hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: paivana and caddy config refresh

Browse source
This commit is contained in:
Hernâni Marques 2026-09-09 00:52:54 +02:00
parent d8dbc6242b
commit 56f814a6de
No known key found for this signature in database
74 changed files with 4517 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

41
configs/paivana/README.md
View file

@ -2,27 +2,32 @@
GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.
One process = one `BASE_URL` + one `DESTINATION_BASE_URL` + one `MERCHANT_BACKEND_URL`.
Shared **image / secrets / entrypoint / conf template**; per-service env sets
`PAIVANA_BASE_URL` + `PAIVANA_DESTINATION_BASE_URL`. Portal on **9025**; app
paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only
(`19128` SilverBullet, `19129` Galene HTTP, `19130` CryptPad edge, `19131` Meet).
| Item | Value |
|------|--------|
| Live | `/home/hernani/koopa-paivana/` |
| Containers | `koopa-paivana`, `koopa-paivana-upstream` |
| Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` |
| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
| Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
| Host port | **9025** → Caddy `paivana.hacktivism.ch` |
| Currency | **GOA** |
| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via host `172.17.0.1:19128–19131` |
| Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy |
| Currency | **GOA** (goa-shop); other units need other merchant backends / later instances |
| Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
| Access | **`-g`** site-wide: pay once → example upstream free to browse |
| Upstream | example site in `upstream/` (compose service) |
| Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) |
| Access | **`-g`** site-wide: pay once → that hostname free to browse |
## Layout
| Path | Role |
|------|------|
| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
| `compose.yml` | `koopa-paivana` + nginx upstream |
| `conf/paivana.conf.template` | Config; secrets substituted at start |
| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
| `compose.yml` | portal + 4 app paywalls + nginx upstream (YAML anchor `x-paivana-common`) |
| `conf/paivana.conf.template` | Shared conf; `@BASE_URL@` / `@DESTINATION_BASE_URL@` / secrets at start |
| `entrypoint.sh` | Env + secrets → run `paivana-httpd -g -f` |
| `secrets/` | **not in git** — live only |
| `upstream/` | Protected demo content |
| `container-koopa-paivana.service` | systemd --user oneshot compose up |
@ -90,9 +95,10 @@ extra_hosts:
| Check | Expect |
|-------|--------|
| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` |
| `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` |
| `curl -si http://127.0.0.1:902{8,9,0}/` | **302** same template path (per-host BASE_URL) |
| `https://{paivana,silverbullet,galene,cryptpad,meet}.hacktivism.ch/` | unpaid → **302** `…/templates/paivana#…` (or paywall HTML) |
| monitoring `urls` | `www.paivana` OK |
| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:4200** (wenn `E2E_PAIVANA=1`) |
| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:42** (wenn `E2E_PAIVANA=1`) |
---
@ -137,22 +143,27 @@ Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).
## Merchant template
Create (or replace via PATCH / DELETE+POST — see live merchant API):
```bash
curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
-H "Authorization: Bearer secret-token:…" \
-H 'Content-Type: application/json' \
-d '{
"template_id": "paivana",
"template_description": "Paivana paywall (GOA)",
"template_description": "Paivana paywall portal (GOA)",
"template_contract": {
"template_type": "paivana",
"summary": "Access to paivana.hacktivism.ch",
"summary": "Access to paivana.hacktivism.ch portal",
"website_regex": ".*",
"choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
"choices": [{ "amount": "GOA:42", "description": "Unlock portal (cryptpad / galene / silverbullet links)" }]
}
}'
```
goa-shop is GOA-only. TESTPAYSAN / FLOODS / talersticker CHF / stage-CHF need
other `MERCHANT_BACKEND_URL` values (separate Paivana process or later phase).
## Docs
- https://docs.taler.net/taler-paivana-manual.html