configs/paivana: charge GOA:4200 for example site

2026/2026-07-13--paivana-goa.md

@@ -0,0 +1,20 @@
+# 2026-07-13 — Paivana (GOA paywall) on koopa
+
+## Done
+
+- Podman stack **`koopa-paivana`** + **`koopa-paivana-upstream`** at `~/koopa-paivana/`
+- Host port **9025**
+- Image `localhost/koopa-paivana:latest` (built from `git.taler.net/paivana` + deb.taler.net libs; package not on apt yet)
+- Merchant: instance **`goa-shop`**, template **`paivana`** (`template_type: paivana`, **GOA:4200**)
+- After payment: site-wide cookie (`-g`) → example upstream free to browse
+- `extra_hosts: taler.hacktivism.ch:host-gateway` so pasta can reach merchant
+- Flags: `-g` (site-wide), `-f` (X-Forwarded-For)
+- Smoke: `curl -si http://127.0.0.1:9025/` → **302** to `/.well-known/paivana/templates/paivana#…`
+- Config mirror: `configs/paivana/`
+- Caddy: `paivana.hacktivism.ch` → `:9025` (`configs/caddy/Caddyfile`)
+- User unit: `container-koopa-paivana.service` enabled
+
+## Refs
+
+- https://docs.taler.net/taler-paivana-manual.html
+- https://docs.taler.net/design-documents/095-captcha-100.html

configs/paivana/README.md

@@ -1,13 +1,98 @@
 # paivana — `paivana.hacktivism.ch`
 
-GNU Taler **paivana-httpd** reverse-proxy paywall, GOA payments.
+GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.
 
 | Item | Value |
 |------|--------|
 | Live | `/home/hernani/koopa-paivana/` |
 | Containers | `koopa-paivana`, `koopa-paivana-upstream` |
-| Host port | **9025** |
+| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`) |
+| Host port | **9025** → Caddy `paivana.hacktivism.ch` |
 | Currency | **GOA** |
 | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
+| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
+| Access | **`-g`** site-wide: pay once → example upstream free to browse |
+| Upstream | example site in `upstream/` (compose service) |
 
-Build: `Containerfile` from `git.taler.net/paivana` + deb.taler.net libs.
+## Layout
+
+| Path | Role |
+|------|------|
+| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
+| `compose.yml` | `koopa-paivana` + nginx upstream |
+| `conf/paivana.conf.template` | Config; secrets substituted at start |
+| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
+| `secrets/` | **not in git** — live only |
+| `upstream/` | Protected demo content |
+| `container-koopa-paivana.service` | systemd --user oneshot compose up |
+| `taler-systems.gpg` | Deb signing key (build context) |
+
+## Secrets (live)
+
+| File | Role |
+|------|------|
+| `~/koopa-paivana/secrets/merchant-access-token` | `secret-token:…` for goa-shop |
+| `~/koopa-paivana/secrets/paivana-secret` | cookie MAC secret (stable across restarts) |
+
+Mirror notes: `koopa-admin-secrets` → `koopa/home-hernani/koopa-paivana/secrets/` (paths only / examples).
+
+## Ops
+
+```bash
+# as hernani on koopa
+cd ~/koopa-paivana
+podman compose build
+podman compose up -d
+podman logs -f koopa-paivana
+curl -si http://127.0.0.1:9025/ | head   # 302 → /.well-known/paivana/templates/paivana#…
+```
+
+Autostart:
+
+```bash
+mkdir -p ~/.config/systemd/user
+cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now container-koopa-paivana.service
+```
+
+## Network notes
+
+Rootless pasta cannot hairpin public DNS for the merchant. Compose sets:
+
+```yaml
+extra_hosts:
+  - "taler.hacktivism.ch:host-gateway"
+```
+
+so `paivana-httpd` can load templates from the merchant API.
+
+## Caddy
+
+Vhost → `127.0.0.1:9025` (see `configs/caddy/Caddyfile`).  
+Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).
+
+## Merchant template
+
+```bash
+curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
+  -H "Authorization: Bearer secret-token:…" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "template_id": "paivana",
+    "template_description": "Paivana paywall (GOA)",
+    "template_contract": {
+      "template_type": "paivana",
+      "summary": "Access to paivana.hacktivism.ch",
+      "website_regex": ".*",
+      "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
+    }
+  }'
+```
+
+## Docs
+
+- https://docs.taler.net/taler-paivana-manual.html
+- https://docs.taler.net/design-documents/095-captcha-100.html
+- https://docs.taler.net/design-documents/076-paywall-proxy.html
+- https://docs.taler.net/manpages/paivana.conf.5.html

configs/paivana/upstream/index.html

@@ -1,8 +1,54 @@
 <!DOCTYPE html>
 <html lang="en">
-<head><meta charset="utf-8"/><title>Protected — paivana.hacktivism.ch</title></head>
+<head>
+  <meta charset="utf-8"/>
+  <meta name="viewport" content="width=device-width, initial-scale=1"/>
+  <title>Example site — free after GOA:4200</title>
+  <style>
+    :root { color-scheme: light dark; }
+    body {
+      font-family: system-ui, sans-serif;
+      max-width: 42rem;
+      margin: 3rem auto;
+      padding: 0 1.25rem;
+      line-height: 1.55;
+    }
+    .badge {
+      display: inline-block;
+      font-size: 0.85rem;
+      font-weight: 600;
+      padding: 0.2rem 0.55rem;
+      border-radius: 999px;
+      background: #0a7;
+      color: #fff;
+    }
+    h1 { margin: 0.6rem 0 0.4rem; font-size: 1.75rem; }
+    .price { font-variant-numeric: tabular-nums; }
+    code { background: color-mix(in srgb, CanvasText 12%, transparent); padding: 0.1em 0.35em; border-radius: 3px; }
+    .card {
+      margin-top: 1.5rem;
+      padding: 1rem 1.1rem;
+      border: 1px solid color-mix(in srgb, CanvasText 18%, transparent);
+      border-radius: 10px;
+    }
+    ul { padding-left: 1.2rem; }
+  </style>
+</head>
 <body>
-  <h1>Payment verified</h1>
+  <span class="badge">unlocked</span>
-  <p>Demo upstream behind Paivana (GOA). Site: <code>https://paivana.hacktivism.ch/</code></p>
+  <h1>Example site</h1>
+  <p>
+    You paid <strong class="price">GOA:4200</strong> once via GNU Taler / Paivana.
+    This whole example site is now free for you to browse (site-wide access cookie).
+  </p>
+  <div class="card">
+    <p><strong>What this demonstrates</strong></p>
+    <ul>
+      <li>Paywall: <code>paivana-httpd</code> in front of a normal upstream HTTP site</li>
+      <li>Currency: exploration money <code>GOA</code> on exchange.hacktivism.ch</li>
+      <li>After payment: no further charge for pages behind this proxy</li>
+    </ul>
+    <p style="margin-bottom:0">Host: <code>https://paivana.hacktivism.ch/</code></p>
+  </div>
 </body>
 </html>