ops: GOA merchant-first 2026-09-15 daylog + lab-hosts + APPLY driver

2026/2026-09-15--goa-ansible-merchant-first.md

@@ -0,0 +1,124 @@
+# 2026-09-15 — GOA Ansible Merchant-first
+
+**Freigabe:** Live-Stop / Caddy = nein bis Chat-OK.  
+**Feed:** `taler-deployment` `origin/dev/hernani/regio-goa-explorational-currency`  
+**Work branch:** `dev/hernani/goa-regio-ng-vanilla`
+
+## Naming
+
+| | |
+|--|--|
+| **vanilla** | Ansible Vollkomposition (Merchant+Exchange+Bank+nginx/pg); GOA-Ersatz-Kandidat |
+| **local** | Lab only: loopback / `goa.local` |
+
+`configs/lab-local/goa-regio-ng` = **vanilla** @ **local**. Nie `REGIO_PUBLISH_KOOPA_PORTS=1` neben Live.
+
+## Ist (lab green)
+
+```bash
+ssh hernani@koopa 'podman ps --format "{{.Names}} {{.Status}} {{.Ports}}" | grep -E "goa-regio|taler-hacktivism"'
+# taler-hacktivism* Up  9010–9015
+# goa-regio-ng      Up  127.0.0.1:9180→80, 127.0.0.1:9322→22
+
+ssh hernani@koopa "podman exec goa-regio-ng sh -c '
+  for u in nginx postgresql libeufin-bank taler-merchant-httpd taler-exchange-httpd taler-merchant.target; do
+    printf \"%s=\"; systemctl is-active \$u
+  done'"
+# all=active
+
+ssh hernani@koopa 'for h in bank.goa.local exchange.goa.local backend.goa.local; do
+  curl -sS -o /dev/null -w "$h %{http_code}\n" -H "Host: $h" http://127.0.0.1:9180/config
+done'
+# all 200
+
+ssh hernani@koopa 'curl -sS -H "Host: exchange.goa.local" http://127.0.0.1:9180/keys' \
+  | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["master_public_key"],d["currency"],len(d.get("denominations",[])))'
+# TW6K5… GOA 27
+```
+
+| Piece | Live | Lab vanilla@local |
+|-------|------|-------------------|
+| Merchant | :9010 | **active** · instance `default` |
+| Exchange | :9011 | **active** · master TW6K5 · 27 denoms |
+| Bank | :9012 | libeufin-bank OK |
+| MASTER | TW6K5… | sha256 match enc `current/exchange-offline/master.priv` |
+
+Playbook: `ok=92 changed=20 failed=0` after `/etc/hosts` pin (bank.goa.local NXDOMAIN once).
+
+## Lab hosts (ephemeral)
+
+Container recreate drops hosts. Re-pin:
+
+```bash
+cd $HOME/git/admin-logs/local/koopa-admin-log/configs/lab-local
+ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
+# unsafe_writes — /etc/hosts EBUSY on atomic rename inside podman
+```
+
+## Merchant token (lab)
+
+SoT: `koopa-admin-secrets-enc/backups/goa/lab-local/merchant/secrets/merchant-default-access-token`  
+passwd = PLAIN; Bearer = file value as-is (`secret-token:…`). `/instances/default/private/products` **200**.  
+`/config` `"currency":"CHF"` = tip dual-merchant; GOA under `currencies.GOA`.
+
+## t2 — wire + order + withdraw + pay (lab) **done**
+
+Bank acct `lab-merchant` via `libeufin-bank create-account`; secrets under `…/lab-local/merchant/secrets/`. Wire `x-taler-bank`.
+
+```bash
+# POST /instances/default/private/accounts → 200 salt/h_wire
+# POST orders GOA:1 → 200 unpaid
+# create-token labwallet; POST withdrawals; wallet-cli withdraw; POST confirm → 204
+# handle-uri --yes "$taler_pay_uri"
+```
+
+| | |
+|--|--|
+| WID | `1eab9b0d-a3a8-41a8-b070-d7645b25ab25` |
+| withdraw | `txn:withdrawal:2EBFWF7GK415A151KP56MWCVK2CYMDHMR55Q9BG11VT6NR55YC80` final |
+| pay | `txn:payment:D4H75B5YDNJ52G8T6ADBDCXVWXCVZBG5HVSGE7G4S0XBQ6K8H3Y0` done |
+| order | `2026.257-6E75WGDBR32M4` **paid** |
+| wallet | GOA:9 (GOA:10 − GOA:1); CLI 1.6.43 **inside** `goa-regio-ng` |
+
+## Zielbild
+
+Ansible = SoT. Zwei Formen, gleiche Playbooks: **Full-stack Podman** · **Recreate-Fabrik**.  
+Branch: **master = stage**; anderer = **prod**. Kein `STAGE_ENV`.  
+**Reihenfolge:** **1 GOA** → **2 FP/Stage** (zwei Stacks) → **3 mytops-***. Merchant-Probleme → mytops vorziehen.  
+Gate: elelmon moderate → purse/withdraw → lab harden → Live-Merchant cutover nur wenn 1–3 grün → restore-back. Greenfield `*.2.*` PARK.
+
+## APPLY 20260915T0013Z
+
+BACKUP+APT+COMMIT OK. APPLY_SMOKE_FAIL was `sm=$(smoke)` capture; driver now `if smoke; then` → **APPLY_OK**. Smoke endpoints 200. Live bank/exchange/merchant Up; lab `goa-regio-ng` Up. Images retagged `:live` / `:landing`.
+
+## Arbeit 1 — live confirm overflow (2026-09-16) **FAIL**
+
+Smoke: `$HOME/git/llm/llm-work-input/goa-confirm-smoke.sh` (fresh scratch wallet; WCLI `$HOME/.local/bin/taler-wallet-cli.mjs`).
+
+| | |
+|--|--|
+| user | `cfm18923` 2026-09-16T00:35:23Z |
+| max_debt | acct#1=1e12 · **#2=1e8** · #3=1e12 |
+| credit | GOA:4798.5 **200** |
+| TOS | `exchanges add` + `update` + `accept-tos` **OK** |
+| GOA:20 WID | `062e3112-e235-4fea-95d1-644773100224` |
+| create | body `amount` + `exchange_url` → **200** |
+| force-select | rpub + epayto from `/keys` → **200** `selected` |
+| confirm | POST `/accounts/{user}/withdrawals/{wid}/confirm` → **500** code **5110** P0001 `amount value overflowed` |
+| GOA:4200 | same scratch rpub → **409** code **5114** Reserve pub already used (script; skip until GOA:20 green) |
+
+`CONFIRM_SMOKE_FAIL`. Select+TOS+RPUB green for GOA:20; overflow still at confirm. Next: dump `make_incoming` / `bank_wire_transfer` for that WID; lower remaining 1e12 if dump confirms.
+
+## Pointers
+
+| | |
+|--|--|
+| inventory | `configs/lab-local/goa-regio-ng-koopa.yml` |
+| lab hosts | `configs/lab-local/lab-hosts.yml` |
+| Lab README | `configs/lab-local/README.md` |
+| backup daylog | `2026/2026-09-04--goa-backup-regio-ng.md` |
+| APPLY driver | `scripts/taler-shared/goa-live-backup-upgrade.sh` |
+| dumps | koopa `~/backups/goa/current` → `20260904T1238Z` |
+| Caddy | taler→9010 · exchange→9011 · bank→9012 |
+
+Leave-off: t1+t2 lab green. Live confirm **5110**. No Live-Stop / no Caddy.