ops: paivana and caddy config refresh

configs/paivana/compose.yml

@@ -1,29 +1,45 @@
-# koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
+# koopa-paivana — shared image/secrets/entrypoint for portal + app paywalls
 # Live: /home/hernani/koopa-paivana/
+#
+# Public Caddy targets (unchanged):
+#   9025 → portal (paivana.hacktivism.ch)
+#   9028 → paywall silverbullet
+#   9029 → paywall galene
+#   9030 → paywall cryptpad
+#   9031 → paywall meet (Jitsi web)
+# App backends (loopback only; see app compose):
+#   127.0.0.1:19128 / 19129 / 19130 / 19131
+
+x-paivana-common: &paivana-common
+  image: localhost/koopa-paivana:latest
+  restart: unless-stopped
+  user: "1000:1000"
+  userns_mode: keep-id
+  extra_hosts:
+    - "taler.hacktivism.ch:172.17.0.1"
+    - "bank.hacktivism.ch:172.17.0.1"
+    - "exchange.hacktivism.ch:172.17.0.1"
+  volumes:
+    - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
+    - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
+    - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
+    - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
+  labels:
+    org.hacktivism.managed_by: koopa-admin
+    org.hacktivism.currency: GOA
+
 services:
   paivana:
+    <<: *paivana-common
     build:
       context: .
       dockerfile: Containerfile
-    image: localhost/koopa-paivana:latest
     container_name: koopa-paivana
-    restart: unless-stopped
-    # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
-    user: "1000:1000"
-    userns_mode: keep-id
     ports:
       - "9025:9967"
-    extra_hosts:
-      # pasta publishes merchant on host :9010. Prefer fixed IPv4 — host-gateway
-      # alone still loses to public AAAA and times out from the container.
-      - "taler.hacktivism.ch:172.17.0.1"
-      - "bank.hacktivism.ch:172.17.0.1"
-      - "exchange.hacktivism.ch:172.17.0.1"
-    volumes:
-      - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
-      - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
-      - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
-      - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
+    environment:
+      PAIVANA_BASE_URL: https://paivana.hacktivism.ch/
+      PAIVANA_DESTINATION_BASE_URL: http://upstream:8080/
     depends_on:
       - upstream
     labels:
@@ -33,8 +49,68 @@ services:
       org.hacktivism.managed_by: koopa-admin
       org.hacktivism.currency: GOA
 
+  # App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031.
+  paivana-silverbullet:
+    <<: *paivana-common
+    container_name: koopa-paivana-silverbullet
+    ports:
+      - "9028:9967"
+    environment:
+      PAIVANA_BASE_URL: https://silverbullet.hacktivism.ch/
+      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19128/
+    labels:
+      org.hacktivism.service: paivana-silverbullet
+      org.hacktivism.host_port: "9028"
+      org.hacktivism.site: silverbullet.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.currency: GOA
+
+  paivana-galene:
+    <<: *paivana-common
+    container_name: koopa-paivana-galene
+    ports:
+      - "9029:9967"
+    environment:
+      PAIVANA_BASE_URL: https://galene.hacktivism.ch/
+      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19129/
+    labels:
+      org.hacktivism.service: paivana-galene
+      org.hacktivism.host_port: "9029"
+      org.hacktivism.site: galene.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.currency: GOA
+
+  paivana-cryptpad:
+    <<: *paivana-common
+    container_name: koopa-paivana-cryptpad
+    ports:
+      - "9030:9967"
+    environment:
+      PAIVANA_BASE_URL: https://cryptpad.hacktivism.ch/
+      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19130/
+    labels:
+      org.hacktivism.service: paivana-cryptpad
+      org.hacktivism.host_port: "9030"
+      org.hacktivism.site: cryptpad.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.currency: GOA
+
+  paivana-meet:
+    <<: *paivana-common
+    container_name: koopa-paivana-meet
+    ports:
+      - "9031:9967"
+    environment:
+      PAIVANA_BASE_URL: https://meet.hacktivism.ch/
+      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19131/
+    labels:
+      org.hacktivism.service: paivana-meet
+      org.hacktivism.host_port: "9031"
+      org.hacktivism.site: meet.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.currency: GOA
+
   upstream:
-    # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
     image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
     container_name: koopa-paivana-upstream
     restart: unless-stopped