20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docker/examples/README.md

@@ -0,0 +1,24 @@
+# Container TOML examples
+
+Copy the appropriate TOML outside this directory and point CONFIG_FILE at the
+absolute copy path. See [Docker and Compose](../../docs/docker.md) for mounts,
+startup, graceful stop and config reload.
+
+| File | Mode | Inputs |
+| --- | --- | --- |
+| validate.toml | Single run | /input/anchor.tal |
+| validate-all5.toml | Single run | Five named RIR TALs |
+| daemon.toml | Continuous | /input/anchor.tal |
+| daemon-all5.toml | Continuous | Five named RIR TALs |
+
+All examples use text/info diagnostics, require-complete=true, and automatic
+TA certificate refresh (ta omitted). TAL files are never automatically updated.
+Uncomment an anchor's ta field to use a fixed certificate. Policy
+allow-valid-cache permits only a validated cached certificate and marks fallback
+partial. First automatic use needs reachable TAL URIs; fixed files are not an
+automatic-cache seed. These examples contain no TALs or certificates.
+
+Container paths differ from native configuration paths. Validate uses
+/state/repository and /state/repository.ta-cache under the writable /state mount;
+daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
+an explicit migration or separate cache mount before switching to these paths.

docker/examples/daemon-all5.toml

@@ -0,0 +1,39 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "daemon"
+state-root = "/data"
+interval-secs = 60
+retain-runs = 20
+shutdown-grace-secs = 30
+# max-runs = 3 # uncomment only for a finite run
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "afrinic"
+tal = "/input/afrinic.tal"
+# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "apnic"
+tal = "/input/apnic.tal"
+# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "arin"
+tal = "/input/arin.tal"
+# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "lacnic"
+tal = "/input/lacnic.tal"
+# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "ripe"
+tal = "/input/ripe.tal"
+# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate

docker/examples/daemon.toml

@@ -0,0 +1,19 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "daemon"
+state-root = "/data"
+interval-secs = 60
+retain-runs = 20
+shutdown-grace-secs = 30
+# max-runs = 3 # uncomment only for a finite run
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate

docker/examples/validate-all5.toml

@@ -0,0 +1,37 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "afrinic"
+tal = "/input/afrinic.tal"
+# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "apnic"
+tal = "/input/apnic.tal"
+# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "arin"
+tal = "/input/arin.tal"
+# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "lacnic"
+tal = "/input/lacnic.tal"
+# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
+
+[[anchors]]
+id = "ripe"
+tal = "/input/ripe.tal"
+# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate

docker/examples/validate.toml

@@ -0,0 +1,17 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate