docs: reflect live koopa state (inventory + exchange-ansible)

Capture what is actually running on host koopa: podman names/ports,
Caddy vhosts, and hernani paths. Authoritative snapshot:
host/overview/LIVE.md.

Rename docs to live container taler-hacktivism-exchange-ansible
(not the short taler-exchange-hacktivism label). Add public-only
mirror of ~/ansible-taler-exchange deploy helpers (no secrets.yml).

configs/ports.md

@@ -7,9 +7,9 @@
 | 443 | systemd `https-proxy.socket` → Caddy **9001** |
 | 9000 | Caddy HTTP + ACME webroot |
 | 9001 | Caddy HTTPS (vhosts) |
-| 9010 | podman `taler-hacktivism` (merchant nginx TLS) — **not** in firewalld |
-| 9011 | podman `taler-exchange-hacktivism` (exchange httpd) — **not** in firewalld |
-| 9012 | podman `taler-bank-hacktivism` (libeufin-bank) — **not** in firewalld |
+| 9010 | podman `taler-hacktivism` (merchant) |
+| 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) |
+| 9012 | podman `taler-hacktivism-bank` (libeufin-bank) |
 | 9013–9015 | bank / exchange / merchant public landings |
 | 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` |
 | 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |

configs/taler-exchange-ansible/Containerfile

@@ -0,0 +1,26 @@
+FROM docker.io/library/debian:trixie
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update -yqq && \
+    apt-get install -yqq \
+                   ansible \
+		   cron \
+                   git \
+                   locales \
+                   openssh-server \
+                   python3 \
+                   python3-debian \
+                   systemd \
+                   whois # mkpasswd provided by whois package
+
+RUN mkdir -p /etc/ansible/facts.d
+
+#####################################################################
+## WARNING: THIS ALLOWS FOR COMPLETELY UNAUTHENTICATED SSH SESSIONS #
+####### FOR TESTING ENVIRONMENT ONLY! ###############################
+RUN echo "root:$(mkpasswd -s </dev/null)" | chpasswd -e
+RUN sed -i'' -e's/^#PermitRootLogin prohibit-password$/PermitRootLogin yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^#PasswordAuthentication yes$/PasswordAuthentication yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^#PermitEmptyPasswords no$/PermitEmptyPasswords yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^UsePAM yes/UsePAM no/' /etc/ssh/sshd_config

configs/taler-exchange-ansible/README.md

@@ -0,0 +1,33 @@
+# Exchange on koopa — Ansible-managed container
+
+**Live state reflected from host koopa** (not a full upstream clone of ansible-taler-exchange).
+
+| Item | Live on koopa |
+|------|----------------|
+| Container name | **`taler-hacktivism-exchange-ansible`** |
+| Image | `localhost/taler-hacktivism-exchange-ansible:landing` (build tag `:base`) |
+| Ports | **9011** (API), **9014** (landing/intro) |
+| Site | `https://exchange.hacktivism.ch` |
+| Tree | `/home/hernani/ansible-taler-exchange/` |
+| Secrets | `inventories/host_vars/.../secrets.yml` — **not** in admin-log |
+
+## Files here (mirrors / excerpts)
+
+| File | Role |
+|------|------|
+| `run-container-koopa.sh` | Build image, run systemd container `--name taler-hacktivism-exchange-ansible` |
+| `deploy-hacktivism-goa.sh` | `ansible-playbook` limit that host + public/secrets vars |
+| `Containerfile` | Debian + systemd base for the container |
+| `public.yml` | Non-secret host_vars for hacktivism GOA |
+| `inventories-default.snippet` | Inventory lines for the koopa container host |
+
+## Ops
+
+```bash
+cd ~/ansible-taler-exchange
+./run-container-koopa.sh          # recreate container if needed
+./deploy-hacktivism-goa.sh        # apply ansible (needs secrets.yml + vault)
+podman ps --filter name=taler-hacktivism-exchange-ansible
+```
+
+Full host inventory of all services: **`host/overview/LIVE.md`**.

configs/taler-exchange-ansible/deploy-hacktivism-goa.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Deploy event-currency GOA exchange (regional-currency flow + systemd).
+# Prerequisites on koopa:
+#   1) ./run-container-koopa.sh   # systemd container, port 9011
+#   2) this script
+# Inventory: ansible_connection=podman
+set -eu
+cd "$(dirname "$0")"
+export PATH="${HOME}/venv-ansible/bin:${PATH}"
+export ANSIBLE_HOST_KEY_CHECKING=False
+if [ ! -f vault_pass.txt ]; then
+  echo unused > vault_pass.txt
+fi
+
+# Refuse obvious non-systemd targets early
+if ! podman exec taler-hacktivism-exchange-ansible cat /proc/1/comm 2>/dev/null | grep -qx systemd; then
+  echo "error: container PID1 is not systemd. Run ./run-container-koopa.sh first." >&2
+  exit 1
+fi
+
+exec ansible-playbook -v \
+  --limit taler-hacktivism-exchange-ansible \
+  -e @inventories/host_vars/taler-hacktivism-exchange-ansible/public.yml \
+  -e @inventories/host_vars/taler-hacktivism-exchange-ansible/secrets.yml \
+  playbooks/setup-hacktivism-goa.yml

configs/taler-exchange-ansible/inventories-default.snippet

@@ -0,0 +1,6 @@
+# From live ~/ansible-taler-exchange/inventories/default (koopa lines only)
+# hacktivism GOA exchange: podman container on koopa (API host:9011; ansible via podman)
+taler-hacktivism-exchange-ansible ansible_connection=podman ansible_user=root
+
+[testing]
+taler-hacktivism-exchange-ansible

configs/taler-exchange-ansible/public.yml

@@ -0,0 +1,31 @@
+---
+# Event currency (GOA) — aligned with regional-currency without fiat.
+# Target: Caddy → host :9011 → container exchange.
+
+domain_name: "hacktivism.ch"
+exchange_domain: "exchange.hacktivism.ch"
+TARGET_HOST_NAME: "taler-hacktivism-exchange-ansible"
+
+taler_repo_suites: trixie
+
+# regional-currency style flags (systemd required)
+require_systemd: true
+do_conversion: false
+# greenfield with new offline key: set true after offline key exists in container
+do_offline: false
+exchange_account_id: "1"
+use_static_goa_coins: true
+exchange_wire_method: x-taler-bank
+
+CURRENCY: GOA
+CURRENCY_ROUND_UNIT: "GOA:0.00000001"
+EXCHANGE_BASE_URL: "https://exchange.hacktivism.ch/"
+EXCHANGE_HTTP_PORT: 9011
+
+EXCHANGE_MASTER_PUB: TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10
+
+EXCHANGE_TERMS_ETAG: "no-terms-v0"
+EXCHANGE_PP_ETAG: "no-privacy-v0"
+
+EXCHANGE_BANK_ACCOUNT_PAYTO: "payto://x-taler-bank/bank.hacktivism.ch/exchange?receiver-name=GOA%20Exchange"
+EXCHANGE_WIRE_GATEWAY_URL: "https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/"

configs/taler-exchange-ansible/run-container-koopa.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Recreate taler-hacktivism-exchange-ansible with systemd (regional-currency style).
+# Image: Containerfile (debian + systemd + ssh). Port: only 9011.
+# Ansible: ansible_connection=podman  →  systemctl inside container.
+set -euo pipefail
+
+NAME=taler-hacktivism-exchange-ansible
+IMAGE=localhost/taler-hacktivism-exchange-ansible:base
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+
+cd "$ROOT"
+podman build -f Containerfile -t "$IMAGE"
+
+echo "Stopping/removing existing $NAME (if any)..."
+podman rm -f "$NAME" 2>/dev/null || true
+
+podman run -d \
+  --name "$NAME" \
+  --hostname "$NAME" \
+  --network pasta \
+  --systemd=always \
+  -p 9011:9011 \
+  --label org.hacktivism.service=taler-exchange \
+  --label org.hacktivism.host_port=9011 \
+  --label org.hacktivism.site=exchange.hacktivism.ch \
+  --label org.hacktivism.currency=GOA \
+  --label org.hacktivism.managed_by=ansible-taler-exchange \
+  --label org.hacktivism.init=systemd \
+  "$IMAGE" \
+  /usr/sbin/init
+
+echo "waiting for systemd..."
+for i in $(seq 1 30); do
+  if podman exec "$NAME" systemctl is-system-running 2>/dev/null | grep -Eq 'running|degraded'; then
+    break
+  fi
+  sleep 1
+done
+
+podman ps --filter "name=$NAME" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}"
+echo -n "PID1: "
+podman exec "$NAME" cat /proc/1/comm
+echo -n "systemd: "
+podman exec "$NAME" systemctl is-system-running || true
+echo "Next: ./deploy-hacktivism-goa.sh"