20260914 强制 TOML 配置并完善 TA 刷新与 daemon

examples/config/README.md

@@ -0,0 +1,32 @@
+# Complete native TOML examples
+
+See the [complete configuration reference](../../docs/configuration.md) for all
+fields, types, defaults and constraints. Copy a file into your deployment
+directory and prepare trusted TALs in its input/ directory. The fixed example
+also needs a valid, matching ripe.cer. No live inputs are bundled here.
+
+| File | Purpose |
+| --- | --- |
+| [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
+| [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
+| [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
+| [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
+| [daemon-three.toml](daemon-three.toml) | Five automatic TAs, three cycles with independent state |
+
+For example, copy validate-full.toml to /srv/panda/validate.toml and prepare
+/srv/panda/input/ripe.tal:
+
+```bash
+panda-rpki validate --config /srv/panda/validate.toml --check-config
+panda-rpki validate --config /srv/panda/validate.toml --print-config
+panda-rpki validate --config /srv/panda/validate.toml
+```
+
+Paths are relative to the configuration file. Automatic mode refreshes the TA
+certificate, never the TAL. Uncomment ta or constraints only after preparing the
+corresponding files. Omitted constraints still discovers a same-stem file when
+one exists.
+
+Full/daemon examples explicitly choose require-complete=true and
+run-timeout-secs=1800; built-in defaults are false and 0. Use the
+[Docker examples](../../docker/examples/README.md) for container paths.

examples/config/daemon-all5.toml

@@ -0,0 +1,45 @@
+config-version = 1
+mode = "daemon"
+state-root = "data/all5"
+interval-secs = 60
+retain-runs = 10
+shutdown-grace-secs = 30
+# Common settings: these choices are explicit, not all built-in defaults.
+ta-refresh-policy = "allow-valid-cache"
+max-ca-depth = 64
+http-timeout-secs = 300
+http-root-cert = [] # optional: ["tls/internal-root.pem"]
+parallel-max-repo-sync-workers-global = 8
+parallel-phase2-object-workers = 8
+parallel-phase2-worker-queue-capacity = 256
+parallel-repo-worker-queue-capacity = 1024 # effective minimum
+log-level = "info"
+log-format = "text"
+log-progress-interval-secs = 10
+require-complete = true # built-in default is false
+run-timeout-secs = 1800 # built-in default is 0 (unlimited)
+
+[[anchors]]
+id = "afrinic"
+tal = "input/afrinic.tal"
+# ta = "input/afrinic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "apnic"
+tal = "input/apnic.tal"
+# ta = "input/apnic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "arin"
+tal = "input/arin.tal"
+# ta = "input/arin.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "lacnic"
+tal = "input/lacnic.tal"
+# ta = "input/lacnic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# ta = "input/ripe.cer" # uncomment for fixed mode

examples/config/daemon-three.toml

@@ -0,0 +1,46 @@
+config-version = 1
+mode = "daemon"
+state-root = "data/three"
+interval-secs = 0
+max-runs = 3
+retain-runs = 10
+shutdown-grace-secs = 30
+# Common settings: these choices are explicit, not all built-in defaults.
+ta-refresh-policy = "allow-valid-cache"
+max-ca-depth = 64
+http-timeout-secs = 300
+http-root-cert = [] # optional: ["tls/internal-root.pem"]
+parallel-max-repo-sync-workers-global = 8
+parallel-phase2-object-workers = 8
+parallel-phase2-worker-queue-capacity = 256
+parallel-repo-worker-queue-capacity = 1024 # effective minimum
+log-level = "info"
+log-format = "text"
+log-progress-interval-secs = 10
+require-complete = true # built-in default is false
+run-timeout-secs = 1800 # built-in default is 0 (unlimited)
+
+[[anchors]]
+id = "afrinic"
+tal = "input/afrinic.tal"
+# ta = "input/afrinic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "apnic"
+tal = "input/apnic.tal"
+# ta = "input/apnic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "arin"
+tal = "input/arin.tal"
+# ta = "input/arin.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "lacnic"
+tal = "input/lacnic.tal"
+# ta = "input/lacnic.cer" # uncomment for fixed mode
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# ta = "input/ripe.cer" # uncomment for fixed mode

examples/config/validate-fixed.toml

@@ -0,0 +1,12 @@
+config-version = 1
+mode = "validate"
+out = "output/fixed"
+rrdp-state-dir = "state/fixed"
+log-format = "text"
+require-complete = true
+run-timeout-secs = 1800
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+ta = "input/ripe.cer"

examples/config/validate-full.toml

@@ -0,0 +1,27 @@
+config-version = 1
+mode = "validate"
+out = "output/full"
+rrdp-state-dir = "state/full"
+rrdp-sync-mode = "auto"
+ccr-out = "output/full/result.ccr"
+publish-dir = "publish/full"
+# Common settings: these choices are explicit, not all built-in defaults.
+ta-refresh-policy = "allow-valid-cache"
+max-ca-depth = 64
+http-timeout-secs = 300
+http-root-cert = [] # optional: ["tls/internal-root.pem"]
+parallel-max-repo-sync-workers-global = 8
+parallel-phase2-object-workers = 8
+parallel-phase2-worker-queue-capacity = 256
+parallel-repo-worker-queue-capacity = 1024 # effective minimum
+log-level = "info"
+log-format = "text"
+log-progress-interval-secs = 10
+require-complete = true # built-in default is false
+run-timeout-secs = 1800 # built-in default is 0 (unlimited)
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# ta = "input/ripe.cer" # uncomment for fixed mode
+# constraints = "input/ripe.constraints" # must exist when explicit

examples/config/validate-minimal.toml

@@ -0,0 +1,9 @@
+config-version = 1
+mode = "validate"
+out = "output/minimal"
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# ta = "input/ripe.cer" # uncomment for fixed mode
+# constraints = "input/ripe.constraints" # must exist when explicit