merchant: start/health + certbot_renew (container nginx TLS :8081, ACME :8082)

scripts/taler-merchant/start_base_services_for_taler.sh

@@ -0,0 +1,133 @@
+#!/bin/bash
+# Root: base services for manual merchant (no systemd).
+# Pattern (all three stacks): root base → shell as service user → start_*.sh
+#
+# Container: taler-hacktivism
+# Then as taler-merchant-httpd: /usr/local/bin/start_merchant.sh [--restart]
+#
+# Usage:
+#   /root/start_base_services_for_taler.sh              # interactive shell as service user
+#   /root/start_base_services_for_taler.sh --no-shell   # base only (automation)
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "Run as root" >&2
+  exit 1
+fi
+
+NO_SHELL=0
+for arg in "$@"; do
+  case "$arg" in
+    --no-shell|-n) NO_SHELL=1 ;;
+    --help|-h)
+      echo "Usage: $0 [--no-shell]"
+      exit 0
+      ;;
+  esac
+done
+
+PWD_BIN="/usr/local/bin"
+MERCHANT_STARTER="start_merchant.sh"
+LOG_DIR=/var/log/taler-merchant
+RUN_DIR=/var/run/taler-merchant/httpd
+
+# --- Debian postgresql defaults (pg_createcluster layout) ---
+ensure_postgresql() {
+  echo "  Debian perms on /etc/postgresql + data/log/run..."
+  if [ -d /etc/postgresql ]; then
+    chown -R root:postgres /etc/postgresql
+    find /etc/postgresql -type d -exec chmod 755 {} \;
+    find /etc/postgresql -type f -name '*.conf' -exec chmod 640 {} \;
+  fi
+  chown -R postgres:postgres /var/lib/postgresql /var/log/postgresql 2>/dev/null || true
+  mkdir -p /var/run/postgresql
+  chown postgres:postgres /var/run/postgresql
+  # Debian package uses setgid sticky on run dir
+  chmod 2775 /var/run/postgresql 2>/dev/null || chmod 775 /var/run/postgresql
+
+  if pg_isready -q 2>/dev/null; then
+    echo "  already accepting connections"
+    pg_isready || true
+    return 0
+  fi
+
+  # Stale socket lock only when not accepting
+  rm -f /var/run/postgresql/.s.PGSQL.*.lock 2>/dev/null || true
+  if ! pgrep -u postgres -x postgres >/dev/null 2>&1; then
+    rm -f /var/lib/postgresql/*/main/postmaster.pid 2>/dev/null || true
+  fi
+
+  if command -v pg_ctlcluster >/dev/null 2>&1 && command -v pg_lsclusters >/dev/null 2>&1; then
+    while read -r ver name _rest; do
+      [ -n "$ver" ] || continue
+      echo "  pg_ctlcluster $ver $name start"
+      pg_ctlcluster "$ver" "$name" start 2>/dev/null || true
+    done < <(pg_lsclusters --no-header 2>/dev/null || true)
+  fi
+  if ! pg_isready -q 2>/dev/null; then
+    if [ -x /etc/init.d/postgresql ]; then
+      /etc/init.d/postgresql start || true
+    else
+      service postgresql start || true
+    fi
+  fi
+  sleep 1
+  pg_isready || true
+}
+
+echo "Start certbot renewal (background)..."
+if [ -x /root/scripts/certbot_renew.sh ]; then
+  /root/scripts/certbot_renew.sh &
+elif [ -x ./scripts/certbot_renew.sh ]; then
+  ./scripts/certbot_renew.sh &
+fi
+
+echo "Create log + runtime dirs... permissions for taler-merchant-httpd / www-data:"
+mkdir -p "$LOG_DIR" /var/run/taler-merchant "$RUN_DIR"
+chown taler-merchant-httpd: "$LOG_DIR"
+chmod 755 "$LOG_DIR"
+chown taler-merchant-httpd:www-data /var/run/taler-merchant "$RUN_DIR"
+chmod 755 /var/run/taler-merchant "$RUN_DIR"
+# merchant app data (package default home)
+if [ -d /var/lib/taler-merchant ]; then
+  chown -R taler-merchant-httpd:www-data /var/lib/taler-merchant 2>/dev/null || true
+fi
+
+echo "Start base services needed for Taler Merchant."
+echo ""
+
+if [ -f /root/.taler-secrets-env ]; then
+  echo -n "Read secrets needed for SMS delivery:"
+  set -a
+  # shellcheck disable=SC1091
+  source /root/.taler-secrets-env && echo " OK"
+  set +a
+else
+  echo "No /root/.taler-secrets-env (SMS may fail)"
+fi
+
+echo "1. postgresql:"
+ensure_postgresql
+
+echo "2. nginx:"
+if [ -x /etc/init.d/nginx ]; then
+  /etc/init.d/nginx start 2>/dev/null || nginx || true
+else
+  service nginx start 2>/dev/null || nginx || true
+fi
+
+if [ "$NO_SHELL" -eq 1 ]; then
+  echo "Base services started (--no-shell). Next: runuser -u taler-merchant-httpd -- $PWD_BIN/$MERCHANT_STARTER [--restart]"
+  exit 0
+fi
+
+echo "3. Switching now to user taler-merchant-httpd, in $PWD_BIN; find executable $MERCHANT_STARTER there!"
+echo ""
+cd "$PWD_BIN"
+# util-linux: -u and -s/--shell are mutually exclusive
+exec runuser -u taler-merchant-httpd -- env \
+  CLICKSEND_API_KEY="${CLICKSEND_API_KEY:-}" \
+  CLICKSEND_USERNAME="${CLICKSEND_USERNAME:-}" \
+  TELESIGN_AUTH_TOKEN="${TELESIGN_AUTH_TOKEN:-}" \
+  bash