diff --git a/2026/2026-07-10.md b/2026/2026-07-10.md index 3a6cd45..d554047 100644 --- a/2026/2026-07-10.md +++ b/2026/2026-07-10.md @@ -15,3 +15,4 @@ - admin-log: Tor relay mirror documented (`configs/tor/`, host/tor) - Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified) - Bonfire: republish foss outbox → Local users + public internet feeds; guest `/feed/local` shows posts +- Reflect live koopa state in admin-log: `host/overview/LIVE.md`, exchange name **taler-hacktivism-exchange-ansible**, ansible mirror diff --git a/README.md b/README.md index 7ef8298..68a5323 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ host/ # openSUSE host-level config + overview configs/ # mirrored app configs (caddy, taler, forgejo, …) taler-merchant/ # overrides + nginx (same tree style as exchange) taler-exchange/ # overrides + coins + taler-exchange-ansible/ # live koopa exchange container (ansible) forgejo/ # rootless git.hacktivism.ch castopod/ bonfire/ prime/ # compose mirrors (no secret values) tor/ # KoopaRelay ORPort 8080 @@ -36,19 +37,22 @@ scripts/ # merchant, exchange, monitoring helpers ## Live containers (podman) -| Name | Image / role | Host port | -|------|----------------|-----------| -| `taler-hacktivism` | merchant | **9010** | -| `taler-exchange-hacktivism` | exchange | **9011** | -| `taler-bank-hacktivism` | libeufin-bank (GOA, no IBAN) | **9012** | -| `koopa-castopod` (+ mariadb/redis) | Castopod Fediverse podcast | **9020** | -| `koopa-bonfire` (+ postgres) | Bonfire social | **9021** | -| `koopa-prime` (Jellyfin) | media | **9022** | -| qBittorrent (prime stack) | torrents | **9023** | -| `koopa-forgejo` (+ postgres) | **Forgejo rootless** git | **9024** (+ SSH **9200**) | +**Authoritative snapshot of host koopa:** [`host/overview/LIVE.md`](host/overview/LIVE.md) (refreshed from live). -Start model (Taler): **root** `/root/start_base_services_*` → shell as service user → `/usr/local/bin/start_*.sh [--restart]`. -Start model (user apps): `hernani` → `cd ~/koopa-{castopod,bonfire,prime,forgejo} && podman-compose up -d`. +| Name (podman) | Role | Host port | +|---------------|------|-----------| +| `taler-hacktivism` | merchant | **9010** (+ landing **9015**) | +| **`taler-hacktivism-exchange-ansible`** | exchange (Ansible/systemd) | **9011** (+ landing **9014**) | +| `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) | +| `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** | +| `koopa-bonfire` (+ postgres) | Bonfire | **9021** | +| `koopa-prime-jellyfin` | Jellyfin | **9022** | +| `koopa-prime-qbittorrent` | qBittorrent | **9023** | +| `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** | + +Start model (Taler merchant/bank): **root** `start_base_services_*` → `/usr/local/bin/start_*.sh`. +Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh` + `deploy-hacktivism-goa.sh`. +Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`. Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** (Caddy → 9010–9015 / 9020–**9024**; git-SSH host **9200** direct). diff --git a/configs/ports.md b/configs/ports.md index 926ac2b..bed754b 100644 --- a/configs/ports.md +++ b/configs/ports.md @@ -7,9 +7,9 @@ | 443 | systemd `https-proxy.socket` → Caddy **9001** | | 9000 | Caddy HTTP + ACME webroot | | 9001 | Caddy HTTPS (vhosts) | -| 9010 | podman `taler-hacktivism` (merchant nginx TLS) — **not** in firewalld | -| 9011 | podman `taler-exchange-hacktivism` (exchange httpd) — **not** in firewalld | -| 9012 | podman `taler-bank-hacktivism` (libeufin-bank) — **not** in firewalld | +| 9010 | podman `taler-hacktivism` (merchant) | +| 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) | +| 9012 | podman `taler-hacktivism-bank` (libeufin-bank) | | 9013–9015 | bank / exchange / merchant public landings | | 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` | | 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` | diff --git a/configs/taler-exchange-ansible/Containerfile b/configs/taler-exchange-ansible/Containerfile new file mode 100644 index 0000000..1f0e667 --- /dev/null +++ b/configs/taler-exchange-ansible/Containerfile @@ -0,0 +1,26 @@ +FROM docker.io/library/debian:trixie + +ENV DEBIAN_FRONTEND=noninteractive + +RUN apt-get update -yqq && \ + apt-get install -yqq \ + ansible \ + cron \ + git \ + locales \ + openssh-server \ + python3 \ + python3-debian \ + systemd \ + whois # mkpasswd provided by whois package + +RUN mkdir -p /etc/ansible/facts.d + +##################################################################### +## WARNING: THIS ALLOWS FOR COMPLETELY UNAUTHENTICATED SSH SESSIONS # +####### FOR TESTING ENVIRONMENT ONLY! ############################### +RUN echo "root:$(mkpasswd -s vault_pass.txt +fi + +# Refuse obvious non-systemd targets early +if ! podman exec taler-hacktivism-exchange-ansible cat /proc/1/comm 2>/dev/null | grep -qx systemd; then + echo "error: container PID1 is not systemd. Run ./run-container-koopa.sh first." >&2 + exit 1 +fi + +exec ansible-playbook -v \ + --limit taler-hacktivism-exchange-ansible \ + -e @inventories/host_vars/taler-hacktivism-exchange-ansible/public.yml \ + -e @inventories/host_vars/taler-hacktivism-exchange-ansible/secrets.yml \ + playbooks/setup-hacktivism-goa.yml diff --git a/configs/taler-exchange-ansible/inventories-default.snippet b/configs/taler-exchange-ansible/inventories-default.snippet new file mode 100644 index 0000000..ae62297 --- /dev/null +++ b/configs/taler-exchange-ansible/inventories-default.snippet @@ -0,0 +1,6 @@ +# From live ~/ansible-taler-exchange/inventories/default (koopa lines only) +# hacktivism GOA exchange: podman container on koopa (API host:9011; ansible via podman) +taler-hacktivism-exchange-ansible ansible_connection=podman ansible_user=root + +[testing] +taler-hacktivism-exchange-ansible diff --git a/configs/taler-exchange-ansible/public.yml b/configs/taler-exchange-ansible/public.yml new file mode 100644 index 0000000..a580052 --- /dev/null +++ b/configs/taler-exchange-ansible/public.yml @@ -0,0 +1,31 @@ +--- +# Event currency (GOA) — aligned with regional-currency without fiat. +# Target: Caddy → host :9011 → container exchange. + +domain_name: "hacktivism.ch" +exchange_domain: "exchange.hacktivism.ch" +TARGET_HOST_NAME: "taler-hacktivism-exchange-ansible" + +taler_repo_suites: trixie + +# regional-currency style flags (systemd required) +require_systemd: true +do_conversion: false +# greenfield with new offline key: set true after offline key exists in container +do_offline: false +exchange_account_id: "1" +use_static_goa_coins: true +exchange_wire_method: x-taler-bank + +CURRENCY: GOA +CURRENCY_ROUND_UNIT: "GOA:0.00000001" +EXCHANGE_BASE_URL: "https://exchange.hacktivism.ch/" +EXCHANGE_HTTP_PORT: 9011 + +EXCHANGE_MASTER_PUB: TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10 + +EXCHANGE_TERMS_ETAG: "no-terms-v0" +EXCHANGE_PP_ETAG: "no-privacy-v0" + +EXCHANGE_BANK_ACCOUNT_PAYTO: "payto://x-taler-bank/bank.hacktivism.ch/exchange?receiver-name=GOA%20Exchange" +EXCHANGE_WIRE_GATEWAY_URL: "https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/" diff --git a/configs/taler-exchange-ansible/run-container-koopa.sh b/configs/taler-exchange-ansible/run-container-koopa.sh new file mode 100755 index 0000000..88049c0 --- /dev/null +++ b/configs/taler-exchange-ansible/run-container-koopa.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# Recreate taler-hacktivism-exchange-ansible with systemd (regional-currency style). +# Image: Containerfile (debian + systemd + ssh). Port: only 9011. +# Ansible: ansible_connection=podman → systemctl inside container. +set -euo pipefail + +NAME=taler-hacktivism-exchange-ansible +IMAGE=localhost/taler-hacktivism-exchange-ansible:base +ROOT="$(cd "$(dirname "$0")" && pwd)" + +cd "$ROOT" +podman build -f Containerfile -t "$IMAGE" + +echo "Stopping/removing existing $NAME (if any)..." +podman rm -f "$NAME" 2>/dev/null || true + +podman run -d \ + --name "$NAME" \ + --hostname "$NAME" \ + --network pasta \ + --systemd=always \ + -p 9011:9011 \ + --label org.hacktivism.service=taler-exchange \ + --label org.hacktivism.host_port=9011 \ + --label org.hacktivism.site=exchange.hacktivism.ch \ + --label org.hacktivism.currency=GOA \ + --label org.hacktivism.managed_by=ansible-taler-exchange \ + --label org.hacktivism.init=systemd \ + "$IMAGE" \ + /usr/sbin/init + +echo "waiting for systemd..." +for i in $(seq 1 30); do + if podman exec "$NAME" systemctl is-system-running 2>/dev/null | grep -Eq 'running|degraded'; then + break + fi + sleep 1 +done + +podman ps --filter "name=$NAME" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}" +echo -n "PID1: " +podman exec "$NAME" cat /proc/1/comm +echo -n "systemd: " +podman exec "$NAME" systemctl is-system-running || true +echo "Next: ./deploy-hacktivism-goa.sh" diff --git a/host/overview/LIVE.md b/host/overview/LIVE.md new file mode 100644 index 0000000..481a953 --- /dev/null +++ b/host/overview/LIVE.md @@ -0,0 +1,84 @@ +# Live inventory — koopa (2026-07-10) + +Snapshot of **what runs on host koopa** (openSUSE Tumbleweed). No secrets. + +Refresh command ideas: + +```bash +hostname; date -R +podman ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' +systemctl is-active caddy tor +ss -lntp | grep -E '90[0-9]{2}|9200|8080' +``` + +## Host + +| Item | Value | +|------|--------| +| Hostname | `koopa` | +| Role | App host behind VeciGate (WAN :80→9000, :443→9001) | +| Edge | Caddy **9000/9001**, systemd socket proxies **80/443** | +| Tor | `tor.service` ORPort **8080**, ControlPort **9051** (localhost) | + +## Running podman containers + +| Name | Image | Ports (host) | Public site | +|------|--------|--------------|-------------| +| `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` | +| **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` | +| `taler-hacktivism-bank` | `localhost/taler-hacktivism-banking:live` | **9012**, **9013** | `bank.hacktivism.ch` | +| `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` | +| `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` | +| `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` | +| `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` | +| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` | + +### Naming note (exchange) + +Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-exchange-hacktivism` / not without `-ansible`). +Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`). + +## Caddy vhosts → backends + +| Host | Backend | +|------|---------| +| `taler.hacktivism.ch` | 9010 (API) + 9015 (`/intro`) | +| `exchange.hacktivism.ch` | 9011 + 9014 (`/intro`) | +| `bank.hacktivism.ch` | 9012 + 9013 (`/intro`, terms, privacy) | +| `castopod.hacktivism.ch` | 9020 | +| `bonfire.hacktivism.ch` | 9021 | +| `prime.hacktivism.ch` | 9022 | +| `bt.hacktivism.ch` | 9023 | +| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct | + +Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). Apply: `~/koopa-caddy/apply.sh`. + +## Paths on host (`hernani`) + +| Path | Role | +|------|------| +| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container | +| `~/koopa-castopod/` | Castopod compose | +| `~/koopa-bonfire/` | Bonfire compose + gitbot | +| `~/koopa-prime/` | Jellyfin + qBittorrent | +| `~/koopa-forgejo/` | Forgejo rootless | +| `~/koopa-caddy/` | Desired Caddyfile + `apply.sh` | + +## Start models + +| Stack | How | +|-------|-----| +| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` | +| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` | +| User apps | `cd ~/koopa-* && podman-compose up -d` | + +## Related docs in this repo + +| Topic | Doc | +|-------|-----| +| Ports | `configs/ports.md` | +| Diagram | `host/overview/services.md` | +| Exchange Ansible (koopa) | `configs/taler-exchange-ansible/` | +| Forgejo | `2026/2026-07-10--forgejo-rootless.md` | +| Bonfire public feeds | `configs/bonfire/public-feeds.md` | +| Castopod content | `2026/2026-07-09--castopod-content.md` | diff --git a/host/overview/services.md b/host/overview/services.md index 4b5d43c..03e4c69 100644 --- a/host/overview/services.md +++ b/host/overview/services.md @@ -1,6 +1,8 @@ # Service overview — koopa -## Diagram +**Live container/port inventory:** [`LIVE.md`](LIVE.md) (state as observed on host). + +Diagram ```mermaid flowchart TB @@ -26,7 +28,7 @@ flowchart TB subgraph Podman["podman rootless (hernani)"] Merch["taler-hacktivism\n:9010"] - Exch["taler-exchange-hacktivism\n:9011"] + Exch["taler-hacktivism-exchange-ansible\n:9011"] Bank["taler-bank-hacktivism\n:9012"] Castopod["koopa-castopod\n:9020"] Bonfire["koopa-bonfire\n:9021"]