ops: GOA regio-ng AIO restore scripts + wire post-restore helper

scripts/taler-shared/goa-regio-ng/goa-wire-post-restore.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Inside CTR (as root): wire path after empty→restore.
+# - /etc/hosts *.goa.local
+# - nginx bank proxy → libeufin :9012 (empty image still has :8080)
+# - taler-exchange-dbconfig -p -s (schema + grants for wire role)
+# - systemd -a drop-ins (dual exchange-account-1 + exchange-account-default)
+# - start wirewatch + transfer; require wirewatch active
+set -euo pipefail
+
+echo "==== WIRE POST-RESTORE ===="
+
+if ! grep -q 'bank.goa.local' /etc/hosts 2>/dev/null; then
+  echo '127.0.0.1 bank.goa.local exchange.goa.local backend.goa.local' >> /etc/hosts
+fi
+grep -E 'goa\.local' /etc/hosts || true
+
+SNIP=/etc/nginx/snippets/regional-currency-bank-proxy.conf
+if [ -f "$SNIP" ] && grep -q '127.0.0.1:8080' "$SNIP"; then
+  sed -i 's|proxy_pass http://127.0.0.1:8080;|proxy_pass http://127.0.0.1:9012;|' "$SNIP"
+  echo "NGINX_PROXY_9012=patched"
+fi
+if command -v nginx >/dev/null 2>&1; then
+  nginx -t
+  systemctl reload nginx 2>/dev/null || systemctl restart nginx || true
+fi
+
+taler-exchange-dbconfig -p -s
+echo "DBCONFIG_OK"
+
+ACCT=exchange-account-default
+for unit in taler-exchange-wirewatch taler-exchange-transfer; do
+  bin="/usr/bin/${unit}"
+  d="/etc/systemd/system/${unit}.service.d"
+  mkdir -p "$d"
+  cat > "${d}/account.conf" <<EOF
+[Service]
+ExecStart=
+ExecStart=${bin} -c /etc/taler-exchange/taler-exchange.conf -L INFO -a ${ACCT}
+EOF
+done
+systemctl daemon-reload
+systemctl reset-failed taler-exchange-wirewatch.service taler-exchange-transfer.service 2>/dev/null || true
+systemctl restart taler-exchange-wirewatch.service
+systemctl start taler-exchange-transfer.service 2>/dev/null || true
+
+# wait wirewatch
+ok=0
+for i in $(seq 1 30); do
+  st=$(systemctl is-active taler-exchange-wirewatch.service 2>/dev/null || echo missing)
+  if [ "$st" = "active" ]; then
+    ok=1
+    break
+  fi
+  sleep 1
+done
+echo "WIREWATCH=$(systemctl is-active taler-exchange-wirewatch.service 2>/dev/null || echo missing)"
+echo "TRANSFER=$(systemctl is-active taler-exchange-transfer.service 2>/dev/null || echo missing)"
+if [ "$ok" -ne 1 ]; then
+  journalctl -u taler-exchange-wirewatch.service -n 40 --no-pager || true
+  echo "FAIL wirewatch not active"
+  exit 1
+fi
+
+TOKEN=$(awk -F= '/^TOKEN=/{print $2; exit}' \
+  /etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf 2>/dev/null || true)
+if [ -n "${TOKEN:-}" ]; then
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
+    -H "Authorization: Bearer ${TOKEN}" \
+    http://bank.goa.local/accounts/exchange/taler-wire-gateway/config 2>/dev/null || echo ERR)
+  echo "WIRE_GATEWAY_VIA_NGINX=${code}"
+  case "$code" in 200|204) ;; *)
+    echo "FAIL wire gateway via bank.goa.local"
+    exit 1
+    ;;
+  esac
+fi
+
+echo "WIRE_POST_RESTORE_OK"