Document reboot recovery and Taler in-container app autostart.

Record post-reboot 502 causes and the ensure-taler-apps automation path.

2026/2026-07-16--container-autostart.md

@@ -34,4 +34,17 @@
 systemctl --user is-enabled podman-restart.service
 podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}'
 systemctl --user --failed
+systemctl --user is-active taler-merchant-apps.service taler-bank-apps.service
+~/.local/bin/ensure-taler-apps.sh status
 ```
+
+## Taler apps inside containers (added same day, later)
+
+Merchant/bank containers only run **`sleep infinity`**. Autostart of the
+*apps* is **not** podman-restart alone — see:
+
+- `scripts/taler-shared/ensure-taler-apps.sh`
+- user units **`taler-merchant-apps.service`**, **`taler-bank-apps.service`**
+- drop-ins under `configs/systemd/user/container-taler-*.service.d/apps.conf`
+- install: `scripts/taler-shared/install-ensure-taler-apps.sh`
+- narrative: `2026-07-16--reboot-recovery.md`

2026/2026-07-16--reboot-recovery.md

@@ -0,0 +1,51 @@
+# Reboot recovery — 2026-07-16
+
+Host **koopa** rebooted (~20:23 CEST). Containers came up via
+`unless-stopped` + user units, but **Taler app processes inside** merchant/bank
+did **not** (containers run `sleep infinity`).
+
+## What was broken after boot
+
+| Symptom | Cause | Outcome |
+|---------|--------|---------|
+| `taler.hacktivism.ch/intro` **502** | only `sleep infinity` in merchant | fixed manually, then **automated** |
+| `bank.hacktivism.ch/intro` **502** | bank same; landing nginx off | fixed + automated |
+| Bank **auto-confirm** missing | not started after boot | automated (`--loop 2`) |
+| `koopa-tor-relay` crash-loop | host **`tor.service`** binds **8080**/**9051** | still open → `ISSUES.md` |
+| `koopa-paivana` **502** | merchant private API down at start | unit now **After** merchant-apps |
+| Exchange / forgejo / bonfire / castopod / tops / nym / prime | mostly OK | — |
+
+## Automation (removes manual post-boot)
+
+Installed on koopa (user **hernani**):
+
+| Piece | Role |
+|-------|------|
+| `~/.local/bin/ensure-taler-apps.sh` | start base + merchant/bank apps + auto-confirm |
+| `taler-merchant-apps.service` | oneshot after `container-taler-hacktivism` |
+| `taler-bank-apps.service` | oneshot after `container-taler-hacktivism-bank` |
+| drop-ins `container-taler-*.service.d/apps.conf` | `Wants=` the apps units |
+| paivana `order.conf` | `After=taler-merchant-apps.service` |
+
+Repo sources: `scripts/taler-shared/`, `configs/systemd/user/`.  
+Install/reinstall: `scripts/taler-shared/install-ensure-taler-apps.sh`.
+
+```bash
+# status / force now
+systemctl --user start taler-merchant-apps.service taler-bank-apps.service
+~/.local/bin/ensure-taler-apps.sh status
+```
+
+Auto-confirm poll: **2 s** (was 4 s).
+
+## Quick health
+
+```bash
+curl -sk -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/config
+curl -sk -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/intro/
+curl -sk -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/config
+curl -sk -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/intro/
+curl -sk -o /dev/null -w '%{http_code}\n' https://exchange.hacktivism.ch/keys
+```
+
+Expected: **200** on config/intro/keys (site root may **302** → `/intro/`).

2026/2026-07-16.md

@@ -2,4 +2,6 @@
 
 - **koopa-nym** (nym.com) mirror → `2026-07-16--koopa-nym.md`
 - **container autostart** (podman-restart + units) → `2026-07-16--container-autostart.md`
+- **reboot recovery + Taler in-container app autostart** → `2026-07-16--reboot-recovery.md`  
+  (`ensure-taler-apps.sh`, `taler-*-apps.service`, auto-confirm **2 s**)
 - **Open issues** → [`ISSUES.md`](../ISSUES.md)