Deployment guide

Alice-LG

Overview

Alice-LG is the looking glass that internet exchanges and network operators put in front of their route servers. It turns raw BGP state into a browser interface where anyone can search a prefix, open a neighbour, and read exactly what that peer announced, what was accepted and what was rejected, and why. The interface shows AS paths, next hops and BGP communities.

Alice-LG is a frontend only. It speaks HTTP to a backend API rather than BGP itself, so an Alice-LG installed on its own has nothing to display. This SecureAnyCloud image ships the whole looking glass stack on one VM: Alice-LG, the birdwatcher API it consumes, and a BIRD 2 route server for birdwatcher to read, wired to a small self-contained demo topology.

The interface shows a real BGP neighbour, accepted prefixes and filtered prefixes as soon as first boot finishes, so you can confirm that the product works before you point it at production. Repointing it at your own route servers is a configuration change, covered in Step 9.

Alice-LG has no user accounts of its own, and a looking glass discloses routing topology. The image therefore puts nginx in front of it with HTTP Basic Auth and a unique password generated on the first boot of your VM.

What you get:

Alice-LG 6.2.0 built from the pinned upstream release tag, running as the alice-lg systemd service with its React frontend compiled into the binary
birdwatcher 2.2.5, the HTTP API that translates BIRD state into JSON for Alice-LG, bound to loopback only
BIRD 2.14 from the Ubuntu archive, acting as the demo route server whose state the looking glass renders
A second BIRD 2 instance in its own network namespace, peered with the route server over a private link, so the looking glass has a real BGP neighbour and real prefixes on day one
An import policy that deliberately rejects some of those prefixes, with human-readable rejection reasons, so the Filtered view is populated too
nginx on port 80 with per-VM HTTP Basic Auth (user alice) protecting the whole interface and API
Alice-LG on 127.0.0.1:7340 and birdwatcher on 127.0.0.1:29184, never exposed to the network directly
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
A dependency licence report shipped in the image at /usr/share/doc/sac-alice-lg/DEPENDENCY-LICENCES.txt
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size. Alice-LG is light on resources and scales with the number of route servers and the size of their tables.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from wherever your operators browse from. Add 443/tcp once you put your own domain and TLS certificate in front (see Step 10).

A looking glass exposes routing topology. Treat port 80 as sensitive and restrict it to trusted ranges.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Alice-LG by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once, create the VM, then open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:alice-lg-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name alice-lg \
  --image sac1647283583153:alice-lg-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name alice-lg --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as the administrator user you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the looking glass stack is running

The appliance is a chain of four components. nginx terminates the browser connection and applies the password gate. Alice-LG renders the interface. birdwatcher turns BIRD state into JSON, and BIRD holds the routing table. All four must be running.

systemctl is-active bird.service sac-bird-demo-peer.service birdwatcher.service alice-lg.service nginx.service

Every line reports active. Then confirm where each service is bound. Only nginx is on a routable address, and BGP is confined to the private demo link.

ss -tln | grep -E ':(80|179|7340|29184)'

Alice-LG appears on 127.0.0.1:7340 and birdwatcher on 127.0.0.1:29184, both loopback only. BGP appears on 10.255.0.1:179, the private link inside this VM, never a public address. Only port 80 is bound on 0.0.0.0.

Step 5 - Retrieve your looking glass password

Alice-LG has no login of its own, so nginx protects it with HTTP Basic Auth. The username is alice. A unique password is generated on the first boot of your VM and written to a root-only file. Read the file as root:

sudo cat /root/alice-lg-credentials.txt

The file contains the URL, the username and the password. No credential of any kind ships inside the image, so this password exists only on your VM.

Step 6 - Sign in to the looking glass

Open the ALICE_LG_URL from the previous step in a browser, or open http://<vm-public-ip>/. Your browser prompts for the HTTP Basic Auth credentials. Enter alice and the password you just read.

The landing page lists the route servers this looking glass knows about, with the BIRD version each one is running.

You can verify the gate from the shell before you open a browser. Without credentials the interface returns 401. With the per-VM password it returns 200:

curl -s -o /dev/null -w 'no credentials: %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'with password: %{http_code}\n' -u 'alice:<ALICE_LG_PASSWORD>' http://127.0.0.1/

Step 7 - Read the route server and its neighbours

Select the route server in the left-hand column. Alice-LG shows every BGP session, its state, how long it has been up, and how many routes it received and filtered. The bundled demo peer appears here as AS 65001 in state up.

The same information is available from the shell, straight from BIRD:

sudo birdc show protocols demo_peer_as65001

The session reports Established. The routes it carried are in the route server's table. List them:

sudo birdc show route protocol demo_peer_as65001

Step 8 - Read accepted and filtered routes

Click the neighbour to open its routes. This is the view operators work in most. Alice-LG shows the prefixes the peer announced and splits them into accepted and filtered. For each filtered prefix, it explains why the prefix was rejected. The reasons come from BGP large communities that the route server's import policy attaches, which Alice-LG resolves into readable text.

The filtered set is also visible from the shell:

sudo birdc show route filtered protocol demo_peer_as65001

The global search box at the top searches every route server at once. An operator can answer "is my prefix visible here" in one step.

You can run the same query from the API, which is useful for monitoring:

curl -sS -u 'alice:<ALICE_LG_PASSWORD>' -w '\nHTTP %{http_code}\n' 'http://127.0.0.1/api/v1/routeservers'

A correct credential returns the route server list and HTTP 200. A wrong one returns HTTP 401 and no data, which is the same gate your browser meets.

Step 9 - Point Alice-LG at your own route servers

The bundled demo topology lets the appliance prove itself on day one. In production, point Alice-LG at your real route servers instead. Each route server needs a backend API that Alice-LG can read: birdwatcher for BIRD, or the GoBGP and OpenBGPD backends that Alice-LG also supports.

Alice-LG's configuration lives in one file. Display it:

sudo cat /etc/alice-lg/alice.conf

Each route server is a pair of sections. Add one pair per route server, and point api at that route server's birdwatcher endpoint. Keep or remove the bundled demo-rs-v4 source as you prefer:

[source.rs1-lon] name = rs1.lon.example.net (IPv4) group = LON [source.rs1-lon.birdwatcher] api = http://rs1.lon.example.net:29184/ type = single_table main_table = master4

Set type to match how that route server's BIRD is configured. Use single_table for a single-table configuration, which is what arouteserver generates, or multi_table if each peer has its own table. Then restart Alice-LG:

sudo systemctl restart alice-lg.service

Confirm that the service came back and is serving:

systemctl is-active alice-lg.service

If a new route server does not appear, check that its birdwatcher endpoint is reachable from this VM. Also check that the routes_table_filtered and routes_filtered modules are enabled in that birdwatcher's configuration. Otherwise the Filtered view stays empty.

Once your own route servers are confirmed working, and only then, you can stop the bundled demo topology. The command below removes the local route server that the demo-rs-v4 source reads:

sudo systemctl disable --now sac-bird-demo-peer.service bird.service birdwatcher.service

At the same time, remove the [source.demo-rs-v4] sections from /etc/alice-lg/alice.conf, then restart Alice-LG. Otherwise the interface keeps a route server entry it can no longer reach.

Step 10 - Add your own domain and TLS

The image serves plain HTTP on port 80 behind the password gate. For anything reachable beyond a trusted management network, terminate TLS with your own certificate.

Point a DNS record at the VM and obtain a certificate. Then add a 443 server block to /etc/nginx/sites-available/sac-alice-lg that proxies to the same http://alice_lg upstream and keeps the auth_basic lines. Test the configuration, then reload nginx:

sudo nginx -t

Many operators also replace the Basic Auth gate with their existing SSO by putting an authenticating proxy in front. Whatever you choose, do not remove the gate and expose Alice-LG directly. It has no authentication of its own, and the interface reveals your peering topology.

Server Components

Component Version Purpose

Alice-LG 6.2.0 The looking glass web interface and its JSON API

birdwatcher 2.2.5 HTTP API that turns BIRD state into JSON for Alice-LG

BIRD 2.14 The routing daemon whose state is displayed

nginx 1.24 Reverse proxy and per VM HTTP Basic Auth gate

Ubuntu 24.04 LTS Base operating system

Filesystem Layout

Path Purpose

/usr/local/bin/alice-lg The Alice-LG binary, with the frontend compiled in

/usr/local/bin/birdwatcher The birdwatcher API binary

/etc/alice-lg/alice.conf Alice-LG configuration, including the route server sources

/etc/birdwatcher/birdwatcher.conf birdwatcher configuration

/etc/bird/bird.conf The demo route server's BIRD configuration

/etc/bird/sac-demo-peer.conf The demo BGP peer's BIRD configuration

/etc/nginx/sites-available/sac-alice-lg The nginx site, including the auth gate

/etc/nginx/snippets/sac-alice-lg-listen.conf The nginx listener, opened at first boot

/root/alice-lg-credentials.txt Per VM URL, username and password (root only)

/usr/share/doc/sac-alice-lg/DEPENDENCY-LICENCES.txt Dependency licence report

Managing the services

Check the status of the interface service:

systemctl status alice-lg.service --no-pager

Restart the interface after a configuration change with sudo systemctl restart alice-lg.service. birdwatcher and BIRD are managed the same way. BIRD also accepts a live reconfiguration without dropping sessions:

sudo birdc configure

On startup

alice-lg-firstboot.service runs once, on the first boot of your VM. It does the following, in order:

Waits for the looking glass to serve real route data.
Generates the per-VM Basic Auth password and writes it to /root/alice-lg-credentials.txt.
Opens the nginx listener on port 80.
Verifies the whole path end to end, then writes its sentinel at /var/lib/sac/data/alice-lg-firstboot.done.

Until the service has run, nginx listens on loopback only and holds an empty password file. The image cannot serve anyone, and no credential ships inside it.

sac-lg-fabric.service recreates the private link and network namespace that the demo BGP session runs over. It runs on every boot and holds no state.

Backups

Alice-LG is a viewer over live route server APIs, so there is no application database to back up. Back up your configuration:

sudo tar czf ~/alice-lg-config-backup.tar.gz /etc/alice-lg/alice.conf /etc/bird

Do not add /root/alice-lg-credentials.txt or /etc/nginx/.alice-lg.htpasswd to a backup archive. Both hold this VM's password. They are regenerated per VM rather than restored, and copying them creates a credential-bearing file outside the paths that protect the originals.

Troubleshooting

The browser asks for a password and never accepts it. Confirm that the username is alice, and read the password again with sudo cat /root/alice-lg-credentials.txt. The password is unique to the VM and is not recoverable from anywhere else. If it has been lost, regenerate it by removing /var/lib/sac/data/alice-lg-firstboot.done and running sudo systemctl start alice-lg-firstboot.service.

The interface loads but shows no route servers. Check systemctl is-active alice-lg.service birdwatcher.service. If birdwatcher is down, Alice-LG has no data source. Check sudo journalctl -u birdwatcher.service -n 40 --no-pager.

A route server appears but its neighbours list is empty. That route server's birdwatcher can reach BIRD, but no BGP session is up on it. Verify with sudo birdc show protocols on that route server.

Routes appear with no prefix. birdwatcher parses BIRD's text output, so a route server whose BIRD prints sub-second timestamps produces routes that birdwatcher cannot fully parse. Set timeformat route "%Y-%m-%d %H:%M:%S"; in that BIRD's configuration, as the bundled demo route server does.

The Filtered tab is always empty for your own route server. BIRD only keeps rejected routes when the channel sets import keep filtered on;, and birdwatcher only exposes them when the routes_filtered and routes_table_filtered modules are enabled.

Security recommendations

Keep the HTTP Basic Auth gate. Alice-LG has no authentication of its own, and the interface reveals your peering topology, your members and their prefixes.
Restrict port 80. Limit port 80 in the NSG to the networks your operators browse from, and put TLS in front before exposing it more widely.
Leave Alice-LG and birdwatcher on loopback. They are reachable only through nginx by design. Exposing birdwatcher would hand out route server state with no authentication at all.
Rotate the password. Regenerate /etc/nginx/.alice-lg.htpasswd with htpasswd, and keep /root/alice-lg-credentials.txt root-only.
Keep the VM patched. Unattended security upgrades are enabled on the base image and continue to run on your VM.

Known limitations

Alice-LG 6.2.0 depends on three libraries that have published advisories but no fixed release in the major version Alice-LG uses. Upstream has to move each library to a new major version before these can be fixed. SecureAnyCloud builds the image with every other dependency raised to a fixed release.

CVE-2026-41889 (jackc/pgx v4) and CVE-2026-32286 (jackc/pgproto3 v2). Both are in the PostgreSQL client and are reachable only if you switch Alice-LG to store_backend = postgres. The image uses Alice-LG's default in-memory store and ships no PostgreSQL. If you enable the PostgreSQL backend, point it only at a database server you control.
CVE-2026-30405 (osrg/gobgp v3). Alice-LG uses GoBGP's API and BGP packet types only. The GoBGP server package that contains the vulnerable code is not linked into the binary.

Support

SecureAnyCloud provides 24/7 support for this image. Contact sales@secureanycloud.com or visit secureanycloud.com.

Alice-LG and birdwatcher are open source projects of the Alice-LG community, distributed under the BSD 3-Clause licence. BIRD is a project of CZ.NIC, distributed under the GNU General Public License version 2.

SecureAnyCloud is not affiliated with, endorsed by, or sponsored by the Alice-LG project or CZ.NIC. All trademarks are the property of their respective owners.

Deploy on Azure

Launch Alice-LG on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure