diff --git a/configs/README.md b/configs/README.md index a0904e0..61e422b 100644 --- a/configs/README.md +++ b/configs/README.md @@ -9,7 +9,7 @@ Directories are named to match **live podman container names** where possible. | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) | | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` | | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 | -| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors | +| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, `koopa-decidim`, … | compose mirrors | | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) | | `caddy/` `firewalld/` `systemd/` | host services | | | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) | diff --git a/configs/caddy/decidim.hacktivism.ch.caddy b/configs/caddy/decidim.hacktivism.ch.caddy new file mode 100644 index 0000000..0d3970f --- /dev/null +++ b/configs/caddy/decidim.hacktivism.ch.caddy @@ -0,0 +1,17 @@ +# 9027 decidim (rails) +# Live: merged into /etc/caddy/Caddyfile +decidim.hacktivism.ch { + header Alt-Svc "clear" + reverse_proxy 127.0.0.1:9027 { + header_up Host {host} + header_up X-Forwarded-For {remote_host} + header_up X-Forwarded-Host {host} + header_up X-Forwarded-Proto {scheme} + header_up X-Forwarded-Port 443 + flush_interval -1 + transport http { + read_timeout 3600s + write_timeout 3600s + } + } +} diff --git a/configs/decidim/.env.example b/configs/decidim/.env.example new file mode 100644 index 0000000..303db55 --- /dev/null +++ b/configs/decidim/.env.example @@ -0,0 +1,13 @@ +POSTGRES_PASSWORD=@inline-secret@ +SECRET_KEY_BASE=@inline-secret@ +DECIDIM_APPLICATION_NAME=hacktivism +DECIDIM_MAILER_SENDER=noreply@hacktivism.ch +DECIDIM_AVAILABLE_LOCALES=en,de,fr +DECIDIM_DEFAULT_LOCALE=en +DECIDIM_HOST=decidim.hacktivism.ch +SMTP_ADDRESS=127.0.0.1 +SMTP_DOMAIN=hacktivism.ch +SMTP_USERNAME=unused +SMTP_PASSWORD=unused +SMTP_PORT=25 +QUEUE_ADAPTER=sidekiq diff --git a/configs/decidim/README.md b/configs/decidim/README.md new file mode 100644 index 0000000..ea04610 --- /dev/null +++ b/configs/decidim/README.md @@ -0,0 +1,23 @@ +# Decidim — decidim.hacktivism.ch + +| Item | Value | +|------|--------| +| Live | `/home/hernani/koopa-decidim/` | +| Compose | `compose.yml` (mirror, no secrets) | +| Port | **9027** → Caddy | +| Site | https://decidim.hacktivism.ch/ | +| Image | `decidim/decidim:0.30.8` + postgres 16 + redis 7 + sidekiq | + +Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo. + +Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Bonfire/Castopod). Analog stack: `configs/castopod/`. + +```bash +cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d +~/koopa-decidim/bin/install-systemd.sh +~/koopa-decidim/bin/apply-branding.sh +``` + +Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (vhost `decidim.hacktivism.ch` → `127.0.0.1:9027`). + +This tree documents **this** instance only. Secrets stay in `koopa-admin-secrets` / host `~/koopa-decidim/{.env,users.env}`. diff --git a/configs/decidim/assets/img/favicon.svg b/configs/decidim/assets/img/favicon.svg new file mode 100644 index 0000000..e1d3dc3 --- /dev/null +++ b/configs/decidim/assets/img/favicon.svg @@ -0,0 +1,90 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/configs/decidim/assets/img/isoc-gold.png b/configs/decidim/assets/img/isoc-gold.png new file mode 100644 index 0000000..21ec52b Binary files /dev/null and b/configs/decidim/assets/img/isoc-gold.png differ diff --git a/configs/decidim/assets/img/logo.svg b/configs/decidim/assets/img/logo.svg new file mode 100644 index 0000000..e1d3dc3 --- /dev/null +++ b/configs/decidim/assets/img/logo.svg @@ -0,0 +1,90 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/configs/decidim/bin/apply-branding.sh b/configs/decidim/bin/apply-branding.sh new file mode 100755 index 0000000..6327fe3 --- /dev/null +++ b/configs/decidim/bin/apply-branding.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash +# Apply hacktivism colors + header CSS on the live organization. +set -euo pipefail +cd "${HOME}/koopa-decidim" +set -a +# shellcheck disable=SC1091 +source .env +# shellcheck disable=SC1091 +source users.env +set +a +podman exec \ + -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \ + -e DECIDIM_SYSTEM_EMAIL \ + -e DECIDIM_SYSTEM_PASSWORD \ + -e DECIDIM_ADMIN_EMAIL \ + -e DECIDIM_ADMIN_PASSWORD \ + -e DECIDIM_ADMIN_NAME \ + -e DECIDIM_APPLICATION_NAME \ + -e DECIDIM_DEFAULT_LOCALE \ + -e DECIDIM_AVAILABLE_LOCALES \ + koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb +echo "branding applied. public: https://decidim.hacktivism.ch/" diff --git a/configs/decidim/bin/install-systemd.sh b/configs/decidim/bin/install-systemd.sh new file mode 100755 index 0000000..76fefab --- /dev/null +++ b/configs/decidim/bin/install-systemd.sh @@ -0,0 +1,38 @@ +#!/usr/bin/env bash +# Install Decidim user systemd units on koopa (boot via linger). +set -euo pipefail +HERE="$(cd "$(dirname "$0")" && pwd)" +LIVE="${HOME}/koopa-decidim" +# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin +if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then + UNIT_SRC="${HERE}/../../configs/decidim" +elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then + UNIT_SRC="${LIVE}" +else + echo "ERROR: decidim unit files not found" >&2 + exit 1 +fi +UNIT_DIR="${HOME}/.config/systemd/user" + +mkdir -p "${UNIT_DIR}" +cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/" +cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/" + +systemctl --user daemon-reload +systemctl --user enable \ + container-koopa-decidim-db.service \ + container-koopa-decidim.service + +if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then + (cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d) +fi + +systemctl --user start \ + container-koopa-decidim-db.service \ + container-koopa-decidim.service + +systemctl --user --no-pager --lines=0 status \ + container-koopa-decidim-db.service \ + container-koopa-decidim.service || true + +echo "OK. Public: https://decidim.hacktivism.ch/" diff --git a/configs/decidim/bin/seed-example.sh b/configs/decidim/bin/seed-example.sh new file mode 100755 index 0000000..51f1dba --- /dev/null +++ b/configs/decidim/bin/seed-example.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash +# Publish public example process/meeting + optional isoc user from users.env. +set -euo pipefail +cd "${HOME}/koopa-decidim" +set -a +# shellcheck disable=SC1091 +source .env +# shellcheck disable=SC1091 +source users.env +set +a + +src="" +if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then + src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" +elif [ -f ./seed_example.rb ]; then + src="./seed_example.rb" +else + echo "ERROR: seed_example.rb not found" >&2 + exit 1 +fi +podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb + +avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}" +avatar_ctr="" +if [ -f "${avatar_host}" ]; then + avatar_ctr="/tmp/isoc-gold.png" + podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}" +fi + +podman exec \ + -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \ + -e DECIDIM_ADMIN_EMAIL \ + -e DECIDIM_ISOC_EMAIL \ + -e DECIDIM_ISOC_PASSWORD \ + -e DECIDIM_ISOC_NAME \ + -e DECIDIM_ISOC_NICKNAME \ + -e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \ + koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb +echo "seed done. public: https://decidim.hacktivism.ch/processes/example" diff --git a/configs/decidim/bin/up.sh b/configs/decidim/bin/up.sh new file mode 100755 index 0000000..21a6a9d --- /dev/null +++ b/configs/decidim/bin/up.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +set -euo pipefail +DIR="${HOME}/koopa-decidim" +cd "${DIR}" +set -a +# shellcheck disable=SC1091 +source .env +set +a +podman-compose up -d +echo "== wait for :9027 ==" +ok=0 +for i in $(seq 1 80); do + code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true) + echo "try $i: $code" + case "$code" in + 2*|3*) ok=1; break ;; + esac + sleep 5 +done +[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; } +echo "local ok. public: https://decidim.hacktivism.ch/" diff --git a/configs/decidim/bootstrap.rb b/configs/decidim/bootstrap.rb new file mode 100644 index 0000000..8ec96a1 --- /dev/null +++ b/configs/decidim/bootstrap.rb @@ -0,0 +1,78 @@ +# frozen_string_literal: true +# Create system admin + organization + org admin. Idempotent. +# Usage: bundle exec rails runner /code/lib/koopa_bootstrap.rb + +host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch") +sys_email = ENV.fetch("DECIDIM_SYSTEM_EMAIL") +sys_password = ENV.fetch("DECIDIM_SYSTEM_PASSWORD") +admin_email = ENV.fetch("DECIDIM_ADMIN_EMAIL") +admin_password = ENV.fetch("DECIDIM_ADMIN_PASSWORD") +admin_name = ENV.fetch("DECIDIM_ADMIN_NAME", "hacktivism") +org_name = ENV.fetch("DECIDIM_APPLICATION_NAME", "hacktivism") + +sys = Decidim::System::Admin.find_or_initialize_by(email: sys_email) +sys.password = sys_password +sys.password_confirmation = sys_password +sys.save! +puts "system admin: #{sys.email}" + +org = Decidim::Organization.find_by(host: host) +if org.nil? + attrs = { + host: host, + default_locale: ENV.fetch("DECIDIM_DEFAULT_LOCALE", "en"), + available_locales: ENV.fetch("DECIDIM_AVAILABLE_LOCALES", "en,de,fr").split(","), + reference_prefix: "HCK", + time_zone: "Europe/Zurich", + users_registration_mode: "enabled", + force_users_to_authenticate_before_access_organization: false, + available_authorizations: [], + tos_version: Time.current, + colors: { + "primary" => "#e8a838", + "secondary" => "#3ecfbf", + "tertiary" => "#3d3128", + "success" => "#16a34a", + "warning" => "#f0d090", + "alert" => "#e7131a" + }, + header_snippets: %() + } + name_val = { "en" => org_name, "de" => org_name, "fr" => org_name } + desc_val = { "en" => "hacktivism participatory platform", "de" => "hacktivism Partizipationsplattform", "fr" => "plateforme participative hacktivism" } + begin + org = Decidim::Organization.new(attrs.merge(name: name_val, description: desc_val)) + org.save! + rescue StandardError + org = Decidim::Organization.new(attrs.merge(name: org_name, description: "hacktivism participatory platform")) + org.save! + end + Decidim::System::CreateDefaultPages.call(org) if defined?(Decidim::System::CreateDefaultPages) + Decidim::System::CreateDefaultContentBlocks.call(org) if defined?(Decidim::System::CreateDefaultContentBlocks) + puts "organization created host=#{org.host}" +else + org.colors = { + "primary" => "#e8a838", + "secondary" => "#3ecfbf", + "tertiary" => "#3d3128", + "success" => "#16a34a", + "warning" => "#f0d090", + "alert" => "#e7131a" + } + org.header_snippets = %() + org.save! + puts "organization updated host=#{org.host}" +end + +user = Decidim::User.find_or_initialize_by(email: admin_email, organization: org) +user.name = admin_name +user.nickname = admin_name.downcase.gsub(/[^a-z0-9_]/, "")[0, 20] +user.password = admin_password +user.password_confirmation = admin_password +user.admin = true +user.confirmed_at ||= Time.current +user.tos_agreement = true +user.accepted_tos_version = org.tos_version +user.locale = org.default_locale +user.save! +puts "org admin: #{user.email}" diff --git a/configs/decidim/compose.yml b/configs/decidim/compose.yml new file mode 100644 index 0000000..980f990 --- /dev/null +++ b/configs/decidim/compose.yml @@ -0,0 +1,131 @@ +# koopa-decidim — Decidim behind host Caddy on :9027 +# Docs: https://docs.decidim.org/en/develop/install/ +# Image: official pre-generated app (core modules only). No secrets in this file. + +x-logging: &default-logging + driver: "json-file" + options: + max-size: "50m" + max-file: "4" + +x-app-env: &app-env + RAILS_ENV: production + RAILS_SERVE_STATIC_FILES: "true" + RAILS_LOG_TO_STDOUT: "true" + DATABASE_URL: postgres://decidim:${POSTGRES_PASSWORD}@postgres:5432/decidim + REDIS_URL: redis://redis:6379/0 + SECRET_KEY_BASE: ${SECRET_KEY_BASE} + DECIDIM_APPLICATION_NAME: ${DECIDIM_APPLICATION_NAME:-hacktivism} + DECIDIM_MAILER_SENDER: ${DECIDIM_MAILER_SENDER:-noreply@hacktivism.ch} + DECIDIM_AVAILABLE_LOCALES: ${DECIDIM_AVAILABLE_LOCALES:-en,de,fr} + DECIDIM_DEFAULT_LOCALE: ${DECIDIM_DEFAULT_LOCALE:-en} + SMTP_ADDRESS: ${SMTP_ADDRESS:-127.0.0.1} + SMTP_DOMAIN: ${SMTP_DOMAIN:-hacktivism.ch} + SMTP_USERNAME: ${SMTP_USERNAME:-unused} + SMTP_PASSWORD: ${SMTP_PASSWORD:-unused} + SMTP_PORT: ${SMTP_PORT:-25} + SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain} + QUEUE_ADAPTER: ${QUEUE_ADAPTER:-sidekiq} + +services: + decidim: + image: docker.io/decidim/decidim:0.30.8 + container_name: koopa-decidim + hostname: decidim + ports: + - "9027:3000" + env_file: + - .env + environment: + <<: *app-env + volumes: + - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro + - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro + - ./theme/hacktivism.css:/code/public/hacktivism.css:ro + - ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro + - ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro + - ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro + - decidim-storage:/code/storage + - decidim-uploads:/code/public/uploads + - decidim-tmp:/code/tmp + entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"] + command: ["bundle", "exec", "rails", "s", "-b", "0.0.0.0", "-p", "3000"] + restart: unless-stopped + logging: *default-logging + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_started + labels: + org.hacktivism.service: decidim + org.hacktivism.host_port: "9027" + org.hacktivism.site: decidim.hacktivism.ch + org.hacktivism.managed_by: koopa-admin + + sidekiq: + image: docker.io/decidim/decidim:0.30.8 + container_name: koopa-decidim-sidekiq + hostname: sidekiq + env_file: + - .env + environment: + <<: *app-env + volumes: + - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro + - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro + - decidim-storage:/code/storage + - decidim-uploads:/code/public/uploads + - decidim-tmp:/code/tmp + entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"] + command: ["bundle", "exec", "sidekiq", "-C", "config/sidekiq.yml"] + restart: unless-stopped + logging: *default-logging + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_started + labels: + org.hacktivism.service: decidim + org.hacktivism.managed_by: koopa-admin + + postgres: + image: docker.io/library/postgres:16-alpine + container_name: koopa-decidim-db + hostname: postgres + environment: + - POSTGRES_USER=decidim + - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} + - POSTGRES_DB=decidim + volumes: + - decidim-db:/var/lib/postgresql/data + restart: unless-stopped + logging: *default-logging + healthcheck: + test: ["CMD-SHELL", "pg_isready -U decidim -d decidim"] + interval: 5s + timeout: 5s + retries: 12 + labels: + org.hacktivism.service: decidim + org.hacktivism.managed_by: koopa-admin + + redis: + image: docker.io/library/redis:7-alpine + container_name: koopa-decidim-redis + hostname: redis + volumes: + - decidim-redis:/data + restart: unless-stopped + logging: *default-logging + labels: + org.hacktivism.service: decidim + org.hacktivism.managed_by: koopa-admin + +volumes: + decidim-db: + decidim-redis: + decidim-storage: + decidim-uploads: + decidim-tmp: diff --git a/configs/decidim/container-koopa-decidim-db.service b/configs/decidim/container-koopa-decidim-db.service new file mode 100644 index 0000000..c15c8c6 --- /dev/null +++ b/configs/decidim/container-koopa-decidim-db.service @@ -0,0 +1,21 @@ +# user systemd — Decidim postgres + redis +[Unit] +Description=Decidim postgres/redis (koopa-decidim-db) +Wants=network-online.target +After=network-online.target +RequiresMountsFor=%t/containers + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +RestartSec=20 +TimeoutStartSec=300 +TimeoutStopSec=120 +WorkingDirectory=/home/hernani/koopa-decidim +ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d postgres redis' +ExecStop=/usr/bin/podman stop -t 30 koopa-decidim-db koopa-decidim-redis +Type=oneshot +RemainAfterExit=yes + +[Install] +WantedBy=default.target diff --git a/configs/decidim/container-koopa-decidim.service b/configs/decidim/container-koopa-decidim.service new file mode 100644 index 0000000..c84ec49 --- /dev/null +++ b/configs/decidim/container-koopa-decidim.service @@ -0,0 +1,21 @@ +# user systemd — Decidim stack (app + sidekiq) +[Unit] +Description=Decidim stack (koopa-decidim) +Wants=network-online.target container-koopa-decidim-db.service +After=network-online.target container-koopa-decidim-db.service +RequiresMountsFor=%t/containers + +[Service] +Environment=PODMAN_SYSTEMD_UNIT=%n +Restart=on-failure +RestartSec=20 +TimeoutStartSec=600 +TimeoutStopSec=120 +WorkingDirectory=/home/hernani/koopa-decidim +ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d' +ExecStop=/usr/bin/podman stop -t 30 koopa-decidim koopa-decidim-sidekiq +Type=oneshot +RemainAfterExit=yes + +[Install] +WantedBy=default.target diff --git a/configs/decidim/entrypoint.sh b/configs/decidim/entrypoint.sh new file mode 100755 index 0000000..b7af36d --- /dev/null +++ b/configs/decidim/entrypoint.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# Wait for Postgres, migrate, then exec CMD (rails or sidekiq). +set -euo pipefail + +export RAILS_ENV="${RAILS_ENV:-production}" + +echo "koopa-decidim: waiting for postgres..." +i=0 +until bundle exec rails runner 'ActiveRecord::Base.connection.execute("SELECT 1")' >/dev/null 2>&1; do + i=$((i + 1)) + if [ "$i" -ge 60 ]; then + echo "koopa-decidim: postgres not ready after ${i} tries" >&2 + exit 1 + fi + sleep 3 +done + +echo "koopa-decidim: db:prepare" +bundle exec rails db:prepare + +echo "koopa-decidim: exec $*" +exec "$@" diff --git a/configs/decidim/seed_example.rb b/configs/decidim/seed_example.rb new file mode 100644 index 0000000..e51525c --- /dev/null +++ b/configs/decidim/seed_example.rb @@ -0,0 +1,247 @@ +# frozen_string_literal: true +# Public process + meeting + page + proposal (readable without an account). +# Optional participant from env: DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD. +# Optional avatar: DECIDIM_ISOC_AVATAR (PNG path inside the container). +# Usage: bundle exec rails runner /code/lib/koopa_seed_example.rb + +def t(en, de, fr) + { "en" => en, "de" => de, "fr" => fr } +end + +def fail_model!(record) + raise "#{record.class}: #{record.errors.full_messages.join("; ")}" +end + +host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch") +org = Decidim::Organization.find_by!(host: host) +admin = Decidim::User.find_by!(email: ENV.fetch("DECIDIM_ADMIN_EMAIL"), organization: org) + +org.update!(force_users_to_authenticate_before_access_organization: false) + +slug = "example" +process = Decidim::ParticipatoryProcess.find_or_initialize_by(organization: org, slug: slug) +process.assign_attributes( + title: t( + "Public digital commons", + "Öffentliche digitale Allmende", + "Communs numériques publics" + ), + subtitle: t( + "Which self-hosted services stay readable without an account?", + "Welche selbst gehosteten Dienste bleiben ohne Konto lesbar?", + "Quels services auto-hébergés restent lisibles sans compte ?" + ), + short_description: t( + "

hacktivism.ch already runs Lemmy, Bonfire, Castopod and Decidim. This process asks what must stay readable without a login — and what may require an account to write.

", + "

hacktivism.ch betreibt bereits Lemmy, Bonfire, Castopod und Decidim. Dieser Prozess fragt, was ohne Anmeldung lesbar bleiben muss — und wofür ein Konto zum Schreiben reicht.

", + "

hacktivism.ch fait déjà tourner Lemmy, Bonfire, Castopod et Decidim. Ce processus demande ce qui doit rester lisible sans compte — et ce qui peut exiger un compte pour écrire.

" + ), + description: t( + "

Reading civic material should not depend on creating an account. Writing (proposals, comments, votes) can.

" \ + "

Concrete questions:

Anyone can read this process. Sign in only to take part.

", + "

Öffentliches Beteiligungsmaterial soll ohne Konto lesbar sein. Schreiben (Vorschläge, Kommentare, Stimmen) kann ein Konto brauchen.

" \ + "

Konkrete Fragen:

Lesen ohne Anmeldung. Anmelden nur zum Mitmachen.

", + "

Lire du matériel civique ne doit pas exiger un compte. Écrire (propositions, commentaires, votes) peut le faire.

" \ + "

Questions concrètes :

Lecture sans compte. Connexion seulement pour participer.

" + ), + start_date: Date.current, + end_date: Date.current + 180, + published_at: process.published_at || Time.current, + private_space: false, + promoted: true, + scopes_enabled: false, + weight: 1 +) +process.save || fail_model!(process) +puts "process id=#{process.id} slug=#{process.slug} published=#{process.published_at}" + +step = process.steps.find_or_initialize_by(position: 1) +step.assign_attributes( + title: t("Open discussion", "Offene Diskussion", "Discussion ouverte"), + description: t( + "

Collect positions on public-by-default reading. No decision this step.

", + "

Positionen zum Lesen ohne Konto sammeln. In dieser Phase keine Entscheidung.

", + "

Recueillir les positions sur la lecture sans compte. Pas de décision à cette étape.

" + ), + start_date: Date.current, + end_date: Date.current + 180, + active: true +) +step.save || fail_model!(step) +puts "step id=#{step.id} active=#{step.active}" + +pages = Decidim::Component.find_or_initialize_by( + participatory_space: process, + manifest_name: "pages" +) +pages.assign_attributes( + name: t("Background", "Hintergrund", "Contexte"), + published_at: pages.published_at || Time.current, + visible: true, + weight: 0 +) +pages.save || fail_model!(pages) +page = Decidim::Pages::Page.find_or_initialize_by(component: pages) +page.body = t( + "

ISOC-style public-interest internet: people should inspect how a civic tool works without first handing over an identity.

" \ + "

On this instance the stock cookie banner is hidden; only essential consent is set. The same idea applies to participation spaces: the text of a process is not a privilege of registered users.

" \ + "

This page is part of that argument. It is published on purpose.

", + "

Internet im öffentlichen Interesse: man soll sehen können, wie ein Beteiligungswerkzeug arbeitet, ohne zuerst eine Identität abzugeben.

" \ + "

Auf dieser Instanz ist der Vorrats-Cookie-Banner ausgeblendet; es gilt nur essential. Dieselbe Idee gilt für Beteiligungsräume: der Text eines Prozesses ist kein Privileg registrierter Konten.

" \ + "

Diese Seite ist absichtlich öffentlich.

", + "

Internet d'intérêt public : on doit pouvoir voir comment un outil civique fonctionne sans d'abord céder une identité.

" \ + "

Ici, la bannière cookies par défaut est masquée ; seul l'essentiel est posé. Même idée pour les espaces de participation : le texte d'un processus n'est pas un privilège des comptes.

" \ + "

Cette page est publique volontairement.

" +) +page.save || fail_model!(page) +puts "pages component id=#{pages.id} page=#{page.id}" + +meetings = Decidim::Component.find_or_initialize_by( + participatory_space: process, + manifest_name: "meetings" +) +meetings.assign_attributes( + name: t("Meetings", "Treffen", "Rencontres"), + published_at: meetings.published_at || Time.current, + visible: true, + weight: 1 +) +meetings.save || fail_model!(meetings) +puts "meetings component id=#{meetings.id} published=#{meetings.published_at}" + +start_at = Time.current.utc.change(hour: 18, min: 0) + 7.days +finish_at = start_at + 2.hours +meeting = Decidim::Meetings::Meeting.find_or_initialize_by( + component: meetings, + author: admin +) +meeting.title = t( + "Open session: reading without an account", + "Offene Runde: Lesen ohne Konto", + "Séance ouverte : lire sans compte" +) +meeting.assign_attributes( + description: t( + "

Public agenda (no registration to read):

    " \ + "
  1. What is already public on hacktivism.ch (Lemmy, Decidim, Castopod).
    2. " \ + "
  2. Privacy by default — no tracker banner as a gate.
    3. " \ + "
  3. Where login is justified (writing, admin).
    4. " \ + "

Online / public. Signing in is optional.

", + "

Öffentliche Traktanden (Lesen ohne Anmeldung):

    " \ + "
  1. Was auf hacktivism.ch schon öffentlich ist (Lemmy, Decidim, Castopod).
    2. " \ + "
  2. Privatsphäre als Vorgabe — kein Tracker-Banner als Tür.
    3. " \ + "
  3. Wo ein Login gerechtfertigt ist (Schreiben, Admin).
    4. " \ + "

Online / öffentlich. Anmelden ist freiwillig.

", + "

Ordre du jour public (lecture sans inscription) :

    " \ + "
  1. Ce qui est déjà public sur hacktivism.ch (Lemmy, Decidim, Castopod).
    2. " \ + "
  2. Vie privée par défaut — pas de bannière traqueur comme porte.
    3. " \ + "
  3. Où un compte se justifie (écriture, admin).
    4. " \ + "

En ligne / public. Connexion facultative.

" + ), + start_time: meeting.start_time || start_at, + end_time: meeting.end_time || finish_at, + address: "hacktivism.ch", + location: t("Online, public stream notes", "Online, öffentliche Notizen", "En ligne, notes publiques"), + location_hints: t( + "No ticket. Page stays readable if you do not attend.", + "Kein Ticket. Die Seite bleibt lesbar, wenn man nicht teilnimmt.", + "Pas de billet. La page reste lisible sans y assister." + ), + type_of_meeting: "in_person", + registration_type: "registration_disabled", + registrations_enabled: false, + private_meeting: false, + transparent: true, + published_at: meeting.published_at || Time.current, + comments_enabled: true +) +meeting.save || fail_model!(meeting) +puts "meeting id=#{meeting.id} published=#{meeting.published_at} start=#{meeting.start_time}" + +proposals = Decidim::Component.find_or_initialize_by( + participatory_space: process, + manifest_name: "proposals" +) +proposals.assign_attributes( + name: t("Proposals", "Vorschläge", "Propositions"), + published_at: proposals.published_at || Time.current, + visible: true, + weight: 2 +) +proposals.save || fail_model!(proposals) + +proposal = Decidim::Proposals::Proposal.find_or_initialize_by(component: proposals) +if proposal.new_record? || proposal.title.blank? + proposal.title = t( + "Keep public processes readable without login", + "Öffentliche Prozesse ohne Anmeldung lesbar halten", + "Garder les processus publics lisibles sans connexion" + ) + proposal.body = t( + "

Decide as a standing rule: published process pages, meetings and this proposal list stay readable without an account. Login is only for creating or endorsing proposals, commenting, and administration.

", + "

Als Regel festhalten: veröffentlichte Prozessseiten, Treffen und diese Vorschlagsliste bleiben ohne Konto lesbar. Login nur zum Erstellen oder Unterstützen von Vorschlägen, Kommentieren und für die Administration.

", + "

En faire une règle : les pages de processus publiées, les rencontres et cette liste de propositions restent lisibles sans compte. Connexion seulement pour créer ou soutenir, commenter, et pour l'administration.

" + ) + proposal.add_coauthor(admin) + proposal.published_at = Time.current +end +proposal.save || fail_model!(proposal) +puts "proposal id=#{proposal.id} published=#{proposal.published_at}" + +block = Decidim::ContentBlock.find_or_initialize_by( + organization: org, + scope_name: "homepage", + manifest_name: "highlighted_processes" +) +block.weight ||= 45 +block.published_at ||= Time.current +block.save || fail_model!(block) +puts "homepage highlighted_processes published=#{block.published_at}" + +isoc_email = ENV["DECIDIM_ISOC_EMAIL"].to_s.strip +isoc_password = ENV["DECIDIM_ISOC_PASSWORD"].to_s +if isoc_email.empty? || isoc_password.empty? + puts "isoc user skipped (DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD unset)" +else + isoc = Decidim::User.find_or_initialize_by(email: isoc_email, organization: org) + isoc.name = ENV.fetch("DECIDIM_ISOC_NAME", "isoc") + isoc.nickname = ENV.fetch("DECIDIM_ISOC_NICKNAME", "isoc") + isoc.password = isoc_password + isoc.password_confirmation = isoc_password + isoc.admin = false + isoc.confirmed_at ||= Time.current + isoc.tos_agreement = true + isoc.accepted_tos_version = org.tos_version + isoc.locale = org.default_locale + isoc.save || fail_model!(isoc) + avatar_path = ENV["DECIDIM_ISOC_AVATAR"].to_s + if !avatar_path.empty? && File.file?(avatar_path) + isoc.avatar.purge if isoc.avatar.attached? + isoc.avatar.attach( + io: File.open(avatar_path, "rb"), + filename: "isoc-gold.png", + content_type: "image/png" + ) + isoc.save || fail_model!(isoc) + puts "isoc avatar attached from #{avatar_path} blob=#{isoc.avatar.blob&.byte_size}" + else + puts "isoc avatar skipped (DECIDIM_ISOC_AVATAR missing)" + end + puts "isoc user id=#{isoc.id} email=#{isoc.email} nick=#{isoc.nickname} admin=#{isoc.admin} confirmed=#{isoc.confirmed_at}" +end + +puts "public process: https://#{host}/processes/#{process.slug}" +puts "public meeting: https://#{host}/processes/#{process.slug}/f/#{meetings.id}/meetings/#{meeting.id}" +puts "public proposal: https://#{host}/processes/#{process.slug}/f/#{proposals.id}/proposals/#{proposal.id}" diff --git a/configs/decidim/theme/hacktivism-consent.js b/configs/decidim/theme/hacktivism-consent.js new file mode 100644 index 0000000..796f5d7 --- /dev/null +++ b/configs/decidim/theme/hacktivism-consent.js @@ -0,0 +1,10 @@ +/* Essential-only consent; banner hidden via CSS. */ +(function () { + var name = "decidim-consent"; + if (document.cookie.indexOf(name + "=") !== -1) return; + document.cookie = + name + + "=" + + encodeURIComponent(JSON.stringify({ essential: true })) + + "; path=/; max-age=31536000; SameSite=Lax"; +})(); diff --git a/configs/decidim/theme/hacktivism.css b/configs/decidim/theme/hacktivism.css new file mode 100644 index 0000000..f38e96d --- /dev/null +++ b/configs/decidim/theme/hacktivism.css @@ -0,0 +1,98 @@ +/* hacktivism — same palette as bonfire/git/lemmy (exchange-dark) */ +:root, +html { + --primary: #e8a838; + --primary-rgb: 232, 168, 56; + --secondary: #3ecfbf; + --secondary-rgb: 62, 207, 191; + --tertiary: #3d3128; + --success: #16a34a; + --warning: #f0d090; + --alert: #e7131a; + --highlight: #e8a838; +} + +html, +body { + background-color: #1a1410 !important; + background-image: + radial-gradient(ellipse 90% 55% at 50% 108%, rgba(26, 107, 110, 0.35) 0%, transparent 55%), + radial-gradient(circle 420px at 12% 18%, rgba(232, 168, 56, 0.22) 0%, transparent 62%), + linear-gradient(165deg, #2c1e14 0%, #1a1410 38%, #12181a 72%, #0e1c1e 100%) !important; + background-attachment: fixed !important; + color: #fff6e8 !important; +} + +a { + color: #e8a838 !important; +} +a:hover { + color: #f0d090 !important; +} + +.title-bar, +.main-bar, +.navbar, +.topbar, +header.header, +.main-nav, +.footer, +.mini-footer, +.off-canvas, +.sidebar { + background-color: #14110e !important; + color: #fff6e8 !important; + border-color: #2a2018 !important; +} + +.card, +.card__content, +.callout, +.flash, +.dialog, +.reveal, +.accordion-item, +.comment-thread, +.process-header, +.hero, +.home-section { + background-color: #221c16 !important; + color: #fff6e8 !important; + border-color: #2a2018 !important; +} + +.button, +.button.primary, +.button--sc, +input[type="submit"].button { + background-color: #e8a838 !important; + border-color: #e8a838 !important; + color: #1a1410 !important; +} + +.button.secondary { + background-color: #3d3128 !important; + border-color: #3d3128 !important; + color: #fff6e8 !important; +} + +h1, h2, h3, h4, h5, h6, +.title-bar__title, +.card__title { + color: #f0c86a !important; +} + +input, +textarea, +select, +.input-group-field { + background-color: #221c16 !important; + color: #fff6e8 !important; + border-color: #3d3128 !important; +} + +/* No third-party trackers; hide stock GDPR banner (privacy by default). */ +#dc-dialog-wrapper, +.cookies__container { + display: none !important; +} diff --git a/configs/decidim/theme/hacktivism.rb b/configs/decidim/theme/hacktivism.rb new file mode 100644 index 0000000..762e5d8 --- /dev/null +++ b/configs/decidim/theme/hacktivism.rb @@ -0,0 +1,14 @@ +# frozen_string_literal: true +# hacktivism theme + host allowlist for decidim.hacktivism.ch + +Rails.application.config.hosts << "decidim.hacktivism.ch" +Rails.application.config.hosts << "127.0.0.1" +Rails.application.config.hosts << "localhost" + +if Rails.application.config.respond_to?(:assume_ssl=) + Rails.application.config.assume_ssl = true +end + +Decidim.configure do |config| + config.enable_html_header_snippets = true if config.respond_to?(:enable_html_header_snippets=) +end diff --git a/configs/ports.md b/configs/ports.md index f8bdc8d..872d09c 100644 --- a/configs/ports.md +++ b/configs/ports.md @@ -18,12 +18,13 @@ | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** | | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** | | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** | +| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** | | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) | | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` | | 8080 | Tor ORPort | VeciGate: WAN **80→9000**, WAN **443→9001**. -Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}. +Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}. Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN. | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |