20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docs/getting-started.md

@@ -1,5 +1,7 @@
 # Getting started
 
+For every field, default, constraint and complete example, see the [TOML configuration reference](configuration.md)。
+
 Panda RPKI v0.1.0 is a Linux command-line application. You can use Docker without
 installing Rust, or build a native binary. It requires outbound HTTPS to RPKI
 repositories, a writable state directory, and enough disk space for repository
@@ -7,10 +9,11 @@ objects and outputs. Resource use depends on the selected trust anchors.
 
 ## Prepare trust anchors
 
-A trust anchor defines what you trust. Obtain its TAL from the responsible RIR
-and obtain the current DER certificate from a certificate URI in that TAL.
-Panda RPKI checks that the certificate matches the TAL public key. It takes
-both files as explicit inputs; it does not refresh the supplied TA file for you.
+A trust anchor defines what you trust. Obtain its TAL from the responsible RIR.
+Panda RPKI checks the TAL public key and either uses a configured DER certificate
+or refreshes a certificate from the TAL's HTTPS/rsync URI. Automatic refresh
+stores a validated last-known certificate beside the protocol state; it never
+changes the TAL itself.
 
 For example, the [RIPE NCC trust-anchor page](https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/ripe-ncc-rpki-trust-anchor-structure/)
 publishes the RIPE NCC TAL. From the project root:
@@ -20,6 +23,7 @@ mkdir -p input
 curl --fail --location --proto '=https' --proto-redir '=https' \
   --connect-timeout 15 --max-time 120 \
   https://tal.rpki.ripe.net/ripe-ncc.tal -o input/anchor.tal
+# Optional: download a TA certificate only for fixed mode.
 curl --fail --location --proto '=https' --proto-redir '=https' \
   --connect-timeout 15 --max-time 120 \
   https://rpki.ripe.net/ta/ripe-ncc-ta.cer -o input/anchor.cer
@@ -36,10 +40,11 @@ commands, input checks, and the filenames used by Compose.
 
 ## Docker first run
 
-Follow the [README Quick start](../README.md#quick-start). It creates
-`output/summary.json`, `output/vrps.csv` and `output/result.ccr`. State is retained
-under `state/repository-db/`. View warnings in the terminal and inspect the
-summary to distinguish rejected objects from successful repository updates.
+Follow the [README Quick start](../README.md#quick-start). The only application
+argument is `--config`; all paths, anchors, workers and logging belong in that
+TOML file. It creates `output/summary.json`, `output/vrps.csv` and
+`output/result.ccr`. State is retained under `state/repository/repository-db/` and the
+automatic TA cache is a sibling `state/repository.ta-cache/` directory.
 
 ## Build from source
 
@@ -53,14 +58,30 @@ cargo build --locked --release
 target/release/panda-rpki --help
 ```
 
-Run with the same inputs:
+Create a configuration file (paths are relative to the file, or use absolute
+container paths):
+
+```toml
+config-version = 1
+mode = "validate"
+out = "output/native"
+rrdp-state-dir = "state"
+ccr-out = "output/native/result.ccr"
+
+[[anchors]]
+id = "anchor"
+tal = "input/anchor.tal"
+# ta = "input/anchor.cer" # uncomment for fixed mode
+```
+
+Run with that configuration:
 
 ```bash
-target/release/panda-rpki validate \
-  --tal input/anchor.tal --ta input/anchor.cer \
-  --rrdp-state-dir state --out output/native \
-  --ccr-out output/native/result.ccr
+target/release/panda-rpki validate --config validate.toml
 ```
 
+Use `validate --config validate.toml --check-config` before a run for a read-only local check, or
+`validate --config validate.toml --print-config` to inspect absolute paths, defaults and field sources.
+
 For tests, install `python3-cryptography` and `openssl`. See
 [Development](development.md) and [Usage](usage.md) for next steps.