monitoring/merge: origin ladder+metrics + stage domains/profiles

2026/2026-07-16--container-autostart.md

@@ -0,0 +1,50 @@
+# Container autostart on reboot — 2026-07-16
+
+## How it is set (hernani@koopa, rootless podman)
+
+1. **`loginctl` Linger=yes** for `hernani` — user systemd runs without login.
+2. **`podman-restart.service` (user)** enabled — on boot starts all containers with
+   restart policy that should come up (`unless-stopped` / `always`, not manually stopped).
+3. **Per-container (or stack) user units** under `~/.config/systemd/user/container-*.service`
+   also enabled (belt-and-suspenders + DB ordering drop-ins).
+4. **Restart policy** on every production container: **`unless-stopped`**.
+
+## Production set (should-start-on-boot)
+
+| Container |
+|-----------|
+| `taler-hacktivism`, `taler-hacktivism-bank`, `taler-hacktivism-exchange-ansible` |
+| `koopa-forgejo`, `koopa-forgejo-db` |
+| `koopa-prime-jellyfin`, `koopa-prime-qbittorrent` |
+| `koopa-tor-relay`, `koopa-nym` |
+| `koopa-bonfire`, `koopa-bonfire-db` |
+| `koopa-castopod`, `koopa-castopod-mariadb`, `koopa-castopod-redis` |
+| `koopa-paivana`, `koopa-paivana-upstream` |
+| `koopa-tops-ng1` … `ng3` (+ `container-koopa-tops.service` ensure) |
+
+## Changed this day
+
+- Taler stack: `restart=no` → **`unless-stopped`**
+- New units: forgejo(+db), prime jellyfin/qbittorrent, paivana-upstream, three taler containers
+- Enabled **`podman-restart.service`**
+
+## Checks after reboot
+
+```bash
+systemctl --user is-enabled podman-restart.service
+podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}'
+systemctl --user --failed
+systemctl --user is-active taler-merchant-apps.service taler-bank-apps.service
+~/.local/bin/ensure-taler-apps.sh status
+```
+
+## Taler apps inside containers (added same day, later)
+
+Merchant/bank containers only run **`sleep infinity`**. Autostart of the
+*apps* is **not** podman-restart alone — see:
+
+- `scripts/taler-shared/ensure-taler-apps.sh`
+- user units **`taler-merchant-apps.service`**, **`taler-bank-apps.service`**
+- drop-ins under `configs/systemd/user/container-taler-*.service.d/apps.conf`
+- install: `scripts/taler-shared/install-ensure-taler-apps.sh`
+- narrative: `2026-07-16--reboot-recovery.md`

2026/2026-07-16--koopa-nym.md

@@ -0,0 +1,15 @@
+# koopa-nym (nym.com nym-node) — 2026-07-16
+
+Admin-log mirror for a new podman container **`koopa-nym`** running
+[nym-node](https://nym.com/docs/operators/nodes/nym-node) for the Nym mixnet /
+NymVPN network.
+
+| Item | Value |
+|------|--------|
+| Config | `configs/nym/` |
+| Scripts | `scripts/nym/` |
+| Default mode | `mixnode` |
+| HTTP host port | **9080** (avoids Tor **8080**) |
+| Mixnet | **1789** |
+
+Bonding and wallet mnemonics stay on the host secrets layout — not in this repo.

2026/2026-07-16--reboot-recovery.md

@@ -0,0 +1,51 @@
+# Reboot recovery — 2026-07-16
+
+Host **koopa** rebooted (~20:23 CEST). Containers came up via
+`unless-stopped` + user units, but **Taler app processes inside** merchant/bank
+did **not** (containers run `sleep infinity`).
+
+## What was broken after boot
+
+| Symptom | Cause | Outcome |
+|---------|--------|---------|
+| `taler.hacktivism.ch/intro` **502** | only `sleep infinity` in merchant | fixed manually, then **automated** |
+| `bank.hacktivism.ch/intro` **502** | bank same; landing nginx off | fixed + automated |
+| Bank **auto-confirm** missing | not started after boot | automated (`--loop 2`) |
+| `koopa-tor-relay` crash-loop | host **`tor.service`** binds **8080**/**9051** | still open → `ISSUES.md` |
+| `koopa-paivana` **502** | merchant private API down at start | unit now **After** merchant-apps |
+| Exchange / forgejo / bonfire / castopod / tops / nym / prime | mostly OK | — |
+
+## Automation (removes manual post-boot)
+
+Installed on koopa (user **hernani**):
+
+| Piece | Role |
+|-------|------|
+| `~/.local/bin/ensure-taler-apps.sh` | start base + merchant/bank apps + auto-confirm |
+| `taler-merchant-apps.service` | oneshot after `container-taler-hacktivism` |
+| `taler-bank-apps.service` | oneshot after `container-taler-hacktivism-bank` |
+| drop-ins `container-taler-*.service.d/apps.conf` | `Wants=` the apps units |
+| paivana `order.conf` | `After=taler-merchant-apps.service` |
+
+Repo sources: `scripts/taler-shared/`, `configs/systemd/user/`.  
+Install/reinstall: `scripts/taler-shared/install-ensure-taler-apps.sh`.
+
+```bash
+# status / force now
+systemctl --user start taler-merchant-apps.service taler-bank-apps.service
+~/.local/bin/ensure-taler-apps.sh status
+```
+
+Auto-confirm poll: **2 s** (was 4 s).
+
+## Quick health
+
+```bash
+curl -sk -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/config
+curl -sk -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/intro/
+curl -sk -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/config
+curl -sk -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/intro/
+curl -sk -o /dev/null -w '%{http_code}\n' https://exchange.hacktivism.ch/keys
+```
+
+Expected: **200** on config/intro/keys (site root may **302** → `/intro/`).

2026/2026-07-16.md

@@ -0,0 +1,7 @@
+# 2026-07-16
+
+- **koopa-nym** (nym.com) mirror → `2026-07-16--koopa-nym.md`
+- **container autostart** (podman-restart + units) → `2026-07-16--container-autostart.md`
+- **reboot recovery + Taler in-container app autostart** → `2026-07-16--reboot-recovery.md`  
+  (`ensure-taler-apps.sh`, `taler-*-apps.service`, auto-confirm **2 s**)
+- **Open issues** → [`ISSUES.md`](../ISSUES.md)

2026/2026-07-17.md

@@ -0,0 +1,5 @@
+# 2026-07-17
+
+- Bank: `taler://withdraw` **ohne `:443`** (Wallet-Apps); live deployed
+- Merchant/bank in-container apps after reboot via `ensure-taler-apps` + user units
+- Admin-log: 13 Commits (19:04–01:07) + follow-up; `main` force-pushed → Forgejo