docs: reflect live koopa state (inventory + exchange-ansible)

Capture what is actually running on host koopa: podman names/ports, Caddy vhosts, and hernani paths. Authoritative snapshot: host/overview/LIVE.md. Rename docs to live container taler-hacktivism-exchange-ansible (not the short taler-exchange-hacktivism label). Add public-only mirror of ~/ansible-taler-exchange deploy helpers (no secrets.yml).
2026-07-10 16:00:24 +02:00 · 2026-07-10 16:00:24 +02:00 · b5c1bf7591
commit b5c1bf7591
parent 549ca638e8
11 changed files with 274 additions and 17 deletions
--- a/2026/2026-07-10.md
+++ b/2026/2026-07-10.md
@ -15,3 +15,4 @@
 - admin-log: Tor relay mirror documented (`configs/tor/`, host/tor)
 - Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified)
 - Bonfire: republish foss outbox → Local users + public internet feeds; guest `/feed/local` shows posts
+- Reflect live koopa state in admin-log: `host/overview/LIVE.md`, exchange name **taler-hacktivism-exchange-ansible**, ansible mirror
--- a/README.md
+++ b/README.md
@ -25,6 +25,7 @@ host/                      # openSUSE host-level config + overview
 configs/                   # mirrored app configs (caddy, taler, forgejo, …)
  taler-merchant/          # overrides + nginx (same tree style as exchange)
  taler-exchange/          # overrides + coins
+  taler-exchange-ansible/  # live koopa exchange container (ansible)
  forgejo/                 # rootless git.hacktivism.ch
  castopod/ bonfire/ prime/ # compose mirrors (no secret values)
  tor/                     # KoopaRelay ORPort 8080
@ -36,19 +37,22 @@ scripts/                   # merchant, exchange, monitoring helpers

 ## Live containers (podman)

-| Name | Image / role | Host port |
-|------|----------------|-----------|
-| `taler-hacktivism` | merchant | **9010** |
-| `taler-exchange-hacktivism` | exchange | **9011** |
-| `taler-bank-hacktivism` | libeufin-bank (GOA, no IBAN) | **9012** |
-| `koopa-castopod` (+ mariadb/redis) | Castopod Fediverse podcast | **9020** |
-| `koopa-bonfire` (+ postgres) | Bonfire social | **9021** |
-| `koopa-prime` (Jellyfin) | media | **9022** |
-| qBittorrent (prime stack) | torrents | **9023** |
-| `koopa-forgejo` (+ postgres) | **Forgejo rootless** git | **9024** (+ SSH **9200**) |
+**Authoritative snapshot of host koopa:** [`host/overview/LIVE.md`](host/overview/LIVE.md) (refreshed from live).

-Start model (Taler): **root** `/root/start_base_services_*` → shell as service user → `/usr/local/bin/start_*.sh [--restart]`.  
-Start model (user apps): `hernani` → `cd ~/koopa-{castopod,bonfire,prime,forgejo} && podman-compose up -d`.
+| Name (podman) | Role | Host port |
+|---------------|------|-----------|
+| `taler-hacktivism` | merchant | **9010** (+ landing **9015**) |
+| **`taler-hacktivism-exchange-ansible`** | exchange (Ansible/systemd) | **9011** (+ landing **9014**) |
+| `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) |
+| `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** |
+| `koopa-bonfire` (+ postgres) | Bonfire | **9021** |
+| `koopa-prime-jellyfin` | Jellyfin | **9022** |
+| `koopa-prime-qbittorrent` | qBittorrent | **9023** |
+| `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** |
+
+Start model (Taler merchant/bank): **root** `start_base_services_*` → `/usr/local/bin/start_*.sh`.  
+Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh` + `deploy-hacktivism-goa.sh`.  
+Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.

 Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`**  
 (Caddy → 9010–9015 / 9020–**9024**; git-SSH host **9200** direct).
--- a/configs/ports.md
+++ b/configs/ports.md
@ -7,9 +7,9 @@
 | 443 | systemd `https-proxy.socket` → Caddy **9001** |
 | 9000 | Caddy HTTP + ACME webroot |
 | 9001 | Caddy HTTPS (vhosts) |
-| 9010 | podman `taler-hacktivism` (merchant nginx TLS) — **not** in firewalld |
-| 9011 | podman `taler-exchange-hacktivism` (exchange httpd) — **not** in firewalld |
-| 9012 | podman `taler-bank-hacktivism` (libeufin-bank) — **not** in firewalld |
+| 9010 | podman `taler-hacktivism` (merchant) |
+| 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) |
+| 9012 | podman `taler-hacktivism-bank` (libeufin-bank) |
 | 9013–9015 | bank / exchange / merchant public landings |
 | 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` |
 | 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |
--- a/configs/taler-exchange-ansible/Containerfile
+++ b/configs/taler-exchange-ansible/Containerfile
@ -0,0 +1,26 @@
+FROM docker.io/library/debian:trixie
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update -yqq && \
+    apt-get install -yqq \
+                   ansible \
+		   cron \
+                   git \
+                   locales \
+                   openssh-server \
+                   python3 \
+                   python3-debian \
+                   systemd \
+                   whois # mkpasswd provided by whois package
+
+RUN mkdir -p /etc/ansible/facts.d
+
+#####################################################################
+## WARNING: THIS ALLOWS FOR COMPLETELY UNAUTHENTICATED SSH SESSIONS #
+####### FOR TESTING ENVIRONMENT ONLY! ###############################
+RUN echo "root:$(mkpasswd -s </dev/null)" | chpasswd -e
+RUN sed -i'' -e's/^#PermitRootLogin prohibit-password$/PermitRootLogin yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^#PasswordAuthentication yes$/PasswordAuthentication yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^#PermitEmptyPasswords no$/PermitEmptyPasswords yes/' /etc/ssh/sshd_config \
+        && sed -i'' -e's/^UsePAM yes/UsePAM no/' /etc/ssh/sshd_config
--- a/configs/taler-exchange-ansible/README.md
+++ b/configs/taler-exchange-ansible/README.md
@ -0,0 +1,33 @@
+# Exchange on koopa — Ansible-managed container
+
+**Live state reflected from host koopa** (not a full upstream clone of ansible-taler-exchange).
+
+| Item | Live on koopa |
+|------|----------------|
+| Container name | **`taler-hacktivism-exchange-ansible`** |
+| Image | `localhost/taler-hacktivism-exchange-ansible:landing` (build tag `:base`) |
+| Ports | **9011** (API), **9014** (landing/intro) |
+| Site | `https://exchange.hacktivism.ch` |
+| Tree | `/home/hernani/ansible-taler-exchange/` |
+| Secrets | `inventories/host_vars/.../secrets.yml` — **not** in admin-log |
+
+## Files here (mirrors / excerpts)
+
+| File | Role |
+|------|------|
+| `run-container-koopa.sh` | Build image, run systemd container `--name taler-hacktivism-exchange-ansible` |
+| `deploy-hacktivism-goa.sh` | `ansible-playbook` limit that host + public/secrets vars |
+| `Containerfile` | Debian + systemd base for the container |
+| `public.yml` | Non-secret host_vars for hacktivism GOA |
+| `inventories-default.snippet` | Inventory lines for the koopa container host |
+
+## Ops
+
+```bash
+cd ~/ansible-taler-exchange
+./run-container-koopa.sh          # recreate container if needed
+./deploy-hacktivism-goa.sh        # apply ansible (needs secrets.yml + vault)
+podman ps --filter name=taler-hacktivism-exchange-ansible
+```
+
+Full host inventory of all services: **`host/overview/LIVE.md`**.
--- a/configs/taler-exchange-ansible/deploy-hacktivism-goa.sh
+++ b/configs/taler-exchange-ansible/deploy-hacktivism-goa.sh
@ -0,0 +1,25 @@
+#!/bin/sh
+# Deploy event-currency GOA exchange (regional-currency flow + systemd).
+# Prerequisites on koopa:
+#   1) ./run-container-koopa.sh   # systemd container, port 9011
+#   2) this script
+# Inventory: ansible_connection=podman
+set -eu
+cd "$(dirname "$0")"
+export PATH="${HOME}/venv-ansible/bin:${PATH}"
+export ANSIBLE_HOST_KEY_CHECKING=False
+if [ ! -f vault_pass.txt ]; then
+  echo unused > vault_pass.txt
+fi
+
+# Refuse obvious non-systemd targets early
+if ! podman exec taler-hacktivism-exchange-ansible cat /proc/1/comm 2>/dev/null | grep -qx systemd; then
+  echo "error: container PID1 is not systemd. Run ./run-container-koopa.sh first." >&2
+  exit 1
+fi
+
+exec ansible-playbook -v \
+  --limit taler-hacktivism-exchange-ansible \
+  -e @inventories/host_vars/taler-hacktivism-exchange-ansible/public.yml \
+  -e @inventories/host_vars/taler-hacktivism-exchange-ansible/secrets.yml \
+  playbooks/setup-hacktivism-goa.yml
--- a/configs/taler-exchange-ansible/inventories-default.snippet
+++ b/configs/taler-exchange-ansible/inventories-default.snippet
@ -0,0 +1,6 @@
+# From live ~/ansible-taler-exchange/inventories/default (koopa lines only)
+# hacktivism GOA exchange: podman container on koopa (API host:9011; ansible via podman)
+taler-hacktivism-exchange-ansible ansible_connection=podman ansible_user=root
+
+[testing]
+taler-hacktivism-exchange-ansible
--- a/configs/taler-exchange-ansible/public.yml
+++ b/configs/taler-exchange-ansible/public.yml
@ -0,0 +1,31 @@
+---
+# Event currency (GOA) — aligned with regional-currency without fiat.
+# Target: Caddy → host :9011 → container exchange.
+
+domain_name: "hacktivism.ch"
+exchange_domain: "exchange.hacktivism.ch"
+TARGET_HOST_NAME: "taler-hacktivism-exchange-ansible"
+
+taler_repo_suites: trixie
+
+# regional-currency style flags (systemd required)
+require_systemd: true
+do_conversion: false
+# greenfield with new offline key: set true after offline key exists in container
+do_offline: false
+exchange_account_id: "1"
+use_static_goa_coins: true
+exchange_wire_method: x-taler-bank
+
+CURRENCY: GOA
+CURRENCY_ROUND_UNIT: "GOA:0.00000001"
+EXCHANGE_BASE_URL: "https://exchange.hacktivism.ch/"
+EXCHANGE_HTTP_PORT: 9011
+
+EXCHANGE_MASTER_PUB: TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10
+
+EXCHANGE_TERMS_ETAG: "no-terms-v0"
+EXCHANGE_PP_ETAG: "no-privacy-v0"
+
+EXCHANGE_BANK_ACCOUNT_PAYTO: "payto://x-taler-bank/bank.hacktivism.ch/exchange?receiver-name=GOA%20Exchange"
+EXCHANGE_WIRE_GATEWAY_URL: "https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/"
--- a/configs/taler-exchange-ansible/run-container-koopa.sh
+++ b/configs/taler-exchange-ansible/run-container-koopa.sh
@ -0,0 +1,45 @@
+#!/bin/bash
+# Recreate taler-hacktivism-exchange-ansible with systemd (regional-currency style).
+# Image: Containerfile (debian + systemd + ssh). Port: only 9011.
+# Ansible: ansible_connection=podman  →  systemctl inside container.
+set -euo pipefail
+
+NAME=taler-hacktivism-exchange-ansible
+IMAGE=localhost/taler-hacktivism-exchange-ansible:base
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+
+cd "$ROOT"
+podman build -f Containerfile -t "$IMAGE"
+
+echo "Stopping/removing existing $NAME (if any)..."
+podman rm -f "$NAME" 2>/dev/null || true
+
+podman run -d \
+  --name "$NAME" \
+  --hostname "$NAME" \
+  --network pasta \
+  --systemd=always \
+  -p 9011:9011 \
+  --label org.hacktivism.service=taler-exchange \
+  --label org.hacktivism.host_port=9011 \
+  --label org.hacktivism.site=exchange.hacktivism.ch \
+  --label org.hacktivism.currency=GOA \
+  --label org.hacktivism.managed_by=ansible-taler-exchange \
+  --label org.hacktivism.init=systemd \
+  "$IMAGE" \
+  /usr/sbin/init
+
+echo "waiting for systemd..."
+for i in $(seq 1 30); do
+  if podman exec "$NAME" systemctl is-system-running 2>/dev/null | grep -Eq 'running|degraded'; then
+    break
+  fi
+  sleep 1
+done
+
+podman ps --filter "name=$NAME" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}"
+echo -n "PID1: "
+podman exec "$NAME" cat /proc/1/comm
+echo -n "systemd: "
+podman exec "$NAME" systemctl is-system-running || true
+echo "Next: ./deploy-hacktivism-goa.sh"
--- a/host/overview/LIVE.md
+++ b/host/overview/LIVE.md
@ -0,0 +1,84 @@
+# Live inventory — koopa (2026-07-10)
+
+Snapshot of **what runs on host koopa** (openSUSE Tumbleweed). No secrets.
+
+Refresh command ideas:
+
+```bash
+hostname; date -R
+podman ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'
+systemctl is-active caddy tor
+ss -lntp | grep -E '90[0-9]{2}|9200|8080'
+```
+
+## Host
+
+| Item | Value |
+|------|--------|
+| Hostname | `koopa` |
+| Role | App host behind VeciGate (WAN :80→9000, :443→9001) |
+| Edge | Caddy **9000/9001**, systemd socket proxies **80/443** |
+| Tor | `tor.service` ORPort **8080**, ControlPort **9051** (localhost) |
+
+## Running podman containers
+
+| Name | Image | Ports (host) | Public site |
+|------|--------|--------------|-------------|
+| `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` |
+| **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` |
+| `taler-hacktivism-bank` | `localhost/taler-hacktivism-banking:live` | **9012**, **9013** | `bank.hacktivism.ch` |
+| `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` |
+| `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` |
+| `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` |
+| `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` |
+| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
+
+### Naming note (exchange)
+
+Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-exchange-hacktivism` / not without `-ansible`).  
+Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`).
+
+## Caddy vhosts → backends
+
+| Host | Backend |
+|------|---------|
+| `taler.hacktivism.ch` | 9010 (API) + 9015 (`/intro`) |
+| `exchange.hacktivism.ch` | 9011 + 9014 (`/intro`) |
+| `bank.hacktivism.ch` | 9012 + 9013 (`/intro`, terms, privacy) |
+| `castopod.hacktivism.ch` | 9020 |
+| `bonfire.hacktivism.ch` | 9021 |
+| `prime.hacktivism.ch` | 9022 |
+| `bt.hacktivism.ch` | 9023 |
+| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
+
+Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). Apply: `~/koopa-caddy/apply.sh`.
+
+## Paths on host (`hernani`)
+
+| Path | Role |
+|------|------|
+| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
+| `~/koopa-castopod/` | Castopod compose |
+| `~/koopa-bonfire/` | Bonfire compose + gitbot |
+| `~/koopa-prime/` | Jellyfin + qBittorrent |
+| `~/koopa-forgejo/` | Forgejo rootless |
+| `~/koopa-caddy/` | Desired Caddyfile + `apply.sh` |
+
+## Start models
+
+| Stack | How |
+|-------|-----|
+| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` |
+| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` |
+| User apps | `cd ~/koopa-* && podman-compose up -d` |
+
+## Related docs in this repo
+
+| Topic | Doc |
+|-------|-----|
+| Ports | `configs/ports.md` |
+| Diagram | `host/overview/services.md` |
+| Exchange Ansible (koopa) | `configs/taler-exchange-ansible/` |
+| Forgejo | `2026/2026-07-10--forgejo-rootless.md` |
+| Bonfire public feeds | `configs/bonfire/public-feeds.md` |
+| Castopod content | `2026/2026-07-09--castopod-content.md` |
--- a/host/overview/services.md
+++ b/host/overview/services.md
@ -1,6 +1,8 @@
 # Service overview — koopa

-## Diagram
+**Live container/port inventory:** [`LIVE.md`](LIVE.md) (state as observed on host).
+
+Diagram

 ```mermaid
 flowchart TB
@ -26,7 +28,7 @@ flowchart TB

    subgraph Podman["podman rootless (hernani)"]
      Merch["taler-hacktivism\n:9010"]
-      Exch["taler-exchange-hacktivism\n:9011"]
+      Exch["taler-hacktivism-exchange-ansible\n:9011"]
      Bank["taler-bank-hacktivism\n:9012"]
      Castopod["koopa-castopod\n:9020"]
      Bonfire["koopa-bonfire\n:9021"]