docs: GOA deb upgrades + monitoring notes

scripts/taler-shared/upgrade-goa-debs.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Upgrade GNU Taler .deb packages *inside* the three GOA containers on koopa.
+# Host openSUSE packages are unrelated (zypper) — do not confuse with this.
+#
+# Containers (no systemd as PID 1): after apt, restart with start_*.sh only.
+#
+# Run on koopa host as a user that can `podman exec` the containers:
+#   ./upgrade-goa-debs.sh
+#   ./upgrade-goa-debs.sh bank|exchange|merchant
+#
+# Mirror: scripts/taler-shared/ in koopa-admin-log.
+# Live note: 2026/2026-07-16--taler-package-upgrade-goa.md
+set -euo pipefail
+
+BANK_CTR="${BANK_CTR:-taler-hacktivism-bank}"
+EXCHANGE_CTR="${EXCHANGE_CTR:-taler-hacktivism-exchange-ansible}"
+MERCHANT_CTR="${MERCHANT_CTR:-taler-hacktivism}"
+
+only="${1:-all}"
+
+pod_root() {
+  local ctr="$1"
+  shift
+  podman exec -u root "$ctr" bash -c "$*"
+}
+
+upgrade_bank() {
+  echo "======== bank ($BANK_CTR) ========"
+  pod_root "$BANK_CTR" '
+    set -e
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update -qq
+    apt-get install -y libeufin-bank libeufin-common
+    dpkg -l libeufin-bank libeufin-common | awk "/^ii/{print \$2,\$3}"
+  '
+  # restart app only (postgres via start_base if needed)
+  pod_root "$BANK_CTR" '
+    set -e
+    if ! runuser -u postgres -- psql -c "SELECT 1" >/dev/null 2>&1; then
+      pg_ctlcluster 17 main start || true
+      sleep 2
+    fi
+    mkdir -p /var/log/libeufin-bank
+    chown libeufin-bank:libeufin-bank /var/log/libeufin-bank 2>/dev/null || true
+    runuser -u libeufin-bank -- /usr/local/bin/start_bank.sh --restart
+  '
+}
+
+upgrade_exchange() {
+  echo "======== exchange ($EXCHANGE_CTR) ========"
+  pod_root "$EXCHANGE_CTR" '
+    set -e
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update -qq
+    apt-get install -y \
+      taler-exchange taler-exchange-database taler-exchange-offline \
+      taler-exchange-typst libtalerexchange taler-terms-generator \
+      taler-exchange-aml-webui taler-exchange-kyc-webui || true
+    dpkg -l "taler-exchange*" "libtalerexchange" "taler-terms-generator" 2>/dev/null \
+      | awk "/^ii/{print \$2,\$3}"
+  '
+  # do not run dbinit as root (role "root" does not exist)
+  pod_root "$EXCHANGE_CTR" '
+    set -e
+    if id taler-exchange-httpd >/dev/null 2>&1; then
+      runuser -u taler-exchange-httpd -- taler-exchange-dbinit 2>&1 | tail -20 || true
+    fi
+    if [ -x /root/start_base_services_for_taler_exchange.sh ]; then
+      /root/start_base_services_for_taler_exchange.sh --no-shell 2>/dev/null || true
+    fi
+    if [ -x /usr/local/bin/start_exchange.sh ]; then
+      runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart 2>&1 | tail -30 || true
+    fi
+    pgrep -a taler-exchange-httpd | head -3 || true
+  '
+}
+
+upgrade_merchant() {
+  echo "======== merchant ($MERCHANT_CTR) ========"
+  pod_root "$MERCHANT_CTR" '
+    set -e
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update -qq
+    apt-get install -y \
+      taler-merchant taler-merchant-webui taler-merchant-typst \
+      libtalermerchant taler-terms-generator
+    dpkg -l "taler-merchant*" "libtalermerchant" 2>/dev/null | awk "/^ii/{print \$2,\$3}"
+  '
+  pod_root "$MERCHANT_CTR" '
+    set -e
+    # schema: prefer tools as service user; failures may be noisy — check /config after
+    if id taler-merchant-httpd >/dev/null 2>&1; then
+      runuser -u taler-merchant-httpd -- taler-merchant-dbinit 2>&1 | tail -20 || true
+    fi
+    runuser -u taler-merchant-httpd -- /usr/local/bin/start_merchant.sh --restart
+  '
+}
+
+smoke() {
+  echo "======== smoke (host loopback) ========"
+  curl -sS -m 8 -o /dev/null -w "bank    %{http_code}  :9012/config\n" http://127.0.0.1:9012/config || true
+  curl -sS -m 8 -o /dev/null -w "exchange %{http_code}  :9011/config\n" http://127.0.0.1:9011/config || true
+  curl -skS -m 8 -o /dev/null -w "merchant %{http_code}  :9010/config\n" https://127.0.0.1:9010/config || true
+}
+
+case "$only" in
+  all)
+    upgrade_bank
+    upgrade_exchange
+    upgrade_merchant
+    smoke
+    ;;
+  bank) upgrade_bank; smoke ;;
+  exchange) upgrade_exchange; smoke ;;
+  merchant) upgrade_merchant; smoke ;;
+  -h|--help|help)
+    sed -n '2,20p' "$0"
+    exit 0
+    ;;
+  *)
+    echo "usage: $0 [all|bank|exchange|merchant]" >&2
+    exit 2
+    ;;
+esac
+
+echo "DONE — re-run taler-monitoring versions/urls from a laptop if desired."