diff --git a/2026/2026-07-13--paivana-goa.md b/2026/2026-07-13--paivana-goa.md index 9606641..0095b40 100644 --- a/2026/2026-07-13--paivana-goa.md +++ b/2026/2026-07-13--paivana-goa.md @@ -7,13 +7,22 @@ - Image `localhost/koopa-paivana:latest` (built from `git.taler.net/paivana` + deb.taler.net libs; package not on apt yet) - Merchant: instance **`goa-shop`**, template **`paivana`** (`template_type: paivana`, **GOA:4200**) - After payment: site-wide cookie (`-g`) → example upstream free to browse -- `extra_hosts: taler.hacktivism.ch:host-gateway` so pasta can reach merchant - Flags: `-g` (site-wide), `-f` (X-Forwarded-For) - Smoke: `curl -si http://127.0.0.1:9025/` → **302** to `/.well-known/paivana/templates/paivana#…` - Config mirror: `configs/paivana/` - Caddy: `paivana.hacktivism.ch` → `:9025` (`configs/caddy/Caddyfile`) - User unit: `container-koopa-paivana.service` enabled +## Was später kaputt / nachgezogen (klar) + +Siehe **`configs/paivana/README.md` → „Was kaputt war“**. Kurz: + +1. **Extra Upstream-systemd-Unit** race mit Compose → exit **125** / start-limit — **nur** Compose-Unit behalten. +2. **Paivana vor Merchant-Apps** → öffentliches **502** — `order.conf` `After=taler-merchant-apps`. +3. **Pasta DNS/AAAA**: `host-gateway` reichte nicht → `extra_hosts` auf **`172.17.0.1`** pin (`f26bf6a`). + +Gesund: **302** lokal / **402** public paywall + monitoring `www.paivana`. + ## Refs - https://docs.taler.net/taler-paivana-manual.html diff --git a/2026/2026-07-17.md b/2026/2026-07-17.md index de35634..33ee314 100644 --- a/2026/2026-07-17.md +++ b/2026/2026-07-17.md @@ -3,3 +3,8 @@ - Bank: `taler://withdraw` **ohne `:443`** (Wallet-Apps); live deployed - Merchant/bank in-container apps after reboot via `ensure-taler-apps` + user units - Admin-log: 13 Commits (19:04–01:07) + follow-up; `main` force-pushed → Forgejo +- **Paivana — was kaputt war** klar dokumentiert (`configs/paivana/README.md`): + 1. Upstream-only systemd race (exit 125) + 2. Start vor Merchant-Apps → 502 + 3. Pasta AAAA/timeout → pin `172.17.0.1` + Live-Stack war gesund (302/402); Ursache/Fix nicht wiederholen. diff --git a/configs/paivana/README.md b/configs/paivana/README.md index 3b8700a..643fdb4 100644 --- a/configs/paivana/README.md +++ b/configs/paivana/README.md @@ -37,6 +37,65 @@ GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA pay Mirror notes: `koopa-admin-secrets` → `koopa/home-hernani/koopa-paivana/secrets/` (paths only / examples). +## Was kaputt war (klar · 2026-07) + +Drei **unabhängige** Defekte; Symptom oft gleich (Paywall 502 / tot / kein Template). +Stand: behoben auf koopa; nicht wiederholen. + +### 1) Boot-Race: extra systemd-Unit nur für Upstream + +| | | +|--|--| +| **Symptom** | Nach Reboot: `container-koopa-paivana-upstream.service` **failed** / start-limit-hit; Upstream fehlt oder Compose und Unit kämpfen. | +| **Ursache** | Separate User-Unit tat nur `podman start koopa-paivana-upstream` **ohne** dass Compose die Container schon angelegt hatte → **exit 125**. Compose-Unit startet **beide** Services (`paivana` + `upstream`) ohnehin. | +| **Fix** | **Nur** `container-koopa-paivana.service` (compose up). Separate Upstream-Unit: `disable --now`. Nicht neu anlegen. | +| **Nicht verwechseln mit** | Problem 2 (Merchant noch down → 502 trotz laufender Container). | + +### 2) Start-Reihenfolge: Paivana vor Merchant-Apps → **502** + +| | | +|--|--| +| **Symptom** | `paivana.hacktivism.ch` / `:9025` **502** nach Boot; Container laufen, Paywall/Template-Flow tot. | +| **Ursache** | Merchant-Container ist hoch, aber **In-App** (`taler-merchant-httpd` etc.) startet erst über `taler-merchant-apps.service` / `ensure-taler-apps`. Paivana braucht die **private Merchant-API** (Template `paivana` / goa-shop). Zu früh → 502. | +| **Fix** | Drop-in `configs/systemd/user/container-koopa-paivana.service.d/order.conf`: `After=` / `Wants=` `taler-merchant-apps.service` (+ ggf. merchant-Container). Siehe `2026/2026-07-16--reboot-recovery.md`. | +| **Check** | Merchant `https://taler.hacktivism.ch/config` **200**, dann Paivana smoke (unten). | + +### 3) Pasta / DNS: Container erreicht Merchant nicht (Timeout / AAAA) + +| | | +|--|--| +| **Symptom** | Paivana läuft, aber Template-Laden / Merchant-Calls **hängen oder scheitern**; Logs: Timeouts Richtung `taler.hacktivism.ch`. | +| **Ursache** | Rootless **pasta** hairpint öffentliche DNS nicht sauber. `extra_hosts: …:host-gateway` allein reichte nicht: oft gewinnt noch die **öffentliche AAAA**, Connection timeout. Merchant sitzt am Host (**~:9010**), erreichbar über Pasta-IPv4 **`172.17.0.1`**. | +| **Fix** | In `compose.yml` feste IPv4-Hosts (nicht nur host-gateway): | + +```yaml +extra_hosts: + - "taler.hacktivism.ch:172.17.0.1" + - "bank.hacktivism.ch:172.17.0.1" + - "exchange.hacktivism.ch:172.17.0.1" +``` + +| | | +|--|--| +| **Commit** | `f26bf6a` (pin Taler hosts to pasta IPv4) | + +### Kurz: was *nicht* das Problem war + +- Caddy-Vhost an sich (leitet auf **9025**). +- Fehlen des Templates im Merchant (Template `paivana` / GOA:4200 war angelegt; ohne Merchant-Apps oder ohne Routing wirkt es so, als fehlte es). +- „Nur nginx-Upstream“ — Upstream ist unprivileged nginx **:8080**; ohne Problem 1/2/3 ist das stabil. + +### Erwartet gesund + +| Check | Expect | +|-------|--------| +| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` | +| `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` | +| monitoring `urls` | `www.paivana` OK | +| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:4200** (wenn `E2E_PAIVANA=1`) | + +--- + ## Ops ```bash @@ -54,35 +113,22 @@ Autostart (**only** the compose unit — starts **both** `koopa-paivana` and ```bash mkdir -p ~/.config/systemd/user cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/ -# optional: After= merchant (configs/systemd/user/container-koopa-paivana.service.d/) +# required on koopa: After= merchant apps +# configs/systemd/user/container-koopa-paivana.service.d/order.conf systemctl --user daemon-reload systemctl --user enable --now container-koopa-paivana.service ``` **Do not** enable a separate `container-koopa-paivana-upstream.service` that only -runs `podman start koopa-paivana-upstream`. At boot that unit races compose -(container not created yet → exit 125 → start-limit-hit). Compose already -starts the upstream. If such a unit exists: +runs `podman start koopa-paivana-upstream` — see failure **#1** above. +If such a unit exists: `systemctl --user disable --now container-koopa-paivana-upstream.service`. -Healthy smoke: - -| Check | Expect | -|-------|--------| -| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` | -| template URL / public `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` | -| monitoring | `./scripts/taler-monitoring/taler-monitoring.sh -d hacktivism.ch urls` → `www.paivana` OK | - ## Network notes -Rootless pasta cannot hairpin public DNS for the merchant. Compose sets: - -```yaml -extra_hosts: - - "taler.hacktivism.ch:host-gateway" -``` - -so `paivana-httpd` can load templates from the merchant API. +See failure **#3**. Live compose pins Taler hostnames to pasta IPv4 +`172.17.0.1` so `paivana-httpd` reaches the host merchant private API without +public AAAA timeouts. ## Caddy