freeze initial panda-rpki staging

deploy/docker/.env.example

@@ -0,0 +1,35 @@
+# Staging/runtime configuration. Copy to .env; never commit the copied file.
+VALIDATOR_IMAGE=panda-rpki-validator:0.1.0-dirty-amd64
+VALIDATOR_PLATFORM=linux/amd64
+COMPOSE_PROJECT_NAME=panda-rpki-validator
+HOST_DATA_DIR=/var/lib/panda-rpki-validator
+RESTART_POLICY=no
+VALIDATOR_COMMAND=run
+
+# Normal sync/validation contract (the defaults match the existing runtime).
+MAX_RUNS=3
+INTERVAL_SECS=0
+RIRS=afrinic,apnic,arin,lacnic,ripe
+TAL_INPUT_MODE=file-with-ta
+RESOURCE_VALIDATION_MODE=validation-update-03
+RETAIN_RUNS=10
+OUTPUT_COMPACT_REPORT=1
+ALLOW_RSYNC_MIRROR_REUSE=1
+RSYNC_SCOPE=module-root
+FAILURE_SNAPSHOT_RESET=1
+PERIODIC_SNAPSHOT_RESET=0
+PERIODIC_SNAPSHOT_MAX_DELTAS=100
+DB_STATS_EXACT_EVERY=3
+RPKI_PROGRESS_LOG=1
+ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE=0
+RPKI_ANALYZE=0
+RPKI_EXTRA_ARGS=
+
+# For a private/custom TAL, mount a directory at the package's
+# /opt/panda-rpki-validator/custom-fixtures path and set these values in the
+# compose environment; do not commit the mounted files.
+# RIRS=custom
+# TAL_INPUT_MODE=custom-file-with-ta
+# CUSTOM_TAL_PATH=/opt/panda-rpki-validator/custom-fixtures/tal/custom.tal
+# CUSTOM_TA_PATH=/opt/panda-rpki-validator/custom-fixtures/ta/custom-ta.cer
+# CUSTOM_TAL_URI=rsync://example.invalid/module/ta.cer

deploy/docker/compose.yml

@@ -0,0 +1,37 @@
+services:
+  validator:
+    image: ${VALIDATOR_IMAGE:?VALIDATOR_IMAGE is required}
+    platform: ${VALIDATOR_PLATFORM:?VALIDATOR_PLATFORM is required}
+    container_name: ${COMPOSE_PROJECT_NAME:-panda-rpki-validator}-validator
+    environment:
+      PACKAGE_ROOT: /opt/panda-rpki-validator
+      RUN_ROOT: /var/lib/panda-rpki-validator
+      BIN_DIR: /opt/panda-rpki-validator/bin
+      FIXTURE_DIR: /opt/panda-rpki-validator/fixtures
+      MAX_RUNS: ${MAX_RUNS:-3}
+      INTERVAL_SECS: ${INTERVAL_SECS:-0}
+      RIRS: ${RIRS:-afrinic,apnic,arin,lacnic,ripe}
+      TAL_INPUT_MODE: ${TAL_INPUT_MODE:-file-with-ta}
+      RESOURCE_VALIDATION_MODE: ${RESOURCE_VALIDATION_MODE:-validation-update-03}
+      RETAIN_RUNS: ${RETAIN_RUNS:-10}
+      OUTPUT_COMPACT_REPORT: ${OUTPUT_COMPACT_REPORT:-1}
+      ALLOW_RSYNC_MIRROR_REUSE: ${ALLOW_RSYNC_MIRROR_REUSE:-1}
+      RSYNC_SCOPE: ${RSYNC_SCOPE:-module-root}
+      FAILURE_SNAPSHOT_RESET: ${FAILURE_SNAPSHOT_RESET:-1}
+      PERIODIC_SNAPSHOT_RESET: ${PERIODIC_SNAPSHOT_RESET:-0}
+      PERIODIC_SNAPSHOT_MAX_DELTAS: ${PERIODIC_SNAPSHOT_MAX_DELTAS:-100}
+      DB_STATS_EXACT_EVERY: ${DB_STATS_EXACT_EVERY:-3}
+      RPKI_PROGRESS_LOG: ${RPKI_PROGRESS_LOG:-1}
+      ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE: ${ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE:-0}
+      RPKI_ANALYZE: ${RPKI_ANALYZE:-0}
+      RPKI_EXTRA_ARGS: ${RPKI_EXTRA_ARGS:-}
+      CUSTOM_TAL_PATH: ${CUSTOM_TAL_PATH:-/opt/panda-rpki-validator/custom-fixtures/tal/custom.tal}
+      CUSTOM_TA_PATH: ${CUSTOM_TA_PATH:-/opt/panda-rpki-validator/custom-fixtures/ta/custom-ta.cer}
+      CUSTOM_TAL_URI: ${CUSTOM_TAL_URI:-}
+    volumes:
+      - ${HOST_DATA_DIR:-/var/lib/panda-rpki-validator}/state:/var/lib/panda-rpki-validator/state
+      - ${HOST_DATA_DIR:-/var/lib/panda-rpki-validator}/runs:/var/lib/panda-rpki-validator/runs
+      - ${HOST_DATA_DIR:-/var/lib/panda-rpki-validator}/logs:/var/lib/panda-rpki-validator/logs
+      - ${HOST_DATA_DIR:-/var/lib/panda-rpki-validator}/tmp:/var/lib/panda-rpki-validator/tmp
+    restart: ${RESTART_POLICY:-no}
+    command: ["${VALIDATOR_COMMAND:-run}"]

deploy/docker/scripts/start.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$COMPOSE_ROOT"
+
+[[ -f .env ]] || { echo "missing $COMPOSE_ROOT/.env; copy .env.example first" >&2; exit 2; }
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+mkdir -p "${HOST_DATA_DIR:-/var/lib/panda-rpki-validator}"/{state,runs,logs,tmp}
+docker compose -f compose.yml up -d

deploy/docker/scripts/status.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$COMPOSE_ROOT"
+docker compose -f compose.yml ps

deploy/docker/scripts/stop.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$COMPOSE_ROOT"
+docker compose -f compose.yml down