add OpenBSD TA constraints and localhost TLS examples

examples/config/README.md

@@ -10,6 +10,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here.
 | [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
 | [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
 | [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
+| [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA |
 | [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
 | [daemon-three.toml](daemon-three.toml) | Five automatic TAs, three cycles with independent state |
 
@@ -30,3 +31,29 @@ one exists.
 Full/daemon examples explicitly choose require-complete=true and
 run-timeout-secs=1800; built-in defaults are false and 0. Use the
 [Docker examples](../../docker/examples/README.md) for container paths.
+
+## Local HTTPS test repository
+
+`validate-localhost.toml` is a runnable example for the generated repository
+used by the regression tests. It explicitly sets `http-root-cert` to the test
+CA and uses a fixed RPKI TA so the run does not depend on an external TA
+endpoint. Copy it beside the generated fixture because its paths are relative
+to the configuration file:
+
+```bash
+work="$(mktemp -d)"
+cp examples/config/validate-localhost.toml "$work/validate.toml"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output/localhost" "$work/state/localhost"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+target/release/panda-rpki validate --config "$work/validate.toml"
+```