ops: GOA vanilla landings stats wdGet + collect greening
This commit is contained in:
Hernâni Marques
parent
0d881cd726
commit
337d253691
24 changed files with 1074 additions and 107 deletions
354
scripts/caddy/Caddyfile.koopa-live-wdGet
Normal file
354
scripts/caddy/Caddyfile.koopa-live-wdGet
Normal file
|
|
@ -0,0 +1,354 @@
|
|||
# Internal only (not in the browser URL):
|
||||
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
||||
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
||||
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh
|
||||
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
||||
{
|
||||
email info+koopa@hacktivism.ch
|
||||
http_port 9000
|
||||
https_port 9001
|
||||
auto_https disable_redirects
|
||||
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
|
||||
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
|
||||
servers {
|
||||
protocols h1 h2
|
||||
}
|
||||
}
|
||||
|
||||
(proxy_public) {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Port 443
|
||||
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
|
||||
}
|
||||
|
||||
taler.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9015 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# surface + aptdeploy HTML (taler.hacktivism.ch only)
|
||||
handle /taler-monitoring-surface_err {
|
||||
redir /taler-monitoring-surface_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-surface_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-surface {
|
||||
redir /taler-monitoring-surface/ 302
|
||||
}
|
||||
handle /taler-monitoring-surface* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy_err {
|
||||
redir /taler-monitoring-aptdeploy_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy {
|
||||
redir /taler-monitoring-aptdeploy/ 302
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
handle /taler-monitoring-mattermost_err {
|
||||
redir /taler-monitoring-mattermost_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-mattermost_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-mattermost {
|
||||
redir /taler-monitoring-mattermost/ 302
|
||||
}
|
||||
handle /taler-monitoring-mattermost* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
handle /taler-monitoring-mail_err {
|
||||
redir /taler-monitoring-mail_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-mail_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-mail {
|
||||
redir /taler-monitoring-mail/ 302
|
||||
}
|
||||
handle /taler-monitoring-mail* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
# SPA: /webui → /webui/
|
||||
redir /webui /webui/ 302
|
||||
|
||||
# Merchant API + WebUI (nginx :9010 → unix socket)
|
||||
reverse_proxy https://127.0.0.1:9010 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
exchange.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9014 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:9011 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
bank.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
# Static terms/privacy on landing nginx :9013
|
||||
handle /terms* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
handle /privacy* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# FP pattern (francpaysan-admin-log files/caddy/Caddyfile @wdGet):
|
||||
# GET withdrawal-operation → landing :9013 → demo-api :19096
|
||||
# (injects suggested_exchange / required_exchange for Android/iOS)
|
||||
@wdGet {
|
||||
method GET
|
||||
path /taler-integration/withdrawal-operation/*
|
||||
}
|
||||
handle @wdGet {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:9012 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
castopod.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9020 {
|
||||
header_up Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
bonfire.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9021 {
|
||||
header_up Host {host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
prime.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9022 {
|
||||
header_up Host {host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
bt.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9023 {
|
||||
header_up Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
|
||||
git.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9024 {
|
||||
header_up Host {host}
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Taler Operations design previews (static nginx)
|
||||
tops.ng1.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9090 {
|
||||
header_up Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng2.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9091 {
|
||||
header_up Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng3.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9092 {
|
||||
header_up Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
# 9025 paivana-httpd (GOA paywall)
|
||||
paivana.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9025 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Port 443
|
||||
}
|
||||
}
|
||||
|
||||
# 9026 lemmy (+ ui/pictrs via internal nginx)
|
||||
lemmy.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9026 {
|
||||
header_up Host {host}
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# 9027 decidim (rails)
|
||||
decidim.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9027 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Port 443
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch {
|
||||
handle /.well-known/acme-challenge/* {
|
||||
root * /var/www/acme
|
||||
file_server
|
||||
}
|
||||
handle {
|
||||
redir https://{host}{uri} permanent
|
||||
}
|
||||
}
|
||||
|
||||
# --- LLM Lightweight Monitoring (applied 2026-09-05T10:08:03+02:00) ---
|
||||
monitoring.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
root * /var/www/monitoring-sites/monitoring.hacktivism.ch
|
||||
file_server
|
||||
try_files {path} /index.html
|
||||
}
|
||||
|
||||
# ngi0-landing dossiers test sites (static) — numbering like tops.ng*
|
||||
dossiers.ngi.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
|
||||
file_server
|
||||
try_files {path} /index.html
|
||||
}
|
||||
|
||||
dossiers.2.ngi.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
root * /var/www/monitoring-sites/dossiers.2.ngi.hacktivism.ch
|
||||
file_server
|
||||
try_files {path} /index.html
|
||||
}
|
||||
|
||||
dossiers.3.ngi.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
root * /var/www/monitoring-sites/dossiers.3.ngi.hacktivism.ch
|
||||
file_server
|
||||
try_files {path} /index.html
|
||||
}
|
||||
|
|
@ -10,6 +10,24 @@ sudo caddy validate --config /etc/caddy/Caddyfile
|
|||
sudo systemctl reload caddy
|
||||
```
|
||||
|
||||
Preferred live path: edit `~/koopa-caddy/Caddyfile`, then `sudo ~/bin/caddy-apply`
|
||||
(copies → `/etc/caddy/Caddyfile`, validate, `systemctl reload caddy`).
|
||||
|
||||
## GOA bank @wdGet (FP Android withdraw) — full replace
|
||||
|
||||
Live snapshot + `@wdGet` (GET Integration → `:9013` → demo-api):
|
||||
|
||||
- `Caddyfile.koopa-live-wdGet` — whole-file replacement (based on live koopa, not admin-log mirror)
|
||||
- `apply-goa-wdGet-full-replace.sh` — replaces `~/koopa-caddy/Caddyfile` **and** `/etc/caddy/Caddyfile`, reload, smoke
|
||||
|
||||
```bash
|
||||
# on koopa (root) — scp both files first if no admin-log checkout:
|
||||
sudo bash /tmp/goa-fp-port/caddy/apply-goa-wdGet-full-replace.sh \
|
||||
/tmp/goa-fp-port/caddy/Caddyfile.koopa-live-wdGet
|
||||
```
|
||||
|
||||
FP SoT: `$HOME/git/admin-logs/taler/francpaysan-admin-log` `files/caddy/Caddyfile` `@wdGet`.
|
||||
|
||||
## dossiers.ngi* — basic_auth (htaccess-in-front)
|
||||
|
||||
Caddy **ignores** Apache `.htaccess`. Use:
|
||||
|
|
|
|||
80
scripts/caddy/apply-goa-wdGet-full-replace.sh
Executable file
80
scripts/caddy/apply-goa-wdGet-full-replace.sh
Executable file
|
|
@ -0,0 +1,80 @@
|
|||
#!/usr/bin/env bash
|
||||
# Full-replace koopa Caddyfile with live snapshot + FP @wdGet (GOA Android withdraw).
|
||||
#
|
||||
# Replaces BOTH:
|
||||
# /home/hernani/koopa-caddy/Caddyfile (runtime SoT for ~/bin/caddy-apply)
|
||||
# /etc/caddy/Caddyfile (active config)
|
||||
# then validates + systemctl reload caddy.
|
||||
#
|
||||
# On koopa (root):
|
||||
# sudo bash /path/to/apply-goa-wdGet-full-replace.sh
|
||||
# # or with explicit file:
|
||||
# sudo bash …/apply-goa-wdGet-full-replace.sh /path/to/Caddyfile.koopa-live-wdGet
|
||||
#
|
||||
# FP pattern: francpaysan-admin-log files/caddy/Caddyfile @wdGet
|
||||
# Ship file: scripts/caddy/Caddyfile.koopa-live-wdGet (live koopa + @wdGet only)
|
||||
set -euo pipefail
|
||||
|
||||
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
SRC="${1:-$HERE/Caddyfile.koopa-live-wdGet}"
|
||||
USER_CADDY="/home/hernani/koopa-caddy/Caddyfile"
|
||||
ETC_CADDY="/etc/caddy/Caddyfile"
|
||||
BACKUP_DIR="/etc/caddy"
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
echo "ERROR: run as root: sudo bash $0${1:+ $1}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
[[ -f "$SRC" ]] || { echo "ERROR: missing source: $SRC" >&2; exit 1; }
|
||||
[[ -d "$(dirname "$USER_CADDY")" ]] || { echo "ERROR: missing dir: $(dirname "$USER_CADDY")" >&2; exit 1; }
|
||||
[[ -f "$ETC_CADDY" ]] || { echo "ERROR: missing $ETC_CADDY" >&2; exit 1; }
|
||||
command -v caddy >/dev/null || { echo "ERROR: caddy not in PATH" >&2; exit 1; }
|
||||
|
||||
if ! grep -q '@wdGet' "$SRC"; then
|
||||
echo "ERROR: source lacks @wdGet — refusing replace: $SRC" >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! grep -q 'path /taler-integration/withdrawal-operation/\*' "$SRC"; then
|
||||
echo "ERROR: source lacks Integration @wdGet path — refusing: $SRC" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ts=$(date +%Y%m%d-%H%M%S)
|
||||
bak_etc="${BACKUP_DIR}/Caddyfile.bak-goa-wdGet-${ts}"
|
||||
bak_user="${USER_CADDY}.bak-goa-wdGet-${ts}"
|
||||
|
||||
cp -a "$ETC_CADDY" "$bak_etc"
|
||||
echo "backup etc: $bak_etc"
|
||||
if [[ -f "$USER_CADDY" ]]; then
|
||||
cp -a "$USER_CADDY" "$bak_user"
|
||||
echo "backup user: $bak_user"
|
||||
fi
|
||||
|
||||
install -o hernani -g hernani -m 644 "$SRC" "$USER_CADDY"
|
||||
echo "wrote: $USER_CADDY"
|
||||
|
||||
install -o root -g caddy -m 644 "$SRC" "$ETC_CADDY" 2>/dev/null \
|
||||
|| install -o root -g root -m 644 "$SRC" "$ETC_CADDY"
|
||||
echo "wrote: $ETC_CADDY"
|
||||
|
||||
echo "validate..."
|
||||
caddy validate --config "$ETC_CADDY"
|
||||
|
||||
echo "reload..."
|
||||
systemctl reload caddy
|
||||
systemctl is-active caddy
|
||||
|
||||
echo "spot-check @wdGet:"
|
||||
grep -n '@wdGet\|withdrawal-operation\|reverse_proxy 127.0.0.1:9013\|reverse_proxy 127.0.0.1:9012' "$ETC_CADDY" | head -20
|
||||
|
||||
echo "smoke public Integration (expect suggested_exchange + required_exchange):"
|
||||
smoke="$(curl -sS --max-time 10 \
|
||||
'https://bank.hacktivism.ch/taler-integration/withdrawal-operation/00000000-0000-0000-0000-000000000001' || true)"
|
||||
echo "$smoke"
|
||||
if echo "$smoke" | grep -q 'suggested_exchange' && echo "$smoke" | grep -q 'required_exchange'; then
|
||||
echo "OK: public Integration injects exchange fields"
|
||||
else
|
||||
echo "WARN: public smoke missing exchange fields — check nginx Integration + demo-api :19096" >&2
|
||||
exit 1
|
||||
fi
|
||||
18
scripts/caddy/wdGet-bank-snippet.caddy
Normal file
18
scripts/caddy/wdGet-bank-snippet.caddy
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# Paste into live ~/koopa-caddy/Caddyfile inside bank.hacktivism.ch { ... }
|
||||
# BEFORE the catch-all: reverse_proxy 127.0.0.1:9012
|
||||
# Then on koopa: sudo ~/bin/caddy-apply
|
||||
#
|
||||
# FP pattern: francpaysan-admin-log files/caddy/Caddyfile @wdGet
|
||||
# GET Integration → landing :9013 → demo-api :19096
|
||||
# (injects suggested_exchange / required_exchange for Android/iOS)
|
||||
# SoT mirrors: configs/caddy/Caddyfile + host/caddy/Caddyfile
|
||||
|
||||
@wdGet {
|
||||
method GET
|
||||
path /taler-integration/withdrawal-operation/*
|
||||
}
|
||||
handle @wdGet {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue