public looking glass

Pre-Alpha. This page describes behavior that may change. Not for production use.

Stand up a public Looking Glass for your AS. The goal is that your peers, your customers, and the general public can query your route table, see your peer state, and read your AS path topology graph, without logging in and without being able to mutate anything.

The Looking Glass is a separate HTTP server inside Ze. It runs on its own port, with no authentication, and exposes both an HTMX web UI and a Birdwatcher-compatible JSON API that Alice-LG can consume.

Configuration

system {
    host    lg-01;
    domain  as30740.net;
}

environment {
    looking-glass {
        enabled true;
        server main {
            ip   0.0.0.0;
            port 8443;
        }
        tls true;
    }
}

That is the whole configuration surface. The Looking Glass reads from the same BGP state as the rest of the daemon, so it shows whatever your peers have told you, exactly as your BGP RIB sees it.

For TLS, Ze generates an ECDSA P-256 self-signed certificate on first start if none is configured. For a public deployment, you want a real certificate. Drop it into the blob store or terminate TLS in front of Ze with a reverse proxy (nginx, Caddy, haproxy) that proxies /lg/ and /api/looking-glass/.

Exposing it

The Looking Glass listens on the IP and port you configure. To expose it publicly, either:

1. Bind directly to a public interface (ip 0.0.0.0 plus a firewall rule opening the port).
2. Bind to 127.0.0.1 and put a reverse proxy in front.

Option 2 is what most deployments pick because it lets you terminate TLS, add rate limiting, and put the Looking Glass on port 443 alongside other web services.

Reverse proxy example (nginx)

server {
    listen 443 ssl http2;
    server_name lg.as30740.net;

    ssl_certificate     /etc/letsencrypt/live/lg.as30740.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/lg.as30740.net/privkey.pem;

    location /lg/ {
        proxy_pass       http://127.0.0.1:8443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
    }

    location /api/looking-glass/ {
        proxy_pass       http://127.0.0.1:8443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
    }

    location = / {
        return 302 /lg/peers;
    }
}

Verifying

The web UI lives at /lg/. Three tabs:

• /lg/peers: every peer with state, ASN name from Team Cymru, and route counts.
• /lg/lookup: prefix or IP lookup with the AS path topology graph rendered inline.
• /lg/search: unified search by prefix, AS path pattern, or community.

The Birdwatcher API lives at /api/looking-glass/. Test it with curl:

curl -s https://lg.as30740.net/api/looking-glass/status
curl -s https://lg.as30740.net/api/looking-glass/protocols/bgp
curl -s 'https://lg.as30740.net/api/looking-glass/routes/search?prefix=8.8.8.8'

The API returns snake_case field names (Birdwatcher convention), not Ze's usual kebab-case.

Alice-LG integration

Point Alice-LG at the Birdwatcher API and you get a turn-key multi-router Looking Glass.

sources:
  - name: "AS30740 Edge"
    type: birdwatcher
    birdwatcher:
      api: "https://lg.as30740.net/api/looking-glass"

Alice-LG handles the user-facing UI; Ze handles the data.

What to expose, what not to

A few things are worth not publishing.

Do not expose the SSH CLI publicly. That is the read-write, authenticated control plane. Put it behind a jump host or a VPN. The Looking Glass exists precisely so you do not need to.

Do not expose the authenticated web UI on the same port. The authenticated web UI is a different HTTP server inside Ze, on a different port. Make sure the reverse proxy only exposes /lg/ and /api/looking-glass/, not /config/ or /admin/.

Be careful about what your communities reveal. The Looking Glass shows the communities on every route. If you use communities for internal signalling (geographic tagging, customer identity, traffic engineering), that information is visible to anyone who looks. Most operators accept this because the communities are usually public anyway.

What could go wrong

Certificate mismatch. Using the self-signed cert in production breaks browser trust. Use a real certificate from the start.

SSE flood. Every open /lg/peers tab opens an SSE connection for live updates. The server caps at 100 concurrent SSE clients. If you expect more, either scale out behind a load balancer or disable the SSE feature in the reverse proxy.

ASN name decorator. The Team Cymru decorator queries DNS on every peer. If your DNS resolver is slow or the cache is cold, page loads are slow. Tune environment { dns { cache-size cache-ttl } } if this hurts.

Rate limiting. The Looking Glass does not rate-limit itself. A reverse proxy with limit_req or similar is the right place to protect it against abuse. Prefix lookups are relatively cheap; AS path graph rendering is more expensive.

See also

• Looking Glass reference for the full interface reference.
• System configuration for the looking-glass block.
• In-tree Looking Glass guide.