# Container TOML examples

Copy the appropriate TOML outside this directory and point CONFIG_FILE at the
absolute copy path. See [Docker and Compose](../../docs/docker.md) for mounts,
startup, graceful stop and config reload.

| File | Mode | Inputs |
| --- | --- | --- |
| validate.toml | Single run | /input/anchor.tal |
| validate-all5.toml | Single run | Five named RIR TALs and constraints |
| validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
| daemon.toml | Continuous | /input/anchor.tal |
| daemon-all5.toml | Continuous | Five named RIR TALs and constraints |

All examples use text/info diagnostics, require-complete=true, and automatic
TA certificate refresh (ta omitted). TAL files are never automatically updated.
Uncomment an anchor's ta field to use a fixed certificate. Policy
allow-valid-cache permits only a validated cached certificate and marks fallback
partial. First automatic use needs reachable TAL URIs; fixed files are not an
automatic-cache seed. These examples contain no TALs or certificates.

Container paths differ from native configuration paths. Validate uses
/state/repository and /state/repository.ta-cache under the writable /state mount;
daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
an explicit migration or separate cache mount before switching to these paths.

The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
`tals/*.constraints` from the repository into INPUT_DIR. Customize those copies
or set top-level `ta-constraints-enabled = false` to disable all policies,
including same-stem file discovery. See [provenance](../../tals/README.md).

## Local HTTPS test repository

`validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated
by `tests/support/generate_repository.py`. The server runs on the host at
`localhost:8443`; the Compose example therefore uses host networking. The
fixture and its CA are generated for the test run and are not production trust
roots:

```bash
work="$(mktemp -d)"
python3 tests/support/generate_repository.py \
  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
ln -s cases/baseline-v1/http "$work/fixture/active"
mkdir -p "$work/output" "$work/state"
python3 tests/support/serve_repository.py \
  "$work/fixture/active" 8443 \
  "$work/fixture/certs/rrdp-server.pem" \
  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
server_pid="$!"
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
grep -qx ready "$work/server.log"
export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
export PUID="$(id -u)" PGID="$(id -g)"
docker compose -f docker/compose.localhost.yaml run --build --rm validator
```