Overview

rtb-buddy is a command-line tool for the RtBrick Full Stack Network Operating System (RBFS). It generates APIGW and LI X1 cryptographic artifacts without relying on external web pages. The tool streamlines a single CLI workflow for creating JWKS files, signed JWT tokens, and mutual TLS (mTLS) certificates.

Installation

Quick Install

curl installer
curl -fsSL https://raw.githubusercontent.com/rtbrick/tools/main/install_rtb_buddy.sh | sudo bash

This detects your OS and architecture, downloads the latest release from GitHub, verifies the checksum, and installs rtb-buddy to /usr/local/bin.

From Source

Requires Go 1.27+
git clone https://github.com/rtbrick/tools.git
cd tools
make build

The binary rtb-buddy is placed in the project root.

Go Install

go install github.com/rtbrick/tools/cmd/rtb-buddy@latest

The binary is placed in $(go env GOPATH)/bin.

Usage

# Generate key pair
rtb-buddy apigw generate jwks

# Issue a token
rtb-buddy apigw generate token --sub alice --name Alice --preferred-username alice --scope supervisor

# Verify a token
echo "<token>" | rtb-buddy apigw inspect token

Shell Completion

# zsh (current session)
source <(rtb-buddy completion zsh)

# zsh (persistent - Linux)
rtb-buddy completion zsh > "${fpath[1]}/_rtb-buddy"

# zsh (persistent - macOS)
rtb-buddy completion zsh > "$(brew --prefix)/share/zsh/site-functions/_rtb-buddy"

# bash
source <(rtb-buddy completion bash)

Commands

apigw

APIGWD related commands.

apigw generate jwks

Generates an RSA key pair as two JWKS files.

  • --priv-key — output path for the private JWKS (default: apigw-jwks-priv.json)

  • --pub-key — output path for the public JWKS (default: apigw-jwks.json)

  • --kid — key ID for the JWKS entries (default: access)

The private JWKS contains two entries (private key + public key, same KID). The public JWKS contains one entry (public key only, for distribution).

rtb-buddy apigw generate jwks
rtb-buddy apigw generate jwks --kid "prod" --priv-key prod-jwks-priv.json --pub-key prod-jwks.json
apigw generate token

Generates a signed JWT. The private key is read from the JWKS file.

  • --priv-key — private JWKS file path (default: apigw-jwks-priv.json)* --kid — key ID to select from the JWKS (empty = first key)

  • --override-kid — override the kid in the JWT header (default: use the JWKS entry’s kid)

  • --sub — token subject (required)

  • --name — name claim (required)

  • --preferred-username — preferred username claim (required)

  • --scope — scope claim (default: supervisor)

  • --iss — issuer (default: rtbrick)

  • --dur — token duration (default: 30s)

# Single key in JWKS — --kid not needed
rtb-buddy apigw generate token \
  --sub 1234567890 \
  --name rtbrick \
  --preferred-username rtbrick \
  --scope supervisor

# Multiple keys — select by KID
rtb-buddy apigw generate token \
  --kid "prod" \
  --sub 1234567890 \
  --name rtbrick \
  --preferred-username rtbrick

# Override the kid in the JWT header
rtb-buddy apigw generate token \
  --kid "access" \
  --override-kid "rotated" \
  --sub 1234567890 \
  --name rtbrick \
  --preferred-username rtbrick
apigw generate tls
rtb-buddy apigw generate tls --org "rtbrick"
apigw inspect token

Decode a JWT from stdin. Verify signature if public JWKS is available. Reports expiration status.

  • --pub-key — public JWKS file path for signature verification (default: apigw-jwks.json)

  • --override-kid — override the kid for key lookup in the JWKS

# Verify with matching kid
rtb-buddy apigw generate token --kid access --sub 123 --name admin --preferred-username admin \
  | rtb-buddy apigw inspect token

# Override kid for key lookup (e.g. token has kid "test", JWKS has kid "access")
rtb-buddy apigw generate token --kid access --override-kid test --sub 123 --name admin --preferred-username admin \
  | rtb-buddy apigw inspect token --override-kid access

lix1

LI X1 mTLS certificate management commands for Lawful Intercept.

mTLS Setup

LI X1 uses mutual TLS (mTLS) between ADMF (Administrative Function, the LI management system) and RBFS (network element, the network device).

CA

Trust anchor — issues certificates for all components

RBFS

Server — presents certificate, verifies ADMF clients

ADMF

Client — presents certificate, verifies RBFS server

Generating the CA and certificates
# 1. Generate CA
rtb-buddy lix1 generate ca --cn "LI X1 CA" --org "RtBrick" --ou "Engineering"

# 2. Generate RBFS certificate (server)
rtb-buddy lix1 generate cert --cn "rbfs-router-01" --org "RtBrick" --ou "Engineering" --crt rbfs.crt --crt-key rbfs.key

# 3. Generate ADMF certificate (client)
rtb-buddy lix1 generate cert --cn "admf-prod" --org "RtBrick" --ou "Engineering" --crt admf.crt --crt-key admf.key
Deploy

  • RBFS: rbfs.crt + rbfs.key + ca.crt

  • ADMF: admf.crt + admf.key + ca.crt

Both sides need ca.crt to verify each other’s certificates.

lix1 generate ca

Generates a root CA certificate and private key.

  • --ca-crt — CA certificate output path (default: ca.crt)

  • --ca-crt-key — CA private key output path (default: ca.key)

  • --cn — Common Name (required)

  • --org — Organization (required)

  • --ou — Organizational Unit (required)

  • --duration — Certificate validity duration (default: 87600h / 10 years)

rtb-buddy lix1 generate ca --cn "RtBrick LIX1" --org "RtBrick" --ou "Engineering"
rtb-buddy lix1 generate ca --cn "My CA" --org "My Org" --ou "Eng" --ca-crt my-ca.crt --ca-crt-key my-ca.key
lix1 generate cert

Generates a certificate signed by the CA.

  • --ca-crt — CA certificate input path (default: ca.crt)

  • --ca-crt-key — CA private key input path (default: ca.key)

  • --crt — Certificate output path (required)

  • --crt-key — Private key output path (required)

  • --cn — Common Name (required)

  • --org — Organization (required)

  • --ou — Organizational Unit (required)

  • --duration — Certificate validity duration (default: 87600h / 10 years)

rtb-buddy lix1 generate cert --cn "Test Device 1" --org "RtBrick" --ou "Testing" --crt device_test_1.crt --crt-key device_test_1.key
rtb-buddy lix1 generate cert --cn "ADMF" --org "RtBrick" --ou "Engineering" --crt admf.crt --crt-key admf.key
rtb-buddy lix1 generate cert --cn "RBFS" --org "RtBrick" --ou "Engineering" --crt rbfs.crt --crt-key rbfs.key
lix1 test cert

Validates the certificate and it’s trust chain.

  • --crt — Certificate to test (required)

  • --ca-crt — CA certificate for chain validation (default: ca.crt)

rtb-buddy lix1 test cert --crt device_test_1.crt
rtb-buddy lix1 test cert --crt admf.crt --ca-crt ca.crt
Example output:
Subject: CN=Test Device 1,OU=Testing,O=RtBrick
Issuer: CN=RtBrick LIX1,OU=Engineering,O=RtBrick
Serial: 1658
Signature Algorithm: SHA256-RSA
Not Before: 2026-09-16T17:11:06Z
Not After: 2036-09-13T17:11:06Z
Is CA: false

Status: VALID (expires in 87600h0m0s)

Verifying certificate chain against CA...
Chain verification: OK

rbfs

RBFS router management commands.

rbfs config restconf

RESTCONF operations for RBFS routers.

rbfs config restconf get

Get RESTCONF configuration from an RBFS router.

  • --auth-mode — Use HTTPS with JWT authentication (port 12321); default is HTTP (port 19091)

  • --element — Element name (defaults to basepath)

  • -o, --output — Output file path (default: print to stdout)

  • -p, --path — RESTCONF data path (e.g. rtbrick-config:lldp, default: full config)

  • --priv-key — Private JWKS file path for token generation (default: apigw-jwks-priv.json)

  • --kid — Key ID to select from the JWKS (default: access)

  • --sub — Token subject (default: 78228339)

  • --name — Token name claim (default: rtb-buddy)

  • --scope — Token scope (default: supervisor)

  • --iss — Token issuer (default: rtbrick)

  • --dur — Token duration (default: 30s)

# Get full config to stdout
rtb-buddy rbfs config restconf get ufi29.q2c.u35.r3.nbg.rtbrick.net
# Get specific path to stdout
rtb-buddy rbfs config restconf get ufi29.q2c.u35.r3.nbg.rtbrick.net -p rtbrick-config:lldp
# Get specific path to file
rtb-buddy rbfs config restconf get ufi29.q2c.u35.r3.nbg.rtbrick.net -p rtbrick-config:system -o system.json
# HTTPS with JWT
rtb-buddy rbfs config restconf get ufi29.q2c.u35.r3.nbg.rtbrick.net --auth-mode -p rtbrick-config:system
rbfs config restconf put

Put RESTCONF configuration to an RBFS router.

  • --auth-mode — Use HTTPS with JWT authentication (port 12321); default is HTTP (port 19091)

  • --element — Element name (defaults to basepath)

  • -f, --file — Input file path (default: stdin)

  • -p, --path — RESTCONF data path (e.g. rtbrick-config:system)

  • --priv-key — Private JWKS file path for token generation (default: apigw-jwks-priv.json)

  • --kid — Key ID to select from the JWKS (default: access)

  • --sub — Token subject (default: 78228339)

  • --name — Token name claim (default: rtb-buddy)

  • --scope — Token scope (default: supervisor)

  • --iss — Token issuer (default: rtbrick)

  • --dur — Token duration (default: 30s)

# Put config from stdin
cat config.json | rtb-buddy rbfs config restconf put ufi29.q2c.u35.r3.nbg.rtbrick.net -p rtbrick-config:system
# Put config from file
rtb-buddy rbfs config restconf put ufi29.q2c.u35.r3.nbg.rtbrick.net -p rtbrick-config:system -f config.json
# HTTPS with JWT
rtb-buddy rbfs config restconf put ufi29.q2c.u35.r3.nbg.rtbrick.net --auth-mode -p rtbrick-config:system -f config.json