scripts: sanity/dns/wallet-cli helpers; ops cleanup

scripts/taler-dns/bake-hosts-into-images.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+# Install in-container pin script (+ systemd on exchange), hook start_base scripts,
+# commit images so recreate keeps the bake.
+#
+# Run on koopa:
+#   ./bake-hosts-into-images.sh
+set -euo pipefail
+
+PIN_IP="${PIN_IP:-212.51.151.254}"
+SRC_DIR="${SRC_DIR:-/tmp/taler-dns-bake}"
+mkdir -p "$SRC_DIR"
+
+# expect these next to us or in SRC_DIR
+SCRIPT_IN="${SCRIPT_IN:-$SRC_DIR/pin-hacktivism-hosts.in-container.sh}"
+UNIT_IN="${UNIT_IN:-$SRC_DIR/pin-hacktivism-hosts.service}"
+
+[ -f "$SCRIPT_IN" ] || { echo "missing $SCRIPT_IN" >&2; exit 1; }
+
+install_into() {
+  local C="$1"
+  if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
+    echo "SKIP $C (not running)"
+    return 0
+  fi
+  echo "=== install into $C ==="
+  podman cp "$SCRIPT_IN" "$C:/usr/local/bin/pin-hacktivism-hosts"
+  podman exec "$C" chmod 755 /usr/local/bin/pin-hacktivism-hosts
+  # run once now
+  podman exec -e PIN_IP="$PIN_IP" "$C" /usr/local/bin/pin-hacktivism-hosts
+  podman exec "$C" grep hacktivism /etc/hosts || true
+}
+
+hook_start_base() {
+  local C="$1" base="$2"
+  podman exec "$C" bash -lc "
+    set -e
+    f='$base'
+    if [ ! -f \"\$f\" ]; then echo \"no \$f\"; exit 0; fi
+    if grep -q pin-hacktivism-hosts \"\$f\"; then
+      echo \"already hooked: \$f\"
+      exit 0
+    fi
+    # insert right after shebang / first line block
+    cp \"\$f\" \"\$f.bak-before-pin\"
+    {
+      head -n 1 \"\$f\"
+      echo ''
+      echo '# Pin public GOA hostnames (pasta DNS). Baked by bake-hosts-into-images.sh'
+      echo 'if [ -x /usr/local/bin/pin-hacktivism-hosts ]; then'
+      echo '  PIN_IP=${PIN_IP} /usr/local/bin/pin-hacktivism-hosts || true'
+      echo 'fi'
+      tail -n +2 \"\$f\"
+    } > \"\$f.new\"
+    mv \"\$f.new\" \"\$f\"
+    chmod +x \"\$f\"
+    echo \"hooked \$f\"
+  "
+}
+
+# --- bank ---
+install_into taler-hacktivism-bank
+hook_start_base taler-hacktivism-bank /root/start_base_services_for_taler_bank.sh
+
+# --- merchant ---
+install_into taler-hacktivism
+hook_start_base taler-hacktivism /root/start_base_services_for_taler.sh
+
+# --- exchange (systemd) ---
+install_into taler-hacktivism-exchange-ansible
+if [ -f "$UNIT_IN" ]; then
+  podman cp "$UNIT_IN" taler-hacktivism-exchange-ansible:/etc/systemd/system/pin-hacktivism-hosts.service
+  podman exec taler-hacktivism-exchange-ansible bash -lc '
+    sed -i "s/PIN_IP=212.51.151.254/PIN_IP='"${PIN_IP}"'/" /etc/systemd/system/pin-hacktivism-hosts.service
+    systemctl daemon-reload
+    systemctl enable pin-hacktivism-hosts.service
+    systemctl start pin-hacktivism-hosts.service
+    systemctl is-enabled pin-hacktivism-hosts.service
+    # ensure wirewatch starts after pin
+    mkdir -p /etc/systemd/system/taler-exchange-wirewatch.service.d
+    cat > /etc/systemd/system/taler-exchange-wirewatch.service.d/pin-hosts.conf <<EOF
+[Unit]
+After=pin-hacktivism-hosts.service
+Requires=pin-hacktivism-hosts.service
+EOF
+    systemctl daemon-reload
+    systemctl restart taler-exchange-wirewatch 2>/dev/null || true
+  '
+fi
+
+# --- commit images ---
+echo "=== commit images ==="
+podman commit taler-hacktivism-bank \
+  localhost/taler-hacktivism-banking:live
+podman commit taler-hacktivism-bank \
+  localhost/taler-hacktivism-banking:hosts-pinned
+
+podman commit taler-hacktivism \
+  localhost/taler-hacktivism-live:landing
+podman commit taler-hacktivism \
+  localhost/taler-hacktivism-live:hosts-pinned
+
+podman commit taler-hacktivism-exchange-ansible \
+  localhost/taler-hacktivism-exchange-ansible:landing
+podman commit taler-hacktivism-exchange-ansible \
+  localhost/taler-hacktivism-exchange-ansible:hosts-pinned
+
+echo
+echo "Images updated:"
+podman images | grep -E 'hacktivism|hosts-pinned' | head -20
+echo
+echo "Verify:"
+for C in taler-hacktivism-bank taler-hacktivism-exchange-ansible taler-hacktivism; do
+  echo -n "$C: "
+  podman exec "$C" getent ahostsv4 bank.hacktivism.ch 2>/dev/null | head -1 || echo FAIL
+done
+echo "done."