add OpenBSD TA constraints and localhost TLS examples

docker/examples/README.md

@@ -7,9 +7,10 @@ startup, graceful stop and config reload.
 | File | Mode | Inputs |
 | --- | --- | --- |
 | validate.toml | Single run | /input/anchor.tal |
-| validate-all5.toml | Single run | Five named RIR TALs |
+| validate-all5.toml | Single run | Five named RIR TALs and constraints |
+| validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
 | daemon.toml | Continuous | /input/anchor.tal |
-| daemon-all5.toml | Continuous | Five named RIR TALs |
+| daemon-all5.toml | Continuous | Five named RIR TALs and constraints |
 
 All examples use text/info diagnostics, require-complete=true, and automatic
 TA certificate refresh (ta omitted). TAL files are never automatically updated.
@@ -22,3 +23,36 @@ Container paths differ from native configuration paths. Validate uses
 /state/repository and /state/repository.ta-cache under the writable /state mount;
 daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
 an explicit migration or separate cache mount before switching to these paths.
+
+The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
+`tals/*.constraints` from the repository into INPUT_DIR. Customize those copies
+or set top-level `ta-constraints-enabled = false` to disable all policies,
+including same-stem file discovery. See [provenance](../../tals/README.md).
+
+## Local HTTPS test repository
+
+`validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated
+by `tests/support/generate_repository.py`. The server runs on the host at
+`localhost:8443`; the Compose example therefore uses host networking. The
+fixture and its CA are generated for the test run and are not production trust
+roots:
+
+```bash
+work="$(mktemp -d)"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output" "$work/state"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
+export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.localhost.yaml run --build --rm validator
+```

docker/examples/daemon-all5.toml

@@ -10,30 +10,37 @@ shutdown-grace-secs = 30
 run-timeout-secs = 1800
 require-complete = true
 ta-refresh-policy = "allow-valid-cache"
+# Set false to ignore all constraints files, including adjacent auto-discovery.
+ta-constraints-enabled = true
 log-level = "info"
 log-format = "text"
 
 [[anchors]]
 id = "afrinic"
 tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
 # ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "apnic"
 tal = "/input/apnic.tal"
+constraints = "/input/apnic.constraints"
 # ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "arin"
 tal = "/input/arin.tal"
+constraints = "/input/arin.constraints"
 # ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "lacnic"
 tal = "/input/lacnic.tal"
+constraints = "/input/lacnic.constraints"
 # ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "ripe"
 tal = "/input/ripe.tal"
+constraints = "/input/ripe.constraints"
 # ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate

docker/examples/validate-all5.toml

@@ -8,30 +8,37 @@ ccr-out = "/output/result.ccr"
 run-timeout-secs = 1800
 require-complete = true
 ta-refresh-policy = "allow-valid-cache"
+# Set false to ignore all constraints files, including adjacent auto-discovery.
+ta-constraints-enabled = true
 log-level = "info"
 log-format = "text"
 
 [[anchors]]
 id = "afrinic"
 tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
 # ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "apnic"
 tal = "/input/apnic.tal"
+constraints = "/input/apnic.constraints"
 # ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "arin"
 tal = "/input/arin.tal"
+constraints = "/input/arin.constraints"
 # ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "lacnic"
 tal = "/input/lacnic.tal"
+constraints = "/input/lacnic.constraints"
 # ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "ripe"
 tal = "/input/ripe.tal"
+constraints = "/input/ripe.constraints"
 # ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate

docker/examples/validate-localhost.toml

@@ -0,0 +1,21 @@
+# Use with docker/compose.localhost.yaml or docker run --network host.
+# The fixture is mounted at /fixture and is created by
+# tests/support/generate_repository.py.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+rrdp-sync-mode = "snapshot"
+ccr-out = "/output/result.ccr"
+http-timeout-secs = 5
+# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
+http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
+log-level = "info"
+log-format = "text"
+require-complete = true
+run-timeout-secs = 300
+
+[[anchors]]
+id = "custom"
+tal = "/fixture/tal/custom.tal"
+ta = "/fixture/ta/custom-ta.cer"