20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docker/compose.all5.yaml

@@ -1,62 +1,23 @@
+# Copy docker/examples/validate-all5.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
   validator:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
     user: "${PUID:-1000}:${PGID:-1000}"
     read_only: true
+    init: true
     tmpfs:
       - /tmp
     volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to an all-RIR validate TOML file}:/config/validate.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
       - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
       - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
     command:
       - validate
-      - --tal
-      - /input/${AFRINIC_TAL_FILE:?set AFRINIC_TAL_FILE}
-      - --ta
-      - /input/${AFRINIC_TA_FILE:?set AFRINIC_TA_FILE}
-      - --tal-id
-      - afrinic
-      - --tal
-      - /input/${APNIC_TAL_FILE:?set APNIC_TAL_FILE}
-      - --ta
-      - /input/${APNIC_TA_FILE:?set APNIC_TA_FILE}
-      - --tal-id
-      - apnic
-      - --tal
-      - /input/${ARIN_TAL_FILE:?set ARIN_TAL_FILE}
-      - --ta
-      - /input/${ARIN_TA_FILE:?set ARIN_TA_FILE}
-      - --tal-id
-      - arin
-      - --tal
-      - /input/${LACNIC_TAL_FILE:?set LACNIC_TAL_FILE}
-      - --ta
-      - /input/${LACNIC_TA_FILE:?set LACNIC_TA_FILE}
-      - --tal-id
-      - lacnic
-      - --tal
-      - /input/${RIPE_TAL_FILE:?set RIPE_TAL_FILE}
-      - --ta
-      - /input/${RIPE_TA_FILE:?set RIPE_TA_FILE}
-      - --tal-id
-      - ripe
-      - --parallel-phase2-object-workers
-      - "${PANDA_RPKI_WORKERS:-8}"
-      - --parallel-max-repo-sync-workers-global
-      - "${PANDA_RPKI_REPO_WORKERS:-8}"
-      - --parallel-phase2-worker-queue-capacity
-      - "${PANDA_RPKI_WORKER_QUEUE_CAPACITY:-256}"
-      - --rrdp-state-dir
-      - /state
-      - --rrdp-sync-mode
-      - "${PANDA_RPKI_RRDP_SYNC_MODE:-auto}"
-      - --http-timeout-secs
-      - "${PANDA_RPKI_HTTP_TIMEOUT_SECS:-600}"
-      - --ccr-out
-      - /output/all5.ccr
-      - --out
-      - /output
+      - --config
+      - /config/validate.toml