20260914 强制 TOML 配置并完善 TA 刷新与 daemon

2026-09-14 16:58:08 +08:00
parent 6383e2c12c
commit 4975128945
48 changed files with 2795 additions and 1459 deletions
--- a/docker/compose.all5-daemon.yaml
+++ b/docker/compose.all5-daemon.yaml
@@ -1,3 +1,6 @@
+# Copy docker/examples/daemon-all5.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
  validator:
    build:
@@ -12,62 +15,10 @@ services:
    tmpfs:
      - /tmp
    volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to an all-RIR daemon TOML file}:/config/daemon.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
      - ${DAEMON_DIR:?set DAEMON_DIR to a writable dedicated directory}:/data
-    environment:
-      PANDA_RPKI_LOG_LEVEL: "${PANDA_RPKI_LOG_LEVEL:-info}"
-      PANDA_RPKI_LOG_FORMAT: "${PANDA_RPKI_LOG_FORMAT:-text}"
-      PANDA_RPKI_LOG_PROGRESS_INTERVAL_SECS: "${PANDA_RPKI_LOG_PROGRESS_INTERVAL_SECS:-10}"
    command:
      - daemon
-      - --state-root
-      - /data
-      - --interval-secs
-      - "${PANDA_RPKI_INTERVAL_SECS:-60}"
-      - --retain-runs
-      - "${PANDA_RPKI_RETAIN_RUNS:-10}"
-      - --run-timeout-secs
-      - "${PANDA_RPKI_RUN_TIMEOUT_SECS:-0}"
-      - --shutdown-grace-secs
-      - "${PANDA_RPKI_SHUTDOWN_GRACE_SECS:-30}"
-      - --
-      - --tal
-      - /input/${AFRINIC_TAL_FILE:?set AFRINIC_TAL_FILE}
-      - --ta
-      - /input/${AFRINIC_TA_FILE:?set AFRINIC_TA_FILE}
-      - --tal-id
-      - afrinic
-      - --tal
-      - /input/${APNIC_TAL_FILE:?set APNIC_TAL_FILE}
-      - --ta
-      - /input/${APNIC_TA_FILE:?set APNIC_TA_FILE}
-      - --tal-id
-      - apnic
-      - --tal
-      - /input/${ARIN_TAL_FILE:?set ARIN_TAL_FILE}
-      - --ta
-      - /input/${ARIN_TA_FILE:?set ARIN_TA_FILE}
-      - --tal-id
-      - arin
-      - --tal
-      - /input/${LACNIC_TAL_FILE:?set LACNIC_TAL_FILE}
-      - --ta
-      - /input/${LACNIC_TA_FILE:?set LACNIC_TA_FILE}
-      - --tal-id
-      - lacnic
-      - --tal
-      - /input/${RIPE_TAL_FILE:?set RIPE_TAL_FILE}
-      - --ta
-      - /input/${RIPE_TA_FILE:?set RIPE_TA_FILE}
-      - --tal-id
-      - ripe
-      - --parallel-phase2-object-workers
-      - "${PANDA_RPKI_WORKERS:-8}"
-      - --parallel-max-repo-sync-workers-global
-      - "${PANDA_RPKI_REPO_WORKERS:-8}"
-      - --parallel-phase2-worker-queue-capacity
-      - "${PANDA_RPKI_WORKER_QUEUE_CAPACITY:-256}"
-      - --parallel-repo-worker-queue-capacity
-      - "${PANDA_RPKI_REPO_QUEUE_CAPACITY:-256}"
-      - --http-timeout-secs
-      - "${PANDA_RPKI_HTTP_TIMEOUT_SECS:-600}"
+      - --config
+      - /config/daemon.toml
--- a/docker/compose.all5.yaml
+++ b/docker/compose.all5.yaml
@@ -1,62 +1,23 @@
+# Copy docker/examples/validate-all5.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
  validator:
    build:
      context: ..
      dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
    user: "${PUID:-1000}:${PGID:-1000}"
    read_only: true
+    init: true
    tmpfs:
      - /tmp
    volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to an all-RIR validate TOML file}:/config/validate.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
      - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
      - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
    command:
      - validate
-      - --tal
-      - /input/${AFRINIC_TAL_FILE:?set AFRINIC_TAL_FILE}
-      - --ta
-      - /input/${AFRINIC_TA_FILE:?set AFRINIC_TA_FILE}
-      - --tal-id
-      - afrinic
-      - --tal
-      - /input/${APNIC_TAL_FILE:?set APNIC_TAL_FILE}
-      - --ta
-      - /input/${APNIC_TA_FILE:?set APNIC_TA_FILE}
-      - --tal-id
-      - apnic
-      - --tal
-      - /input/${ARIN_TAL_FILE:?set ARIN_TAL_FILE}
-      - --ta
-      - /input/${ARIN_TA_FILE:?set ARIN_TA_FILE}
-      - --tal-id
-      - arin
-      - --tal
-      - /input/${LACNIC_TAL_FILE:?set LACNIC_TAL_FILE}
-      - --ta
-      - /input/${LACNIC_TA_FILE:?set LACNIC_TA_FILE}
-      - --tal-id
-      - lacnic
-      - --tal
-      - /input/${RIPE_TAL_FILE:?set RIPE_TAL_FILE}
-      - --ta
-      - /input/${RIPE_TA_FILE:?set RIPE_TA_FILE}
-      - --tal-id
-      - ripe
-      - --parallel-phase2-object-workers
-      - "${PANDA_RPKI_WORKERS:-8}"
-      - --parallel-max-repo-sync-workers-global
-      - "${PANDA_RPKI_REPO_WORKERS:-8}"
-      - --parallel-phase2-worker-queue-capacity
-      - "${PANDA_RPKI_WORKER_QUEUE_CAPACITY:-256}"
-      - --rrdp-state-dir
-      - /state
-      - --rrdp-sync-mode
-      - "${PANDA_RPKI_RRDP_SYNC_MODE:-auto}"
-      - --http-timeout-secs
-      - "${PANDA_RPKI_HTTP_TIMEOUT_SECS:-600}"
-      - --ccr-out
-      - /output/all5.ccr
-      - --out
-      - /output
+      - --config
+      - /config/validate.toml
--- a/docker/compose.daemon.yaml
+++ b/docker/compose.daemon.yaml
@@ -1,9 +1,12 @@
+# Copy docker/examples/daemon.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
  validator:
    build:
      context: ..
      dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
    user: "${PUID:-1000}:${PGID:-1000}"
    read_only: true
    init: true
@@ -12,29 +15,10 @@ services:
    tmpfs:
      - /tmp
    volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to a daemon TOML file}:/config/daemon.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
      - ${DAEMON_DIR:?set DAEMON_DIR to a writable dedicated directory}:/data
-    environment:
-      PANDA_RPKI_LOG_LEVEL: "${PANDA_RPKI_LOG_LEVEL:-info}"
-      PANDA_RPKI_LOG_FORMAT: "${PANDA_RPKI_LOG_FORMAT:-text}"
    command:
      - daemon
-      - --state-root
-      - /data
-      - --interval-secs
-      - "${PANDA_RPKI_INTERVAL_SECS:-60}"
-      - --retain-runs
-      - "${PANDA_RPKI_RETAIN_RUNS:-10}"
-      - --run-timeout-secs
-      - "${PANDA_RPKI_RUN_TIMEOUT_SECS:-0}"
-      - --shutdown-grace-secs
-      - "30"
-      - --
-      - --tal
-      - /input/${TAL_FILE:?set TAL_FILE}
-      - --ta
-      - /input/${TA_FILE:?set TA_FILE}
-      - --parallel-max-repo-sync-workers-global
-      - "${PANDA_RPKI_REPO_WORKERS:-8}"
-      - --parallel-phase2-object-workers
-      - "${PANDA_RPKI_WORKERS:-8}"
+      - --config
+      - /config/daemon.toml
--- a/docker/compose.yaml
+++ b/docker/compose.yaml
@@ -1,28 +1,23 @@
+# Copy docker/examples/validate.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
  validator:
    build:
      context: ..
      dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
    user: "${PUID:-1000}:${PGID:-1000}"
    read_only: true
+    init: true
    tmpfs:
      - /tmp
    volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to a validate TOML file}:/config/validate.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
      - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
      - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
    command:
      - validate
-      - --tal
-      - /input/${TAL_FILE:?set TAL_FILE}
-      - --ta
-      - /input/${TA_FILE:?set TA_FILE}
-      - --rrdp-state-dir
-      - /state
-      - --rrdp-sync-mode
-      - "${PANDA_RPKI_RRDP_SYNC_MODE:-auto}"
-      - --ccr-out
-      - /output/result.ccr
-      - --out
-      - /output
+      - --config
+      - /config/validate.toml
--- a/docker/examples/README.md
+++ b/docker/examples/README.md
@@ -0,0 +1,24 @@
+# Container TOML examples
+
+Copy the appropriate TOML outside this directory and point CONFIG_FILE at the
+absolute copy path. See [Docker and Compose](../../docs/docker.md) for mounts,
+startup, graceful stop and config reload.
+
+| File | Mode | Inputs |
+| --- | --- | --- |
+| validate.toml | Single run | /input/anchor.tal |
+| validate-all5.toml | Single run | Five named RIR TALs |
+| daemon.toml | Continuous | /input/anchor.tal |
+| daemon-all5.toml | Continuous | Five named RIR TALs |
+
+All examples use text/info diagnostics, require-complete=true, and automatic
+TA certificate refresh (ta omitted). TAL files are never automatically updated.
+Uncomment an anchor's ta field to use a fixed certificate. Policy
+allow-valid-cache permits only a validated cached certificate and marks fallback
+partial. First automatic use needs reachable TAL URIs; fixed files are not an
+automatic-cache seed. These examples contain no TALs or certificates.
+
+Container paths differ from native configuration paths. Validate uses
+/state/repository and /state/repository.ta-cache under the writable /state mount;
+daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
+an explicit migration or separate cache mount before switching to these paths.
--- a/docker/examples/daemon-all5.toml
+++ b/docker/examples/daemon-all5.toml
@@ -0,0 +1,39 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "daemon"
+state-root = "/data"
+interval-secs = 60
+retain-runs = 20
+shutdown-grace-secs = 30
+# max-runs = 3 # uncomment only for a finite run
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "afrinic"
+tal = "/input/afrinic.tal"
+# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "apnic"
+tal = "/input/apnic.tal"
+# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "arin"
+tal = "/input/arin.tal"
+# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "lacnic"
+tal = "/input/lacnic.tal"
+# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "ripe"
+tal = "/input/ripe.tal"
+# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
--- a/docker/examples/daemon.toml
+++ b/docker/examples/daemon.toml
@@ -0,0 +1,19 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "daemon"
+state-root = "/data"
+interval-secs = 60
+retain-runs = 20
+shutdown-grace-secs = 30
+# max-runs = 3 # uncomment only for a finite run
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate
--- a/docker/examples/validate-all5.toml
+++ b/docker/examples/validate-all5.toml
@@ -0,0 +1,37 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "afrinic"
+tal = "/input/afrinic.tal"
+# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "apnic"
+tal = "/input/apnic.tal"
+# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "arin"
+tal = "/input/arin.tal"
+# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "lacnic"
+tal = "/input/lacnic.tal"
+# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "ripe"
+tal = "/input/ripe.tal"
+# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
--- a/docker/examples/validate.toml
+++ b/docker/examples/validate.toml
@@ -0,0 +1,17 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate