diff --git a/configs/paivana/Containerfile b/configs/paivana/Containerfile
new file mode 100644
index 0000000..20ba0bb
--- /dev/null
+++ b/configs/paivana/Containerfile
@@ -0,0 +1,55 @@
+# Build paivana-httpd from source against Taler libs (deb.taler.net)
+FROM docker.io/library/debian:trixie AS build
+ENV DEBIAN_FRONTEND=noninteractive
+RUN mkdir -p /etc/apt/keyrings
+COPY taler-systems.gpg /etc/apt/keyrings/taler-systems.gpg
+RUN apt-get update -yqq \
+ && apt-get install -yqq --no-install-recommends \
+      ca-certificates curl gnupg git \
+      meson ninja-build pkg-config gcc g++ make \
+      zlib1g-dev libmicrohttpd-dev libcurl4-gnutls-dev \
+      libjansson-dev libgcrypt20-dev libpq-dev \
+      python3 python3-jinja2 \
+ && printf "%s\n" "deb [signed-by=/etc/apt/keyrings/taler-systems.gpg] https://deb.taler.net/apt/debian trixie main" \
+      > /etc/apt/sources.list.d/taler.list \
+ && apt-get update -yqq \
+ && apt-get install -yqq --no-install-recommends \
+      libgnunet-dev libtalerexchange-dev libtalermerchant-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+RUN git clone --depth 1 https://git.taler.net/paivana.git . \
+ && if [ -x ./bootstrap ]; then ./bootstrap; fi \
+ && if [ -x ./configure ]; then \
+      ./configure --prefix=/usr/local && make -j"$(nproc)" && make install; \
+    else \
+      meson setup build --prefix=/usr/local && meson compile -C build && meson install -C build; \
+    fi
+
+FROM docker.io/library/debian:trixie-slim
+ENV DEBIAN_FRONTEND=noninteractive
+RUN mkdir -p /etc/apt/keyrings
+COPY taler-systems.gpg /etc/apt/keyrings/taler-systems.gpg
+RUN apt-get update -yqq \
+ && apt-get install -yqq --no-install-recommends ca-certificates curl \
+ && printf "%s\n" "deb [signed-by=/etc/apt/keyrings/taler-systems.gpg] https://deb.taler.net/apt/debian trixie main" \
+      > /etc/apt/sources.list.d/taler.list \
+ && apt-get update -yqq \
+ && apt-get install -yqq --no-install-recommends \
+      libtalerexchange libtalermerchant libgnunet \
+      libmicrohttpd12t64 libcurl3t64-gnutls libjansson4 libgcrypt20 zlib1g libpq5 \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd --system --home /var/lib/paivana --shell /usr/sbin/nologin paivana-httpd \
+ && mkdir -p /etc/paivana /var/lib/paivana \
+ && chown -R paivana-httpd:paivana-httpd /var/lib/paivana /etc/paivana
+
+COPY --from=build /usr/local/ /usr/local/
+RUN ldconfig || true
+COPY entrypoint.sh /usr/local/bin/paivana-entrypoint
+COPY conf/paivana.conf.template /etc/paivana/paivana.conf.template
+RUN chmod 755 /usr/local/bin/paivana-entrypoint \
+ && chown paivana-httpd:paivana-httpd /etc/paivana/paivana.conf.template
+
+USER paivana-httpd
+EXPOSE 9967
+ENTRYPOINT ["/usr/local/bin/paivana-entrypoint"]
diff --git a/configs/paivana/README.md b/configs/paivana/README.md
new file mode 100644
index 0000000..4bc39cd
--- /dev/null
+++ b/configs/paivana/README.md
@@ -0,0 +1,13 @@
+# paivana — `paivana.hacktivism.ch`
+
+GNU Taler **paivana-httpd** reverse-proxy paywall, GOA payments.
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-paivana/` |
+| Containers | `koopa-paivana`, `koopa-paivana-upstream` |
+| Host port | **9025** |
+| Currency | **GOA** |
+| Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
+
+Build: `Containerfile` from `git.taler.net/paivana` + deb.taler.net libs.
diff --git a/configs/paivana/compose.yml b/configs/paivana/compose.yml
new file mode 100644
index 0000000..016d633
--- /dev/null
+++ b/configs/paivana/compose.yml
@@ -0,0 +1,42 @@
+# koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
+# Live: /home/hernani/koopa-paivana/
+services:
+  paivana:
+    build:
+      context: .
+      dockerfile: Containerfile
+    image: localhost/koopa-paivana:latest
+    container_name: koopa-paivana
+    restart: unless-stopped
+    ports:
+      - "9025:9967"
+    extra_hosts:
+      - "taler.hacktivism.ch:host-gateway"
+      - "bank.hacktivism.ch:host-gateway"
+      - "exchange.hacktivism.ch:host-gateway"
+    volumes:
+      - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
+      - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
+      - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
+      - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
+    depends_on:
+      - upstream
+    labels:
+      org.hacktivism.service: paivana
+      org.hacktivism.host_port: "9025"
+      org.hacktivism.site: paivana.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+      org.hacktivism.currency: GOA
+
+  upstream:
+    image: docker.io/library/nginx:1.27-alpine
+    container_name: koopa-paivana-upstream
+    restart: unless-stopped
+    volumes:
+      - ./upstream:/usr/share/nginx/html:ro
+    expose:
+      - "80"
+    command: ["nginx", "-g", "daemon off;"]
+    labels:
+      org.hacktivism.service: paivana-upstream
+      org.hacktivism.managed_by: koopa-admin
diff --git a/configs/paivana/conf/paivana.conf.template b/configs/paivana/conf/paivana.conf.template
new file mode 100644
index 0000000..abad54b
--- /dev/null
+++ b/configs/paivana/conf/paivana.conf.template
@@ -0,0 +1,18 @@
+# paivana.hacktivism.ch — paywall reverse proxy
+# Secrets injected by entrypoint from /run/secrets/
+
+[paivana]
+SERVE = tcp
+PORT = 9967
+BIND_TO = 0.0.0.0
+
+BASE_URL = https://paivana.hacktivism.ch/
+
+DESTINATION_BASE_URL = http://upstream:80/
+
+MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/
+MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@
+
+SECRET = @PAIVANA_SECRET@
+
+WHITELIST = ^/(favicon\.ico|robots\.txt)$
diff --git a/configs/paivana/entrypoint.sh b/configs/paivana/entrypoint.sh
new file mode 100755
index 0000000..e751b47
--- /dev/null
+++ b/configs/paivana/entrypoint.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -eu
+TOKEN_FILE="${MERCHANT_TOKEN_FILE:-/run/secrets/merchant-access-token}"
+SECRET_FILE="${PAIVANA_SECRET_FILE:-/run/secrets/paivana-secret}"
+TEMPLATE="${PAIVANA_CONF_TEMPLATE:-/etc/paivana/paivana.conf.template}"
+OUT="${PAIVANA_CONF:-/tmp/paivana.conf}"
+
+if [ ! -r "$TOKEN_FILE" ]; then
+  echo "missing merchant token: $TOKEN_FILE" >&2
+  exit 1
+fi
+if [ ! -r "$SECRET_FILE" ]; then
+  echo "missing paivana secret: $SECRET_FILE" >&2
+  exit 1
+fi
+
+TOKEN=$(tr -d '\n\r' < "$TOKEN_FILE")
+SECRET=$(tr -d '\n\r' < "$SECRET_FILE")
+
+awk -v t="$TOKEN" -v s="$SECRET" '
+{
+  gsub(/@MERCHANT_ACCESS_TOKEN@/, t)
+  gsub(/@PAIVANA_SECRET@/, s)
+  print
+}
+' "$TEMPLATE" > "$OUT"
+chmod 600 "$OUT"
+
+exec paivana-httpd -c "$OUT" -g -f -L INFO
diff --git a/configs/paivana/taler-systems.gpg b/configs/paivana/taler-systems.gpg
new file mode 100644
index 0000000..b53bff4
Binary files /dev/null and b/configs/paivana/taler-systems.gpg differ
diff --git a/configs/paivana/upstream/index.html b/configs/paivana/upstream/index.html
new file mode 100644
index 0000000..c27ede4
--- /dev/null
+++ b/configs/paivana/upstream/index.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"/><title>Protected — paivana.hacktivism.ch</title></head>
+<body>
+  <h1>Payment verified</h1>
+  <p>Demo upstream behind Paivana (GOA). Site: <code>https://paivana.hacktivism.ch/</code></p>
+</body>
+</html>
diff --git a/configs/paivana/upstream/robots.txt b/configs/paivana/upstream/robots.txt
new file mode 100644
index 0000000..1f53798
--- /dev/null
+++ b/configs/paivana/upstream/robots.txt
@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /