From 2eb44c95d9bd2e5e8dd6112d9abf56a67259aa67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sat, 12 Sep 2026 21:37:05 +0200 Subject: [PATCH] config: update READMEs and compose files for various services --- 2026/2026-09-11--forgejo-gitleaks-enc-gate.md | 55 +++++++++++++++++ .../2026-09-12--enc-inventur-rewrite-hooks.md | 60 +++++++++++++++++++ configs/cryptpad/README.md | 2 +- configs/cryptpad/compose.yml | 4 +- configs/forgejo/README.md | 4 ++ configs/galene/compose.yml | 4 +- configs/meet/compose.yml | 4 +- configs/notes/compose.yml | 4 +- configs/paivana/README.md | 7 +-- configs/paivana/compose.yml | 16 ++--- configs/paivana/upstream/index.html | 4 +- configs/ports.md | 8 +-- 12 files changed, 145 insertions(+), 27 deletions(-) create mode 100644 2026/2026-09-11--forgejo-gitleaks-enc-gate.md create mode 100644 2026/2026-09-12--enc-inventur-rewrite-hooks.md diff --git a/2026/2026-09-11--forgejo-gitleaks-enc-gate.md b/2026/2026-09-11--forgejo-gitleaks-enc-gate.md new file mode 100644 index 0000000..8a89620 --- /dev/null +++ b/2026/2026-09-11--forgejo-gitleaks-enc-gate.md @@ -0,0 +1,55 @@ +# 2026-09-11 — Forgejo/ht gitleaks + *enc.git Klartext-Sperre (TODO320) + +**Status:** live on koopa Forgejo (`koopa-forgejo` / `git.hacktivism.ch`) +**Freigabe:** Auftrag `TODO=320` this session (host mutation ht) +**Analog:** firefly/taler `admin-log/firefly/28-gitolite-enc-gitleaks.md` + `hooks/common/pre-receive.d-gitleaks` +**Tip:** k stays **319** (no tip-advance) + +## What + +1. **gitleaks** pre-receive on non-`*enc.git` — reject pushes with detected secrets. +2. **Skip** `*enc.git` for gitleaks (ciphertext / FP). +3. **`git-crypt-enforce`** on `*enc.git` — require `.gitattributes` + `.git-crypt/`; reject blobs under `filter=git-crypt` missing `\0GITCRYPT` (9-byte header). + +## Live paths (koopa) + +| Item | Path | +|------|------| +| Data root | `~/koopa-forgejo/data` → container `/var/lib/gitea` | +| Binary | `data/custom/bin/gitleaks` (v8.21.2 linux_x64) | +| Shared hooks | `data/custom/hooks/pre-receive.d/{gitleaks,git-crypt-enforce}` | +| Smoke | `data/custom/bin/smoke-todo320.sh` (run **inside** container) | +| Per-repo | `data/git/repositories/*/*.git/hooks/pre-receive.d/` → symlinks to shared hooks (container paths) | +| Staging / installer SoT | laptop `PATH[llm-configs]/bin/forgejo-hooks/` + koopa `~/koopa-forgejo/hooks-staging/` | + +Installer: `install-hooks-ht.sh` (idempotent; podman; does not restart container). +After install: **~32** repos linked. **New repos:** re-run installer (custom/hooks alone not relied on for auto-sync into every bare repo). + +## Smoke (Done-when a/b/c) — PASSED 2026-09-11 + +```bash +podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh +# ALL SMOKES PASSED +# (a) secret push denied — private-key fixture (not AWS EXAMPLE keys) +# (b) enc ciphertext allowed +# (c) enc plaintext denied +``` + +Fixes needed during smoke: park incoming objects on `refs/tmp/*` (not `refs/heads/*`, else `rev-list tip --not --branches` is empty); magic check `head -c 9` for `\0GITCRYPT`. + +## Rollback + +```bash +# Per repo or all: remove custom hooks from pre-receive.d (keep Forgejo `gitea` hook) +rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/gitleaks +rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/git-crypt-enforce +# Optional: remove shared copies under data/custom/hooks/pre-receive.d/ +``` + +## Ops notes + +- Use **podman** (not docker sock) for `koopa-forgejo`. +- Symlink targets must be **container** paths (`/var/lib/gitea/custom/...`). +- Hook logs redact via gitleaks `--redact`; do not echo secrets. +- Laptop SSH: `Host git.hacktivism.ch` ProxyJump koopa, Port 9200, User git. +- Local SoT scripts: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`. diff --git a/2026/2026-09-12--enc-inventur-rewrite-hooks.md b/2026/2026-09-12--enc-inventur-rewrite-hooks.md new file mode 100644 index 0000000..980f31d --- /dev/null +++ b/2026/2026-09-12--enc-inventur-rewrite-hooks.md @@ -0,0 +1,60 @@ +# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY) + +**Status:** report only — **no** admin-log / firefly / Taler push this stretch +**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only +**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`) +**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0% +**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt` + +## Priority table (tip) + +| Priority | Repo | Outcome | +|----------|------|---------| +| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). | +| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). | +| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. | +| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. | +| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. | +| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. | + +## Wrong origin (cleared) + +Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`. + +## Hooks (TODO320) — reinstall + smoke 2026-09-12 + +Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/` +Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh` + +``` +OK gitleaks=8.21.2 repos_linked=32 +podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh +ALL SMOKES PASSED + (a) secret push denied + (b) enc ciphertext allowed + (c) enc plaintext denied +``` + +`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks. +Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING). + +**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext). +Inventur STATUS close block appended same turn. + +## GPG recipients (credit + control) + +- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep) +- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa) + +## Blocked / needs next Freigabe + +1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks. +2. Optional: commit/push work-output dirty overlay (2090) after review. +3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy. +4. Admin-log **push** of this file (report-only until Freigabe). + +## HALT (unchanged) + +- No ladder restart `@START_N=333` +- No admin-log / firefly / Taler push without Freigabe +- No force-push to `hernani/git.git` diff --git a/configs/cryptpad/README.md b/configs/cryptpad/README.md index 2be16ff..2a91ced 100644 --- a/configs/cryptpad/README.md +++ b/configs/cryptpad/README.md @@ -5,7 +5,7 @@ | Stack | [CryptPad](https://cryptpad.org/) | | Image | `localhost/koopa-cryptpad:cachyos` | | Live dir | `/home/hernani/koopa-cryptpad/` | -| Host port | **9030** = Paivana paywall; nginx edge backend **127.0.0.1:19130** → app | +| Host port | **9030** = Paivana paywall; nginx edge backend **172.17.0.1:19130** → app (pasta host IP; Paivana DEST) | | App ports (internal) | **3000** HTTP, **3003** websocket | | Public site | `cryptpad.hacktivism.ch` | diff --git a/configs/cryptpad/compose.yml b/configs/cryptpad/compose.yml index 1b37a6f..6452461 100644 --- a/configs/cryptpad/compose.yml +++ b/configs/cryptpad/compose.yml @@ -3,7 +3,7 @@ # Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos # # Public :9030 = koopa-paivana-cryptpad (shared paivana image). -# Edge backend loopback only — Paivana DEST → 127.0.0.1:19130 +# Edge on pasta host IP — Paivana DEST → 172.17.0.1:19130 (not LAN 0.0.0.0) # App listens 3000 (http) + 3003 (websocket) inside the net. services: cryptpad: @@ -44,7 +44,7 @@ services: volumes: - ./edge.conf:/etc/nginx/conf.d/default.conf:ro ports: - - "127.0.0.1:${BACKEND_PORT:-19130}:80" + - "172.17.0.1:${BACKEND_PORT:-19130}:80" labels: org.hacktivism.service: cryptpad-edge org.hacktivism.host_port: "9030" diff --git a/configs/forgejo/README.md b/configs/forgejo/README.md index a5d9a6a..9359a0b 100644 --- a/configs/forgejo/README.md +++ b/configs/forgejo/README.md @@ -58,3 +58,7 @@ Or: Profile → Appearance → theme **hacktivism**, then hard-reload. ### Registration Public signup is disabled (`DISABLE_REGISTRATION`, no registration button). + +### pre-receive: gitleaks + *enc.git gate (TODO320, 2026-09-11) + +Live hooks under `~/koopa-forgejo/data/custom/hooks/pre-receive.d/` (gitleaks skip `*enc.git`; `git-crypt-enforce` Klartext-Sperre). Binary `data/custom/bin/gitleaks` v8.21.2. Installer + smoke: laptop `llm-configs/bin/forgejo-hooks/`. Ops note: `2026/2026-09-11--forgejo-gitleaks-enc-gate.md`. New repos → re-run `install-hooks-ht.sh`. diff --git a/configs/galene/compose.yml b/configs/galene/compose.yml index d162f36..1919f87 100644 --- a/configs/galene/compose.yml +++ b/configs/galene/compose.yml @@ -3,7 +3,7 @@ # Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos # # Public :9029 = koopa-paivana-galene (shared paivana image). -# Backend loopback only — Paivana DEST → 127.0.0.1:19129 (HTTP -insecure). +# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19129 (HTTP -insecure; not LAN 0.0.0.0). # WebRTC UDP: still published (see README / ports.md) services: galene: @@ -17,7 +17,7 @@ services: - ./data:/data - ./entrypoint.sh:/docker-entrypoint.sh:ro ports: - - "127.0.0.1:${BACKEND_PORT:-19129}:8443" + - "172.17.0.1:${BACKEND_PORT:-19129}:8443" - "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp" labels: org.hacktivism.service: galene diff --git a/configs/meet/compose.yml b/configs/meet/compose.yml index 9e2cd52..9aacb27 100644 --- a/configs/meet/compose.yml +++ b/configs/meet/compose.yml @@ -1,7 +1,7 @@ # koopa-meet — Jitsi Meet (CachyOS web stub + follow-up signaling/media) # Live: /home/hernani/koopa-meet/ # Public :9031 = koopa-paivana-meet (shared paivana image). -# Backend loopback only — Paivana DEST → 127.0.0.1:19131 +# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19131 (not LAN 0.0.0.0) # # Next: add prosody / jicofo / jvb services (CachyOS images or pinned binaries). # Official docker-jitsi-meet is Debian-based — do not pull those as default here. @@ -16,7 +16,7 @@ services: environment: - TZ=Europe/Zurich ports: - - "127.0.0.1:${BACKEND_PORT:-19131}:80" + - "172.17.0.1:${BACKEND_PORT:-19131}:80" labels: org.hacktivism.service: meet org.hacktivism.backend_port: "${BACKEND_PORT:-19131}" diff --git a/configs/notes/compose.yml b/configs/notes/compose.yml index 4a874d4..fec8d42 100644 --- a/configs/notes/compose.yml +++ b/configs/notes/compose.yml @@ -3,7 +3,7 @@ # Build: bash ~/koopa-admin-log/scripts/notes/build.sh → localhost/koopa-silverbullet:cachyos # # Public :9028 = koopa-paivana-silverbullet (shared paivana image). -# Backend loopback only — Paivana DEST → 127.0.0.1:19128 +# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19128 (not LAN 0.0.0.0) services: notes: image: localhost/koopa-silverbullet:cachyos @@ -26,7 +26,7 @@ services: volumes: - ./space:/space ports: - - "127.0.0.1:${BACKEND_PORT:-19128}:3000" + - "172.17.0.1:${BACKEND_PORT:-19128}:3000" labels: org.hacktivism.service: silverbullet org.hacktivism.host_port: "9028" diff --git a/configs/paivana/README.md b/configs/paivana/README.md index 8cac2f0..285cec8 100644 --- a/configs/paivana/README.md +++ b/configs/paivana/README.md @@ -13,9 +13,9 @@ paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only | Live | `/home/hernani/koopa-paivana/` | | Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` | | Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` | -| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via host `172.17.0.1:19128–19131` | +| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via pasta host IP `172.17.0.1:19128–19131` (compose publish, not `127.0.0.1`) | | Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy | -| Currency | **GOA** (goa-shop); other units need other merchant backends / later instances | +| Currency | **multi** via goa-shop template `paivana` choices (CHF / FLOODS / GOA / TESTPAYSAN); wallet still filters by held coins | | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` | | Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) | | Access | **`-g`** site-wide: pay once → that hostname free to browse | @@ -161,8 +161,7 @@ curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' }' ``` -goa-shop is GOA-only. TESTPAYSAN / FLOODS / talersticker CHF / stage-CHF need -other `MERCHANT_BACKEND_URL` values (separate Paivana process or later phase). +goa-shop template `paivana` exposes multi-currency **choices**. Wallet/UI still only offers currencies the wallet holds. Live conf must use `instances/goa-shop/` + matching merchant token (not `goa-demo-*`). ## Docs diff --git a/configs/paivana/compose.yml b/configs/paivana/compose.yml index 688c10f..160cfb7 100644 --- a/configs/paivana/compose.yml +++ b/configs/paivana/compose.yml @@ -7,8 +7,8 @@ # 9029 → paywall galene # 9030 → paywall cryptpad # 9031 → paywall meet (Jitsi web) -# App backends (loopback only; see app compose): -# 127.0.0.1:19128 / 19129 / 19130 / 19131 +# App backends on pasta host IP (see app compose; not LAN 0.0.0.0): +# 172.17.0.1:19128 / 19129 / 19130 / 19131 x-paivana-common: &paivana-common image: localhost/koopa-paivana:latest @@ -26,7 +26,7 @@ x-paivana-common: &paivana-common - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro labels: org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi services: paivana: @@ -47,7 +47,7 @@ services: org.hacktivism.host_port: "9025" org.hacktivism.site: paivana.hacktivism.ch org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi # App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031. paivana-silverbullet: @@ -63,7 +63,7 @@ services: org.hacktivism.host_port: "9028" org.hacktivism.site: silverbullet.hacktivism.ch org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi paivana-galene: <<: *paivana-common @@ -78,7 +78,7 @@ services: org.hacktivism.host_port: "9029" org.hacktivism.site: galene.hacktivism.ch org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi paivana-cryptpad: <<: *paivana-common @@ -93,7 +93,7 @@ services: org.hacktivism.host_port: "9030" org.hacktivism.site: cryptpad.hacktivism.ch org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi paivana-meet: <<: *paivana-common @@ -108,7 +108,7 @@ services: org.hacktivism.host_port: "9031" org.hacktivism.site: meet.hacktivism.ch org.hacktivism.managed_by: koopa-admin - org.hacktivism.currency: GOA + org.hacktivism.currency: multi upstream: image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine diff --git a/configs/paivana/upstream/index.html b/configs/paivana/upstream/index.html index 6cf7a1f..fe9706b 100644 --- a/configs/paivana/upstream/index.html +++ b/configs/paivana/upstream/index.html @@ -45,7 +45,7 @@

hacktivism tools

You paid once via GNU Taler / Paivana - (GOA:42 on this merchant). + (template paivana on goa-shop: CHF / FLOODS / GOA / TESTPAYSAN choices). Site-wide access cookie is set for paivana.hacktivism.ch.

@@ -58,7 +58,7 @@

Notes

diff --git a/configs/ports.md b/configs/ports.md index 0df00bf..36ccd88 100644 --- a/configs/ports.md +++ b/configs/ports.md @@ -19,10 +19,10 @@ | **9025** | podman **`koopa-paivana`** (portal paywall) → Caddy **`paivana.hacktivism.ch`** | | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** | | **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** | -| **9028** | podman **`koopa-paivana-silverbullet`** → Caddy **`silverbullet.hacktivism.ch`** (app backend `127.0.0.1:19128`) | -| **9029** | podman **`koopa-paivana-galene`** → Caddy **`galene.hacktivism.ch`** (app backend `127.0.0.1:19129`; UDP 10000–10099 still Galene) | -| **9030** | podman **`koopa-paivana-cryptpad`** → Caddy **`cryptpad.hacktivism.ch`** (edge backend `127.0.0.1:19130`) | -| **9031** | podman **`koopa-paivana-meet`** → Caddy **`meet.hacktivism.ch`** (app backend `127.0.0.1:19131`) | +| **9028** | podman **`koopa-paivana-silverbullet`** → Caddy **`silverbullet.hacktivism.ch`** (app backend `172.17.0.1:19128`) | +| **9029** | podman **`koopa-paivana-galene`** → Caddy **`galene.hacktivism.ch`** (app backend `172.17.0.1:19129`; UDP 10000–10099 still Galene) | +| **9030** | podman **`koopa-paivana-cryptpad`** → Caddy **`cryptpad.hacktivism.ch`** (edge backend `172.17.0.1:19130`) | +| **9031** | podman **`koopa-paivana-meet`** → Caddy **`meet.hacktivism.ch`** (app backend `172.17.0.1:19131`) | | **9032** | podman **`koopa-bbb-front`** (Ubuntu) → Caddy **`bbb.hacktivism.ch`** | | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) | | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |