add OpenBSD TA constraints and localhost TLS examples

README.md

@@ -1,25 +1,25 @@
 # Panda RPKI
 
-For every field, default, constraint and complete example, see the [TOML configuration reference](docs/configuration.md)。
-
 Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
 over RRDP, validates signed objects, and exports routing data as CSV and Canonical
 Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
 
-Version 0.1.0 is an unreleased candidate, validated on Linux x86-64. Other
-platforms are not yet verified. Review the [standards and limitations](docs/conformance-matrix.md)
-and [security policy](SECURITY.md) before evaluating it for routing use.
+Configuration is provided through TOML. See the [TOML configuration reference](docs/configuration.md)
+for every field, default, constraint and complete example.
+
+This build is validated on Linux x86-64. Other platforms are not yet verified.
+Review the [standards and limitations](docs/conformance-matrix.md) and [security
+policy](SECURITY.md) before evaluating it for routing use.
 
 ## Quick start
 
-Requirements: Linux, Docker, and a TAL. A matching DER trust-anchor certificate
-may be supplied in the TOML, or Panda can refresh it from the TAL's URI. Follow
-[input preparation](docs/getting-started.md#prepare-trust-anchors) for trusted
-RIR inputs. From the project root, after placing `input/anchor.tal` (and, for a
-fixed-TA run, `input/anchor.cer`):
+Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and
+its constraints under `tals/`, so no TAL download or `input/` setup is needed for
+this first run. A matching DER trust-anchor certificate may be supplied in the
+TOML, or Panda can refresh it from the TAL's URI. From the project root:
 
 ```bash
-docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
+docker build -f docker/Dockerfile -t panda-rpki:local .
 mkdir -p state output
 cat > validate.toml <<'TOML'
 config-version = 1
@@ -29,22 +29,26 @@ rrdp-state-dir = "/state/repository"
 ccr-out = "/output/result.ccr"
 
 [[anchors]]
-id = "anchor"
-tal = "/input/anchor.tal"
-# ta = "/input/anchor.cer" # uncomment for fixed TA mode
+id = "afrinic"
+tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
+# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
 TOML
 docker run --rm --read-only --tmpfs /tmp \
   --user "$(id -u):$(id -g)" \
-  -v "$PWD/input:/input:ro" \
+  -v "$PWD/tals:/input:ro" \
   -v "$PWD/state:/state" \
   -v "$PWD/output:/output" \
   -v "$PWD/validate.toml:/config/validate.toml:ro" \
-  panda-rpki:v0.1.0 validate --config /config/validate.toml
+  panda-rpki:local validate --config /config/validate.toml
 ```
 
 The quick start refreshes the TA certificate automatically; TAL files themselves
 remain operator-maintained. For complete single/all-five and daemon TOML files,
-see [Compose examples](docker/examples/README.md).
+see [Compose examples](docker/examples/README.md). The two all-five examples
+use the vendored [OpenBSD TALs and constraints](tals/README.md) with resource
+constraints enabled. Edit the copied policy files or set top-level
+`ta-constraints-enabled = false` to disable them.
 
 Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
 Reuse the state directory to allow delta updates on subsequent runs.
@@ -61,9 +65,8 @@ For continuous operation see [Usage](docs/usage.md#continuous-operation).
 - CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
 - Daemon intervals, persistent state, run retention, timeouts and graceful stop.
 
-Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply explicit
-TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server
-is included. See the
+The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh
+follows each TAL's HTTPS or rsync URI. No RTR server is included. See the
 [standards matrix](docs/conformance-matrix.md) for profiles and limitations.
 
 ## Documentation