config: update READMEs and compose files for various services

2026-09-12 21:37:05 +02:00 · 2026-09-12 21:37:05 +02:00 · 2eb44c95d9
commit 2eb44c95d9
parent b19b1d3cf6
12 changed files with 145 additions and 27 deletions
--- a/2026/2026-09-11--forgejo-gitleaks-enc-gate.md
+++ b/2026/2026-09-11--forgejo-gitleaks-enc-gate.md
@ -0,0 +1,55 @@
+# 2026-09-11 — Forgejo/ht gitleaks + *enc.git Klartext-Sperre (TODO320)
+
+**Status:** live on koopa Forgejo (`koopa-forgejo` / `git.hacktivism.ch`)  
+**Freigabe:** Auftrag `TODO=320` this session (host mutation ht)  
+**Analog:** firefly/taler `admin-log/firefly/28-gitolite-enc-gitleaks.md` + `hooks/common/pre-receive.d-gitleaks`  
+**Tip:** k stays **319** (no tip-advance)
+
+## What
+
+1. **gitleaks** pre-receive on non-`*enc.git` — reject pushes with detected secrets.  
+2. **Skip** `*enc.git` for gitleaks (ciphertext / FP).  
+3. **`git-crypt-enforce`** on `*enc.git` — require `.gitattributes` + `.git-crypt/`; reject blobs under `filter=git-crypt` missing `\0GITCRYPT` (9-byte header).
+
+## Live paths (koopa)
+
+| Item | Path |
+|------|------|
+| Data root | `~/koopa-forgejo/data` → container `/var/lib/gitea` |
+| Binary | `data/custom/bin/gitleaks` (v8.21.2 linux_x64) |
+| Shared hooks | `data/custom/hooks/pre-receive.d/{gitleaks,git-crypt-enforce}` |
+| Smoke | `data/custom/bin/smoke-todo320.sh` (run **inside** container) |
+| Per-repo | `data/git/repositories/*/*.git/hooks/pre-receive.d/` → symlinks to shared hooks (container paths) |
+| Staging / installer SoT | laptop `PATH[llm-configs]/bin/forgejo-hooks/` + koopa `~/koopa-forgejo/hooks-staging/` |
+
+Installer: `install-hooks-ht.sh` (idempotent; podman; does not restart container).  
+After install: **~32** repos linked. **New repos:** re-run installer (custom/hooks alone not relied on for auto-sync into every bare repo).
+
+## Smoke (Done-when a/b/c) — PASSED 2026-09-11
+
+```bash
+podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
+# ALL SMOKES PASSED
+# (a) secret push denied — private-key fixture (not AWS EXAMPLE keys)
+# (b) enc ciphertext allowed
+# (c) enc plaintext denied
+```
+
+Fixes needed during smoke: park incoming objects on `refs/tmp/*` (not `refs/heads/*`, else `rev-list tip --not --branches` is empty); magic check `head -c 9` for `\0GITCRYPT`.
+
+## Rollback
+
+```bash
+# Per repo or all: remove custom hooks from pre-receive.d (keep Forgejo `gitea` hook)
+rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/gitleaks
+rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/git-crypt-enforce
+# Optional: remove shared copies under data/custom/hooks/pre-receive.d/
+```
+
+## Ops notes
+
+- Use **podman** (not docker sock) for `koopa-forgejo`.  
+- Symlink targets must be **container** paths (`/var/lib/gitea/custom/...`).  
+- Hook logs redact via gitleaks `--redact`; do not echo secrets.  
+- Laptop SSH: `Host git.hacktivism.ch` ProxyJump koopa, Port 9200, User git.  
+- Local SoT scripts: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`.
--- a/2026/2026-09-12--enc-inventur-rewrite-hooks.md
+++ b/2026/2026-09-12--enc-inventur-rewrite-hooks.md
@ -0,0 +1,60 @@
+# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY)
+
+**Status:** report only — **no** admin-log / firefly / Taler push this stretch  
+**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only  
+**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`)  
+**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0%  
+**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt`
+
+## Priority table (tip)
+
+| Priority | Repo | Outcome |
+|----------|------|---------|
+| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). |
+| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). |
+| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. |
+| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. |
+| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. |
+| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. |
+
+## Wrong origin (cleared)
+
+Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`.
+
+## Hooks (TODO320) — reinstall + smoke 2026-09-12
+
+Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`  
+Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh`
+
+```
+OK gitleaks=8.21.2 repos_linked=32
+podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
+ALL SMOKES PASSED
+  (a) secret push denied
+  (b) enc ciphertext allowed
+  (c) enc plaintext denied
+```
+
+`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks.  
+Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING).
+
+**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext).  
+Inventur STATUS close block appended same turn.
+
+## GPG recipients (credit + control)
+
+- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep)
+- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa)
+
+## Blocked / needs next Freigabe
+
+1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks.  
+2. Optional: commit/push work-output dirty overlay (2090) after review.  
+3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy.  
+4. Admin-log **push** of this file (report-only until Freigabe).
+
+## HALT (unchanged)
+
+- No ladder restart `@START_N=333`  
+- No admin-log / firefly / Taler push without Freigabe  
+- No force-push to `hernani/git.git`
--- a/configs/cryptpad/README.md
+++ b/configs/cryptpad/README.md
@ -5,7 +5,7 @@
 | Stack | [CryptPad](https://cryptpad.org/) |
 | Image | `localhost/koopa-cryptpad:cachyos` |
 | Live dir | `/home/hernani/koopa-cryptpad/` |
-| Host port | **9030** = Paivana paywall; nginx edge backend **127.0.0.1:19130** → app |
+| Host port | **9030** = Paivana paywall; nginx edge backend **172.17.0.1:19130** → app (pasta host IP; Paivana DEST) |
 | App ports (internal) | **3000** HTTP, **3003** websocket |
 | Public site | `cryptpad.hacktivism.ch` |

--- a/configs/cryptpad/compose.yml
+++ b/configs/cryptpad/compose.yml
@ -3,7 +3,7 @@
 # Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos
 #
 # Public :9030 = koopa-paivana-cryptpad (shared paivana image).
-# Edge backend loopback only — Paivana DEST → 127.0.0.1:19130
+# Edge on pasta host IP — Paivana DEST → 172.17.0.1:19130 (not LAN 0.0.0.0)
 # App listens 3000 (http) + 3003 (websocket) inside the net.
 services:
  cryptpad:
@ -44,7 +44,7 @@ services:
    volumes:
      - ./edge.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
-      - "127.0.0.1:${BACKEND_PORT:-19130}:80"
+      - "172.17.0.1:${BACKEND_PORT:-19130}:80"
    labels:
      org.hacktivism.service: cryptpad-edge
      org.hacktivism.host_port: "9030"
--- a/configs/forgejo/README.md
+++ b/configs/forgejo/README.md
@ -58,3 +58,7 @@ Or: Profile → Appearance → theme **hacktivism**, then hard-reload.
 ### Registration

 Public signup is disabled (`DISABLE_REGISTRATION`, no registration button).
+
+### pre-receive: gitleaks + *enc.git gate (TODO320, 2026-09-11)
+
+Live hooks under `~/koopa-forgejo/data/custom/hooks/pre-receive.d/` (gitleaks skip `*enc.git`; `git-crypt-enforce` Klartext-Sperre). Binary `data/custom/bin/gitleaks` v8.21.2. Installer + smoke: laptop `llm-configs/bin/forgejo-hooks/`. Ops note: `2026/2026-09-11--forgejo-gitleaks-enc-gate.md`. New repos → re-run `install-hooks-ht.sh`.
--- a/configs/galene/compose.yml
+++ b/configs/galene/compose.yml
@ -3,7 +3,7 @@
 # Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos
 #
 # Public :9029 = koopa-paivana-galene (shared paivana image).
-# Backend loopback only — Paivana DEST → 127.0.0.1:19129 (HTTP -insecure).
+# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19129 (HTTP -insecure; not LAN 0.0.0.0).
 # WebRTC UDP: still published (see README / ports.md)
 services:
  galene:
@ -17,7 +17,7 @@ services:
      - ./data:/data
      - ./entrypoint.sh:/docker-entrypoint.sh:ro
    ports:
-      - "127.0.0.1:${BACKEND_PORT:-19129}:8443"
+      - "172.17.0.1:${BACKEND_PORT:-19129}:8443"
      - "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp"
    labels:
      org.hacktivism.service: galene
--- a/configs/meet/compose.yml
+++ b/configs/meet/compose.yml
@ -1,7 +1,7 @@
 # koopa-meet — Jitsi Meet (CachyOS web stub + follow-up signaling/media)
 # Live: /home/hernani/koopa-meet/
 # Public :9031 = koopa-paivana-meet (shared paivana image).
-# Backend loopback only — Paivana DEST → 127.0.0.1:19131
+# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19131 (not LAN 0.0.0.0)
 #
 # Next: add prosody / jicofo / jvb services (CachyOS images or pinned binaries).
 # Official docker-jitsi-meet is Debian-based — do not pull those as default here.
@ -16,7 +16,7 @@ services:
    environment:
      - TZ=Europe/Zurich
    ports:
-      - "127.0.0.1:${BACKEND_PORT:-19131}:80"
+      - "172.17.0.1:${BACKEND_PORT:-19131}:80"
    labels:
      org.hacktivism.service: meet
      org.hacktivism.backend_port: "${BACKEND_PORT:-19131}"
--- a/configs/notes/compose.yml
+++ b/configs/notes/compose.yml
@ -3,7 +3,7 @@
 # Build: bash ~/koopa-admin-log/scripts/notes/build.sh → localhost/koopa-silverbullet:cachyos
 #
 # Public :9028 = koopa-paivana-silverbullet (shared paivana image).
-# Backend loopback only — Paivana DEST → 127.0.0.1:19128
+# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19128 (not LAN 0.0.0.0)
 services:
  notes:
    image: localhost/koopa-silverbullet:cachyos
@ -26,7 +26,7 @@ services:
    volumes:
      - ./space:/space
    ports:
-      - "127.0.0.1:${BACKEND_PORT:-19128}:3000"
+      - "172.17.0.1:${BACKEND_PORT:-19128}:3000"
    labels:
      org.hacktivism.service: silverbullet
      org.hacktivism.host_port: "9028"
--- a/configs/paivana/README.md
+++ b/configs/paivana/README.md
@ -13,9 +13,9 @@ paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only
 | Live | `/home/hernani/koopa-paivana/` |
 | Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` |
 | Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
-| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via host `172.17.0.1:19128–19131` |
+| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via pasta host IP `172.17.0.1:19128–19131` (compose publish, not `127.0.0.1`) |
 | Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy |
-| Currency | **GOA** (goa-shop); other units need other merchant backends / later instances |
+| Currency | **multi** via goa-shop template `paivana` choices (CHF / FLOODS / GOA / TESTPAYSAN); wallet still filters by held coins |
 | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
 | Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) |
 | Access | **`-g`** site-wide: pay once → that hostname free to browse |
@ -161,8 +161,7 @@ curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates'
  }'
 ```

-goa-shop is GOA-only. TESTPAYSAN / FLOODS / talersticker CHF / stage-CHF need
-other `MERCHANT_BACKEND_URL` values (separate Paivana process or later phase).
+goa-shop template `paivana` exposes multi-currency **choices**. Wallet/UI still only offers currencies the wallet holds. Live conf must use `instances/goa-shop/` + matching merchant token (not `goa-demo-*`).

 ## Docs

--- a/configs/paivana/compose.yml
+++ b/configs/paivana/compose.yml
@ -7,8 +7,8 @@
 #   9029 → paywall galene
 #   9030 → paywall cryptpad
 #   9031 → paywall meet (Jitsi web)
-# App backends (loopback only; see app compose):
-#   127.0.0.1:19128 / 19129 / 19130 / 19131
+# App backends on pasta host IP (see app compose; not LAN 0.0.0.0):
+#   172.17.0.1:19128 / 19129 / 19130 / 19131

 x-paivana-common: &paivana-common
  image: localhost/koopa-paivana:latest
@ -26,7 +26,7 @@ x-paivana-common: &paivana-common
    - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
  labels:
    org.hacktivism.managed_by: koopa-admin
-    org.hacktivism.currency: GOA
+    org.hacktivism.currency: multi

 services:
  paivana:
@ -47,7 +47,7 @@ services:
      org.hacktivism.host_port: "9025"
      org.hacktivism.site: paivana.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: GOA
+      org.hacktivism.currency: multi

  # App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031.
  paivana-silverbullet:
@ -63,7 +63,7 @@ services:
      org.hacktivism.host_port: "9028"
      org.hacktivism.site: silverbullet.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: GOA
+      org.hacktivism.currency: multi

  paivana-galene:
    <<: *paivana-common
@ -78,7 +78,7 @@ services:
      org.hacktivism.host_port: "9029"
      org.hacktivism.site: galene.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: GOA
+      org.hacktivism.currency: multi

  paivana-cryptpad:
    <<: *paivana-common
@ -93,7 +93,7 @@ services:
      org.hacktivism.host_port: "9030"
      org.hacktivism.site: cryptpad.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: GOA
+      org.hacktivism.currency: multi

  paivana-meet:
    <<: *paivana-common
@ -108,7 +108,7 @@ services:
      org.hacktivism.host_port: "9031"
      org.hacktivism.site: meet.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: GOA
+      org.hacktivism.currency: multi

  upstream:
    image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
--- a/configs/paivana/upstream/index.html
+++ b/configs/paivana/upstream/index.html
@ -45,7 +45,7 @@
  <h1>hacktivism tools</h1>
  <p>
    You paid once via GNU Taler / Paivana
-    (<strong class="price">GOA:42</strong> on this merchant).
+    (template <code>paivana</code> on <code>goa-shop</code>: CHF / FLOODS / GOA / TESTPAYSAN choices).
    Site-wide access cookie is set for <code>paivana.hacktivism.ch</code>.
  </p>
  <div class="card sites">
@ -58,7 +58,7 @@
    <p><strong>Notes</strong></p>
    <ul>
      <li>One Paivana process = one <code>DESTINATION_BASE_URL</code> → this portal is the gated upstream.</li>
-      <li>Merchant: <code>goa-shop</code> · template <code>paivana</code>.</li>
+      <li>Merchant: <code>goa-shop</code> · template <code>paivana</code> (multi-currency choices).</li>
      <li>Host: <code>https://paivana.hacktivism.ch/</code></li>
    </ul>
  </div>
--- a/configs/ports.md
+++ b/configs/ports.md
@ -19,10 +19,10 @@
 | **9025** | podman **`koopa-paivana`** (portal paywall) → Caddy **`paivana.hacktivism.ch`** |
 | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
 | **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
-| **9028** | podman **`koopa-paivana-silverbullet`** → Caddy **`silverbullet.hacktivism.ch`** (app backend `127.0.0.1:19128`) |
-| **9029** | podman **`koopa-paivana-galene`** → Caddy **`galene.hacktivism.ch`** (app backend `127.0.0.1:19129`; UDP 10000–10099 still Galene) |
-| **9030** | podman **`koopa-paivana-cryptpad`** → Caddy **`cryptpad.hacktivism.ch`** (edge backend `127.0.0.1:19130`) |
-| **9031** | podman **`koopa-paivana-meet`** → Caddy **`meet.hacktivism.ch`** (app backend `127.0.0.1:19131`) |
+| **9028** | podman **`koopa-paivana-silverbullet`** → Caddy **`silverbullet.hacktivism.ch`** (app backend `172.17.0.1:19128`) |
+| **9029** | podman **`koopa-paivana-galene`** → Caddy **`galene.hacktivism.ch`** (app backend `172.17.0.1:19129`; UDP 10000–10099 still Galene) |
+| **9030** | podman **`koopa-paivana-cryptpad`** → Caddy **`cryptpad.hacktivism.ch`** (edge backend `172.17.0.1:19130`) |
+| **9031** | podman **`koopa-paivana-meet`** → Caddy **`meet.hacktivism.ch`** (app backend `172.17.0.1:19131`) |
 | **9032** | podman **`koopa-bbb-front`** (Ubuntu) → Caddy **`bbb.hacktivism.ch`** |
 | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
 | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |