panda-rpki-oss/docker/examples/README.md

Container TOML examples

Copy the appropriate TOML outside this directory and point CONFIG_FILE at the absolute copy path. See Docker and Compose for mounts, startup, graceful stop and config reload.

File	Mode	Inputs
validate.toml	Single run	/input/anchor.tal
validate-all5.toml	Single run	Five named RIR TALs and constraints
validate-localhost.toml	Single run	Generated localhost HTTPS repository and /fixture/certs/rrdp-ca.pem
daemon.toml	Continuous	/input/anchor.tal
daemon-all5.toml	Continuous	Five named RIR TALs and constraints

All examples use text/info diagnostics, require-complete=true, and automatic TA certificate refresh (ta omitted). TAL files are never automatically updated. Uncomment an anchor's ta field to use a fixed certificate. Policy allow-valid-cache permits only a validated cached certificate and marks fallback partial. First automatic use needs reachable TAL URIs; fixed files are not an automatic-cache seed. These examples contain no TALs or certificates.

Container paths differ from native configuration paths. Validate uses /state/repository and /state/repository.ta-cache under the writable /state mount; daemon uses /data/state and /data/state.ta-cache. Existing /state databases need an explicit migration or separate cache mount before switching to these paths.

The all5 examples explicitly enable TA constraints. Copy tals/*.tal and tals/*.constraints from the repository into INPUT_DIR. Customize those copies or set top-level ta-constraints-enabled = false to disable all policies, including same-stem file discovery. See provenance.

Local HTTPS test repository

validate-localhost.toml explicitly sets http-root-cert to the CA generated by tests/support/generate_repository.py. The server runs on the host at localhost:8443; the Compose example therefore uses host networking. The fixture and its CA are generated for the test run and are not production trust roots:

work="$(mktemp -d)"
python3 tests/support/generate_repository.py \
  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
ln -s cases/baseline-v1/http "$work/fixture/active"
mkdir -p "$work/output" "$work/state"
python3 tests/support/serve_repository.py \
  "$work/fixture/active" 8443 \
  "$work/fixture/certs/rrdp-server.pem" \
  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
server_pid="$!"
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
grep -qx ready "$work/server.log"
export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
export PUID="$(id -u)" PGID="$(id -g)"
docker compose -f docker/compose.localhost.yaml run --build --rm validator