20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docker/compose.yaml

@@ -1,28 +1,23 @@
+# Copy docker/examples/validate.toml and set CONFIG_FILE to its absolute path.
+# Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# See docs/docker.md for graceful stop and config reload.
 services:
   validator:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-    image: panda-rpki:v0.1.0
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:v0.1.0}"
     user: "${PUID:-1000}:${PGID:-1000}"
     read_only: true
+    init: true
     tmpfs:
       - /tmp
     volumes:
-      - ${INPUT_DIR:?set INPUT_DIR to the TAL/TA directory}:/input:ro
+      - ${CONFIG_FILE:?set CONFIG_FILE to a validate TOML file}:/config/validate.toml:ro
+      - ${INPUT_DIR:?set INPUT_DIR to the TAL directory (TA certificates optional)}:/input:ro
       - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
       - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
     command:
       - validate
-      - --tal
-      - /input/${TAL_FILE:?set TAL_FILE}
-      - --ta
-      - /input/${TA_FILE:?set TA_FILE}
-      - --rrdp-state-dir
-      - /state
-      - --rrdp-sync-mode
-      - "${PANDA_RPKI_RRDP_SYNC_MODE:-auto}"
-      - --ccr-out
-      - /output/result.ccr
-      - --out
-      - /output
+      - --config
+      - /config/validate.toml