20260914 强制 TOML 配置并完善 TA 刷新与 daemon

README.md

@@ -1,5 +1,7 @@
 # Panda RPKI
 
+For every field, default, constraint and complete example, see the [TOML configuration reference](docs/configuration.md)。
+
 Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
 over RRDP, validates signed objects, and exports routing data as CSV and Canonical
 Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
@@ -10,41 +12,58 @@ and [security policy](SECURITY.md) before evaluating it for routing use.
 
 ## Quick start
 
-Requirements: Linux, Docker, and a TAL with its matching DER trust-anchor
-certificate. Follow [input preparation](docs/getting-started.md#prepare-trust-anchors)
-to obtain these from your chosen RIR. From the project root, after placing them
-in `input/anchor.tal` and `input/anchor.cer`:
+Requirements: Linux, Docker, and a TAL. A matching DER trust-anchor certificate
+may be supplied in the TOML, or Panda can refresh it from the TAL's URI. Follow
+[input preparation](docs/getting-started.md#prepare-trust-anchors) for trusted
+RIR inputs. From the project root, after placing `input/anchor.tal` (and, for a
+fixed-TA run, `input/anchor.cer`):
 
 ```bash
 docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
 mkdir -p state output
+cat > validate.toml <<'TOML'
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment for fixed TA mode
+TOML
 docker run --rm --read-only --tmpfs /tmp \
   --user "$(id -u):$(id -g)" \
   -v "$PWD/input:/input:ro" \
   -v "$PWD/state:/state" \
   -v "$PWD/output:/output" \
-  panda-rpki:v0.1.0 validate \
-    --tal /input/anchor.tal --ta /input/anchor.cer \
-    --rrdp-state-dir /state --out /output \
-    --ccr-out /output/result.ccr
+  -v "$PWD/validate.toml:/config/validate.toml:ro" \
+  panda-rpki:v0.1.0 validate --config /config/validate.toml
 ```
 
+The quick start refreshes the TA certificate automatically; TAL files themselves
+remain operator-maintained. For complete single/all-five and daemon TOML files,
+see [Compose examples](docker/examples/README.md).
+
 Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
 Reuse the state directory to allow delta updates on subsequent runs.
 For continuous operation see [Usage](docs/usage.md#continuous-operation).
 
 ## Features
 
-- Multiple TAL/TA pairs and optional per-anchor resource constraints.
+- Multiple named anchors, fixed or automatically refreshed trust anchors, and
+  optional per-anchor resource constraints.
 - RRDP snapshot, delta, replace/withdraw and protocol fallback.
 - HTTPS same-origin checks for RRDP references and redirects.
 - Independent bounded repository and object worker pools.
 - CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
-- CSV, CCR, JSON summaries and configurable text or JSON logs.
+- CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
 - Daemon intervals, persistent state, run retention, timeouts and graceful stop.
 
-Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply TALs and
-matching TA certificates. No RTR server is included. See the
+Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply explicit
+TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server
+is included. See the
 [standards matrix](docs/conformance-matrix.md) for profiles and limitations.
 
 ## Documentation