From e3a1d0a6ff2190cfe765368a843ea3c4c4b3daf1 Mon Sep 17 00:00:00 2001 From: yuyr Date: Wed, 23 Sep 2026 10:36:21 +0800 Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85=20OSS=20=E9=AA=8C=E8=AF=81?= =?UTF-8?q?=E7=AD=96=E7=95=A5=E9=85=8D=E7=BD=AE=E7=A4=BA=E4=BE=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docker/examples/README.md | 5 +++ docker/examples/validate-policy.toml | 37 ++++++++++++++++++++++ docs/configuration.md | 3 +- docs/docker.md | 5 +++ examples/config/README.md | 6 ++++ examples/config/validate-policy.toml | 47 ++++++++++++++++++++++++++++ 6 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 docker/examples/validate-policy.toml create mode 100644 examples/config/validate-policy.toml diff --git a/docker/examples/README.md b/docker/examples/README.md index a91cb9e..6e4ac4d 100644 --- a/docker/examples/README.md +++ b/docker/examples/README.md @@ -9,6 +9,7 @@ startup, graceful stop and config reload. | validate.toml | Single run | /input/anchor.tal | | validate-all5.toml | Single run | Five named RIR TALs and constraints | | validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` | +| validate-policy.toml | Single run | Complete validation-policy and RRDP/rsync TOML settings | | daemon.toml | Continuous | /input/anchor.tal | | daemon-all5.toml | Continuous | Five named RIR TALs and constraints | @@ -29,6 +30,10 @@ The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and or set top-level `ta-constraints-enabled = false` to disable all policies, including same-stem file discovery. See [provenance](../../tals/README.md). +`validate-policy.toml` is an additive configuration showcase. The existing +container examples intentionally omit the optional policy/transport keys and +continue to use their documented defaults; they do not need to be changed. + ## Local HTTPS test repository `validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated diff --git a/docker/examples/validate-policy.toml b/docker/examples/validate-policy.toml new file mode 100644 index 0000000..9a30a2e --- /dev/null +++ b/docker/examples/validate-policy.toml @@ -0,0 +1,37 @@ +# Container-path configuration showcase for validation policy and rsync. +# Copy the file outside this directory and set CONFIG_FILE to its absolute path. +# The fixed validation time makes the example reproducible; update it or remove +# the line when using it against a current public repository. +config-version = 1 +mode = "validate" +out = "/output/policy" +rrdp-state-dir = "/state/policy" +rrdp-sync-mode = "auto" +ccr-out = "/output/policy/result.ccr" +publish-dir = "/output/publish" + +resource-validation-mode = "validation-update-03" # or "rfc6487" +validation-time = "2026-09-22T00:00:00Z" +sync-preference = "rrdp-then-rsync" # or "rsync-only" +rsync-timeout-secs = 30 +rsync-command = "/usr/bin/rsync" +rsync-mirror-root = "/state/rsync-mirror" +rsync-scope = "module-root" # "host" or "publication-point" + +run-timeout-secs = 1800 +require-complete = true +ta-refresh-policy = "allow-valid-cache" +log-level = "info" +log-format = "text" + +[[anchors]] +id = "anchor" +tal = "/input/anchor.tal" +# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate + +# Keep the compatibility profile for a general public-repository example. +# Set the first two fields to true to enable strict name/CMS DER checks. +[strict] +name = false +cms-der = false +signed-attrs = false diff --git a/docs/configuration.md b/docs/configuration.md index d44b64b..2b617d8 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -227,11 +227,12 @@ copyable files: | --- | --- | --- | | validate-minimal.toml | Minimal single automatic TA | Required fields only; built-in defaults otherwise | | validate-full.toml | All common/validate settings and successful publication | Text logs, strict completion, 1,800-second budget | +| validate-policy.toml | All validation-policy, validation-time and RRDP/rsync settings | Compatibility strict profile; fixed example validation time | | validate-fixed.toml | Fixed certificate | Both tal and ta; certificate must match and be valid | | daemon-all5.toml | Continuous five-TA automatic refresh | All common/daemon settings; max-runs omitted | | daemon-three.toml | Three five-TA cycles | max-runs=3, interval=0, independent state root | -For containers, use the [four Docker configurations](../docker/examples/README.md). +For containers, use the [Docker configurations](../docker/examples/README.md). Mounting a native relative-path example under /config does not automatically make its paths correct. diff --git a/docs/docker.md b/docs/docker.md index f258d85..ca559be 100644 --- a/docs/docker.md +++ b/docs/docker.md @@ -155,6 +155,11 @@ These templates use automatic **TA certificate** refresh, text/info logs and | `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) | | `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) | +`validate-policy.toml` is an additional configuration-only showcase for the +validation-policy, validation-time and RRDP/rsync settings. Run it with +`compose.yaml` after copying it outside the examples directory and setting +`CONFIG_FILE` to the copied file. + For example, from the repository root: ```bash diff --git a/examples/config/README.md b/examples/config/README.md index 56dba05..72dbc94 100644 --- a/examples/config/README.md +++ b/examples/config/README.md @@ -9,6 +9,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here. | --- | --- | | [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults | | [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication | +| [validate-policy.toml](validate-policy.toml) | All validation-policy, validation-time and RRDP/rsync transport settings | | [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate | | [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA | | [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation | @@ -32,6 +33,11 @@ Full/daemon examples explicitly choose require-complete=true and run-timeout-secs=1800; built-in defaults are false and 0. Use the [Docker examples](../../docker/examples/README.md) for container paths. +`validate-policy.toml` is an additive configuration showcase. The existing +examples intentionally omit the optional policy/transport keys and therefore +continue to use their documented built-in defaults; they do not need to be +changed for this iteration. + ## Local HTTPS test repository `validate-localhost.toml` is a runnable example for the generated repository diff --git a/examples/config/validate-policy.toml b/examples/config/validate-policy.toml new file mode 100644 index 0000000..bcf4fcf --- /dev/null +++ b/examples/config/validate-policy.toml @@ -0,0 +1,47 @@ +# Configuration showcase for the validation-policy and rsync transport knobs. +# Paths are relative to this TOML file. +# +# The fixed validation time makes this file reproducible. Update it or remove +# the line when using the example against a current public repository. +config-version = 1 +mode = "validate" +out = "output/policy" +rrdp-state-dir = "state/policy" +rrdp-sync-mode = "auto" +ccr-out = "output/policy/result.ccr" +publish-dir = "publish/policy" + +resource-validation-mode = "validation-update-03" # or "rfc6487" +validation-time = "2026-09-22T00:00:00Z" +sync-preference = "rrdp-then-rsync" # or "rsync-only" +rsync-timeout-secs = 30 +rsync-command = "/usr/bin/rsync" # change if rsync is installed elsewhere +rsync-mirror-root = "state/policy-rsync-mirror" +rsync-scope = "module-root" # "host" or "publication-point" + +ta-refresh-policy = "allow-valid-cache" +max-ca-depth = 64 +http-timeout-secs = 300 +http-root-cert = [] +parallel-max-repo-sync-workers-global = 8 +parallel-phase2-object-workers = 8 +parallel-phase2-worker-queue-capacity = 256 +parallel-repo-worker-queue-capacity = 1024 +log-level = "info" +log-format = "text" +log-progress-interval-secs = 10 +require-complete = true +run-timeout-secs = 1800 + +[[anchors]] +id = "ripe" +tal = "input/ripe.tal" +# ta = "input/ripe.cer" # uncomment for fixed mode +# constraints = "input/ripe.constraints" # must exist when explicit + +# Keep the compatibility profile for a general public-repository example. +# Set the first two fields to true to enable strict name/CMS DER checks. +[strict] +name = false +cms-der = false +signed-attrs = false