scripts/taler-landing: hernani user systemd timer for central stats

Install path for hernani@koopa: oneshot service plus 2-minute timer that
runs the bank full scan and refreshes exchange/merchant stats via podman.

configs/systemd/user/taler-landing-stats.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=Taler landing stats (bank full scan + exchange/merchant)
+Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-landing/README.md
+After=network-online.target
+Wants=network-online.target
+# Prefer after containers are up (ignore if unit names differ)
+After=container-taler-hacktivism-bank.service container-taler-hacktivism.service
+After=taler-bank-apps.service taler-merchant-apps.service
+
+[Service]
+Type=oneshot
+Nice=10
+TimeoutStartSec=480
+# Do not keep "active" after run — timer may fire again cleanly
+RemainAfterExit=no
+Environment=TZ=Europe/Zurich
+Environment=ADMIN_LOG=%h/src/koopa/koopa-admin-log
+Environment=SECRETS_BANK=%h/src/koopa/koopa-admin-secrets/koopa/host-root/taler-bank
+Environment=BANK_URL=http://127.0.0.1:9012
+Environment=BANK_PUBLIC_URL=https://bank.hacktivism.ch
+Environment=EXCHANGE_CONFIG_URL=https://exchange.hacktivism.ch/config
+# All accounts except exchange (double-count of withdraw credits on exchange ledger)
+Environment=SCAN_SKIP=exchange
+Environment=TX_PAGE=500
+Environment=MAX_TX_PAGES=0
+Environment=ACCOUNTS_DELTA=-10000
+ExecStart=%h/.local/bin/collect-landing-stats.sh
+
+[Install]
+WantedBy=default.target

configs/systemd/user/taler-landing-stats.timer

@@ -0,0 +1,13 @@
+[Unit]
+Description=Timer · Taler landing stats (every 2 min)
+Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-landing/README.md
+
+[Timer]
+OnBootSec=90s
+OnUnitActiveSec=2min
+AccuracySec=20s
+Persistent=true
+Unit=taler-landing-stats.service
+
+[Install]
+WantedBy=timers.target

scripts/README.md

@@ -9,6 +9,7 @@
 | `taler-shared/` | host **ensure-taler-apps** (post-container app start + auto-confirm) |
 | `taler-sanity/` | host root checks (stack, settlement, helpers) |
 | `taler-monitoring/` | **outside-in** public URL walk (`/config` → keys/terms/integration/webui) |
+| `taler-landing/` | **hernani user systemd**: central landing `stats.json` (full bank scan + alt units) |
 | `monitoring/` | host `/home/hernani/scripts` (tor relay stats) |
 | `nym/` | **koopa-nym** build/up/status (nym.com nym-node) |
 | `taler-wallet-cli/` | thin wrappers; **benchmarks live in** `../benchmarks/` |
@@ -24,6 +25,11 @@ starts, **`taler-merchant-apps.service`** / **`taler-bank-apps.service`** run
 `taler-shared/install-ensure-taler-apps.sh`). That runs the in-container
 `start_base` + `start_*.sh` (and bank auto-confirm **2 s**).
 
+Landing **stats.json** (bank / exchange / merchant intros) is refreshed by
+**`taler-landing-stats.timer`** as user **hernani** (install:
+`taler-landing/install-landing-stats-host.sh`). Full bank ledger scan + GOA
+alt-unit fields; see `taler-landing/README.md`.
+
 ## Manual start model (all three)
 
 1. **root** runs `/root/start_base_services_for_taler_*.sh`  

scripts/taler-landing/install-landing-stats-host.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Install central landing-stats collector as hernani user systemd timer.
+#
+# On koopa:
+#   cd ~/src/koopa/koopa-admin-log
+#   ./scripts/taler-landing/install-landing-stats-host.sh
+#   systemctl --user start taler-landing-stats.service   # one-shot now
+#   systemctl --user status taler-landing-stats.timer
+#
+# Requires: linger enabled for hernani (loginctl enable-linger hernani)
+# so the timer runs without an interactive login.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ADMIN_LOG="${ADMIN_LOG:-$ROOT}"
+SRC="$ADMIN_LOG/scripts/taler-landing"
+UNIT_SRC="$ADMIN_LOG/configs/systemd/user"
+
+BIN_DST="${HOME}/.local/bin"
+LIB_DST="${HOME}/.local/lib/taler-landing"
+UNIT_DST="${HOME}/.config/systemd/user"
+STATE_DST="${HOME}/.local/state/taler-landing-stats"
+
+mkdir -p "$BIN_DST" "$LIB_DST" "$UNIT_DST" "$STATE_DST"
+
+install -m 0755 "$SRC/collect-landing-stats.sh" "$BIN_DST/collect-landing-stats.sh"
+install -m 0755 "$SRC/collect_bank_stats.py" "$LIB_DST/collect_bank_stats.py"
+install -m 0755 "$SRC/enrich_stats_alt.py" "$LIB_DST/enrich_stats_alt.py"
+install -m 0644 "$SRC/goa_amounts.py" "$LIB_DST/goa_amounts.py"
+
+# Wrapper always uses installed lib next to itself when LIB discovery works;
+# also point ADMIN_LOG for in-container script refresh.
+install -m 0644 "$UNIT_SRC/taler-landing-stats.service" "$UNIT_DST/"
+install -m 0644 "$UNIT_SRC/taler-landing-stats.timer" "$UNIT_DST/"
+
+# Rewrite ExecStart to installed binary if unit uses %h path — units already do.
+systemctl --user daemon-reload
+systemctl --user enable --now taler-landing-stats.timer
+
+echo "Installed (user=$(id -un)):"
+echo "  $BIN_DST/collect-landing-stats.sh"
+echo "  $LIB_DST/{collect_bank_stats,enrich_stats_alt,goa_amounts}.py"
+echo "  $UNIT_DST/taler-landing-stats.{service,timer} (timer enabled)"
+echo "  logs: $STATE_DST/"
+echo
+if ! loginctl show-user "$(id -un)" -p Linger 2>/dev/null | grep -q 'Linger=yes'; then
+  echo "NOTE: enable linger so the timer survives logout:"
+  echo "  sudo loginctl enable-linger $(id -un)"
+  echo
+fi
+echo "Run once now:"
+echo "  systemctl --user start taler-landing-stats.service"
+echo "  journalctl --user -u taler-landing-stats.service -n 40 --no-pager"
+echo
+echo "Optional secrets (if not readable via podman exec bank /root/…):"
+echo "  mkdir -p ~/.config/taler-landing"
+echo "  cp …/bank-admin-password.txt ~/.config/taler-landing/"
+echo "  cp …/bank-explorer-password.txt ~/.config/taler-landing/"
+echo "  chmod 600 ~/.config/taler-landing/*"