goa: backup docs under backups/goa before regio-ng

2026/2026-09-04--goa-backup-regio-ng.md

@@ -0,0 +1,97 @@
+# 2026-09-04 — GOA backup (pre regio-ng)
+
+## Live (koopa)
+
+| Container | Ports | Site |
+|-----------|-------|------|
+| `taler-hacktivism-exchange-ansible` | 9011/9014 | exchange.hacktivism.ch |
+| `taler-hacktivism-bank` | 9012/9013 | bank.hacktivism.ch |
+| `taler-hacktivism` | 9010/9015 | taler.hacktivism.ch |
+| `koopa-paivana` | 9025 | paivana.hacktivism.ch |
+
+Currency **GOA**. Master pub (public): `TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10`.
+
+Probes 2026-09-04: exchange/bank/taler `/config` **200**. Monitoring user units mostly failed (apps/ladder) — separate.
+
+**Risk:** exchange/bank/merchant data sit in container **overlay** (no named volumes). Offline key: `/var/lib/taler-exchange/offline/master.priv` inside exchange container.
+
+## Backup location (ERPNext-style `backups/` + stamp + `current`)
+
+| Host | Path |
+|------|------|
+| koopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
+| magikoopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
+| **secrets** (keys + `*.secret.conf` + host_vars/paivana) | `koopa-admin-secrets/backups/goa/<stamp>/` · `…/current` |
+
+Stamp taken: **`20260904T1238Z`**.
+
+### Non-secret dumps (`~/backups/goa/`)
+
+`exchange/` `bank/` `merchant/` TGZs (PG + etc), `meta/`, optional `images/` (~2.2G).
+
+### Secrets (`koopa-admin-secrets/backups/goa/current/`)
+
+| Path | Content |
+|------|---------|
+| `exchange-offline/master.priv` | offline master (pub TW6K5…) |
+| `exchange-offline/secm_tofus.pub` | secmod TOFU |
+| `exchange/secrets/*.secret.conf` | DB + wire account creds |
+| `merchant/secrets/merchant-db.secret.conf` | merchant DB |
+| `ansible/host_vars/` | public.yml + secrets.yml |
+| `paivana/secrets/` | merchant-access-token, paivana-secret |
+
+Never Forgejo push for `koopa-admin-secrets`. Magikoopa: `~/git/admin-logs/koopa-admin-secrets` (symlink `~/src/koopa/koopa-admin-secrets`).
+
+## Local reproduce (magikoopa) — **one** container, few unprivileged ports
+
+Not the three `goa-local-*` snapshot containers. Use **`regio-local`** only:
+
+| Bind | Role |
+|------|------|
+| `127.0.0.1:9080` | nginx HTTP (`Host: *.goa.local`) |
+| `127.0.0.1:9222` | SSH ansible |
+
+Optional: `REGIO_PUBLISH_KOOPA_PORTS=1` also binds `9010–9012` (still unprivileged).
+
+Tree: `~/src/regio-local/` — see `RESTORE.md`, `README.md`.
+
+### koopa lab ports (2026-09-04)
+
+Same stack **on koopa** without touching live **9010–9015** or **9080** (nym):
+
+| Bind | Role |
+|------|------|
+| `127.0.0.1:9180` | `goa-regio-ng` HTTP |
+| `127.0.0.1:9322` | `goa-regio-ng` SSH |
+| `127.0.0.1:8288` | `mytops-local` HTTP |
+
+Canonical config: **`configs/lab-local/`** (`goa-regio-ng-koopa.yml`, `mytops-local.toml`, README).
+
+### `taler-deployment` branches
+
+```
+dev/hernani/regio-ng-apt-refresh
+  └─ dev/hernani/regio-ng-ensure-postgresql
+       └─ regio-goa-explorational-currency   # GOA profile + master pin/import + TCP 901x
+```
+
+Example inventory: `regional-currency-ng/examples/goa-explorational.yml`  
+(imports `master.priv` from admin-secrets; refuses greenfield when pub pinned).
+
+### Restore flow
+
+```bash
+podman stop goa-local-exchange goa-local-bank goa-local-merchant   # free 901x; leave koopa live alone
+cd ~/src/regio-local
+./scripts/01-build-run.sh
+./scripts/02-inventory.sh
+./scripts/03-deploy.sh          # ansible; master from admin-secrets
+./scripts/05-restore-data.sh    # optional PG dumps from ~/backups/goa/current
+./scripts/04-probe.sh           # expect 200 on :9010 :9011 :9012
+```
+
+## Push
+
+`koopa-admin-log` Push nötig — nur mit Freigabe / User-Push.  
+`taler-deployment` branch `regio-goa-explorational-currency` likewise Freigabe.  
+Live wipe: **no**.