hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: topic notes 2026-07-09 (keys-wire, ipv6, castopod, …)

Browse source
This commit is contained in:
Hernâni Marques 2026-07-09 22:54:08 +02:00
parent 547f0e27ce
commit 86502f5ced
No known key found for this signature in database
11 changed files with 520 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

201
2026/2026-07-09--exchange-snapshot-and-restore.md Normal file
View file

@ -0,0 +1,201 @@
# Exchange snapshot + restore (GOA) — 2026-07-09
**Scope:** local on host **koopa** only. No registry, no upload, no public internet publish.
Container was **stopped** then **committed/saved**. Live name: `taler-exchange-hacktivism`.
---
## 1. What was stored (local files)
Directory (hernani on koopa):
```text
/home/hernani/images/taler-stack-20260709-snapshot/
```
| File | Role | Size (approx.) |
|------|------|----------------|
| `taler-exchange-hacktivism-live-20260709-snapshot.tar` | full exchange image archive | **~1.6 G** |
| `taler-hacktivism-live-20260709-snapshot.tar` | merchant archive (partial earlier run) | ~2.4 G |
| `SHA256SUMS` | checksums for completed saves | |
**Podman images (local store only):**
| Image | Tag | Notes |
|-------|-----|--------|
| `localhost/taler-exchange-hacktivism-live` | `20260709-snapshot` | committed from stopped container |
| `localhost/taler-exchange-hacktivism-live` | `9011` | previous live tag (still present) |
| `localhost/taler-hacktivism-live` | `20260709-snapshot` | merchant (if commit kept) |
| `localhost/taler-bank-hacktivism-live` | `20260709-snapshot` | bank (if commit kept) |
Verify:
```bash
# as hernani@koopa
ls -lh /home/hernani/images/taler-stack-20260709-snapshot/
sha256sum -c /home/hernani/images/taler-stack-20260709-snapshot/SHA256SUMS
podman images | grep exchange
podman ps -a --filter name=taler-exchange-hacktivism
```
Expected container state after stop:
```text
taler-exchange-hacktivism Exited (…) localhost/taler-exchange-hacktivism-live:9011 0.0.0.0:9011->9011/tcp
```
---
## 2. How the snapshot was made
```bash
# as hernani@koopa — local only
podman stop taler-exchange-hacktivism
TAG=20260709-snapshot
OUT=/home/hernani/images/taler-stack-$TAG
mkdir -p "$OUT"
podman commit taler-exchange-hacktivism \
localhost/taler-exchange-hacktivism-live:$TAG
podman save -o "$OUT/taler-exchange-hacktivism-live-$TAG.tar" \
localhost/taler-exchange-hacktivism-live:$TAG
sha256sum "$OUT/taler-exchange-hacktivism-live-$TAG.tar" | tee -a "$OUT/SHA256SUMS"
```
`-p` on commit pauses the container if still running; after `stop` it is optional.
---
## 3. Restore from image (same host)
### A. From local image tag (fast)
```bash
podman rm -f taler-exchange-hacktivism # only if replacing dead/exited
podman run -d --name taler-exchange-hacktivism \
--network pasta \
-p 9011:9011 \
--label org.hacktivism.service=taler-exchange \
--label org.hacktivism.host_port=9011 \
--label org.hacktivism.site=exchange.hacktivism.ch \
--label org.hacktivism.currency=GOA \
--label org.hacktivism.managed_by=koopa-admin \
localhost/taler-exchange-hacktivism-live:20260709-snapshot \
sleep infinity
```
### B. From tar (if image store was wiped)
```bash
podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-exchange-hacktivism-live-20260709-snapshot.tar
# then same podman run as above
```
### C. Start services (manual model, no systemd)
Inside container as **root**, then app user:
```bash
podman exec -u root -it taler-exchange-hacktivism bash
# 1) base: postgres, runtime dirs, secmods, wire helpers
/root/start_base_services_for_taler_exchange.sh --no-shell
# 2) httpd
runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
# 3) health
/usr/local/bin/check_exchange-health.sh
```
Host / public checks:
```bash
curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9011/config
curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/config
curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/keys
```
Caddy already proxies `exchange.hacktivism.ch` → host `:9011` (see `configs/caddy/`, `configs/ports.md`).
---
## 4. GOA configuration (authoritative tree)
**Do not** edit package `taler-exchange.conf` defaults by hand. Site config lives in overrides + coins (merchant pattern).
| In container | In admin-log repo |
|--------------|-------------------|
| `/etc/taler-exchange/exchange-overrides.conf` | `configs/taler-exchange/exchange-overrides.conf` |
| `/etc/taler-exchange/conf.d/exchange-coins.conf` | `configs/taler-exchange/conf.d-exchange-coins.conf` |
| secrets (wire gateway) | **not** in admin-log → `koopa-admin-secrets` |
| start scripts | `scripts/taler-exchange/` |
GOA essentials in overrides:
- `CURRENCY = GOA`, `BASE_URL = https://exchange.hacktivism.ch/`
- `SERVE = tcp`, `PORT = 9011`
- `[currency-goa]` ENABLED + unit names (Yotta…Atomic)
- `[exchange-account-1]` payto `x-taler-bank/bank.hacktivism.ch/exchange`
- Terms stubs: `TERMS_ETAG` / `PRIVACY_ETAG` = `no-terms-v0` / `no-privacy-v0`
Deploy overrides from the local machine (example):
```bash
# from laptop, secrets never committed to admin-log
scp configs/taler-exchange/exchange-overrides.conf \
hernani@koopa:/tmp/exchange-overrides.conf
scp configs/taler-exchange/conf.d-exchange-coins.conf \
hernani@koopa:/tmp/exchange-coins.conf
ssh hernani@koopa 'podman cp /tmp/exchange-overrides.conf taler-exchange-hacktivism:/etc/taler-exchange/exchange-overrides.conf
podman cp /tmp/exchange-coins.conf taler-exchange-hacktivism:/etc/taler-exchange/conf.d/exchange-coins.conf'
```
Greenfield (empty Debian + packages) only:
`scripts/taler-exchange/archive/exchange-bootstrap.sh` **as root inside** container — generates a **new** master key; not the same as restoring this snapshot.
After config change:
```bash
runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
# optional offline keys / wire:
# scripts/taler-exchange/wire-enable-and-upload.sh
# scripts/taler-exchange/offline-sign-upload-keys.sh
# /usr/local/bin/install_no_terms.sh
```
---
## 5. Ansible
There is **no** Ansible playbook in `koopa-admin-log` / this monorepo path for the exchange.
Operational model is: **podman** + **manual start scripts** + **GOA overrides** as above.
If an external Ansible tree is added later, it should only:
1. `podman load` / ensure image tag
2. `podman run` with pasta + `9011:9011` + labels above
3. copy GOA configs from `configs/taler-exchange/`
4. run `start_base` → `start_exchange`
5. never push images to a public registry without explicit request
---
## 6. Related docs
| Doc | Content |
|-----|---------|
| `configs/taler-exchange/README.md` | GOA site notes, terms, ports |
| `scripts/taler-exchange/archive/README.md` | bootstrap vs daily start |
| `configs/ports.md` | 9011 pasta |
| `ops/ROOT_HYGIENE.md` | secrets layout |
---
## 7. Session note (2026-07-09)
- Exchange **stopped** on request (`Exited 137`).
- Snapshot **local only** under `/home/hernani/images/…`.
- Known pre-stop issue: wirewatch had died after Postgres ownership/outage → bank confirms OK but wallet “Geld von Bank abheben…” could hang until wirewatch imports credits. After restore, always verify **wirewatch** is live (`check_exchange-health.sh`).