20260817 fe147 installer原生支持custom TAL模式：RIRS=custom+TAL_INPUT_MODE=custom-file-with-ta+CUSTOM_*全套env，compose挂载fixtures目录，start.sh支持CUSTOM_REPO_NETWORK无竞态接入

deploy/docker-installer/.env.example

@@ -39,12 +39,31 @@ RETAIN_RUNS=100
 # TAL/TA input mode:
 # file-with-ta: use packaged fixture TAL + TA only.
 # file-live-ta: use packaged fixture TAL; snapshot waits for live TA refresh, delta refreshes TA in background.
+# custom-file-with-ta: use the custom TAL/TA below (requires exactly RIRS=custom);
+#   for the local test repo compose component or a third-party test TA.
 # url: pass TAL URL to child process.
 TAL_INPUT_MODE=file-live-ta
 LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1
 LIVE_TA_REFRESH_CONNECT_TIMEOUT_SECS=15
 LIVE_TA_REFRESH_MAX_TIME_SECS=120
 
+# Custom TAL/TA mode (only active with RIRS=custom + TAL_INPUT_MODE=custom-file-with-ta).
+# CUSTOM_FIXTURE_HOST_DIR is the host directory bind-mounted to /opt/ours-rp/custom-fixtures.
+# CUSTOM_TAL_URI is recorded in CIR as the TAL origin URI.
+# HTTP_ROOT_CERT_PATHS lists HTTPS TLS root certificates (space-separated, container
+# paths) for self-signed RRDP/TAL servers; it is independent of the RPKI TA.
+#RIRS=custom
+#TAL_INPUT_MODE=custom-file-with-ta
+#CUSTOM_FIXTURE_HOST_DIR=../custom-fixtures
+#CUSTOM_TAL_PATH=/opt/ours-rp/custom-fixtures/tal/custom.tal
+#CUSTOM_TA_PATH=/opt/ours-rp/custom-fixtures/ta/custom-ta.cer
+#CUSTOM_TAL_URI=https://rpki-local-rrdp:8443/tal/custom.tal
+#HTTP_ROOT_CERT_PATHS=/opt/ours-rp/custom-fixtures/certs/rrdp-ca.pem
+# Optional shared docker network between the soak container and the stack local
+# test repository component. When set, scripts/start.sh attaches the soak
+# container to this external network before starting it.
+#CUSTOM_REPO_NETWORK=rpki-local-repo-net
+
 # Sync and runtime behavior.
 RSYNC_SCOPE=module-root
 # HTTP User-Agent for all outgoing HTTP requests (RRDP / TAL / TA / dead-repo probes).

deploy/docker-installer/compose/docker-compose.yml

@@ -11,8 +11,10 @@ services:
       RUN_ROOT: /var/lib/ours-rp
       BIN_DIR: /opt/ours-rp/bin
       FIXTURE_DIR: /opt/ours-rp/fixtures
+      CUSTOM_FIXTURE_DIR: /opt/ours-rp/custom-fixtures
     volumes:
       - ../.env:/opt/ours-rp/.env:ro
+      - ${CUSTOM_FIXTURE_HOST_DIR:-../custom-fixtures}:/opt/ours-rp/custom-fixtures:ro
       - ${HOST_DATA_DIR:-/var/lib/ours-rp-package-installer}/state:/var/lib/ours-rp/state
       - ${HOST_DATA_DIR:-/var/lib/ours-rp-package-installer}/runs:/var/lib/ours-rp/runs
       - ${HOST_DATA_DIR:-/var/lib/ours-rp-package-installer}/logs:/var/lib/ours-rp/logs

deploy/docker-installer/custom-fixtures/README.md

@@ -0,0 +1,19 @@
+# custom-fixtures 占位目录
+
+默认空目录，仅作为 `compose/docker-compose.yml` 中
+`${CUSTOM_FIXTURE_HOST_DIR:-../custom-fixtures}` 挂载的缺省目标，保证
+RIR 默认模式下 compose 不因缺目录而失败。
+
+启用 custom TAL 模式（`RIRS=custom` + `TAL_INPUT_MODE=custom-file-with-ta`）时，
+把 `CUSTOM_FIXTURE_HOST_DIR` 指向包含以下结构的主机目录：
+
+```text
+<fixture-root>/
+├── tal/custom.tal          # 自定义 TAL
+├── ta/custom-ta.cer        # 自定义 TA DER
+└── certs/rrdp-ca.pem       # 自签 HTTPS 服务的 TLS root cert（如需要）
+```
+
+本仓库的 `rpki_local_repo_installer` 组件会在其 `$HOST_DATA_DIR/fixtures`
+下生成完全兼容的目录结构；stack installer 的 `STACK_TA_MODE=local` 会自动
+完成该指向。

deploy/docker-installer/docs/README.en.md

@@ -54,6 +54,12 @@ Defaults:
 - `ALLOW_CROSS_ARCH=0`
 - `RTR_REPORT_DIR=__HOST_DATA_DIR__/empty-rtr-report`, which mounts an empty fallback directory by default; after deploying a separate RTR service, register its same-host report directory through `scripts/register_rtr_monitor.sh`
 
+To integrate a local or third-party test TA, use the custom TAL mode
+(`RIRS=custom` + `TAL_INPUT_MODE=custom-file-with-ta` together with
+`CUSTOM_TAL_PATH` / `CUSTOM_TA_PATH` / `CUSTOM_TAL_URI` /
+`HTTP_ROOT_CERT_PATHS` and the `CUSTOM_FIXTURE_HOST_DIR` mount); see the
+commented section in `.env.example` for details.
+
 ## First Start Semantics
 
 If there is no successful run under `HOST_DATA_DIR/runs`, `start.sh` starts the core `ours-rp-soak` service first and waits for the first snapshot to succeed before starting metrics, Prometheus and Grafana.

deploy/docker-installer/docs/README.zh-CN.md

@@ -54,6 +54,11 @@ vim .env
 - `ALLOW_CROSS_ARCH=0`
 - `RTR_REPORT_DIR=__HOST_DATA_DIR__/empty-rtr-report`，默认挂载空目录；独立 RTR 服务部署完成后，使用 `scripts/register_rtr_monitor.sh` 注册同机 report 目录
 
+如需对接本地或第三方测试 TA，可使用 custom TAL 模式（`RIRS=custom` +
+`TAL_INPUT_MODE=custom-file-with-ta`，配合 `CUSTOM_TAL_PATH` / `CUSTOM_TA_PATH` /
+`CUSTOM_TAL_URI` / `HTTP_ROOT_CERT_PATHS` 与 `CUSTOM_FIXTURE_HOST_DIR` 挂载），
+配置项说明见 `.env.example` 中的注释段。
+
 ## 首次启动语义
 
 如果 `HOST_DATA_DIR/runs` 下没有成功 run，`start.sh` 会先启动核心 `ours-rp-soak`，等待第一轮 snapshot 成功后再启动 metrics、Prometheus 和 Grafana。

deploy/docker-installer/scripts/start.sh

@@ -47,7 +47,21 @@ if has_success_run; then
 fi
 
 log "starting core soak service"
-compose_cmd --profile core up -d ours-rp-soak
+if [[ -n "${CUSTOM_REPO_NETWORK:-}" ]]; then
+  # Custom TAL mode against the stack local test repository: create the soak
+  # container without starting it, attach the shared external network first,
+  # then start it. This avoids the first snapshot racing the network connect.
+  compose_cmd --profile core up -d --no-start ours-rp-soak 2>/dev/null \
+    || compose_cmd --profile core create ours-rp-soak
+  soak_container="${COMPOSE_PROJECT_NAME:-ours-rp-package-installer}-soak"
+  if ! docker inspect -f '{{json .NetworkSettings.Networks}}' "$soak_container" | grep -q "\"$CUSTOM_REPO_NETWORK\""; then
+    log "attaching soak container to custom repo network: $CUSTOM_REPO_NETWORK"
+    docker network connect "$CUSTOM_REPO_NETWORK" "$soak_container"
+  fi
+  compose_cmd --profile core start ours-rp-soak
+else
+  compose_cmd --profile core up -d ours-rp-soak
+fi
 
 if [[ "$had_success" == "0" && "$WAIT_FIRST_RUN" == "1" ]]; then
   log "no previous successful run found; waiting for first run timeout=${timeout_secs}s"