 3
krill_cas_bgp_roas_total{ca="CA1"} 0
krill_cas_bgp_roas_total{ca="ta"} 0
krill_cas_bgp_roas_total{ca="testbed"} 0
krill_cas_bgp_roas_total{ca="CA2"} 0
```

--------------------------------

### Install Krill via Cargo

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Install a specific tagged release of Krill directly from the GitHub repository.

```shell
cargo install krill --git https://github.com/NLnetLabs/krill \
                    --tag v0.12.0-rc1 \
                    --locked
```

--------------------------------

### Install Specific Krill Version on Ubuntu

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Installs a specific version of Krill on Ubuntu using the package name and version string.

```bash
sudo apt install krill=0.9.0~rc2-1bionic
```

--------------------------------

### Configure RHEL repository

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Repository configuration file content for installing Krill on RHEL-based systems.

```ini
[nlnetlabs]
name=NLnet Labs
baseurl=https://packages.nlnetlabs.nl/linux/centos/$releasever/main/$basearch
enabled=1
```

--------------------------------

### Execute CLI Subcommands with File Inputs

Source: https://krill.docs.nlnetlabs.nl/en/stable/docker.html

Example of running a krillc subcommand that requires a file input, utilizing the volume mount.

```bash
$ krillc roas update --ca my_ca --delta /tmp/delta.in
```

--------------------------------

### TA Signer configuration file example

Source: https://krill.docs.nlnetlabs.nl/en/stable/trust-anchor.html

This configuration file defines the data directory and optional timing parameters for the TA Signer.

```toml
######################################################################################
#                                                                                    #
#                                      DATA                                          #
#                                                                                    #
######################################################################################

# Specify the directory where the TA Signer will store its data.
data_dir = "/var/lib/krillta/data"

######################################################################################
#                                                                                    #
#                                     LOGGING                                        #
#                                                                                    #
######################################################################################

# Log level
#
# The maximum log level ("off", "error", "warn", "info", or "debug") for
# which to log messages.
#
# Defaults to "warn"
#
### log_level = "warn"

# Log type
#
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
# for a file in which case $data_dir/krillta.log will be used. This cannot (yet)
# be overridden.
#
# Defaults to "file"
#
### log_type = "file"

######################################################################################
#                                                                                    #
#                                SIGNER CONFIGURATION                                #
#                                                                                    #
######################################################################################

#
# By default OpenSSL is used for key generation and signing.
#
# But.. The usual Krill HSM support should also work in this context. If you want to
# use an HSM please read the documentation here:
# https://krill.docs.nlnetlabs.nl/en/stable/hsm.html
#
# Note that this configuration cannot be changed after the TA Signer has been
# initialised. Or rather.. where for normal Krill CAs defaults may be changed and
# key rolls can be used to start using a different signer, there is no key roll
# support for the TA. This may be implemented in future in which case we would
# also support RPKI Signed TALs for this process.

######################################################################################
#                                                                                    #
#                                      TIMING                                          #
#                                                                                    #
######################################################################################

#
# Include the following section '[timing_config]' if the default TA
# timing settings need to be changed.
#
#            !!!!!IMPORTANT!!!!!!
#
# If you include this, make sure that both the TA signer and your Krill
# server where the TA Proxy lives use the same configuration.
#
[timing_config]

# The number of years the TA certificate is valid for. The TA certificate
# is only generated once, so set this value before initialising the TA.
#
### certificate_validity_years = 100,

# The validity time in weeks for certificates issued under the TA. Note
# that these certifcates get re-issued by request of the child before
# they would expire.
#
### issued_certificate_validity_weeks = 52

# The threshold in weeks before expiry of a current issued certificate
# used to determine when a new certificate should be requested.
# The hardcoded minimum is 10% more than the current expiration.
#
### issued_certificate_reissue_weeks_before = 26

# The time before the manifest and CRL expire for objects published by
# the TA. This determines the minimal re-signing frequency needed.
#
### mft_next_update_weeks = 12

# The validity time for signed messages between the online and offline
# TA components (TA Proxy and TA Signer). This determines how fast messages
# need to exchanged between the components.
#
# Note that there is replay protection in addition to this constraint, meaning
# that a message that has been previously processed cannot be applied again,
# even if it's still cryptographically valid.
#
### signed_message_validity_days = 14
```

--------------------------------

### Run Keycloak via Docker

Source: https://krill.docs.nlnetlabs.nl/en/stable/multi-user/openid-connect-provider.html

Starts a Keycloak container for demonstration purposes using an in-memory H2 database.

```bash
$ sudo docker run \
    --detach \
    --name keycloak \
    --publish 8443:8443 \
    --env KEYCLOAK_USER=admin \
    --env KEYCLOAK_PASSWORD=password \
    --env DB_VENDOR=h2 quay.io/keycloak/keycloak:12.0.4
```

--------------------------------

### Identify rollback directories

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Example paths for archived and current data directories used during a manual rollback.

```text
/var/lib/krill/data/arch-ca_objects-0.11.0/
/var/lib/krill/data/arch-cas-0.11.0/
/var/lib/krill/data/arch-pubd-0.11.0/
/var/lib/krill/data/arch-pubd_objects-0.11.0/
```

```text
/var/lib/krill/data/ca_objects/
/var/lib/krill/data/cas/
/var/lib/krill/data/pubd/
/var/lib/krill/data/pubd_objects/
```

--------------------------------

### Install Specific Krill Version on RHEL

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Installs a specific version of Krill on RHEL using the package name and version info.

```bash
sudo yum install -y krill-0.9.0~rc2
```

--------------------------------

### Install Specific Krill Version on Debian

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Installs a specific version of Krill on Debian using the package name and version string.

```bash
sudo apt install krill=0.14.0~rc2-1bookworm
```

--------------------------------

### Signer Configuration Reference

Source: https://krill.docs.nlnetlabs.nl/en/stable/hsm.html

Example configuration snippet for defining a default signer using OpenSSL.

```toml
default_signer = "My signer"

[[signers]]
type = "OpenSSL"
name = "My signer"
```

--------------------------------

### Define custom roles in Krill configuration

Source: https://krill.docs.nlnetlabs.nl/en/stable/multi-user/roles.html

Example configuration block for the [auth_roles] section, demonstrating how to define default roles and a restricted role for a specific CA.

```toml
[auth_roles]
"admin" = { permissions = [ "any" ] }
"readwrite" = { permissions = [ "login", "pub-list", "pub-read", "pub-create", "pub-delete", "ca-list", "ca-create", "ca-delete", "read", "update" ] }
"readonly" = { permissions = [ "login", "pub-read", "ca-list", "read" ] }
"read-example" = { permissions = [ "login", "read" ], cas = [ "example" ] }
```

--------------------------------

### Initialize Key Rollover

Source: https://krill.docs.nlnetlabs.nl/en/stable/ca-keyroll.html

Starts the key rollover process for eligible Resource Classes. This command has no effect if a rollover is already in progress.

```bash
krillc keyroll init
```

--------------------------------

### Monitor Keycloak Logs

Source: https://krill.docs.nlnetlabs.nl/en/stable/multi-user/openid-connect-provider.html

Follows the container logs to verify that the Keycloak service has started successfully.

```bash
$ docker logs --follow keycloak
...
14:31:20,766 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0025: Keycloak 12.0.4 (WildFly Core 13.0.3.Final) started in 23954ms - Started 687 of 972 services (687 services are lazy, passive or on-demand)
14:31:20,768 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http management interface listening on http://127.0.0.1:9990/management
14:31:20,769 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990
```

--------------------------------

### Parent Configuration JSON Structure

Source: https://krill.docs.nlnetlabs.nl/en/stable/upgrade.html

Example of the JSON structure for a parent entity configuration in Krill.

```json
{
  "my_parent": {
    "last_exchange": {
      "timestamp": 1617881400,
      "uri": "https://localhost:3000/rfc8181/localname/",
      "result": "Success"
    },
    "last_success": 1617881400,
    "all_resources": {
      "asn": "AS65000",
      "ipv4": "10.0.0.0/8",
      "ipv6": "2001:db8::/32"
    },
    "classes": [
      {
        "class_name": "0",
        "resource_set": {
          "asn": "AS65000",
          "ipv4": "10.0.0.0/8",
          "ipv6": "2001:db8::/32"
        },
        "not_after": "2023-03-15T14:23:57Z",
        "issued_certs": [
          {
            "uri": "rsync://localhost/repo/testbed/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.cer",
            "req_limit": {},
            "cert": "MII..."
          }
        ],
        "signing_cert": {
          "url": "rsync://localhost/repo/ta/0/0BA5C132B94891CB2D3A89EDE12F01ACA4BCD3DC.cer",
          "cert": "MII..."
        }
      }
    ]
  }
}
```

--------------------------------

### Configure OpenID Connect Extra Login Parameters

Source: https://krill.docs.nlnetlabs.nl/en/stable/config.html

Example of defining additional HTTP query parameters for OpenID Connect authorization requests using TOML.

```toml
[openid_connect.extra_login_params]
display=popup
ui_locales="fr-CA fr en"
```

--------------------------------

### Configure Ubuntu repository

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Sets up the main repository source list for Ubuntu systems.

```bash
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/nlnetlabs-archive-keyring.gpg] https://packages.nlnetlabs.nl/linux/ubuntu \
$(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/nlnetlabs.list > /dev/null
```

--------------------------------

### GET /stats/info

Source: https://krill.docs.nlnetlabs.nl/en/stable/monitoring.html

Retrieves the current Krill version and the daemon start timestamp.

```APIDOC
## GET /stats/info

### Description
Returns the Krill version and the timestamp when the daemon was started.

### Method
GET

### Endpoint
/stats/info
```

--------------------------------

### Install Certbot for NGINX

Source: https://krill.docs.nlnetlabs.nl/en/stable/testbed.html

Commands to install Certbot and the NGINX plugin on Debian-based systems.

```bash
apt install certbot
apt install python3-certbot-nginx
certbot --nginx
```

--------------------------------

### Initialize Publication Server

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Initializes the Publication Server using specific RRDP and rsync base URIs.

```bash
$ krillc pubserver server init --rrdp https://krillrepo.example.com/rrdp/ --rsync rsync://krillrepo.example.com/repo/
```

```bash
$ krillc pubserver server init --rrdp https://krillrepo.example.com/rrdp/ --rsync rsync://krillrepo.example.com/repo/ --api
POST:
  https://krill-ui-dev.do.nlnetlabs.nl/api/v1/pubd/init
Headers:
  content-type: application/json
  Authorization: Bearer secret
Body:
{
  "rrdp_base_uri": "https://krillrepo.example.com/rrdp/",
  "rsync_jail": "rsync://krillrepo.example.com/repo/"
}
```

--------------------------------

### Configure Debian repository

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Sets up the main repository source list for Debian systems.

```bash
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/nlnetlabs-archive-keyring.gpg] https://packages.nlnetlabs.nl/linux/debian \
$(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/nlnetlabs.list > /dev/null
```

--------------------------------

### Configure Krill Testbed Settings

Source: https://krill.docs.nlnetlabs.nl/en/stable/testbed.html

Define the RRDP, rsync, and Trust Anchor URIs within the [testbed] section of krill.conf.

```ini
[testbed]
# RRDP BASE URI
#
# Set the base RRDP uri for the testbed repository server.
#
# It is highly recommended to use a proxy in front of Krill.
#
# To expose the RRDP files you can actually proxy back to your testbed
# krill server (https://<yourkrill>/rrdp/), or you can expose the
# files as they are written to disk ($data_dir/repo/rrdp/)
#
# Set the following value to *your* public proxy hostname and path.
rrdp_base_uri = "https://krill.example.org/rrdp/"

# RSYNC BASE URI
#
# Set the base rsync URI (jail) for the testbed repository server.
#
# Make sure that you have an rsyncd running and a module which is
# configured to expose the rsync repository files. By default these
# files would be saved to: $data/repo/rsync/current/
rsync_jail = "rsync://krill.example.org/repo/"

# TA AIA
#
# Set the rsync location for your testbed trust anchor certificate.
#
# You need to configure an rsync server to expose another module for the
# TA certificate. Don't use the module for the repository as its
# content will be overwritten.
#
# Manually retrieve the TA certificate from krill and copy it
# over - it won't change again. You can get it at:
# https://<yourkrill>/ta/ta.cer
ta_aia = "rsync://krill.example.org/ta/ta.cer"

# TA URI
#
# Like above, make the TA certificate available over HTTPS and
# specify the url here so that it may be included in the TAL.
ta_uri = "https://krill.example.org/ta/ta.cer"
```

--------------------------------

### Create Data Directory

Source: https://krill.docs.nlnetlabs.nl/en/stable/building-from-source.html

Create a directory to store Krill's runtime data.

```shell
mkdir ~/data
```

--------------------------------

### POST /api/v1/pubd/init

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Initializes the Publication Server with the specified RRDP and rsync base URIs.

```APIDOC
## POST /api/v1/pubd/init

### Description
Initializes the Publication Server using the provided repository base URIs.

### Method
POST

### Endpoint
https://krill-ui-dev.do.nlnetlabs.nl/api/v1/pubd/init

### Request Body
- **rrdp_base_uri** (string) - Required - The base URI for RRDP.
- **rsync_jail** (string) - Required - The base URI for rsync.

### Request Example
{
  "rrdp_base_uri": "https://krillrepo.example.com/rrdp/",
  "rsync_jail": "rsync://krillrepo.example.com/repo/"
}
```

--------------------------------

### Configure New Repository

Source: https://krill.docs.nlnetlabs.nl/en/stable/ca-migrate-repo.html

Applies the repository response XML provided by the new publication server to the CA.

```bash
krillc repo configure --response </path/to/repo-response.xml>
```

--------------------------------

### Prepare Krill upgrade with krillup

Source: https://krill.docs.nlnetlabs.nl/en/stable/upgrade.html

Usage of the krillup tool to prepare for an upgrade by specifying the configuration file path.

```bash
$ krillup -c ./defaults/krill.conf
2022-02-18 16:51:26 [INFO] Prepare upgrade using configuration file: ./defaults/krill.conf
2022-02-18 16:51:26 [INFO] Processing data from: ./data
2022-02-18 16:51:26 [INFO] Saving prepared data to: ./data/upgrade-data
2022-02-18 16:51:26 [INFO] No preparation is needed for the upgrade from 0.9.3-rc1 to 0.9.5-rc1.
```

--------------------------------

### Configure Testbed Settings

Source: https://krill.docs.nlnetlabs.nl/en/stable/config.html

Configuration for the Krill testbed environment, including trust anchor URIs and repository paths.

```toml
[testbed]
ta_aia = "rsync://testbed.example.com/ta/ta.cer"
ta_uri = "https://testbed.example.com/ta/ta.cer"
rrdp_base_uri = "https://testbed.example.com/rrdp/"
rsync_jail = "rsync://testbed.example.com/repo/"
```

--------------------------------

### GET /api/v1/pubd/publishers

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Retrieves a list of all current publishers.

```APIDOC
## GET /api/v1/pubd/publishers

### Description
Retrieves a list of all current publishers registered on the server.

### Method
GET

### Endpoint
https://localhost:3000/api/v1/pubd/publishers
```

--------------------------------

### GET /api/v1/cas/ca/aspas

Source: https://krill.docs.nlnetlabs.nl/en/stable/manage-aspas.html

Lists all current ASPA configurations.

```APIDOC
## GET /api/v1/cas/ca/aspas

### Description
Retrieves a list of all configured ASPA objects.

### Method
GET

### Endpoint
https://localhost:3000/api/v1/cas/ca/aspas

### Response
#### Success Response (200)
- **customer** (string) - The customer ASN.
- **providers** (array) - List of provider ASNs.
```

--------------------------------

### GET /api/v1/pubd/publishers/{publisher}

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Retrieves the details of a specific publisher from the publication server.

```APIDOC
## GET /api/v1/pubd/publishers/{publisher}

### Description
Retrieves the configuration and status details for a specific publisher.

### Method
GET

### Endpoint
/api/v1/pubd/publishers/{publisher}

### Parameters
#### Path Parameters
- **publisher** (string) - Required - The identifier of the publisher to retrieve.

### Response
#### Success Response (200)
- **base64** (string) - The base64 encoded data associated with the publisher.
- **uri** (string) - The rsync URI for the publisher's repository content.
```

--------------------------------

### Configure Benchmarking Parameters

Source: https://krill.docs.nlnetlabs.nl/en/stable/config.html

Settings for benchmarking Krill performance. Do not use these in production environments.

```toml
[benchmark]
cas = 1337
ca_roas = 9001
```

--------------------------------

### GET /stats/cas

Source: https://krill.docs.nlnetlabs.nl/en/stable/monitoring.html

Retrieves statistics regarding CAs, including ROA configuration analysis.

```APIDOC
## GET /stats/cas

### Description
Returns stats on your CAs, including an analysis of ROA configurations based on known BGP announcements.

### Method
GET

### Endpoint
/stats/cas
```

--------------------------------

### Mount a Custom Configuration File

Source: https://krill.docs.nlnetlabs.nl/en/stable/docker.html

Replace the default configuration file by mounting a local file to the container's data directory.

```bash
docker run -v /tmp/krill.conf:/var/krill/data/krill.conf
```

--------------------------------

### Update apt package index

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Updates the local package index before installing new software.

```bash
sudo apt update
```

--------------------------------

### Add Proposed Repository on Ubuntu

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Configures the apt source list to include the proposed repository for Ubuntu-based systems.

```bash
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/nlnetlabs-archive-keyring.gpg] https://packages.nlnetlabs.nl/linux/ubuntu \
$(lsb_release -cs)-proposed main" | sudo tee /etc/apt/sources.list.d/nlnetlabs-proposed.list > /dev/null
```

--------------------------------

### Show Publisher Details via CLI

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Displays detailed information for a specific publisher, including their base URI and published objects.

```bash
$ krillc pubserver publishers show --publisher testbed
handle: testbed
id: E90C21734C2C370A91A8475CB4F0E75DA4D0F0BF
base uri: rsync://localhost/repo/testbed/
objects:
  rsync://localhost/repo/testbed/0/0BA5C132B94891CB2D3A89EDE12F01ACA4BCD3DC.crl
  rsync://localhost/repo/testbed/0/0BA5C132B94891CB2D3A89EDE12F01ACA4BCD3DC.mft
```

--------------------------------

### GET /api/v1/pubd/stale/{seconds}

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Retrieves a list of publishers that have not published within the specified number of seconds.

```APIDOC
## GET /api/v1/pubd/stale/{seconds}

### Description
Lists all publishers which have not published in a while, helping to identify inactive 3rd party publishers.

### Method
GET

### Endpoint
https://localhost:3000/api/v1/pubd/stale/{seconds}

### Parameters
#### Path Parameters
- **seconds** (integer) - Required - The time threshold in seconds for inactivity.

### Response
#### Success Response (200)
- **publishers** (array) - List of inactive publishers.

#### Response Example
{
  "publishers": [
    {
      "handle": "ta"
    },
    {
      "handle": "testbed"
    }
  ]
}
```

--------------------------------

### GET /stats/repo

Source: https://krill.docs.nlnetlabs.nl/en/stable/publication-server.html

Retrieves statistics for the Publication Server, including publisher details and base URIs.

```APIDOC
## GET /stats/repo

### Description
Returns statistics about the Publication Server, such as the number of files, space used by publishers, and current base URIs.

### Method
GET

### Endpoint
https://localhost:3000/stats/repo
```

--------------------------------

### GET /stats/repo

Source: https://krill.docs.nlnetlabs.nl/en/stable/monitoring.html

Retrieves repository statistics including publisher object counts and connection status.

```APIDOC
## GET /stats/repo

### Description
Returns stats on the repository, if enabled. This includes publisher stats: number and size of objects and last connection time.

### Method
GET

### Endpoint
/stats/repo
```

--------------------------------

### Manage Krill service

Source: https://krill.docs.nlnetlabs.nl/en/stable/install-and-run.html

Commands to enable, start, check status, and view logs for the Krill service.

```bash
sudo systemctl enable --now krill
```

```bash
sudo systemctl status krill
```

```bash
sudo journalctl --unit=krill
```
Tokens:
Raw