add OpenBSD TA constraints and localhost TLS examples

docs/docker.md

@@ -44,12 +44,46 @@ The template mounts the TOML read-only at `/config/validate.toml` and invokes
 `panda-rpki validate --config /config/validate.toml`. Host variables only select
 mounts, image and container UID/GID; they are not read as validator settings.
 
-## All five RIRs
+## Local HTTPS test repository
 
-Put the five RIR TAL files (TA certificates are optional) under `input/` and list them as named anchors in a
-TOML with `/input/...` paths. Then set `CONFIG_FILE` to that file and run:
+Use [validate-localhost.toml](../docker/examples/validate-localhost.toml) and
+[compose.localhost.yaml](../docker/compose.localhost.yaml) to run the generated
+HTTPS repository used by the regression tests. The TOML explicitly sets
+`http-root-cert = ["/fixture/certs/rrdp-ca.pem"]`; this is the generated test
+server CA, separate from the RPKI trust anchor. The validator uses host
+networking because the generated RRDP URI is `https://localhost:8443`:
 
 ```bash
+work="$(mktemp -d)"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output" "$work/state"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
+export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.localhost.yaml run --build --rm validator
+```
+
+## All five RIRs
+
+Copy the vendored [OpenBSD TALs and constraints](../tals/README.md) into an
+operator-managed input directory. Review the retained upstream notices, including
+the ARIN disclaimer. TA certificates are optional; the examples refresh them.
+Both all5 templates enable constraints by default:
+
+```bash
+mkdir -p input state/all5 output/all5
+cp tals/*.tal tals/*.constraints input/
+cp docker/examples/validate-all5.toml all5.toml
 export CONFIG_FILE="$PWD/all5.toml"
 export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state/all5" OUTPUT_DIR="$PWD/output/all5"
 docker compose -f docker/compose.all5.yaml run --build --rm validator
@@ -116,6 +150,7 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 | Compose file | Complete TOML |
 | --- | --- |
 | `compose.yaml` | [validate.toml](../docker/examples/validate.toml) |
+| `compose.localhost.yaml` | [validate-localhost.toml](../docker/examples/validate-localhost.toml) |
 | `compose.all5.yaml` | [validate-all5.toml](../docker/examples/validate-all5.toml) |
 | `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) |
 | `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) |
@@ -123,6 +158,8 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 For example, from the repository root:
 
 ```bash
+mkdir -p input
+cp tals/*.tal tals/*.constraints input/
 cp docker/examples/daemon-all5.toml daemon.toml
 export CONFIG_FILE="$PWD/daemon.toml"
 export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/daemon-state"
@@ -187,3 +224,16 @@ The controller logs are in `docker compose logs`; child diagnostics are in
 format. JSON summary/metadata files remain JSON even with text diagnostics.
 `latest` exists only after a complete success; partial runs do not create or
 replace it, including the first run after upgrading an old state root.
+
+## Change or disable constraints
+
+Edit the copied `input/<rir>.constraints` files, or set an anchor's `constraints`
+to a different file under `/input`. Set top-level `ta-constraints-enabled = false`
+to disable all policies, including same-stem auto-discovery. The all5 examples
+use `true` and explicit paths so missing files fail configuration checks.
+
+Use the stop/check/print/force-recreate steps above after editing. Validate-only
+runs read the configuration and policies afresh on each invocation. Do not
+copy vendored files over customized input files during an image upgrade; merge
+upstream updates deliberately and retain backups. No online TAL or policy
+update is performed by the validator.