diff --git a/2026/2026-07-13--paivana-goa.md b/2026/2026-07-13--paivana-goa.md new file mode 100644 index 0000000..9606641 --- /dev/null +++ b/2026/2026-07-13--paivana-goa.md @@ -0,0 +1,20 @@ +# 2026-07-13 — Paivana (GOA paywall) on koopa + +## Done + +- Podman stack **`koopa-paivana`** + **`koopa-paivana-upstream`** at `~/koopa-paivana/` +- Host port **9025** +- Image `localhost/koopa-paivana:latest` (built from `git.taler.net/paivana` + deb.taler.net libs; package not on apt yet) +- Merchant: instance **`goa-shop`**, template **`paivana`** (`template_type: paivana`, **GOA:4200**) +- After payment: site-wide cookie (`-g`) → example upstream free to browse +- `extra_hosts: taler.hacktivism.ch:host-gateway` so pasta can reach merchant +- Flags: `-g` (site-wide), `-f` (X-Forwarded-For) +- Smoke: `curl -si http://127.0.0.1:9025/` → **302** to `/.well-known/paivana/templates/paivana#…` +- Config mirror: `configs/paivana/` +- Caddy: `paivana.hacktivism.ch` → `:9025` (`configs/caddy/Caddyfile`) +- User unit: `container-koopa-paivana.service` enabled + +## Refs + +- https://docs.taler.net/taler-paivana-manual.html +- https://docs.taler.net/design-documents/095-captcha-100.html diff --git a/configs/paivana/README.md b/configs/paivana/README.md index 4bc39cd..097c833 100644 --- a/configs/paivana/README.md +++ b/configs/paivana/README.md @@ -1,13 +1,98 @@ # paivana — `paivana.hacktivism.ch` -GNU Taler **paivana-httpd** reverse-proxy paywall, GOA payments. +GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments. | Item | Value | |------|--------| | Live | `/home/hernani/koopa-paivana/` | | Containers | `koopa-paivana`, `koopa-paivana-upstream` | -| Host port | **9025** | +| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`) | +| Host port | **9025** → Caddy `paivana.hacktivism.ch` | | Currency | **GOA** | | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` | +| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) | +| Access | **`-g`** site-wide: pay once → example upstream free to browse | +| Upstream | example site in `upstream/` (compose service) | -Build: `Containerfile` from `git.taler.net/paivana` + deb.taler.net libs. +## Layout + +| Path | Role | +|------|------| +| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs | +| `compose.yml` | `koopa-paivana` + nginx upstream | +| `conf/paivana.conf.template` | Config; secrets substituted at start | +| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` | +| `secrets/` | **not in git** — live only | +| `upstream/` | Protected demo content | +| `container-koopa-paivana.service` | systemd --user oneshot compose up | +| `taler-systems.gpg` | Deb signing key (build context) | + +## Secrets (live) + +| File | Role | +|------|------| +| `~/koopa-paivana/secrets/merchant-access-token` | `secret-token:…` for goa-shop | +| `~/koopa-paivana/secrets/paivana-secret` | cookie MAC secret (stable across restarts) | + +Mirror notes: `koopa-admin-secrets` → `koopa/home-hernani/koopa-paivana/secrets/` (paths only / examples). + +## Ops + +```bash +# as hernani on koopa +cd ~/koopa-paivana +podman compose build +podman compose up -d +podman logs -f koopa-paivana +curl -si http://127.0.0.1:9025/ | head # 302 → /.well-known/paivana/templates/paivana#… +``` + +Autostart: + +```bash +mkdir -p ~/.config/systemd/user +cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/ +systemctl --user daemon-reload +systemctl --user enable --now container-koopa-paivana.service +``` + +## Network notes + +Rootless pasta cannot hairpin public DNS for the merchant. Compose sets: + +```yaml +extra_hosts: + - "taler.hacktivism.ch:host-gateway" +``` + +so `paivana-httpd` can load templates from the merchant API. + +## Caddy + +Vhost → `127.0.0.1:9025` (see `configs/caddy/Caddyfile`). +Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For). + +## Merchant template + +```bash +curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \ + -H "Authorization: Bearer secret-token:…" \ + -H 'Content-Type: application/json' \ + -d '{ + "template_id": "paivana", + "template_description": "Paivana paywall (GOA)", + "template_contract": { + "template_type": "paivana", + "summary": "Access to paivana.hacktivism.ch", + "website_regex": ".*", + "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }] + } + }' +``` + +## Docs + +- https://docs.taler.net/taler-paivana-manual.html +- https://docs.taler.net/design-documents/095-captcha-100.html +- https://docs.taler.net/design-documents/076-paywall-proxy.html +- https://docs.taler.net/manpages/paivana.conf.5.html diff --git a/configs/paivana/upstream/index.html b/configs/paivana/upstream/index.html index c27ede4..064d3d7 100644 --- a/configs/paivana/upstream/index.html +++ b/configs/paivana/upstream/index.html @@ -1,8 +1,54 @@ -Protected — paivana.hacktivism.ch + + + + Example site — free after GOA:4200 + + -

Payment verified

-

Demo upstream behind Paivana (GOA). Site: https://paivana.hacktivism.ch/

+ unlocked +

Example site

+

+ You paid GOA:4200 once via GNU Taler / Paivana. + This whole example site is now free for you to browse (site-wide access cookie). +

+
+

What this demonstrates

+ +

Host: https://paivana.hacktivism.ch/

+