From a3334dbcf8bd3075a5afbb8f51b3252e36a1405c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Thu, 9 Jul 2026 10:44:08 +0200 Subject: [PATCH] bank landing: nginx :9013 + English intro (stats placeholders) --- configs/bank-landing/nginx-cors-stats.conf | 6 + configs/bank-landing/nginx-landing.conf | 55 +++++++++ configs/bank-landing/privacy.html | 137 +++++++++++++++++++++ configs/bank-landing/terms.html | 75 +++++++++++ 4 files changed, 273 insertions(+) create mode 100644 configs/bank-landing/nginx-cors-stats.conf create mode 100644 configs/bank-landing/nginx-landing.conf create mode 100644 configs/bank-landing/privacy.html create mode 100644 configs/bank-landing/terms.html diff --git a/configs/bank-landing/nginx-cors-stats.conf b/configs/bank-landing/nginx-cors-stats.conf new file mode 100644 index 0000000..6442861 --- /dev/null +++ b/configs/bank-landing/nginx-cors-stats.conf @@ -0,0 +1,6 @@ +# Snippet: CORS so exchange/merchant landings can fetch stats.json +# Include inside bank landing server { } or merge into bank-landing site. +# location for stats only: +# include /etc/nginx/snippets/goa-stats-cors.conf; (if placed as snippet) + +# Applied as extra location on :9013 bank-landing: diff --git a/configs/bank-landing/nginx-landing.conf b/configs/bank-landing/nginx-landing.conf new file mode 100644 index 0000000..a921dfb --- /dev/null +++ b/configs/bank-landing/nginx-landing.conf @@ -0,0 +1,55 @@ +# Bank landing — :9013 (behind Caddy :443 — never put 9013 in redirects) +server { + listen 9013; + listen [::]:9013; + server_name bank.hacktivism.ch _; + root /var/www/bank-landing; + index index.html; + + # Critical behind reverse_proxy: no :9013 in Location headers + absolute_redirect off; + port_in_redirect off; + + location = / { + return 302 /intro/; + } + location = /intro { + return 302 /intro/; + } + # Terms (same dark palette as merchant/exchange terms pages) + location = /terms { + alias /var/www/bank-landing/terms.html; + default_type text/html; + add_header Cache-Control "no-store" always; + } + location = /terms/ { + return 302 /terms; + } + location = /privacy { + alias /var/www/bank-landing/privacy.html; + default_type text/html; + add_header Cache-Control "no-store" always; + } + location = /privacy/ { + return 302 /privacy; + } + location /intro/ { + alias /var/www/bank-landing/; + } + location = /intro/stats.json { + alias /var/www/bank-landing/stats.json; + default_type application/json; + add_header Access-Control-Allow-Origin * always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Cache-Control "no-store" always; + } + location = /stats.json { + alias /var/www/bank-landing/stats.json; + default_type application/json; + add_header Access-Control-Allow-Origin * always; + add_header Cache-Control "no-store" always; + } + location / { + try_files $uri $uri/ =404; + } +} diff --git a/configs/bank-landing/privacy.html b/configs/bank-landing/privacy.html new file mode 100644 index 0000000..a7a3ae5 --- /dev/null +++ b/configs/bank-landing/privacy.html @@ -0,0 +1,137 @@ + + + + + + Privacy · GOA Bank · Swiss FADP + + + +
bank.hacktivism.ch · privacy · CH
+

Privacy notice · GOA Exploration Bank

+

+ This notice describes personal data processing for the self-hosted bank at + bank.hacktivism.ch under the Swiss Federal Act on Data Protection + (FADP / revDSG, in force since 1 Sep 2023). It is an + explorational service, not a licensed Swiss bank. +

+ +

1. Controller

+

Operators of the hacktivism.ch GNU Taler stack (GOA exploration deployment). + Contact via the operational channels published for this host. No separate DPO + is appointed for this experimental service.

+ +

2. Categories of data retained

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
DataExamplesTypical retention
Account identifiersUsername, account serial, registration timestampFor account lifetime + up to 12 months after deletion or archive wipe
Authentication secretsPassword hashes / tokens (not plaintext passwords)While account exists; tokens until expiry or revoke
Ledger / transactionsCredits, debits, amounts (GOA), subjects, counterparty account names, timestampsOperational retention for the service lifetime; may be wiped on stack reset
Balances & limitsAccount balance, debt limit, conversion flagsWhile account exists
Withdrawal operationsWithdrawal IDs, amounts, status (pending/selected/confirmed), reserve pub when knownUntil completed/aborted + short operational logs (days–weeks)
Technical logsHTTP access logs (IP, User-Agent, path, status), application logsTypically days to a few weeks (rotation); not used for marketing
Landing / demo artefactsPublic stats.json aggregates, demo withdraw URI stateStats overwritten continuously; demo URI until used or rotated
+

Not retained as payment content: wallet coin private keys (never sent to the bank). + Full browser history or device contacts are not collected by this bank service.

+ +

3. Purposes

+ + +

4. Legal basis (Swiss FADP)

+

Processing is necessary to provide the service requested by the user (account / withdraw) + and for overriding private interests of secure operation of an experimental public stack + (Art. 6 and 31 FADP principles: lawfulness, proportionality, purpose limitation).

+ +

5. Recipients & transfers

+ + +

6. Your rights (FADP)

+

Subject to legal limits: right to information/access, rectification, deletion, and to object + to processing. Contact the operators. You may lodge a complaint with the Swiss Federal Data + Protection and Information Commissioner (FDPIC / EDÖB).

+ +

7. Security

+

TLS in transit; access control on bank API; experimental service — no certified ISMS. + Do not store sensitive personal data in transaction subjects.

+ +

Related

+ + + + diff --git a/configs/bank-landing/terms.html b/configs/bank-landing/terms.html new file mode 100644 index 0000000..4a8f4ff --- /dev/null +++ b/configs/bank-landing/terms.html @@ -0,0 +1,75 @@ + + + + + + No Formal Terms · GOA Bank + + + +
bank.hacktivism.ch · GOA
+

No Formal Terms · GOA Exploration Bank

+

This is a self-hosted GNU Taler regional bank at + bank.hacktivism.ch (hacktivism.ch) for the explorational currency + GOA.

+

No formal terms of service apply beyond this short notice.

+ +
+ GOA · explorational + Not legal tender. No guaranteed real-world value, redemption, or convertibility. + Accounts and demo withdraws are for exploration of the GNU Taler stack only. +
+ +

By using this bank you acknowledge

+ +

If you do not agree, do not use this bank.

+ +

Related

+ + +

Privacy

+

Processing under Swiss FADP (revDSG). What data is retained + (accounts, ledger, logs, …) is listed on + /privacy.

+ + +