Update ISSUES for reboot apps mitigation and tor-relay clash.

Mark Taler-apps post-reboot issue mitigated; document host vs container tor ports.
2026-07-16 20:34:57 +02:00 · 2026-07-16 20:34:57 +02:00 · c4c6a7f2c2
commit c4c6a7f2c2
parent b5e9b02146
1 changed files with 80 additions and 67 deletions
--- a/ISSUES.md
+++ b/ISSUES.md
@ -1,24 +1,32 @@
 # Open issues

-As of **2026-07-16** (live scan on koopa). No secrets.
+Stand **2026-07-16** (koopa, live). Keine Secrets.
+
+## Index
+
+| ID | Severity | Status | Kurz |
+|----|----------|--------|------|
+| [I-01](#i-2026-07-16-01) | high | open | firewalld: Nym-Ports unbestätigt |
+| [I-02](#i-2026-07-16-02) | medium | open | Nym nicht bonded / nicht in Explorern |
+| [I-03](#i-2026-07-16-03) | medium | mitigated | Taler-Apps nach Reboot |
+| [I-04](#i-2026-07-16-04) | low | open | Stray `kind_taussig` |
+| [I-05](#i-2026-07-16-05) | low | open | Alte exited Podman-Container |
+| [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` |
+| [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` |

 ---

-## I-2026-07-16-01 — firewalld: Nym ports on koopa unverified
+### I-2026-07-16-01

-| | |
-|--|--|
-| **Severity** | high (for public Nym reachability) |
-| **Host** | koopa |
-| **Status** | open |
+**firewalld: Nym-Ports auf koopa unbestätigt**  
+Severity: high · Host: koopa · Status: open

-VeciGate DNATs **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.  
-Without matching **firewalld** allow rules on koopa, traffic dies on the host.
+VeciGate DNAT **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.  
+Ohne passende **firewalld**-Allow-Regeln stirbt der Traffic am Host.

-Agent could not run `firewall-cmd` (**sudo password required**).
+Agent konnte `firewall-cmd` nicht ausführen (sudo-Passwort).

 ```bash
-# on koopa (with sudo)
 sudo firewall-cmd --permanent --add-port=1789/tcp
 sudo firewall-cmd --permanent --add-port=1789/udp
 sudo firewall-cmd --permanent --add-port=1790/tcp
@ -29,98 +37,103 @@ sudo firewall-cmd --list-ports

 ---

-## I-2026-07-16-02 — Nym node not bonded / not in public explorers
+### I-2026-07-16-02

-| | |
-|--|--|
-| **Severity** | medium (visibility on the Nym network) |
-| **Host** | koopa (`koopa-nym`) |
-| **Status** | open |
+**Nym-Node nicht bonded / nicht in öffentlichen Explorern**  
+Severity: medium · Host: koopa (`koopa-nym`) · Status: open

-Container **is running** (mixnode); API on **9080** answers.  
-Without a **bond** in the Nym wallet the node typically does **not** show up in Harbour Master / network explorers (unlike Tor after ORPort publish).
+Container läuft (mixnode); API auf **9080** antwortet.  
+Ohne **Bond** im Nym-Wallet erscheint der Node typischerweise nicht in Harbour Master / Explorern (anders als Tor nach ORPort-Publish).

-See also: `configs/nym/PUBLIC-LISTING.md`.
+Siehe `configs/nym/PUBLIC-LISTING.md`.

-Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API path/version; node still runs mixmode).
+Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API-Pfad; Node läuft trotzdem im Mixmode).

 **Identity key (public):** `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW`

 ---

-## I-2026-07-16-03 — `podman-restart.service` enabled, inactive this session
+### I-2026-07-16-03

-| | |
-|--|--|
-| **Severity** | low (until reboot is tested) |
-| **Host** | koopa (user hernani) |
-| **Status** | open / expected until reboot |
+**`podman-restart` / Taler-Apps nach Reboot**  
+Severity: medium → mitigated · Host: koopa (hernani) · Status: mitigated 2026-07-16 Abend

-`systemctl --user is-enabled podman-restart` = **enabled**,  
-`is-active` = **inactive** (oneshot; has not run this boot session).
+**Beobachtet:** Container up, aber Merchant/Bank nur `sleep infinity` → öffentlich **502** bis manuelles `start_base` / `start_*.sh`.

-After reboot:
+**Mitigation:** User-Units `taler-merchant-apps.service` / `taler-bank-apps.service` + `~/.local/bin/ensure-taler-apps.sh`  
+→ `2026/2026-07-16--reboot-recovery.md`. Nächster voller Reboot als Test.

 ```bash
-systemctl --user is-active podman-restart.service
-podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}'
+systemctl --user is-active podman-restart.service \
+  taler-merchant-apps.service taler-bank-apps.service
+~/.local/bin/ensure-taler-apps.sh status
 ```

 ---

-## I-2026-07-16-04 — Stray container `kind_taussig`
+### I-2026-07-16-04

-| | |
-|--|--|
-| **Severity** | low (hygiene) |
-| **Host** | koopa |
-| **Status** | open |
+**Stray-Container `kind_taussig`**  
+Severity: low · Host: koopa · Status: open

-Container **Up** ~5 days: `kind_taussig` (`debian:bookworm-slim`), one-off wallet/DEB test script, **`restart=no`**, not a production name.
-
-Candidate to stop/remove when logs are no longer needed:
+Container **Up** ~5 Tage: `kind_taussig` (`debian:bookworm-slim`), einmaliger Wallet/DEB-Test, `restart=no`, kein Prod-Name.

 ```bash
-podman stop kind_taussig
-podman rm kind_taussig
+podman stop kind_taussig && podman rm kind_taussig
 ```

 ---

-## I-2026-07-16-05 — Old exited Podman containers (clutter)
+### I-2026-07-16-05

-| | |
-|--|--|
-| **Severity** | low (hygiene) |
-| **Host** | koopa |
-| **Status** | open |
+**Alte exited Podman-Container (Müll)**  
+Severity: low · Host: koopa · Status: open

-Several **Exited** containers (months/years old), e.g. `pensive_dubinsky`,  
-`hardcore_edison`, `taler-exchange-no-network`, `debian00`, …  
-No autostart; only clutter `podman ps -a`.
+Mehrere **Exited**-Container (Monate/Jahre), z. B. `pensive_dubinsky`, `hardcore_edison`, `taler-exchange-no-network`, `debian00`, …  
+Kein Autostart; nur Unordnung in `podman ps -a`.

-Optional cleanup: `podman container prune` (exited only, after review).
+Optional: `podman container prune` (nur exited, nach Review).

 ---

-## I-2026-07-16-06 — Nym HTTP API listens on `*:9080`
+### I-2026-07-16-06

-| | |
-|--|--|
-| **Severity** | low–medium (attack surface) |
-| **Host** | koopa |
-| **Status** | open (as configured in compose) |
+**Nym HTTP-API lauscht auf `*:9080`**  
+Severity: low–medium · Host: koopa · Status: open (compose so konfiguriert)

-`ss` shows **\*:9080** (rootlessport). **No** VeciGate DNAT for 9080.  
-Usually not reachable from WAN without NAT; reachable from LAN.
+`ss` zeigt **\*:9080** (rootlessport). **Kein** VeciGate-DNAT für 9080 → WAN normalerweise nicht erreichbar; LAN ja.

-Optional harden: publish only `127.0.0.1:9080:8080` in compose.
+Härten optional: in compose nur `127.0.0.1:9080:8080` publishen.
+
+Hinweis: `nym-node` startet intern mit `--http-bind-address [::]:8080` (Container-intern). Öffentlich relevant ist das Host-Mapping **9080**, nicht WAN :8080 (das ist Tor OR).

 ---

-## Not an issue (scan)
+### I-2026-07-16-07

- All production `should-start-on-boot` containers **Up**
- No failed user units
- Taler ports 9010–9015 respond (401/302 OK)
- Linger=yes, container-* units enabled
+**`koopa-tor-relay` vs host `tor.service` (Port-Clash)**  
+Severity: medium · Host: koopa · Status: **fixed** 2026-07-16
+
+**War:** Nach Reboot crash-loopte `koopa-tor-relay` — Host-`tor.service` hielt **8080**/**9051**.  
+**Soll:** nur Container (`KoopaRelay`, ORPort **8080**, VeciGate WAN→koopa:8080).
+
+**Fix:** Host-Tor gestoppt/disabled; ggf. hängenden Prozess gekillt; User-Unit:
+
+```bash
+sudo systemctl disable --now tor
+sudo systemctl mask tor   # optional
+systemctl --user enable --now container-koopa-tor-relay.service
+ss -lntp | grep -E '8080|9051'
+podman ps --filter name=koopa-tor-relay
+```
+
+**Live (nach Fix):** Host-`tor` inactive/disabled; `koopa-tor-relay` Up; 8080 + 127.0.0.1:9051 vom Relay-Prozess.
+
+---
+
+## Kein Issue (Scan)
+
+- Prod-Container mit Boot-Autostart: Up
+- Taler-Ports 9010–9015 antworten (401/302 OK)
+- Linger=yes, container-*-Units enabled
+- Tor-OR: Container-Pfad (I-07 fixed)