64 lines
3.2 KiB
Markdown
64 lines
3.2 KiB
Markdown
# Container TOML examples
|
|
|
|
Copy the appropriate TOML outside this directory and point CONFIG_FILE at the
|
|
absolute copy path. See [Docker and Compose](../../docs/docker.md) for mounts,
|
|
startup, graceful stop and config reload.
|
|
|
|
| File | Mode | Inputs |
|
|
| --- | --- | --- |
|
|
| validate.toml | Single run | /input/anchor.tal |
|
|
| validate-all5.toml | Single run | Five named RIR TALs and constraints |
|
|
| validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
|
|
| validate-policy.toml | Single run | Complete validation-policy and RRDP/rsync TOML settings |
|
|
| daemon.toml | Continuous | /input/anchor.tal |
|
|
| daemon-all5.toml | Continuous | Five named RIR TALs and constraints |
|
|
|
|
All examples use text/info diagnostics, require-complete=true, and automatic
|
|
TA certificate refresh (ta omitted). TAL files are never automatically updated.
|
|
Uncomment an anchor's ta field to use a fixed certificate. Policy
|
|
allow-valid-cache permits only a validated cached certificate and marks fallback
|
|
partial. First automatic use needs reachable TAL URIs; fixed files are not an
|
|
automatic-cache seed. These examples contain no TALs or certificates.
|
|
|
|
Container paths differ from native configuration paths. Validate uses
|
|
/state/repository and /state/repository.ta-cache under the writable /state mount;
|
|
daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
|
|
an explicit migration or separate cache mount before switching to these paths.
|
|
|
|
The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
|
|
`tals/*.constraints` from the repository into INPUT_DIR. Customize those copies
|
|
or set top-level `ta-constraints-enabled = false` to disable all policies,
|
|
including same-stem file discovery. See [provenance](../../tals/README.md).
|
|
|
|
`validate-policy.toml` is an additive configuration showcase. The existing
|
|
container examples intentionally omit the optional policy/transport keys and
|
|
continue to use their documented defaults; they do not need to be changed.
|
|
|
|
## Local HTTPS test repository
|
|
|
|
`validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated
|
|
by `tests/support/generate_repository.py`. The server runs on the host at
|
|
`localhost:8443`; the Compose example therefore uses host networking. The
|
|
fixture and its CA are generated for the test run and are not production trust
|
|
roots:
|
|
|
|
```bash
|
|
work="$(mktemp -d)"
|
|
python3 tests/support/generate_repository.py \
|
|
--rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
|
|
ln -s cases/baseline-v1/http "$work/fixture/active"
|
|
mkdir -p "$work/output" "$work/state"
|
|
python3 tests/support/serve_repository.py \
|
|
"$work/fixture/active" 8443 \
|
|
"$work/fixture/certs/rrdp-server.pem" \
|
|
"$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
|
|
server_pid="$!"
|
|
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
|
|
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
|
|
grep -qx ready "$work/server.log"
|
|
export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
|
|
export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
|
|
export PUID="$(id -u)" PGID="$(id -g)"
|
|
docker compose -f docker/compose.localhost.yaml run --build --rm validator
|
|
```
|