docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

2026-07-13 10:12:00 +02:00 · 2026-07-13 10:12:00 +02:00 · 96961f23f5
commit 96961f23f5
268 changed files with 24161 additions and 0 deletions
--- a/2026/2026-06-29.md
+++ b/2026/2026-06-29.md
@ -0,0 +1,4 @@
+# 2026-06-29
+
+- koopa-admin-log started
+- merchant start/health; container TLS :8081 + certbot :8082
--- a/2026/2026-06-30.md
+++ b/2026/2026-06-30.md
@ -0,0 +1,4 @@
+# 2026-06-30
+
+- separate exchange container reverted → conf.d drop-in
+- exchange start/health + GOA zz- drop-in
--- a/2026/2026-07-01.md
+++ b/2026/2026-07-01.md
@ -0,0 +1,3 @@
+# 2026-07-01
+
+- bank start scripts + GOA bank-overrides
--- a/2026/2026-07-02.md
+++ b/2026/2026-07-02.md
@ -0,0 +1,3 @@
+# 2026-07-02
+
+- exchange ensure-helpers; bank demo withdraw/credit helpers
--- a/2026/2026-07-07.md
+++ b/2026/2026-07-07.md
@ -0,0 +1,3 @@
+# 2026-07-07
+
+- taler.hacktivism.ch LE (certbot), notBefore ~20:44 CEST / notAfter ~2026-10-05
--- a/2026/2026-07-08.md
+++ b/2026/2026-07-08.md
@ -0,0 +1,6 @@
+# 2026-07-08
+
+- Caddy live: taler LE certs (from 07.07.) → /etc/caddy/certs; :443 then 8085/8443 then 9000/9001 + ACME webroot
+- firewalld 9000/9001/80; drop obsolete 443/8082
+- exchange GOA overrides (no KUDOS)
+- exchange.hacktivism.ch LE via Caddy ACME ~21:36 CEST
--- a/2026/2026-07-09--amount-ladder-partial-results.md
+++ b/2026/2026-07-09--amount-ladder-partial-results.md
@ -0,0 +1,47 @@
+# Amount ladder bench — partial results (interrupted 2026-07-09)
+
+
+## Setup
+| Item | Value |
+|------|-------|
+| Bank user | `bench-fat` |
+| Password file (koopa host) | `/root/bank-bench-fat-password.txt` |
+| Admin credit | GOA:100000 |
+| Withdraw | GOA:25000 → wallet available GOA:25000 |
+| Merchant instance | `goa-demo-cp4zqk` |
+| Free-amount template | `goa-free` |
+| Fixed template (legacy) | `goa` amount GOA:5 fixed-order |
+| Withdraw wall time | ~393 s (confirm path issues) |
+
+## Payments (all failed — template URL 404)
+
+| # | Amount | handle (s) | rud (s) | total (s) | status | loadavg |
+|--:|--------|----------:|--------:|----------:|--------|--------:|
+| 1 | `GOA:0.000001` | 0.209 | 0.168 | **0.377** | error | 2.17 |
+| 2 | `GOA:0.001` | 0.234 | 0.17 | **0.404** | error | 2.06 |
+| 3 | `GOA:0.05` | 0.203 | 0.168 | **0.371** | error | 2.21 |
+| 4 | `GOA:0.5` | 0.199 | 0.169 | **0.369** | error | 2.17 |
+| 5 | `GOA:1` | 0.204 | 0.167 | **0.37** | error | 2.07 |
+| 6 | `GOA:3` | 0.201 | 0.168 | **0.37** | error | 2.22 |
+| 7 | `GOA:7` | 0.198 | 0.168 | **0.366** | error | 2.18 |
+| 8 | `GOA:10` | 0.286 | 0.17 | **0.456** | error | 2.23 |
+| 9 | `GOA:25` | 0.204 | 0.167 | **0.372** | error | 2.21 |
+| 10 | `GOA:50` | 0.204 | 0.167 | **0.372** | error | 2.41 |
+| 11 | `GOA:100` | 0.279 | 0.166 | **0.445** | error | 2.27 |
+| 12 | `GOA:250` | 0.294 | 0.168 | **0.462** | error | 2.23 |
+| 13 | `GOA:500` | 0.21 | 0.165 | **0.375** | error | 2.12 |
+| 14 | `GOA:1000` | 0.202 | 0.169 | **0.37** | error | 2.33 |
+| 15 | `GOA:2500` | 0.198 | 0.164 | **0.362** | error | 2.31 |
+| 16 | `GOA:5000` | 0.201 | 0.167 | **0.368** | error | 2.43 |
+
+### Failure
+Wallet requested:
+```
+GET https://taler.hacktivism.ch/instances/goa-demo-cp4zqk/goa-free/templates/
+→ 404
+```
+URI used: `taler://pay-template/taler.hacktivism.ch/instances/goa-demo-cp4zqk/goa-free/?amount=…&summary=…`
+Fix next: correct pay-template path / merchant public template endpoint.
+
+## Planned amount ladder (not all run)
+`GOA:0.000001 0.001 0.05 0.5 1 3 7 10 25 50 100 250 500 1000 2500 5000`
--- a/2026/2026-07-09--bonfire-ground-zero.md
+++ b/2026/2026-07-09--bonfire-ground-zero.md
@ -0,0 +1,46 @@
+# Bonfire ground zero + gitbot (2026-07-09)
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Path | `/home/hernani/koopa-bonfire/` |
+| Containers | `koopa-bonfire`, `koopa-bonfire-db` |
+| Port | **9021** → Caddy `bonfire.hacktivism.ch` |
+| Image | `bonfirenetworks/bonfire:1.0.5-social-amd64` |
+| Env | secrets **64** chars; `DB_MIGRATE_INDEXES_CONCURRENTLY=false` |
+
+Ground zero: wiped volume + dir, clean migrate (import_me `20200828094944` applied, ~109 migrations, identity tables present).
+
+## Accounts
+
+| Login | Role |
+|-------|------|
+| `foss` / `foss@bonfire.hacktivism.ch` | operator account |
+| character `gitbot` | same account (multi-profile) |
+
+Passwords: `/home/hernani/koopa-bonfire/users.env` (mode 600).
+
+Public: https://bonfire.hacktivism.ch/
+
+## Gitbot (commit mirror)
+
+- Live: `~/koopa-bonfire/bin/gitbot-mirror.py`
+- Mirror in repo: `scripts/bonfire/gitbot-mirror.py`
+- State: `~/koopa-bonfire/gitbot-state.json`
+- Poll Forgejo every **300s** (`gitbot-mirror.service`); log `~/koopa-bonfire/gitbot.log`
+- No webhook — API only
+
+```bash
+systemctl --user status gitbot-mirror.service
+tail -20 ~/koopa-bonfire/gitbot.log
+python3 ~/koopa-bonfire/bin/gitbot-mirror.py
+```
+
+More: `2026/2026-07-11--bonfire-gitbot-systemd.md`.
+
+## Lessons
+
+- First boot needs **≥64-byte** `SECRET_KEY_BASE`.
+- Migrations: **`DB_MIGRATE_INDEXES_CONCURRENTLY=false`** on empty DB (avoids concurrent index in txn).
+- Partial DB → wipe volume and ground zero rather than patch half-migrated state.
--- a/2026/2026-07-09--castopod-content.md
+++ b/2026/2026-07-09--castopod-content.md
@ -0,0 +1,34 @@
+# Castopod — admin note (2026-07-09)
+
+Site: **https://castopod.hacktivism.ch/**  
+Admin: https://castopod.hacktivism.ch/cp-admin  
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Live root | `~/koopa-castopod/` |
+| Compose | `podman-compose` (mirror: `configs/castopod/compose.yml`) |
+| Containers | `koopa-castopod`, `koopa-castopod-mariadb`, `koopa-castopod-redis` |
+| Host port | **9020** → Caddy |
+
+Secrets (not in this repo): `~/koopa-castopod/.env`, `~/koopa-castopod/users.env` (mode 600).  
+Also: `koopa-admin-secrets/…/koopa-castopod/`.
+
+## Accounts
+
+| User | Role |
+|------|------|
+| `admin` | instance superadmin |
+| `ngi` | podcaster |
+
+## Ops
+
+```bash
+cd ~/koopa-castopod && set -a && source .env && set +a && podman-compose up -d
+# scripts: scripts/castopod/{up,status,lib}.sh
+```
+
+Podcast content is managed in Castopod, not in admin-log.
+
+Boot/branding: `2026/2026-07-13--castopod-boot-branding.md`, `configs/castopod/`, `scripts/castopod/`.
--- a/2026/2026-07-09--exchange-snapshot-and-restore.md
+++ b/2026/2026-07-09--exchange-snapshot-and-restore.md
@ -0,0 +1,201 @@
+# Exchange snapshot + restore (GOA) — 2026-07-09
+
+**Scope:** local on host **koopa** only. No registry, no upload, no public internet publish.
+
+Container was **stopped** then **committed/saved**. Live name: `taler-hacktivism-exchange-ansible`.
+
+---
+
+## 1. What was stored (local files)
+
+Directory (hernani on koopa):
+
+```text
+/home/hernani/images/taler-stack-20260709-snapshot/
+```
+
+| File | Role | Size (approx.) |
+|------|------|----------------|
+| `taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar` | full exchange image archive | **~1.6 G** |
+| `taler-hacktivism-live-20260709-snapshot.tar` | merchant archive (partial earlier run) | ~2.4 G |
+| `SHA256SUMS` | checksums for completed saves | |
+
+**Podman images (local store only):**
+
+| Image | Tag | Notes |
+|-------|-----|--------|
+| `localhost/taler-hacktivism-exchange-ansible-live` | `20260709-snapshot` | committed from stopped container |
+| `localhost/taler-hacktivism-exchange-ansible-live` | `9011` | previous live tag (still present) |
+| `localhost/taler-hacktivism-live` | `20260709-snapshot` | merchant (if commit kept) |
+| `localhost/taler-bank-hacktivism-live` | `20260709-snapshot` | bank (if commit kept) |
+
+Verify:
+
+```bash
+# as hernani@koopa
+ls -lh /home/hernani/images/taler-stack-20260709-snapshot/
+sha256sum -c /home/hernani/images/taler-stack-20260709-snapshot/SHA256SUMS
+podman images | grep exchange
+podman ps -a --filter name=taler-hacktivism-exchange-ansible
+```
+
+Expected container state after stop:
+
+```text
+taler-hacktivism-exchange-ansible  Exited (…)  localhost/taler-hacktivism-exchange-ansible-live:9011  0.0.0.0:9011->9011/tcp
+```
+
+---
+
+## 2. How the snapshot was made
+
+```bash
+# as hernani@koopa — local only
+podman stop taler-hacktivism-exchange-ansible
+
+TAG=20260709-snapshot
+OUT=/home/hernani/images/taler-stack-$TAG
+mkdir -p "$OUT"
+
+podman commit taler-hacktivism-exchange-ansible \
+  localhost/taler-hacktivism-exchange-ansible-live:$TAG
+
+podman save -o "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" \
+  localhost/taler-hacktivism-exchange-ansible-live:$TAG
+
+sha256sum "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" | tee -a "$OUT/SHA256SUMS"
+```
+
+`-p` on commit pauses the container if still running; after `stop` it is optional.
+
+---
+
+## 3. Restore from image (same host)
+
+### A. From local image tag (fast)
+
+```bash
+podman rm -f taler-hacktivism-exchange-ansible   # only if replacing dead/exited
+
+podman run -d --name taler-hacktivism-exchange-ansible \
+  --network pasta \
+  -p 9011:9011 \
+  --label org.hacktivism.service=taler-exchange \
+  --label org.hacktivism.host_port=9011 \
+  --label org.hacktivism.site=exchange.hacktivism.ch \
+  --label org.hacktivism.currency=GOA \
+  --label org.hacktivism.managed_by=koopa-admin \
+  localhost/taler-hacktivism-exchange-ansible-live:20260709-snapshot \
+  sleep infinity
+```
+
+### B. From tar (if image store was wiped)
+
+```bash
+podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar
+# then same podman run as above
+```
+
+### C. Start services (manual model, no systemd)
+
+Inside container as **root**, then app user:
+
+```bash
+podman exec -u root -it taler-hacktivism-exchange-ansible bash
+# 1) base: postgres, runtime dirs, secmods, wire helpers
+/root/start_base_services_for_taler_exchange.sh --no-shell
+# 2) httpd
+runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
+# 3) health
+/usr/local/bin/check_exchange-health.sh
+```
+
+Host / public checks:
+
+```bash
+curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9011/config
+curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/config
+curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/keys
+```
+
+Caddy already proxies `exchange.hacktivism.ch` → host `:9011` (see `configs/caddy/`, `configs/ports.md`).
+
+---
+
+## 4. GOA configuration (authoritative tree)
+
+**Do not** edit package `taler-exchange.conf` defaults by hand. Site config lives in overrides + coins (merchant pattern).
+
+| In container | In admin-log repo |
+|--------------|-------------------|
+| `/etc/taler-exchange/exchange-overrides.conf` | `configs/taler-exchange/exchange-overrides.conf` |
+| `/etc/taler-exchange/conf.d/exchange-coins.conf` | `configs/taler-exchange/conf.d-exchange-coins.conf` |
+| secrets (wire gateway) | **not** in admin-log → `koopa-admin-secrets` |
+| start scripts | `scripts/taler-exchange/` |
+
+GOA essentials in overrides:
+
+- `CURRENCY = GOA`, `BASE_URL = https://exchange.hacktivism.ch/`
+- `SERVE = tcp`, `PORT = 9011`
+- `[currency-goa]` ENABLED + unit names (Yotta…Atomic)
+- `[exchange-account-1]` payto `x-taler-bank/bank.hacktivism.ch/exchange`
+- Terms stubs: `TERMS_ETAG` / `PRIVACY_ETAG` = `no-terms-v0` / `no-privacy-v0`
+
+Deploy overrides from the local machine (example):
+
+```bash
+# from laptop, secrets never committed to admin-log
+scp configs/taler-exchange/exchange-overrides.conf \
+    hernani@koopa:/tmp/exchange-overrides.conf
+scp configs/taler-exchange/conf.d-exchange-coins.conf \
+    hernani@koopa:/tmp/exchange-coins.conf
+ssh hernani@koopa 'podman cp /tmp/exchange-overrides.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/exchange-overrides.conf
+  podman cp /tmp/exchange-coins.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/conf.d/exchange-coins.conf'
+```
+
+Greenfield (empty Debian + packages) only:  
+`scripts/taler-exchange/archive/exchange-bootstrap.sh` **as root inside** container — generates a **new** master key; not the same as restoring this snapshot.
+
+After config change:
+
+```bash
+runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
+# optional offline keys / wire:
+# scripts/taler-exchange/wire-enable-and-upload.sh
+# scripts/taler-exchange/offline-sign-upload-keys.sh
+# /usr/local/bin/install_no_terms.sh
+```
+
+---
+
+## 5. Ansible
+
+There is **no** Ansible playbook in `koopa-admin-log` / this monorepo path for the exchange.  
+Operational model is: **podman** + **manual start scripts** + **GOA overrides** as above.
+
+If an external Ansible tree is added later, it should only:
+
+1. `podman load` / ensure image tag  
+2. `podman run` with pasta + `9011:9011` + labels above  
+3. copy GOA configs from `configs/taler-exchange/`  
+4. run `start_base` → `start_exchange`  
+5. never push images to a public registry without explicit request  
+
+---
+
+## 6. Related docs
+
+| Doc | Content |
+|-----|---------|
+| `configs/taler-exchange/README.md` | GOA site notes, terms, ports |
+| `scripts/taler-exchange/archive/README.md` | bootstrap vs daily start |
+| `configs/ports.md` | 9011 pasta |
+| `ops/ROOT_HYGIENE.md` | secrets layout |
+
+---
+
+## 7. Session note (2026-07-09)
+
+- Exchange **stopped** on request (`Exited 137`).  
+- Snapshot **local only** under `/home/hernani/images/…`.  
+- Known pre-stop issue: wirewatch had died after Postgres ownership/outage → bank confirms OK but wallet “Withdraw money from bank…” could hang until wirewatch imports credits. After restore, always verify **wirewatch** is live (`check_exchange-health.sh`).
--- a/2026/2026-07-09--ipv6-15d6.md
+++ b/2026/2026-07-09--ipv6-15d6.md
@ -0,0 +1,34 @@
+# 2026-07-09 — IPv6 `:15d6` reachability
+
+## Symptom
+
+`https://exchange.hacktivism.ch/config` failed with `ERR_ADDRESS_UNREACHABLE`
+when clients preferred AAAA `2a02:168:53a8:0:d584:9e34:13cf:15d6`.
+IPv4 `212.51.151.254` worked (HTTP 200).
+
+## Path comparison
+
+| | IPv4 | IPv6 |
+|--|------|------|
+| Public endpoint | WAN IP DNAT | Host global `:15d6` |
+| VeciGate | dstnat 443→9001 | forward 443 (no NAT) |
+| Host listener | Caddy `:9001` | `https-proxy.socket` `:443` → 9001 |
+| firewalld needed | 9001 | **443** (+ 80 for ACME) |
+
+## Fix applied
+
+```bash
+# on koopa (root)
+firewall-cmd --permanent --zone=public --add-port=443/tcp
+firewall-cmd --reload
+```
+
+VeciGate: confirmed IPv6 filter allow 443; added explicit allow **80** for ACME.
+
+## Verify
+
+```bash
+curl -6 -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' \
+  https://exchange.hacktivism.ch/config
+# 200 2a02:168:53a8:0:d584:9e34:13cf:15d6
+```
--- a/2026/2026-07-09--keys-wire.md
+++ b/2026/2026-07-09--keys-wire.md
@ -0,0 +1,17 @@
+# 2026-07-09 — `/keys` + Wire + Merchant GOA
+
+## Done
+
+1. **Exchange `/keys`:** was suspended (no wire accounts → then no online signing keys).
+   - `enable-account` + `wire-fee` + `global-fee` → offline **upload** (local `BASE_URL=http://127.0.0.1:9011/`)
+   - `download` → `sign` → `upload` for denoms + signkeys
+   - Result: `GET /keys` **200**, ~1 MB, currency GOA, master `TW6K5FXF…`
+2. **Merchant health:** `check_merchant-health.sh` includes exchange `/keys` + MASTER_KEY match → **ALL CRITICAL PASSED** (GOA via `host.containers.internal:9011` fallback).
+3. **Wire helpers:** secret `exchange-accountcredentials-1.secret.conf` needs group `taler-exchange-db` mode 640; then aggregator/closer/wirewatch/transfer OK.
+4. **Smoke:** local+public `/keys` 200; bank wire-gateway config as `exchange` → 200 on `:9012`; bank SPA public earlier (LE cert). Full phone Withdraw is manual (wallet app).
+5. **Admin-log:** docs diagram keys/wire; scripts `wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh`; merchant overrides GOA; ports 9012 noted.
+
+## Manual withdraw (phone)
+
+1. https://bank.hacktivism.ch/ → login `explorer` (pw host `/root/bank-explorer-password.txt`)
+2. Withdraw GOA → open in Taler Wallet (exchange.hacktivism.ch `/keys` must stay 200)
--- a/2026/2026-07-09--koopa-prime-jellyfin.md
+++ b/2026/2026-07-09--koopa-prime-jellyfin.md
@ -0,0 +1,43 @@
+# koopa-prime — Jellyfin + qBittorrent (2026-07-09)
+
+## Containers (podman-compose)
+
+Path: `/home/hernani/koopa-prime/`
+
+| Container | Role | Host port |
+|-----------|------|-----------|
+| `koopa-prime-jellyfin` | Video library (Jellyfin) | **9022** |
+| `koopa-prime-qbittorrent` | BitTorrent client | **9023** WebUI, **6881** BT |
+
+## Media wiring
+
+| Host path | Jellyfin | qBittorrent |
+|-----------|----------|-------------|
+| `/home/hernani/Downloads` | `/media/downloads` **ro** (library) | `/downloads` **rw** (save path) |
+
+Downloads land in the same folder Jellyfin scans.
+
+## Auth (login required)
+
+- **Jellyfin:** admin account created via Startup API; library access needs login.
+- **qBittorrent:** WebUI password required (401 without session).
+
+Credentials: `~/koopa-prime/users.env` (mode 600).
+
+## Public / Caddy
+
+| Host | Backend |
+|------|---------|
+| `prime.hacktivism.ch` | `127.0.0.1:9022` |
+| `torrent.prime.hacktivism.ch` | `127.0.0.1:9023` (needs DNS CNAME) |
+
+See session notes for Caddy snippets. BT port **6881** may need firewall/VeciGate if peers should connect.
+
+## Ops
+
+```bash
+cd ~/koopa-prime
+podman-compose ps
+podman-compose logs -f jellyfin
+podman-compose up -d
+```
--- a/2026/2026-07-09--merchant-bank-link.md
+++ b/2026/2026-07-09--merchant-bank-link.md
@ -0,0 +1,8 @@
+# 2026-07-09 — Merchant demo + bank link
+
+1. Disabled mandatory SMS/email TAN on merchant (`MANDATORY_TAN_CHANNELS` empty).
+2. Self-provisioned instance `goa-demo-cp4zqk` via `POST /instances` (HTTP 200, no challenge).
+3. Created bank user `goa-demo-cp4zqk`, credited **GOA:5000**.
+4. Linked payto to merchant: `POST .../private/accounts` → active wire account.
+
+See `configs/taler-hacktivism/demo-instance-goa-demo-cp4zqk.md`.
--- a/2026/2026-07-09.md
+++ b/2026/2026-07-09.md
@ -0,0 +1,6 @@
+# 2026-07-09
+
+- bank.hacktivism.ch LE ~05:43 CEST
+- public intros :9013–9015 + landing-stats; merchant stats fail-closed
+- dual-currency terms + Swiss FADP privacy (merchant/exchange)
+- taler-monitoring (+ versions vs deb.taler.net)
--- a/2026/2026-07-10--admin-log-origin-forgejo.md
+++ b/2026/2026-07-10--admin-log-origin-forgejo.md
@ -0,0 +1,40 @@
+# koopa-admin-log origin on git.hacktivism.ch (2026-07-10)
+
+## Remote
+
+| Item | Value |
+|------|--------|
+| Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
+| Repo | **https://git.hacktivism.ch/hernani/koopa-admin-log** |
+| Visibility | **public** (ops log only; **no secret values**) |
+| Default branch | `main` |
+| HTTPS clone | `https://git.hacktivism.ch/hernani/koopa-admin-log.git` |
+| SSH clone | `ssh://git@git.hacktivism.ch:9200/hernani/koopa-admin-log.git` |
+
+## Local setup
+
+```bash
+cd /path/to/koopa-admin-log
+git remote add origin https://git.hacktivism.ch/hernani/koopa-admin-log.git
+# or SSH (port 9200):
+# git remote add origin ssh://git@git.hacktivism.ch:9200/hernani/koopa-admin-log.git
+
+git push -u origin main
+```
+
+Auth: Forgejo user **`hernani`** (admin; registration disabled site-wide).  
+Credentials: `koopa-admin-secrets/…/koopa-forgejo/users.env` — not in this repo.
+
+## Related
+
+- Forgejo install: `2026-07-10--forgejo-rootless.md`
+- Secrets sibling: **not** hosted here (private material stays in `koopa-admin-secrets` only)
+
+## Network (SSH :9200)
+
+Public git-SSH requires:
+
+1. VeciGate WAN/hairpin + IPv6 forward **9200** → koopa  
+2. koopa firewalld **9200/tcp**
+
+See `2026-07-10--forgejo-rootless.md` (Network exposure) and `../vecigate-admin-log/docs/CHANGELOG.md`.
--- a/2026/2026-07-10--bonfire-federate.md
+++ b/2026/2026-07-10--bonfire-federate.md
@ -0,0 +1,60 @@
+# Bonfire — FEDERATE + public guest access (2026-07-10)
+
+Follow-up to ground zero: `2026-07-09--bonfire-ground-zero.md`.
+
+## Change
+
+| Item | Before | After |
+|------|--------|--------|
+| `.env` `FEDERATE` | unset | **`true`** |
+| Container | recreated | `podman-compose up -d --force-recreate web` |
+| `printenv FEDERATE` (web) | — | `true` |
+| `HOSTNAME` / compose | `bonfire.hacktivism.ch` | unchanged |
+| Port | **9021** → Caddy | unchanged |
+
+Only new env key vs ground-zero `.env`: **`FEDERATE`**.
+
+Live: `/home/hernani/koopa-bonfire/.env` (mode 600).  
+Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-bonfire/.env`.  
+Compose mirror: `configs/bonfire/compose.yml`.
+
+## Intent
+
+- Allow federation-related runtime paths (`FEDERATE` consumed in Bonfire `runtime.exs` as `true|yes|1`).
+- Keep **guest-readable** public surfaces (no login required for explore / profiles that are already public).
+- Operator stance: **federation enablement is accepted as OK** even if the UI banner lags.
+
+## Observed behaviour (after recreate)
+
+| Check | Result |
+|-------|--------|
+| Local `http://127.0.0.1:9021/` | 200; guest UI (Explore / Log in) |
+| Guest UI banner | still may show **“Federation disabled”** |
+| App RPC (earlier probe) | `activity_pub` instance sometimes still `federating: false`, `hostname: "localhost"` despite env |
+| Public profiles | guest-readable when already public |
+| Front / local feed | can be sparse depending on boundaries / feed window |
+
+So: **env is set and container healthy**; full ActivityPub “federating=true” in Application config may still need admin UI / deeper config if outbound federation is required later.
+
+## Ops
+
+```bash
+cd ~/koopa-bonfire
+grep ^FEDERATE= .env
+podman exec koopa-bonfire printenv FEDERATE HOSTNAME
+podman ps --filter name=koopa-bonfire
+curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9021/
+```
+
+Recreate web after env change:
+
+```bash
+cd ~/koopa-bonfire
+set -a && source .env && set +a
+podman-compose up -d --force-recreate web
+```
+
+## Secrets / log rules
+
+- Values only in **`koopa-admin-secrets`**, not in this repo.
+- Daylog major bullet only (see `2026-07-10.md`).
--- a/2026/2026-07-10--forgejo-rootless.md
+++ b/2026/2026-07-10--forgejo-rootless.md
@ -0,0 +1,90 @@
+# Forgejo rootless — git.hacktivism.ch (2026-07-10)
+
+## Emphasis: rootless
+
+Forgejo is installed **rootless end-to-end**:
+
+1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
+2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
+3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
+4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
+
+Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Path | `/home/hernani/koopa-forgejo/` |
+| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
+| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
+| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
+| ROOT_URL | `https://git.hacktivism.ch/` |
+| Landing | explore (public browse OK) |
+| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |
+
+Compose + redacted `app.ini`: `configs/forgejo/`.  
+Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).
+
+## Access policy
+
+| Setting | Value |
+|---------|--------|
+| `DISABLE_REGISTRATION` | **true** — no free self-signup |
+| `SHOW_REGISTRATION_BUTTON` | **false** |
+| OpenID signup/signin | **false** |
+| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
+| Accounts | admin-created only (`forgejo admin user create`) |
+
+Reserved username `admin` cannot be used; first admin: **`hernani`**.
+
+Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).  
+Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.
+
+## Start / status
+
+```bash
+cd ~/koopa-forgejo
+set -a && source .env && set +a
+podman-compose up -d
+podman ps --filter name=koopa-forgejo
+curl -sS http://127.0.0.1:9024/api/healthz
+curl -sS https://git.hacktivism.ch/api/healthz
+```
+
+## Caddy (host root)
+
+Live `/etc/caddy/Caddyfile` matches `configs/caddy/Caddyfile` (applied 2026-07-10; `http://git.` in ACME list; SSH note **9200**).
+
+Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).  
+Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
+
+```bash
+sudo caddy validate --config /etc/caddy/Caddyfile
+sudo systemctl reload caddy
+```
+
+## Network exposure (2026-07-10)
+
+| Layer | Rule |
+|-------|------|
+| **VeciGate IPv4** | WAN **9200** → `192.168.100.95:9200`; hairpin LAN/LAN2 → public A:9200 |
+| **VeciGate IPv6** | WAN→LAN forward **tcp/9200** |
+| **koopa firewalld** | `public` **9200/tcp** (verified 2026-07-10: LAN + hairpin + `ssh -T`) |
+
+Docs: `../vecigate-admin-log` (`ip/firewall/nat/`, `ipv6/firewall/filter/`, `docs/CHANGELOG.md`);  
+host ports: `configs/firewalld/public-ports.md`.
+
+```bash
+# host
+sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload
+# client
+ssh -p 9200 -T git@git.hacktivism.ch
+```
+
+## Notes
+
+- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
+- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…`
+- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.
+- Admin-log origin: `hernani/koopa-admin-log` on this Forgejo — see `2026-07-10--admin-log-origin-forgejo.md`.
--- a/2026/2026-07-10--forgejo-theme-exchange-dark.md
+++ b/2026/2026-07-10--forgejo-theme-exchange-dark.md
@ -0,0 +1,27 @@
+# 2026-07-10 — Forgejo global theme (exchange-dark)
+
+## Goal
+
+Make https://git.hacktivism.ch look closer to https://exchange.hacktivism.ch: warm dark layout, gold + teal accents, readable text.
+
+## Done on koopa
+
+- Custom theme file `theme-hacktivism.css` (full variable set from forgejo-dark + exchange palette).
+- Installed under `~/koopa-forgejo/data/custom/public/assets/css/` (and gitea/custom mirror).
+- Logo/favicon under `…/assets/img/`.
+- `DEFAULT_THEME = hacktivism` in app.ini + compose `FORGEJO__ui__*`.
+- Forced DB: `UPDATE "user" SET theme = 'hacktivism'` (logged-in preference was still `forgejo-auto`).
+
+## Readability
+
+- Body/text cream on `#1a1410`; muted secondary not below ~`#c9b8a0`.
+- Gold primary buttons with dark label text.
+- Explicit overrides for menus, forms, code, labels, messages, footer.
+
+## Admin-log
+
+Source of truth: `configs/forgejo/assets/` + `configs/forgejo/README.md`.
+
+## Note
+
+Browser cache may hold old CSS (`Cache-Control: max-age=21600`). Hard-reload or private window if UI looks stale.
--- a/2026/2026-07-10.md
+++ b/2026/2026-07-10.md
@ -0,0 +1,21 @@
+# 2026-07-10
+
+- landing mem snapshot fix (pipeline → 0 B)
+- Caddy redir / → /intro/ (three sites)
+- SECRETS.md paths only; no secret material in admin-log
+- **Bonfire** `FEDERATE=true` (+ web recreate); guest public profiles OK; UI may still say federation disabled
+  → topic: `2026-07-10--bonfire-federate.md`; secrets: `koopa-admin-secrets/…/koopa-bonfire/`
+- **Forgejo rootless** on `git.hacktivism.ch` (HTTP **9024**, git-SSH **9200**); no free registration; admin `hernani`
+  → topic: `2026-07-10--forgejo-rootless.md`; secrets: `koopa-admin-secrets/…/koopa-forgejo/`
+- **git-SSH :9200** exposed + **verified**: VeciGate DNAT/hairpin + IPv6; firewalld **9200/tcp** (LAN/hairpin/`ssh -T` OK)
+  → vecigate-admin-log CHANGELOG 2026-07-10; `configs/firewalld/public-ports.md`
+- **admin-log origin** → Forgejo `hernani/koopa-admin-log` on git.hacktivism.ch (public; SSH :9200)
+  → topic: `2026-07-10--admin-log-origin-forgejo.md`
+- admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy
+- admin-log: Tor relay mirror documented (`configs/tor/`, host/tor)
+- Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified)
+- Bonfire: republish foss outbox → Local users + public internet feeds; guest `/feed/local` shows posts
+- Reflect live koopa state in admin-log: `host/overview/LIVE.md`, exchange name **taler-hacktivism-exchange-ansible**, ansible mirror
+- configs/: rename mirrors to live container names (`taler-hacktivism`, `taler-hacktivism-bank`; image banking)
+- **Forgejo branding**: theme `hacktivism` (exchange-dark) + Kamek-inspired logo (blue robe, flying on wand); compose DEFAULT_THEME
+  → `configs/forgejo/`
--- a/2026/2026-07-11--bonfire-branding-feeds.md
+++ b/2026/2026-07-11--bonfire-branding-feeds.md
@ -0,0 +1,25 @@
+# Bonfire branding + public feeds (2026-07-11)
+
+After `2026/2026-07-11--bonfire-gitbot-systemd.md`. Logo: `2026/2026-07-11--bonfire-logo-not-served.md`.
+
+## Branding
+
+- hacktivism magician logo (same as git.hacktivism.ch).
+- Deploy: `scripts/bonfire/apply-branding.sh`
+- Logo URL: `/images/hacktivism-logo.svg` (compose bind-mount).
+
+**Official:** [Admin Tools — Instance Settings](https://docs.bonfirenetworks.org/admin-tools.html) (name/icon in UI).  
+Instance theme via `bonfire remote` matches [Settings System](https://docs.bonfirenetworks.org/settings_system.html) (`scope: :instance`).  
+No official doc for custom static files in podman — bind-mount workaround only.
+
+## Public feed (ops)
+
+Gitbot activity can stay in the user outbox; guests on `/` may see a stale feed until republished.
+
+**Official:** [Feed structure](https://docs.bonfirenetworks.org/feed_structure.html) (`FeedPublish`).  
+No official “republish outbox to local feed” procedure — ops SQL + gitbot workaround.
+
+- Continuous: `gitbot-mirror.py` republishes outbox → local + internet every cycle.  
+- One-off: `scripts/bonfire/publish-outbox-to-public.sql`.
+
+Check: https://bonfire.hacktivism.ch/feed/local
--- a/2026/2026-07-11--bonfire-gitbot-systemd.md
+++ b/2026/2026-07-11--bonfire-gitbot-systemd.md
@ -0,0 +1,26 @@
+# Bonfire gitbot + boot (2026-07-11)
+
+After `2026/2026-07-09--bonfire-ground-zero.md`.
+
+## Problems
+
+- Bare hostnames in commit text crash `createPost` (`URI.parse/1`).
+- No webhook; bot polls git.ngi-0.eu every 300s.
+- Stack did not start on boot.
+
+## Fix
+
+- `gitbot-mirror.py`: prefix bare hosts, fallback post, skip after 3 fails.
+- User systemd: `gitbot-mirror.service`, `container-koopa-bonfire-*.service` (`podman-compose up -d`).
+- Install: `scripts/bonfire/install-systemd.sh`
+
+**Official:** [Hosting guide](https://docs.bonfirenetworks.org/deploy.html) recommends Co-op Cloud; we run podman-compose on koopa (ops choice, not upstream path).  
+GraphQL `createPost`: [API reference](https://docs.bonfirenetworks.org/api-reference.html) — no official gitbot mirror doc; custom script.
+
+## Ops
+
+```bash
+systemctl --user status container-koopa-bonfire-db.service container-koopa-bonfire.service gitbot-mirror.service
+tail -30 ~/koopa-bonfire/gitbot.log
+python3 ~/koopa-bonfire/bin/gitbot-mirror.py
+```
--- a/2026/2026-07-11--bonfire-logo-not-served.md
+++ b/2026/2026-07-11--bonfire-logo-not-served.md
@ -0,0 +1,19 @@
+# Bonfire logo not served (2026-07-11)
+
+After `scripts/bonfire/apply-branding.sh` the sidebar showed a broken image.
+
+## Symptom
+
+- `instance_icon` was `/images/hacktivism-logo.svg` but the file returned 404
+- `data/branding/` on disk is not a public URL; `/branding/` is not served by Bonfire
+
+## Official docs
+
+[Admin Tools — Instance Settings](https://docs.bonfirenetworks.org/admin-tools.html) covers instance name and icon in the admin UI only.
+
+No official guide for custom static files in Docker/podman. We use a bind-mount workaround.
+
+## Fix
+
+`compose.yml` mounts `data/branding/logo.svg` into `priv/static/images/hacktivism-logo.svg`.  
+Recreate web: `podman-compose up -d --no-deps --force-recreate web`
--- a/2026/2026-07-11.md
+++ b/2026/2026-07-11.md
@ -0,0 +1,5 @@
+# 2026-07-11
+
+- Bonfire gitbot + boot systemd → `2026/2026-07-11--bonfire-gitbot-systemd.md`
+- Bonfire logo not served → `2026/2026-07-11--bonfire-logo-not-served.md`
+- Bonfire branding + public feeds → `2026/2026-07-11--bonfire-branding-feeds.md`
--- a/2026/2026-07-13--castopod-boot-branding.md
+++ b/2026/2026-07-13--castopod-boot-branding.md
@ -0,0 +1,31 @@
+# Castopod — boot + branding (2026-07-13)
+
+Site: **https://castopod.hacktivism.ch/** · `~/koopa-castopod/` · Caddy **:9020**
+
+## Boot
+
+User systemd + linger (like Bonfire):
+
+```bash
+scripts/castopod/install-systemd.sh
+systemctl --user status container-koopa-castopod{,-mariadb,-redis}.service
+```
+
+Units: `configs/castopod/container-koopa-castopod*.service`
+
+## Branding
+
+Official settings: https://docs.castopod.org/main/en/user-guide/instance/settings/  
+Docker: https://docs.castopod.org/main/en/getting-started/docker/
+
+| Item | Host choice |
+|------|-------------|
+| Site icon | Magician logo (`configs/castopod/assets/img/`) |
+| Theme | Castopod accent **amber** |
+| Optional CSS | `assets/css/theme-hacktivism-overlay.css` (not upstream) |
+
+```bash
+scripts/castopod/apply-branding.sh
+```
+
+Stack/accounts: `2026/2026-07-09--castopod-content.md`.
--- a/2026/README.md
+++ b/2026/README.md
@ -0,0 +1,3 @@
+# Day logs 2026
+
+Major ops only. One file per work day; written the same day (not backfilled).