From b9e25419411dcf2244a0dbf88d5a1abd47d3f938 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sat, 19 Sep 2026 01:05:09 +0200 Subject: [PATCH] docs: remove host/overview LIVE services inventory --- host/overview/LIVE.md | 119 ------------------------------------- host/overview/services.md | 110 ---------------------------------- host/overview/services.txt | 24 -------- 3 files changed, 253 deletions(-) delete mode 100644 host/overview/LIVE.md delete mode 100644 host/overview/services.md delete mode 100644 host/overview/services.txt diff --git a/host/overview/LIVE.md b/host/overview/LIVE.md deleted file mode 100644 index 11120be..0000000 --- a/host/overview/LIVE.md +++ /dev/null @@ -1,119 +0,0 @@ -# Live inventory — koopa (2026-07-13) - -Snapshot of **what runs on host koopa** (openSUSE Tumbleweed). No secrets. - -Refresh command ideas: - -```bash -hostname; date -R -podman ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' -systemctl is-active caddy -systemctl --user is-active container-koopa-tor-relay -systemctl --user is-active container-koopa-nym -ss -lntp | grep -E '90[0-9]{2}|9200|8080|9080|1789' -``` - -## Host - -| Item | Value | -|------|--------| -| Hostname | `koopa` | -| Role | App host behind VeciGate (WAN :80→9000, :443→9001) | -| Edge | Caddy **9000/9001**, systemd socket proxies **80/443** | -| Tor | **podman `koopa-tor-relay`** (host net) ORPort **8080** dual-stack, ControlPort **127.0.0.1:9051** — not host `tor.service` | - -## Running podman containers - -| Name | Image | Ports (host) | Public site | -|------|--------|--------------|-------------| -| `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` | -| **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` | -| `taler-hacktivism-bank` | **`localhost/taler-hacktivism-banking:live`** | **9012**, **9013** | `bank.hacktivism.ch` | -| `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` | -| `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` | -| `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` | -| `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` | -| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` | -| **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` | -| `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` | -| `koopa-decidim` (+ postgres, redis, sidekiq) | `decidim/decidim:0.30.8` | **9027** | `decidim.hacktivism.ch` | -| **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) | -| **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) | -| `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` | -| `koopa-tops-ng2` | `nginx` | **9091** | `tops.ng2.hacktivism.ch` | -| `koopa-tops-ng3` | `nginx` | **9092** | `tops.ng3.hacktivism.ch` | - -### Naming note (exchange) - -Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-hacktivism-exchange-ansible` / not without `-ansible`). -Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`). - -## Caddy vhosts → backends - -| Host | Backend | -|------|---------| -| `taler.hacktivism.ch` | 9010 (API) + 9015 (`/intro`) | -| `exchange.hacktivism.ch` | 9011 + 9014 (`/intro`) | -| `bank.hacktivism.ch` | 9012 + 9013 (`/intro`, terms, privacy) | -| `castopod.hacktivism.ch` | 9020 | -| `bonfire.hacktivism.ch` | 9021 | -| `prime.hacktivism.ch` | 9022 | -| `bt.hacktivism.ch` | 9023 | -| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct | -| `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) | -| `lemmy.hacktivism.ch` | 9026 | -| `decidim.hacktivism.ch` | 9027 | -| `tops.ng1.hacktivism.ch` | 9090 | -| `tops.ng2.hacktivism.ch` | 9091 | -| `tops.ng3.hacktivism.ch` | 9092 | - -Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). - -## Paths on host (`hernani`) - -| Path | Role | -|------|------| -| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container | -| `~/koopa-castopod/` | Castopod compose | -| `~/koopa-lemmy/` | Lemmy compose | -| `~/koopa-decidim/` | Decidim compose | -| `~/koopa-bonfire/` | Bonfire compose + gitbot | -| `~/koopa-prime/` | Jellyfin + qBittorrent | -| `~/koopa-forgejo/` | Forgejo rootless | -| `~/koopa-paivana/` | Paivana paywall (`koopa-paivana`) | -| `~/koopa-tops/` | tops.ng1–ng3 (`koopa-tops-ng*`) | -| `~/koopa-caddy/` | Caddyfile working tree on host | -| `~/koopa-tor-relay/` | Tor relay container (torrc, data/identity, log) | -| `~/koopa-nym/` | Nym nym-node (nym.com mixnet / NymVPN network) | - -## Start models - -| Stack | How | -|-------|-----| -| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` | -| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` | -| User apps | `cd ~/koopa-* && podman-compose up -d` | -| Lemmy | user units `container-koopa-lemmy-db` + `container-koopa-lemmy` (linger) | -| Decidim | user units `container-koopa-decidim-db` + `container-koopa-decidim` (linger) | -| tops (ng1–ng3) | user unit `container-koopa-tops.service` (linger) | - -## Config mirrors in this repo (`configs/`) - -| Live container | Git path | -|----------------|----------| -| `taler-hacktivism` | `configs/taler-hacktivism/` | -| `taler-hacktivism-bank` (image **…-banking**) | `configs/taler-hacktivism-bank/` | -| `taler-hacktivism-exchange-ansible` | `configs/taler-exchange-ansible/` + conf in `configs/taler-exchange/` | -| `koopa-tops-ng1` … `ng3` | `configs/tops/` | - -## Related docs in this repo - -| Topic | Doc | -|-------|-----| -| Ports | `configs/ports.md` | -| Diagram | `host/overview/services.md` | -| Exchange Ansible (koopa) | `configs/taler-exchange-ansible/` | -| Forgejo | `2026/2026-07-10--forgejo-rootless.md` | -| Bonfire public feeds | `configs/bonfire/public-feeds.md` | -| Castopod content | `2026/2026-07-09--castopod-content.md` | -| Decidim | `2026/2026-08-17--decidim.md` · `configs/decidim/` | diff --git a/host/overview/services.md b/host/overview/services.md deleted file mode 100644 index 6c72548..0000000 --- a/host/overview/services.md +++ /dev/null @@ -1,110 +0,0 @@ -# Service overview — koopa - -**Live container/port inventory:** [`LIVE.md`](LIVE.md) (state as observed on host). - -Diagram - -```mermaid -flowchart TB - subgraph Internet - Client[Client IPv4/IPv6] - end - - subgraph VeciGate["VeciGate (MikroTik)"] - DNAT80["DNAT :80 → koopa:9000"] - DNAT443["DNAT :443 → koopa:9001"] - DNATSSH["DNAT :23235 → koopa:22"] - DNATTOR["DNAT :8080 → koopa:8080"] - end - - subgraph Host["openSUSE host koopa"] - subgraph Edge["Edge on host"] - S80["systemd http-proxy.socket :80"] - S443["systemd https-proxy.socket :443"] - CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"] - CaddyHTTPS["Caddy :9001 HTTPS"] - FW["firewalld public\n9000,9001,80,8080,ssh"] - end - - subgraph Podman["podman rootless (hernani)"] - Merch["taler-hacktivism\n:9010"] - Exch["taler-hacktivism-exchange-ansible\n:9011"] - Bank["taler-bank-hacktivism\n:9012"] - Castopod["koopa-castopod\n:9020"] - Bonfire["koopa-bonfire\n:9021"] - Prime["koopa-prime jellyfin\n:9022"] - BT["qbittorrent\n:9023"] - Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"] - Paivana["koopa-paivana\n:9025"] - Lemmy["koopa-lemmy-proxy\n:9026"] - Decidim["koopa-decidim\n:9027"] - end - - Tor["tor ORPort :8080"] - SSH["sshd :22"] - end - - Client --> DNAT80 --> CaddyHTTP - Client --> DNAT443 --> CaddyHTTPS - Client --> DNATSSH --> SSH - Client --> DNATTOR --> Tor - - S80 --> CaddyHTTP - S443 --> CaddyHTTPS - - CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"] - CaddyHTTP -->|other| Redir[301 HTTPS] - CaddyHTTPS -->|taler.hacktivism.ch| Merch - CaddyHTTPS -->|exchange.hacktivism.ch| Exch - CaddyHTTPS -->|bank.hacktivism.ch| Bank - CaddyHTTPS -->|castopod.hacktivism.ch| Castopod - CaddyHTTPS -->|bonfire.hacktivism.ch| Bonfire - CaddyHTTPS -->|prime.hacktivism.ch| Prime - CaddyHTTPS -->|bt.hacktivism.ch| BT - CaddyHTTPS -->|git.hacktivism.ch| Forgejo - CaddyHTTPS -->|paivana.hacktivism.ch| Paivana - CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy - CaddyHTTPS -->|decidim.hacktivism.ch| Decidim -``` - -## Port table - -| Port | Listener | Backend / notes | -|------|----------|-----------------| -| 22 | sshd | LAN; WAN via 23235 | -| 80 | systemd socket | → 127.0.0.1:**9000** | -| 443 | systemd socket | → 127.0.0.1:**9001** | -| 9000 | caddy | HTTP + ACME | -| 9001 | caddy | HTTPS vhosts | -| 9010 | podman | **merchant** nginx | -| 9011 | podman | **exchange** httpd | -| 9012 | podman | **bank** libeufin | -| 9020 | podman | **castopod** | -| 9021 | podman | **bonfire** | -| 9022 | podman | **jellyfin** (prime) | -| 9023 | podman | **qbittorrent** (bt) | -| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` | -| **9025** | podman | **paivana** → `paivana.hacktivism.ch` | -| **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` | -| **9027** | podman | **decidim** → `decidim.hacktivism.ch` | -| **9200** | podman | **forgejo** git-SSH (host-direct) | -| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` | -| 8080 | tor | ORPort | - -Full port notes: `configs/ports.md`. - -## Service index (details elsewhere) - -| Service | Detail docs | -|---------|-------------| -| Caddy | `host/caddy/`, `configs/caddy/` | -| firewalld | `host/firewalld/` | -| systemd proxies | `host/systemd/` | -| Merchant container | `configs/taler-hacktivism/`, `scripts/taler-merchant/` | -| Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` | -| **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` | -| Paivana paywall | `configs/paivana/` | -| tops (`koopa-tops-ng*`) | `configs/tops/` | -| Tor relay (`koopa-tor-relay` podman) | `configs/tor/`, `host/tor/` | -| Tor monitoring scripts | `scripts/monitoring/` | -| VeciGate NAT | `../vecigate-admin-log/ip/firewall/nat/` | diff --git a/host/overview/services.txt b/host/overview/services.txt deleted file mode 100644 index a37748b..0000000 --- a/host/overview/services.txt +++ /dev/null @@ -1,24 +0,0 @@ - Internet - | - +-------------+-------------+ - | VeciGate | - | :80→9000 :443→9001 | - | :23235→22 :8080→8080 | - +-------------+-------------+ - | - koopa 192.168.100.95 - | - +----------------------+----------------------+ - | | | - systemd Caddy other - :80 → 9000 :9000 HTTP sshd :22 - :443 → 9001 :9001 HTTPS tor :8080 - | | - +----------+-----------+ - | - +-------+--------+ - | | - :9010 merchant :9011 exchange - (nginx TLS) (httpd TCP) - | | - unix sock postgres/secmods