hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

monitoring: find SECRETS_ROOT for e2e bank admin password

Browse source
This commit is contained in:
Hernâni Marques 2026-07-17 18:11:24 +02:00
parent 329222f99d
commit bf8a915a01
No known key found for this signature in database
GPG key ID: CB5738652768F7E9
3 changed files with 99 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/taler-monitoring/README.md
View file

@ -22,6 +22,28 @@ Catalog: **[TESTS.md](./TESTS.md)**.
End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
## Secrets (local GOA e2e)
`check_e2e.sh` loads bank/merchant passwords from **koopa-admin-secrets**
(not this repo). Search order:
1. `SECRETS_ROOT` → `…/taler-bank/bank-admin-password.txt`
2. `KOOPA_ADMIN_SECRETS` → `$KOOPA_ADMIN_SECRETS/koopa/host-root/…`
3. Sibling of this checkout: `../koopa-admin-secrets/koopa/host-root`
4. `$HOME/taler/src/koopa-admin-secrets/koopa/host-root` (common laptop layout)
5. `$HOME/.config/taler-landing/bank-admin-password.txt`
6. SSH koopa: `/root/bank-admin-password.txt` or podman bank container
If you keep admin-log at `~/koopa-admin-log` but secrets under `~/taler/src/…`:
```bash
export SECRETS_ROOT="$HOME/taler/src/koopa-admin-secrets/koopa/host-root"
# or: export KOOPA_ADMIN_SECRETS="$HOME/taler/src/koopa-admin-secrets"
./taler-monitoring.sh e2e
```
Or one-shot: `E2E_BANK_ADMIN_PASS=… E2E_MERCHANT_TOKEN=… ./taler-monitoring.sh e2e`
## Commands
```bash
@ -32,6 +54,7 @@ End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
./taler-monitoring.sh sanity
./taler-monitoring.sh e2e
# Other domains — public HTTPS only, never SSH
./taler-monitoring.sh -d taler.net
./taler-monitoring.sh --domain taler-ops.ch

10
scripts/taler-monitoring/check_e2e.sh
View file

@ -440,11 +440,15 @@ else
MPW="${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-$(read_secret "taler-merchant/merchant-goa-demo-cp4zqk-password.txt" || true)}}"
fi
if [ -n "$ADMIN_PASS" ]; then
ok "bank admin secret"
ok "bank admin secret" "${SECRETS_ROOT:+SECRETS_ROOT=${SECRETS_ROOT}}"
elif [ "$E2E_REMOTE" = "1" ]; then
warn "bank admin secret" "missing — will try public registration only"
else
blocker "prereq" "bank admin password missing (SECRETS_ROOT or koopa /root)"
info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'}"
if type secrets_hint >/dev/null 2>&1; then
while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint)
fi
exit 1
fi
if [ -n "$MPW" ]; then
@ -460,6 +464,10 @@ elif [ "$E2E_REMOTE" = "1" ]; then
warn "merchant secret" "missing — private orders fail unless E2E_USE_TEMPLATES=1 (set E2E_MERCHANT_TOKEN)"
else
blocker "prereq" "merchant instance password missing"
info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'} — need taler-merchant/merchant-*-password.txt"
if type secrets_hint >/dev/null 2>&1; then
while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint)
fi
exit 1
fi
# Authorization header for merchant private API (never double secret-token:)

75
scripts/taler-monitoring/lib.sh
View file

@ -758,25 +758,84 @@ PY
done <<<"$list"
}
# Live bank/merchant passwords: sibling **koopa-admin-secrets** (never in admin-log).
# Override: SECRETS_ROOT=/path/to/koopa-admin-secrets/koopa/host-root
# or KOOPA_ADMIN_SECRETS=/path/to/koopa-admin-secrets
SECRETS_ROOT="${SECRETS_ROOT:-}"
_secrets_search_log() { :; } # placeholder if we later want debug
if [ -z "$SECRETS_ROOT" ]; then
_mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
_admin_log="$(cd "${_mon_dir}/../.." && pwd)"
# Prefer explicit env pointing at the secrets *repo* root
if [ -n "${KOOPA_ADMIN_SECRETS:-}" ] && [ -d "${KOOPA_ADMIN_SECRETS}/koopa/host-root/taler-bank" ]; then
SECRETS_ROOT="${KOOPA_ADMIN_SECRETS}/koopa/host-root"
fi
fi
if [ -z "$SECRETS_ROOT" ]; then
_mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
_admin_log="$(cd "${_mon_dir}/../.." && pwd)"
for d in \
"$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/koopa-admin-secrets/koopa/host-root" \
"${_admin_log}/../koopa-admin-secrets/koopa/host-root" \
"${_admin_log}/../../koopa-admin-secrets/koopa/host-root" \
"${HOME}/taler/src/koopa-admin-secrets/koopa/host-root" \
"${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root" \
"${HOME}/koopa-admin-secrets/koopa/host-root" \
"/Users/newkamek/src/koopa/koopa-admin-secrets/koopa/host-root" \
"$HOME/src/koopa/koopa-admin-secrets/koopa/host-root"
"$(cd "${_admin_log}/../.." 2>/dev/null && pwd)/koopa-admin-secrets/koopa/host-root"
do
if [ -d "$d/taler-bank" ]; then SECRETS_ROOT=$d; break; fi
# resolve .. without requiring the dir to exist first for cd
if [ -d "$d/taler-bank" ]; then
SECRETS_ROOT=$(cd "$d" && pwd)
break
fi
done
unset _mon_dir _admin_log d
fi
read_secret() {
local rel="$1"
if [ -n "${SECRETS_ROOT:-}" ] && [ -f "${SECRETS_ROOT}/${rel}" ]; then
tr -d '\n' <"${SECRETS_ROOT}/${rel}"
local rel="$1" base val=""
base=$(basename "$rel")
if [ -n "${SECRETS_ROOT:-}" ]; then
if [ -f "${SECRETS_ROOT}/${rel}" ]; then
tr -d '\n\r' <"${SECRETS_ROOT}/${rel}"
return 0
fi
# also accept flat layout under host-root/
if [ -f "${SECRETS_ROOT}/${base}" ]; then
tr -d '\n\r' <"${SECRETS_ROOT}/${base}"
return 0
fi
fi
# Optional: copy under ~/.config/taler-landing/ (landing-stats style)
if [ -f "${HOME}/.config/taler-landing/${base}" ]; then
tr -d '\n\r' <"${HOME}/.config/taler-landing/${base}"
return 0
fi
koopa_ssh_ok || return 1
koopa_ssh_run 10 "tr -d '\\n' </root/$(basename "$rel") 2>/dev/null || true" 2>/dev/null
# Live on koopa host /root (same basenames as deploy)
if koopa_ssh_ok; then
val=$(koopa_ssh_run 12 "tr -d '\\n\\r' </root/${base} 2>/dev/null || true" 2>/dev/null || true)
if [ -n "$val" ]; then
printf '%s' "$val"
return 0
fi
# container path used by some installs
val=$(koopa_ssh_run 12 \
"podman exec taler-hacktivism-bank tr -d '\\n\\r' </root/${base} 2>/dev/null || true" 2>/dev/null || true)
if [ -n "$val" ]; then
printf '%s' "$val"
return 0
fi
fi
return 1
}
# Human hint when secrets missing (e2e prereq)
secrets_hint() {
cat <<EOF
Set SECRETS_ROOT to koopa-admin-secrets/koopa/host-root (contains taler-bank/),
or KOOPA_ADMIN_SECRETS to the secrets repo root, or export E2E_BANK_ADMIN_PASS.
Example (this machine): SECRETS_ROOT=\$HOME/taler/src/koopa-admin-secrets/koopa/host-root
EOF
}
find_wallet_cli() {