ops: taler-bank auto-confirm + systemd units + README

scripts/taler-bank/auto-confirm-withdrawals.sh

@@ -63,6 +63,11 @@ if [ "$LOOP" -eq 1 ]; then
   if command -v flock >/dev/null 2>&1; then
     if ! flock -n 9; then
       echo "auto-confirm already running (lock $LOCK_FILE) — exit"
+      # Under systemd Restart=always, exit 0 on lock contention flaps the unit
+      # (activating/auto-restart) while the holder is outside the cgroup.
+      if [ -n "${INVOCATION_ID:-}" ]; then
+        exit 75
+      fi
       exit 0
     fi
   fi
@@ -105,6 +110,37 @@ known_ids() {
   fi
 }
 
+# True if WD amount fits explorer debt headroom (or psql unavailable → allow).
+id_affordable() {
+  local wid="$1"
+  if ! command -v psql >/dev/null 2>&1 || ! id -u postgres >/dev/null 2>&1; then
+    return 0
+  fi
+  local ok
+  ok=$(su -s /bin/bash postgres -c "psql -d ${DB_NAME} -At -c \"
+WITH explorer AS (
+  SELECT a.bank_account_id, a.has_debt, a.balance, a.max_debt
+  FROM libeufin_bank.bank_accounts a
+  JOIN libeufin_bank.customers c ON c.customer_id = a.owning_customer_id
+  WHERE c.username = '${USER}'
+  LIMIT 1
+),
+headroom AS (
+  SELECT CASE WHEN has_debt THEN (max_debt).val - (balance).val
+              ELSE (max_debt).val + (balance).val END AS val
+  FROM explorer
+)
+SELECT 1
+FROM libeufin_bank.taler_withdrawal_operations w
+JOIN explorer e ON e.bank_account_id = w.wallet_bank_account
+CROSS JOIN headroom h
+WHERE w.withdrawal_uuid = '${wid}'::uuid
+  AND (w.amount).val <= h.val
+LIMIT 1;
+\"" 2>/dev/null | tr -d '[:space:]')
+  [ "$ok" = "1" ]
+}
+
 # Selected, not yet confirmed, owner = explorer only (runs inside goa CTR).
 db_selected_explorer_ids() {
   if ! command -v psql >/dev/null 2>&1; then
@@ -184,6 +220,11 @@ confirm_one() {
 
   case "$st" in
     selected)
+      # Watch-list IDs bypass DB headroom filter — skip oversized (HTTP 409 forever).
+      if ! id_affordable "$wid"; then
+        qlog "skip $wid selected but over explorer headroom"
+        return 0
+      fi
       log "confirming $wid as $USER (status=selected) ..."
       conf=$(curl -sS -m 15 -o /tmp/acw-conf.out -w '%{http_code}' \
         -X POST \