hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

configs: rename dirs to match live koopa containers

Browse source 
Reflect host naming in git paths:
- configs/taler-hacktivism/ (was taler-merchant) → container taler-hacktivism
- configs/taler-hacktivism-bank/ (was taler-bank) → container …-bank,
  image taler-hacktivism-banking:live
- configs/taler-exchange-ansible/ already matches …-exchange-ansible
- configs/taler-exchange/ = conf inside that exchange container

Update LIVE.md, README, ports/refs. No secret values.
This commit is contained in:
Hernâni Marques 2026-07-10 16:02:52 +02:00 • committed by Hernâni Marques
parent b5c1bf7591
commit 54ebdb7d7a
No known key found for this signature in database
27 changed files with 93 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

38
2026/2026-07-09--exchange-snapshot-and-restore.md
View file

@ -2,7 +2,7 @@
**Scope:** local on host **koopa** only. No registry, no upload, no public internet publish. **Scope:** local on host **koopa** only. No registry, no upload, no public internet publish.
Container was **stopped** then **committed/saved**. Live name: `taler-exchange-hacktivism`. Container was **stopped** then **committed/saved**. Live name: `taler-hacktivism-exchange-ansible`.
--- ---
@ -16,7 +16,7 @@ Directory (hernani on koopa):
| File | Role | Size (approx.) | | File | Role | Size (approx.) |
|------|------|----------------| |------|------|----------------|
| `taler-exchange-hacktivism-live-20260709-snapshot.tar` | full exchange image archive | **~1.6 G** | | `taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar` | full exchange image archive | **~1.6 G** |
| `taler-hacktivism-live-20260709-snapshot.tar` | merchant archive (partial earlier run) | ~2.4 G | | `taler-hacktivism-live-20260709-snapshot.tar` | merchant archive (partial earlier run) | ~2.4 G |
| `SHA256SUMS` | checksums for completed saves | | | `SHA256SUMS` | checksums for completed saves | |
@ -24,8 +24,8 @@ Directory (hernani on koopa):
| Image | Tag | Notes | | Image | Tag | Notes |
|-------|-----|--------| |-------|-----|--------|
| `localhost/taler-exchange-hacktivism-live` | `20260709-snapshot` | committed from stopped container | | `localhost/taler-hacktivism-exchange-ansible-live` | `20260709-snapshot` | committed from stopped container |
| `localhost/taler-exchange-hacktivism-live` | `9011` | previous live tag (still present) | | `localhost/taler-hacktivism-exchange-ansible-live` | `9011` | previous live tag (still present) |
| `localhost/taler-hacktivism-live` | `20260709-snapshot` | merchant (if commit kept) | | `localhost/taler-hacktivism-live` | `20260709-snapshot` | merchant (if commit kept) |
| `localhost/taler-bank-hacktivism-live` | `20260709-snapshot` | bank (if commit kept) | | `localhost/taler-bank-hacktivism-live` | `20260709-snapshot` | bank (if commit kept) |
@ -36,13 +36,13 @@ Verify:
ls -lh /home/hernani/images/taler-stack-20260709-snapshot/ ls -lh /home/hernani/images/taler-stack-20260709-snapshot/
sha256sum -c /home/hernani/images/taler-stack-20260709-snapshot/SHA256SUMS sha256sum -c /home/hernani/images/taler-stack-20260709-snapshot/SHA256SUMS
podman images | grep exchange podman images | grep exchange
podman ps -a --filter name=taler-exchange-hacktivism podman ps -a --filter name=taler-hacktivism-exchange-ansible
``` ```
Expected container state after stop: Expected container state after stop:
```text ```text
taler-exchange-hacktivism Exited (…) localhost/taler-exchange-hacktivism-live:9011 0.0.0.0:9011->9011/tcp taler-hacktivism-exchange-ansible Exited (…) localhost/taler-hacktivism-exchange-ansible-live:9011 0.0.0.0:9011->9011/tcp
``` ```
--- ---
@ -51,19 +51,19 @@ taler-exchange-hacktivism Exited (…) localhost/taler-exchange-hacktivism-liv
```bash ```bash
# as hernani@koopa — local only # as hernani@koopa — local only
podman stop taler-exchange-hacktivism podman stop taler-hacktivism-exchange-ansible
TAG=20260709-snapshot TAG=20260709-snapshot
OUT=/home/hernani/images/taler-stack-$TAG OUT=/home/hernani/images/taler-stack-$TAG
mkdir -p "$OUT" mkdir -p "$OUT"
podman commit taler-exchange-hacktivism \ podman commit taler-hacktivism-exchange-ansible \
localhost/taler-exchange-hacktivism-live:$TAG localhost/taler-hacktivism-exchange-ansible-live:$TAG
podman save -o "$OUT/taler-exchange-hacktivism-live-$TAG.tar" \ podman save -o "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" \
localhost/taler-exchange-hacktivism-live:$TAG localhost/taler-hacktivism-exchange-ansible-live:$TAG
sha256sum "$OUT/taler-exchange-hacktivism-live-$TAG.tar" | tee -a "$OUT/SHA256SUMS" sha256sum "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" | tee -a "$OUT/SHA256SUMS"
``` ```
`-p` on commit pauses the container if still running; after `stop` it is optional. `-p` on commit pauses the container if still running; after `stop` it is optional.
@ -75,9 +75,9 @@ sha256sum "$OUT/taler-exchange-hacktivism-live-$TAG.tar" | tee -a "$OUT/SHA256SU
### A. From local image tag (fast) ### A. From local image tag (fast)
```bash ```bash
podman rm -f taler-exchange-hacktivism # only if replacing dead/exited podman rm -f taler-hacktivism-exchange-ansible # only if replacing dead/exited
podman run -d --name taler-exchange-hacktivism \ podman run -d --name taler-hacktivism-exchange-ansible \
--network pasta \ --network pasta \
-p 9011:9011 \ -p 9011:9011 \
--label org.hacktivism.service=taler-exchange \ --label org.hacktivism.service=taler-exchange \
@ -85,14 +85,14 @@ podman run -d --name taler-exchange-hacktivism \
--label org.hacktivism.site=exchange.hacktivism.ch \ --label org.hacktivism.site=exchange.hacktivism.ch \
--label org.hacktivism.currency=GOA \ --label org.hacktivism.currency=GOA \
--label org.hacktivism.managed_by=koopa-admin \ --label org.hacktivism.managed_by=koopa-admin \
localhost/taler-exchange-hacktivism-live:20260709-snapshot \ localhost/taler-hacktivism-exchange-ansible-live:20260709-snapshot \
sleep infinity sleep infinity
``` ```
### B. From tar (if image store was wiped) ### B. From tar (if image store was wiped)
```bash ```bash
podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-exchange-hacktivism-live-20260709-snapshot.tar podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar
# then same podman run as above # then same podman run as above
``` ```
@ -101,7 +101,7 @@ podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-exchange
Inside container as **root**, then app user: Inside container as **root**, then app user:
```bash ```bash
podman exec -u root -it taler-exchange-hacktivism bash podman exec -u root -it taler-hacktivism-exchange-ansible bash
# 1) base: postgres, runtime dirs, secmods, wire helpers # 1) base: postgres, runtime dirs, secmods, wire helpers
/root/start_base_services_for_taler_exchange.sh --no-shell /root/start_base_services_for_taler_exchange.sh --no-shell
# 2) httpd # 2) httpd
@ -149,8 +149,8 @@ scp configs/taler-exchange/exchange-overrides.conf \
hernani@koopa:/tmp/exchange-overrides.conf hernani@koopa:/tmp/exchange-overrides.conf
scp configs/taler-exchange/conf.d-exchange-coins.conf \ scp configs/taler-exchange/conf.d-exchange-coins.conf \
hernani@koopa:/tmp/exchange-coins.conf hernani@koopa:/tmp/exchange-coins.conf
ssh hernani@koopa 'podman cp /tmp/exchange-overrides.conf taler-exchange-hacktivism:/etc/taler-exchange/exchange-overrides.conf ssh hernani@koopa 'podman cp /tmp/exchange-overrides.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/exchange-overrides.conf
podman cp /tmp/exchange-coins.conf taler-exchange-hacktivism:/etc/taler-exchange/conf.d/exchange-coins.conf' podman cp /tmp/exchange-coins.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/conf.d/exchange-coins.conf'
``` ```
Greenfield (empty Debian + packages) only: Greenfield (empty Debian + packages) only:

2
2026/2026-07-09--merchant-bank-link.md
View file

@ -5,4 +5,4 @@
3. Created bank user `goa-demo-cp4zqk`, credited **GOA:5000**. 3. Created bank user `goa-demo-cp4zqk`, credited **GOA:5000**.
4. Linked payto to merchant: `POST .../private/accounts` → active wire account. 4. Linked payto to merchant: `POST .../private/accounts` → active wire account.
See `configs/taler-merchant/demo-instance-goa-demo-cp4zqk.md`. See `configs/taler-hacktivism/demo-instance-goa-demo-cp4zqk.md`.

1
2026/2026-07-10.md
View file

@ -16,3 +16,4 @@
- Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified) - Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified)
- Bonfire: republish foss outbox → Local users + public internet feeds; guest `/feed/local` shows posts - Bonfire: republish foss outbox → Local users + public internet feeds; guest `/feed/local` shows posts
- Reflect live koopa state in admin-log: `host/overview/LIVE.md`, exchange name **taler-hacktivism-exchange-ansible**, ansible mirror - Reflect live koopa state in admin-log: `host/overview/LIVE.md`, exchange name **taler-hacktivism-exchange-ansible**, ansible mirror
- configs/: rename mirrors to live container names (`taler-hacktivism`, `taler-hacktivism-bank`; image banking)

9
README.md
View file

@ -23,9 +23,10 @@ host/ # openSUSE host-level config + overview
overview/services.md # graphical service map overview/services.md # graphical service map
systemd/ firewalld/ caddy/ network/ systemd/ firewalld/ caddy/ network/
configs/ # mirrored app configs (caddy, taler, forgejo, …) configs/ # mirrored app configs (caddy, taler, forgejo, …)
taler-merchant/ # overrides + nginx (same tree style as exchange) taler-hacktivism/ # merchant container taler-hacktivism
taler-exchange/ # overrides + coins taler-hacktivism-bank/ # bank container (image …-banking)
taler-exchange-ansible/ # live koopa exchange container (ansible) taler-exchange/ # exchange conf (inside ansible container)
taler-exchange-ansible/ # container taler-hacktivism-exchange-ansible
forgejo/ # rootless git.hacktivism.ch forgejo/ # rootless git.hacktivism.ch
castopod/ bonfire/ prime/ # compose mirrors (no secret values) castopod/ bonfire/ prime/ # compose mirrors (no secret values)
tor/ # KoopaRelay ORPort 8080 tor/ # KoopaRelay ORPort 8080
@ -57,7 +58,7 @@ Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.
Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`**
(Caddy → 9010–9015 / 9020–**9024**; git-SSH host **9200** direct). (Caddy → 9010–9015 / 9020–**9024**; git-SSH host **9200** direct).
Service **details**: `configs/taler-*`, `configs/forgejo/`, `scripts/*`. Service **details**: `configs/taler-hacktivism*`, `configs/taler-exchange*`, `configs/forgejo/`, `scripts/*`.
Host-wide picture: **`host/overview/services.md`**. Host-wide picture: **`host/overview/services.md`**.
Port table: **`configs/ports.md`**. Port table: **`configs/ports.md`**.
Router: **`../vecigate-admin-log`**. Router: **`../vecigate-admin-log`**.

2
benchmarks/amount-ladder/README.md
View file

@ -87,4 +87,4 @@ Outputs under `../../.tmp/amount-bench-<UTC>/`:
## Related ## Related
- Partial earlier run (wrong URI): `2026/2026-07-09--amount-ladder-partial-results.md` - Partial earlier run (wrong URI): `2026/2026-07-09--amount-ladder-partial-results.md`
- Instance notes: `configs/taler-merchant/demo-instance-goa-demo-cp4zqk.md` - Instance notes: `configs/taler-hacktivism/demo-instance-goa-demo-cp4zqk.md`

4
benchmarks/amount-ladder/sample-load-inside.sh
View file

@ -11,8 +11,8 @@ echo "=== mem ==="
free -h 2>/dev/null || true free -h 2>/dev/null || true
echo "=== top host cpu ===" echo "=== top host cpu ==="
ps -eo pid,pcpu,pmem,rss,etime,comm --sort=-pcpu 2>/dev/null | head -15 ps -eo pid,pcpu,pmem,rss,etime,comm --sort=-pcpu 2>/dev/null | head -15
echo "=== exchange (taler-exchange-hacktivism) ===" echo "=== exchange (taler-hacktivism-exchange-ansible) ==="
podman exec taler-exchange-hacktivism \ podman exec taler-hacktivism-exchange-ansible \
ps -eo pid,pcpu,pmem,rss,etime,args 2>/dev/null \ ps -eo pid,pcpu,pmem,rss,etime,args 2>/dev/null \
| grep -E 'taler-exchange|postgres -D|PID' | head -25 || true | grep -E 'taler-exchange|postgres -D|PID' | head -25 || true
echo "=== merchant (taler-hacktivism) ===" echo "=== merchant (taler-hacktivism) ==="

31
configs/README.md
View file

@ -1,20 +1,17 @@
# Configs # Config mirrors (from host koopa)
| Path | Source on koopa | Directories are named to match **live podman container names** where possible.
|------|-----------------|
| `caddy/` | host `/etc/caddy` |
| `tor/` | host `/etc/tor` |
| `taler-exchange/` | container `taler-exchange-hacktivism`: overrides + coins |
| `taler-merchant/` | container `taler-hacktivism`: overrides + conf.d + nginx vhost |
| `taler-bank/` | container `taler-bank-hacktivism`: bank-overrides (libeufin) |
| `systemd/` | host proxy sockets / caddy drop-in |
| `firewalld/`, `ports.md` | host edge ports |
Package defaults are not mirrored; **site overrides** and relevant drop-ins only. | Directory | Live container | Image (typical) |
|-----------|----------------|-----------------|
| `taler-hacktivism/` | `taler-hacktivism` | `taler-hacktivism-live:landing` |
| `taler-hacktivism-bank/` | `taler-hacktivism-bank` | **`taler-hacktivism-banking:live`** |
| `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
| `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
| `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, … | compose mirrors |
| `caddy/` `tor/` `firewalld/` `systemd/` | host services | |
``` **Authoritative running inventory:** `host/overview/LIVE.md`.
configs/taler-{exchange,merchant,bank}/
README.md Secrets never live here — `SECRETS.md` / `koopa-admin-secrets`.
*-overrides.conf
…
```

10
configs/taler-exchange/README.md
View file

@ -1,6 +1,12 @@
# Exchange (GOA) site notes # Exchange config (inside ansible container)
Container: **`taler-exchange-hacktivism`** · image tags `localhost/taler-exchange-hacktivism-live:9011` (live) and optional snapshot **Live container:** `taler-hacktivism-exchange-ansible`
**Image:** `localhost/taler-hacktivism-exchange-ansible:landing`
**Deploy tree on host:** `~/ansible-taler-exchange/` → see **`configs/taler-exchange-ansible/`**
This directory mirrors **exchange software config** (overrides, coins, terms), not the Ansible wrapper itself.
Container: **`taler-hacktivism-exchange-ansible`** · image tags `localhost/taler-hacktivism-exchange-ansible-live:9011` (live) and optional snapshot
Host port: **9011** (pasta) · public: **https://exchange.hacktivism.ch/** (Caddy → 9011) Host port: **9011** (pasta) · public: **https://exchange.hacktivism.ch/** (Caddy → 9011)
**Snapshot + restore (local tar, no registry):** **Snapshot + restore (local tar, no registry):**

18
configs/taler-bank/README.md → configs/taler-hacktivism-bank/README.md
View file

@ -1,4 +1,18 @@
# taler-bank (container `taler-bank-hacktivism`) # Bank — live container `taler-hacktivism-bank`
**Reflected from host koopa.**
| Item | Live |
|------|------|
| Container | **`taler-hacktivism-bank`** |
| Image | **`localhost/taler-hacktivism-banking:live`** |
| Ports | **9012** (API), **9013** (landing) |
| Site | `https://bank.hacktivism.ch` |
Config path in this repo: **`configs/taler-hacktivism-bank/`** (was `configs/taler-bank/`).
Scripts: `scripts/taler-bank/`. Secrets: `koopa-admin-secrets/.../taler-bank/` → `/root/bank-*-password.txt`.
---
Image: `docker.io/library/debian:trixie` + package `libeufin-bank` Image: `docker.io/library/debian:trixie` + package `libeufin-bank`
Publish: **9012/tcp only** Publish: **9012/tcp only**
@ -81,4 +95,4 @@ nohup /root/auto-confirm-withdrawals.sh --loop 4 >>/var/log/auto-confirm-withdra
``` ```
Script: `scripts/taler-bank/auto-confirm-withdrawals.sh` Script: `scripts/taler-bank/auto-confirm-withdrawals.sh`
Watches IDs in `/var/www/bank-landing/withdraw.uri` and `withdraw-watch.ids`. Watches IDs in `/var/www/bank-landing/withdraw.uri` and `withdraw-watch.ids`.

0
configs/taler-bank/bank-overrides.conf → configs/taler-hacktivism-bank/bank-overrides.conf
View file

0
configs/taler-bank/libeufin-bank.conf.includes.txt → configs/taler-hacktivism-bank/libeufin-bank.conf.includes.txt
View file

2
configs/taler-merchant/README.md → configs/taler-hacktivism/README.md
View file

@ -1,6 +1,6 @@
# taler-merchant (container `taler-hacktivism`) # taler-merchant (container `taler-hacktivism`)
Image: `localhost/taler-hacktivism-live:9010` Image: `localhost/taler-hacktivism-live:landing`
Publish: **9010/tcp only** Publish: **9010/tcp only**
Labels: `org.hacktivism.service=taler-merchant`, `host_port=9010`, `site=taler.hacktivism.ch` Labels: `org.hacktivism.service=taler-merchant`, `host_port=9010`, `site=taler.hacktivism.ch`

0
configs/taler-merchant/conf.d-merchant.conf → configs/taler-hacktivism/conf.d-merchant.conf
View file

0
configs/taler-merchant/demo-instance-goa-demo-cp4zqk.md → configs/taler-hacktivism/demo-instance-goa-demo-cp4zqk.md
View file

0
configs/taler-merchant/merchant-overrides.conf → configs/taler-hacktivism/merchant-overrides.conf
View file

0
configs/taler-merchant/nginx-taler-merchant.conf → configs/taler-hacktivism/nginx-taler-merchant.conf
View file

0
configs/taler-merchant/taler-merchant.conf.includes.txt → configs/taler-hacktivism/taler-merchant.conf.includes.txt
View file

0
configs/taler-merchant/terms-src/merchant-tos-dual-v0.en.rst → configs/taler-hacktivism/terms-src/merchant-tos-dual-v0.en.rst
View file

12
host/overview/LIVE.md
View file

@ -26,7 +26,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080'
|------|--------|--------------|-------------| |------|--------|--------------|-------------|
| `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` | | `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` |
| **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` | | **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` |
| `taler-hacktivism-bank` | `localhost/taler-hacktivism-banking:live` | **9012**, **9013** | `bank.hacktivism.ch` | | `taler-hacktivism-bank` | **`localhost/taler-hacktivism-banking:live`** | **9012**, **9013** | `bank.hacktivism.ch` |
| `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` | | `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` |
| `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` | | `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` |
| `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` | | `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` |
@ -35,7 +35,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080'
### Naming note (exchange) ### Naming note (exchange)
Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-exchange-hacktivism` / not without `-ansible`). Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-hacktivism-exchange-ansible` / not without `-ansible`).
Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`). Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`).
## Caddy vhosts → backends ## Caddy vhosts → backends
@ -72,6 +72,14 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). Apply: `~/koo
| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` | | Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` |
| User apps | `cd ~/koopa-* && podman-compose up -d` | | User apps | `cd ~/koopa-* && podman-compose up -d` |
## Config mirrors in this repo (`configs/`)
| Live container | Git path |
|----------------|----------|
| `taler-hacktivism` | `configs/taler-hacktivism/` |
| `taler-hacktivism-bank` (image **…-banking**) | `configs/taler-hacktivism-bank/` |
| `taler-hacktivism-exchange-ansible` | `configs/taler-exchange-ansible/` + conf in `configs/taler-exchange/` |
## Related docs in this repo ## Related docs in this repo
| Topic | Doc | | Topic | Doc |

2
host/overview/services.md
View file

@ -90,7 +90,7 @@ Full port notes: `configs/ports.md`.
| Caddy | `host/caddy/`, `configs/caddy/` | | Caddy | `host/caddy/`, `configs/caddy/` |
| firewalld | `host/firewalld/` | | firewalld | `host/firewalld/` |
| systemd proxies | `host/systemd/` | | systemd proxies | `host/systemd/` |
| Merchant container | `configs/taler-merchant/`, `scripts/taler-merchant/` | | Merchant container | `configs/taler-hacktivism/`, `scripts/taler-merchant/` |
| Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` | | Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
| **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` | | **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` |
| Tor relay (`tor.service`) | `configs/tor/`, `host/tor/` | | Tor relay (`tor.service`) | `configs/tor/`, `host/tor/` |

8
scripts/README.md
View file

@ -3,8 +3,8 @@
| Dir | Source on koopa | | Dir | Source on koopa |
|-----|-----------------| |-----|-----------------|
| `taler-merchant/` | podman `taler-hacktivism`: `/root`, `/usr/local/bin` | | `taler-merchant/` | podman `taler-hacktivism`: `/root`, `/usr/local/bin` |
| `taler-exchange/` | podman `taler-exchange-hacktivism`: `/root`, `/usr/local/bin` | | `taler-exchange/` | podman `taler-hacktivism-exchange-ansible`: `/root`, `/usr/local/bin` |
| `taler-bank/` | podman `taler-bank-hacktivism`: `/root`, `/usr/local/bin` | | `taler-hacktivism-bank/` | podman `taler-hacktivism-bank`: `/root`, `/usr/local/bin` |
| `taler-sanity/` | host root checks (stack, settlement, helpers) | | `taler-sanity/` | host root checks (stack, settlement, helpers) |
| `taler-monitoring/` | **outside-in** public URL walk (`/config` → keys/terms/integration/webui) | | `taler-monitoring/` | **outside-in** public URL walk (`/config` → keys/terms/integration/webui) |
| `ops/` | host hygiene (`cleanup-root-scratch.sh`) | | `ops/` | host hygiene (`cleanup-root-scratch.sh`) |
@ -39,11 +39,11 @@ pg_ctlcluster 17 main start
| Container | Root base | App start | App user | | Container | Root base | App start | App user |
|-----------|-----------|-----------|----------| |-----------|-----------|-----------|----------|
| `taler-hacktivism` | `start_base_services_for_taler.sh` | `start_merchant.sh` | `taler-merchant-httpd` | | `taler-hacktivism` | `start_base_services_for_taler.sh` | `start_merchant.sh` | `taler-merchant-httpd` |
| `taler-exchange-hacktivism` | `start_base_services_for_taler_exchange.sh` | `start_exchange.sh` | `taler-exchange-httpd` | | `taler-hacktivism-exchange-ansible` | `start_base_services_for_taler_exchange.sh` | `start_exchange.sh` | `taler-exchange-httpd` |
Exchange one-shots (root, offline / wire): Exchange one-shots (root, offline / wire):
`taler-exchange/wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh` `taler-exchange/wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh`
| `taler-bank-hacktivism` | `start_base_services_for_taler_bank.sh` | `start_bank.sh` | `libeufin-bank` | | `taler-hacktivism-bank` | `start_base_services_for_taler_bank.sh` | `start_bank.sh` | `libeufin-bank` |
`runuser -u USER -- bash` (never `-u` with `-s` on util-linux). `runuser -u USER -- bash` (never `-u` with `-s` on util-linux).

4
scripts/taler-bank/README.md
View file

@ -1,6 +1,6 @@
# taler-bank scripts # taler-bank scripts
Container: **`taler-bank-hacktivism`** (libeufin-bank, GOA, **no IBAN**). Container: **`taler-hacktivism-bank`** (libeufin-bank, GOA, **no IBAN**).
| File | Container path | User | | File | Container path | User |
|------|----------------|------| |------|----------------|------|
@ -32,4 +32,4 @@ Details + JSON schema: `configs/bank-landing/README.md`.
## Config ## Config
See `configs/taler-bank/`. See `configs/taler-hacktivism-bank/`.

2
scripts/taler-exchange/offline-sign-upload-keys.sh
View file

@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
# Offline: download future keys from local exchange, sign, upload. Restore public BASE_URL. # Offline: download future keys from local exchange, sign, upload. Restore public BASE_URL.
# Run as root inside taler-exchange-hacktivism. # Run as root inside taler-hacktivism-exchange-ansible.
set -euo pipefail set -euo pipefail
CONF=/etc/taler-exchange/taler-exchange.conf CONF=/etc/taler-exchange/taler-exchange.conf
OV=/etc/taler-exchange/exchange-overrides.conf OV=/etc/taler-exchange/exchange-overrides.conf

2
scripts/taler-exchange/wire-enable-and-upload.sh
View file

@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
# One-shot: offline enable wire account + fees, upload to local exchange, verify /keys. # One-shot: offline enable wire account + fees, upload to local exchange, verify /keys.
# Run as root inside container taler-exchange-hacktivism. # Run as root inside container taler-hacktivism-exchange-ansible.
set -euo pipefail set -euo pipefail
CONF=/etc/taler-exchange/taler-exchange.conf CONF=/etc/taler-exchange/taler-exchange.conf

2
scripts/taler-merchant/install_dual_terms.sh
View file

@ -3,7 +3,7 @@
# Run as root inside the merchant container (taler-hacktivism). # Run as root inside the merchant container (taler-hacktivism).
# #
# Sets files under TERMS_DIR/en/ for TERMS_ETAG = merchant-tos-dual-v0 # Sets files under TERMS_DIR/en/ for TERMS_ETAG = merchant-tos-dual-v0
# (see configs/taler-merchant/merchant-overrides.conf). # (see configs/taler-hacktivism/merchant-overrides.conf).
set -euo pipefail set -euo pipefail
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin${PATH:+:$PATH}" export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin${PATH:+:$PATH}"

8
scripts/taler-sanity/check_exchange-wirewatch.sh
View file

@ -53,8 +53,8 @@ else
fi fi
# Container credential + wirewatch process # Container credential + wirewatch process
if su - hernani -c 'podman exec taler-exchange-hacktivism true' 2>/dev/null; then if su - hernani -c 'podman exec taler-hacktivism-exchange-ansible true' 2>/dev/null; then
su - hernani -c 'podman exec taler-exchange-hacktivism bash -c " su - hernani -c 'podman exec taler-hacktivism-exchange-ansible bash -c "
set +e set +e
echo \"--- secret (redacted) ---\" echo \"--- secret (redacted) ---\"
if [ -r /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf ]; then if [ -r /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf ]; then
@ -70,9 +70,9 @@ if su - hernani -c 'podman exec taler-exchange-hacktivism true' 2>/dev/null; the
ps -eo pid,stat,args | grep \"[w]irewatch\" || echo \"(no wirewatch process)\" ps -eo pid,stat,args | grep \"[w]irewatch\" || echo \"(no wirewatch process)\"
"' 2>&1 || warn "podman exec exchange failed" "' 2>&1 || warn "podman exec exchange failed"
AUTH_METHOD=$(su - hernani -c 'podman exec -u root taler-exchange-hacktivism \ AUTH_METHOD=$(su - hernani -c 'podman exec -u root taler-hacktivism-exchange-ansible \
grep -E "^WIRE_GATEWAY_AUTH_METHOD" /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf' 2>/dev/null | awk '{print $3}') grep -E "^WIRE_GATEWAY_AUTH_METHOD" /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf' 2>/dev/null | awk '{print $3}')
GW_URL=$(su - hernani -c 'podman exec -u root taler-exchange-hacktivism \ GW_URL=$(su - hernani -c 'podman exec -u root taler-hacktivism-exchange-ansible \
grep -E "^WIRE_GATEWAY_URL" /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf' 2>/dev/null | awk '{print $3}') grep -E "^WIRE_GATEWAY_URL" /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf' 2>/dev/null | awk '{print $3}')
info "WIRE_GATEWAY_URL=$GW_URL" info "WIRE_GATEWAY_URL=$GW_URL"
info "WIRE_GATEWAY_AUTH_METHOD=$AUTH_METHOD" info "WIRE_GATEWAY_AUTH_METHOD=$AUTH_METHOD"

2
scripts/taler-sanity/check_helpers-running.sh
View file

@ -12,7 +12,7 @@ pass() { echo "OK $1"; }
warn() { echo "WARN $1"; } warn() { echo "WARN $1"; }
bad() { echo "FAIL $1"; fail=$((fail + 1)); } bad() { echo "FAIL $1"; fail=$((fail + 1)); }
EXC_CT="${EXCHANGE_CONTAINER:-taler-exchange-hacktivism}" EXC_CT="${EXCHANGE_CONTAINER:-taler-hacktivism-exchange-ansible}"
MER_CT="${MERCHANT_CONTAINER:-taler-hacktivism}" MER_CT="${MERCHANT_CONTAINER:-taler-hacktivism}"
echo "=== ensure + check helpers (no systemd) ===" echo "=== ensure + check helpers (no systemd) ==="