20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docker/compose.daemon.yaml

@@ -1,9 +1,12 @@
+# Copy docker/examples/daemon.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
   validator:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
     user: "${PUID:-1000}:${PGID:-1000}"
     read_only: true
     init: true
@@ -12,29 +15,10 @@ services:
     tmpfs:
       - /tmp
     volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to a daemon TOML file}:/config/daemon.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
       - ${DAEMON_DIR:?set DAEMON_DIR to a writable dedicated directory}:/data
-    environment:
-      PANDA_RPKI_LOG_LEVEL: "${PANDA_RPKI_LOG_LEVEL:-info}"
-      PANDA_RPKI_LOG_FORMAT: "${PANDA_RPKI_LOG_FORMAT:-text}"
     command:
       - daemon
-      - --state-root
-      - /data
-      - --interval-secs
-      - "${PANDA_RPKI_INTERVAL_SECS:-60}"
-      - --retain-runs
-      - "${PANDA_RPKI_RETAIN_RUNS:-10}"
-      - --run-timeout-secs
-      - "${PANDA_RPKI_RUN_TIMEOUT_SECS:-0}"
-      - --shutdown-grace-secs
-      - "30"
-      - --
-      - --tal
-      - /input/${TAL_FILE:?set TAL_FILE}
-      - --ta
-      - /input/${TA_FILE:?set TA_FILE}
-      - --parallel-max-repo-sync-workers-global
-      - "${PANDA_RPKI_REPO_WORKERS:-8}"
-      - --parallel-phase2-object-workers
-      - "${PANDA_RPKI_WORKERS:-8}"
+      - --config
+      - /config/daemon.toml