add OpenBSD TA constraints and localhost TLS examples

docs/configuration.md

@@ -52,6 +52,7 @@ those choices do not change the built-in defaults.
 | `config-version` | Integer | Explicit `1` required | Configuration schema version, not the software version. Missing or unsupported versions are rejected. |
 | `mode` | String | Required | `validate` or `daemon`; must match the command. |
 | `anchors` | Array of tables | At least one required | Write `[[anchors]]` entries; see section 5. No automatic TAL-directory scan. |
+| `ta-constraints-enabled` | Boolean | true | Apply explicit or adjacent TA constraints files. False skips all constraints loading and enforcement, including adjacent discovery; unused missing or malformed files are ignored. |
 | `ta-refresh-policy` | String | `allow-valid-cache` | On automatic TA download failure, permit a revalidated, usable cached certificate. `require-fresh` prohibits fallback. Does not replace fixed TA files. |
 | `max-ca-depth` | Nonnegative integer | 64 | Maximum CA validation-tree depth. Zero is accepted by configuration parsing, but is a depth limit, not unlimited traversal. Usually keep 64. |
 | `http-timeout-secs` | Nonnegative integer, seconds | 300 | HTTP fetch timeout. Zero is normalized to one second, not unlimited. Does not set the whole-run or rsync timeout. |
@@ -113,7 +114,7 @@ otherwise 3 if strict completion is enabled and any cycle was partial; otherwise
 | `id` | String | TAL filename stem | Identifier in results, logs and constraints. An explicitly empty string also falls back to the filename stem. Resolved IDs must be nonempty and unique; explicit names are preferred. |
 | `tal` | File path | Required | TAL obtained from an independently trusted source; must exist and parse during preflight. Contains certificate URIs and the trusted public key. |
 | `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity. Network downloads do not silently replace it. |
-| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. An explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. |
+| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. When ta-constraints-enabled is true, an explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. Set top-level `ta-constraints-enabled = false` to disable all constraints. |
 
 Automatic refresh updates the **TA certificate, never the TAL file**. Each
 validate run or daemon cycle tries the TAL's HTTPS/rsync URIs in order. There is
@@ -292,3 +293,29 @@ produces this excerpt, not the full print output:
 | Logs still JSON | Check top-level settings, recreate the container and inspect new logs. Metadata remains JSON intentionally. |
 | Exited with code 3 | Stopped with partial aggregate results; inspect summaries/lifecycle logs rather than repeatedly stopping. |
 | Latest absent | No complete success yet; partial does not publish even when it exits 0. |
+
+## TA resource constraints
+
+The repository includes five OpenBSD TALs and matching constraints in
+[`tals/`](../tals/README.md), with pinned provenance and checksums. Both all5
+examples explicitly enable them. To customize one anchor, edit its constraints
+file or its `constraints = "/input/custom.constraints"` path. Paths must be
+visible inside the container; relative paths resolve against the TOML directory.
+
+To disable every anchor's constraints, set this **before** `[[anchors]]`:
+
+```toml
+ta-constraints-enabled = false
+```
+
+This takes precedence over explicit paths and same-stem discovery. Re-enable
+with `true`; enabled explicit paths must be readable and syntactically valid.
+Absent adjacent files are allowed for custom TALs without explicit paths.
+Check/print and actual validation use the same selection rules. The summary
+records `taConstraintsEnabled` and `taConstraintsApplied` (anchor IDs and paths).
+A loaded empty file imposes no additional restrictions; enabled alone does not
+imply a file was found.
+
+Each run loads a fresh immutable policy snapshot. Reusing RRDP state does not
+reuse validation results from the previous policy. Stop and recreate the daemon
+to adopt TOML changes; follow the Docker reload procedure after editing files.

docs/docker.md

@@ -44,12 +44,46 @@ The template mounts the TOML read-only at `/config/validate.toml` and invokes
 `panda-rpki validate --config /config/validate.toml`. Host variables only select
 mounts, image and container UID/GID; they are not read as validator settings.
 
-## All five RIRs
+## Local HTTPS test repository
 
-Put the five RIR TAL files (TA certificates are optional) under `input/` and list them as named anchors in a
-TOML with `/input/...` paths. Then set `CONFIG_FILE` to that file and run:
+Use [validate-localhost.toml](../docker/examples/validate-localhost.toml) and
+[compose.localhost.yaml](../docker/compose.localhost.yaml) to run the generated
+HTTPS repository used by the regression tests. The TOML explicitly sets
+`http-root-cert = ["/fixture/certs/rrdp-ca.pem"]`; this is the generated test
+server CA, separate from the RPKI trust anchor. The validator uses host
+networking because the generated RRDP URI is `https://localhost:8443`:
 
 ```bash
+work="$(mktemp -d)"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output" "$work/state"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
+export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.localhost.yaml run --build --rm validator
+```
+
+## All five RIRs
+
+Copy the vendored [OpenBSD TALs and constraints](../tals/README.md) into an
+operator-managed input directory. Review the retained upstream notices, including
+the ARIN disclaimer. TA certificates are optional; the examples refresh them.
+Both all5 templates enable constraints by default:
+
+```bash
+mkdir -p input state/all5 output/all5
+cp tals/*.tal tals/*.constraints input/
+cp docker/examples/validate-all5.toml all5.toml
 export CONFIG_FILE="$PWD/all5.toml"
 export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state/all5" OUTPUT_DIR="$PWD/output/all5"
 docker compose -f docker/compose.all5.yaml run --build --rm validator
@@ -116,6 +150,7 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 | Compose file | Complete TOML |
 | --- | --- |
 | `compose.yaml` | [validate.toml](../docker/examples/validate.toml) |
+| `compose.localhost.yaml` | [validate-localhost.toml](../docker/examples/validate-localhost.toml) |
 | `compose.all5.yaml` | [validate-all5.toml](../docker/examples/validate-all5.toml) |
 | `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) |
 | `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) |
@@ -123,6 +158,8 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 For example, from the repository root:
 
 ```bash
+mkdir -p input
+cp tals/*.tal tals/*.constraints input/
 cp docker/examples/daemon-all5.toml daemon.toml
 export CONFIG_FILE="$PWD/daemon.toml"
 export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/daemon-state"
@@ -187,3 +224,16 @@ The controller logs are in `docker compose logs`; child diagnostics are in
 format. JSON summary/metadata files remain JSON even with text diagnostics.
 `latest` exists only after a complete success; partial runs do not create or
 replace it, including the first run after upgrading an old state root.
+
+## Change or disable constraints
+
+Edit the copied `input/<rir>.constraints` files, or set an anchor's `constraints`
+to a different file under `/input`. Set top-level `ta-constraints-enabled = false`
+to disable all policies, including same-stem auto-discovery. The all5 examples
+use `true` and explicit paths so missing files fail configuration checks.
+
+Use the stop/check/print/force-recreate steps above after editing. Validate-only
+runs read the configuration and policies afresh on each invocation. Do not
+copy vendored files over customized input files during an image upgrade; merge
+upstream updates deliberately and retain backups. No online TAL or policy
+update is performed by the validator.

docs/trust-anchors.md

@@ -6,7 +6,11 @@ Panda RPKI requires a TAL for each configured anchor. The TAL supplies the
 trusted public key and its certificate URI. You may pin a matching DER-encoded
 TA certificate in TOML, or omit `ta` and let Panda fetch, validate and cache the
 current certificate on each run. A certificate alone is not a substitute for an
-independently obtained TAL. No RIR inputs are bundled with this project.
+independently obtained TAL. The repository includes a pinned OpenBSD snapshot of all five TALs and resource
+constraints in [`tals/`](../tals/README.md); TA certificates are not bundled.
+The all5 Compose examples use these policies by default. Copy the ten files
+to your managed input directory, inspect their provenance, and follow the
+[Docker instructions](docker.md#all-five-rirs).
 
 ## Automatic and fixed certificate modes