add OpenBSD TA constraints and localhost TLS examples

examples/config/README.md

@@ -10,6 +10,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here.
 | [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
 | [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
 | [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
+| [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA |
 | [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
 | [daemon-three.toml](daemon-three.toml) | Five automatic TAs, three cycles with independent state |
 
@@ -30,3 +31,29 @@ one exists.
 Full/daemon examples explicitly choose require-complete=true and
 run-timeout-secs=1800; built-in defaults are false and 0. Use the
 [Docker examples](../../docker/examples/README.md) for container paths.
+
+## Local HTTPS test repository
+
+`validate-localhost.toml` is a runnable example for the generated repository
+used by the regression tests. It explicitly sets `http-root-cert` to the test
+CA and uses a fixed RPKI TA so the run does not depend on an external TA
+endpoint. Copy it beside the generated fixture because its paths are relative
+to the configuration file:
+
+```bash
+work="$(mktemp -d)"
+cp examples/config/validate-localhost.toml "$work/validate.toml"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output/localhost" "$work/state/localhost"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+target/release/panda-rpki validate --config "$work/validate.toml"
+```

examples/config/validate-localhost.toml

@@ -0,0 +1,20 @@
+# Copy this file into a temporary test directory next to the generated fixture.
+# The fixture is created by tests/support/generate_repository.py.
+config-version = 1
+mode = "validate"
+out = "output/localhost"
+rrdp-state-dir = "state/localhost"
+rrdp-sync-mode = "snapshot"
+ccr-out = "output/localhost/result.ccr"
+http-timeout-secs = 5
+# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
+http-root-cert = ["fixture/certs/rrdp-ca.pem"]
+log-level = "info"
+log-format = "text"
+require-complete = true
+run-timeout-secs = 300
+
+[[anchors]]
+id = "custom"
+tal = "fixture/tal/custom.tal"
+ta = "fixture/ta/custom-ta.cer"