diff --git a/2026/2026-09-04--goa-backup-regio-ng.md b/2026/2026-09-04--goa-backup-regio-ng.md new file mode 100644 index 0000000..4267e7e --- /dev/null +++ b/2026/2026-09-04--goa-backup-regio-ng.md @@ -0,0 +1,97 @@ +# 2026-09-04 — GOA backup (pre regio-ng) + +## Live (koopa) + +| Container | Ports | Site | +|-----------|-------|------| +| `taler-hacktivism-exchange-ansible` | 9011/9014 | exchange.hacktivism.ch | +| `taler-hacktivism-bank` | 9012/9013 | bank.hacktivism.ch | +| `taler-hacktivism` | 9010/9015 | taler.hacktivism.ch | +| `koopa-paivana` | 9025 | paivana.hacktivism.ch | + +Currency **GOA**. Master pub (public): `TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10`. + +Probes 2026-09-04: exchange/bank/taler `/config` **200**. Monitoring user units mostly failed (apps/ladder) — separate. + +**Risk:** exchange/bank/merchant data sit in container **overlay** (no named volumes). Offline key: `/var/lib/taler-exchange/offline/master.priv` inside exchange container. + +## Backup location (ERPNext-style `backups/` + stamp + `current`) + +| Host | Path | +|------|------| +| koopa | `~/backups/goa//` · `~/backups/goa/current` | +| magikoopa | `~/backups/goa//` · `~/backups/goa/current` | +| **secrets** (keys + `*.secret.conf` + host_vars/paivana) | `koopa-admin-secrets/backups/goa//` · `…/current` | + +Stamp taken: **`20260904T1238Z`**. + +### Non-secret dumps (`~/backups/goa/`) + +`exchange/` `bank/` `merchant/` TGZs (PG + etc), `meta/`, optional `images/` (~2.2G). + +### Secrets (`koopa-admin-secrets/backups/goa/current/`) + +| Path | Content | +|------|---------| +| `exchange-offline/master.priv` | offline master (pub TW6K5…) | +| `exchange-offline/secm_tofus.pub` | secmod TOFU | +| `exchange/secrets/*.secret.conf` | DB + wire account creds | +| `merchant/secrets/merchant-db.secret.conf` | merchant DB | +| `ansible/host_vars/` | public.yml + secrets.yml | +| `paivana/secrets/` | merchant-access-token, paivana-secret | + +Never Forgejo push for `koopa-admin-secrets`. Magikoopa: `~/git/admin-logs/koopa-admin-secrets` (symlink `~/src/koopa/koopa-admin-secrets`). + +## Local reproduce (magikoopa) — **one** container, few unprivileged ports + +Not the three `goa-local-*` snapshot containers. Use **`regio-local`** only: + +| Bind | Role | +|------|------| +| `127.0.0.1:9080` | nginx HTTP (`Host: *.goa.local`) | +| `127.0.0.1:9222` | SSH ansible | + +Optional: `REGIO_PUBLISH_KOOPA_PORTS=1` also binds `9010–9012` (still unprivileged). + +Tree: `~/src/regio-local/` — see `RESTORE.md`, `README.md`. + +### koopa lab ports (2026-09-04) + +Same stack **on koopa** without touching live **9010–9015** or **9080** (nym): + +| Bind | Role | +|------|------| +| `127.0.0.1:9180` | `goa-regio-ng` HTTP | +| `127.0.0.1:9322` | `goa-regio-ng` SSH | +| `127.0.0.1:8288` | `mytops-local` HTTP | + +Canonical config: **`configs/lab-local/`** (`goa-regio-ng-koopa.yml`, `mytops-local.toml`, README). + +### `taler-deployment` branches + +``` +dev/hernani/regio-ng-apt-refresh + └─ dev/hernani/regio-ng-ensure-postgresql + └─ regio-goa-explorational-currency # GOA profile + master pin/import + TCP 901x +``` + +Example inventory: `regional-currency-ng/examples/goa-explorational.yml` +(imports `master.priv` from admin-secrets; refuses greenfield when pub pinned). + +### Restore flow + +```bash +podman stop goa-local-exchange goa-local-bank goa-local-merchant # free 901x; leave koopa live alone +cd ~/src/regio-local +./scripts/01-build-run.sh +./scripts/02-inventory.sh +./scripts/03-deploy.sh # ansible; master from admin-secrets +./scripts/05-restore-data.sh # optional PG dumps from ~/backups/goa/current +./scripts/04-probe.sh # expect 200 on :9010 :9011 :9012 +``` + +## Push + +`koopa-admin-log` Push nötig — nur mit Freigabe / User-Push. +`taler-deployment` branch `regio-goa-explorational-currency` likewise Freigabe. +Live wipe: **no**. diff --git a/2026/2026-09-04--mytops-local-podman.md b/2026/2026-09-04--mytops-local-podman.md new file mode 100644 index 0000000..7a9e96b --- /dev/null +++ b/2026/2026-09-04--mytops-local-podman.md @@ -0,0 +1,47 @@ +# mytops-local on koopa (podman lab) + +**2026-09-04** — merchant http lab next to live goa (not 901x / nym 9080). + +## status + +| where | port | `/config` | +|-------|------|-----------| +| koopa | `127.0.0.1:8288` | 200 (`mytops-local` Up) | +| magikoopa (ref) | `127.0.0.1:8088` | 200 | + +container: `mytops-local` · image `localhost/mytops-debian-systemd:trixie` · +bind `~/src/mytops-admin-log` (rsync from laptop; `.git` optional). + +docs/run: `mytops-admin-log` branch `mytops-local` → entry `mytops-local` / +`mytops-local.md`. `STAGE_ENV` unused on this path. + +## setup (koopa) + +```bash +rsync -az --delete --exclude .git --exclude .DS_Store \ + ~/git/mytops-admin-log/ hernani@koopa:src/mytops-admin-log/ +ssh hernani@koopa +cd ~/src/mytops-admin-log +podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local . +MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/apply-local-base-url.sh +podman rm -f mytops-local 2>/dev/null || true +podman run -d --name mytops-local --hostname mytops-local \ + --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \ + -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \ + -p 127.0.0.1:8288:80 \ + -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:rw" \ + localhost/mytops-debian-systemd:trixie /sbin/init +podman exec mytops-local bash -lc \ + 'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh' +``` + +if dbconfig fails (`policy-rc.d`): start `postgresql`, then dbconfig + `taler-merchant.target`. + +## links + +| what | where | +|------|--------| +| koopa-setup | `koopa-setup` | +| lab-local | `configs/lab-local/` · `configs/ports.md` | +| mytops-admin-log | branch `mytops-local` | +| regio lab | `configs/lab-local/goa-regio-ng-koopa.yml` · `~/src/regio-local/` | diff --git a/README.md b/README.md index e6b5015..47aab15 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,11 @@ Ops log and config mirror for host **koopa** (openSUSE Tumbleweed). **Secrets:** not in this repo — see **`SECRETS.md`** and sibling **`koopa-admin-secrets`**. +## FIND / setup entry + +Plain file **`koopa-setup`** — lab + host pointers (mytops-local, regio-ng, +ports, daylogs). Start there before hunting under `configs/` / `2026/`. + ## Open issues **Visible issue list:** [`ISSUES.md`](ISSUES.md) diff --git a/configs/goa-backups/README.md b/configs/goa-backups/README.md new file mode 100644 index 0000000..82c8fa2 --- /dev/null +++ b/configs/goa-backups/README.md @@ -0,0 +1,5 @@ +# GOA backup pointers + +Canonical dumps: **`~/backups/goa/`** on koopa and magikoopa (not in this git tree). + +See `2026/2026-09-04--goa-backup-regio-ng.md`. diff --git a/configs/lab-local/README.md b/configs/lab-local/README.md new file mode 100644 index 0000000..607819c --- /dev/null +++ b/configs/lab-local/README.md @@ -0,0 +1,51 @@ +# Lab local on koopa (parallel to live) + +Does **not** touch live GOA (`taler-hacktivism*`, **9010–9015**) or **9080** (`koopa-nym`). + +| Lab | Container | Host binds (loopback only) | +|-----|-----------|----------------------------| +| **goa-regio-ng** | `goa-regio-ng` | `127.0.0.1:9180→80`, `127.0.0.1:9322→22` | +| **mytops-local** | `mytops-local` | `127.0.0.1:8288→80` | + +## goa-regio-ng + +- Tree on laptop/koopa: `~/src/regio-local/` +- Inventory (canonical copy here): [`goa-regio-ng-koopa.yml`](./goa-regio-ng-koopa.yml) +- Ansible from magikoopa: ProxyCommand → `hernani@koopa` → `127.0.0.1:9322` +- Master: `koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv` + +```bash +rsync -az ~/src/regio-local/ hernani@koopa:src/regio-local/ +ssh hernani@koopa 'cd ~/src/regio-local && REGIO_HTTP_PORT=9180 REGIO_SSH_PORT=9322 REGIO_BIND=127.0.0.1 ./scripts/01-build-run.sh' +REGIO_PODMAN_SSH=hernani@koopa REGIO_INVENTORY=$HOME/git/admin-logs/koopa-admin-log/configs/lab-local/goa-regio-ng-koopa.yml \ + ~/src/regio-local/scripts/03-deploy.sh +REGIO_HTTP_PORT=9180 REGIO_PROBE_SSH=hernani@koopa ~/src/regio-local/scripts/04-probe.sh +``` + +Never `REGIO_PUBLISH_KOOPA_PORTS=1` on koopa next to live GOA. + +## mytops-local + +- **Verified 2026-09-04:** koopa `127.0.0.1:8288/config` → **200**; laptop same stack on **8088** → **200**. Daylog: `2026/2026-09-04--mytops-local-podman.md`. FIND: [`../koopa-setup`](../koopa-setup) · ports: [`../ports.md`](../ports.md). +- Tree: `mytops-admin-log` **`master`** (`mytops-local/wip:…`; rsync to `~/src/mytops-admin-log` on koopa; `.git` optional). Stage live-restore on betel still TODO. +- Config snippet: [`mytops-local.toml`](./mytops-local.toml) — port **8288** on koopa +- Orchestrator: `MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh` +- If `taler-merchant-dbconfig` fails (no postgres socket): `systemctl enable --now postgresql` inside the container, then dbconfig + `taler-merchant.target` again + +```bash +# on koopa: image + container (repo bind) +podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local . +podman rm -f mytops-local 2>/dev/null || true +podman run -d --name mytops-local --hostname mytops-local \ + --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \ + -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \ + -p 127.0.0.1:8288:80 \ + -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:ro" \ + localhost/mytops-debian-systemd:trixie /sbin/init +# apply koopa URL then setup (needs RW copy of config or run apply on host tree) +podman exec mytops-local bash -lc \ + 'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh' +curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8288/config # expect 200 +``` + +Laptop default remains **8088**; koopa lab uses **8288** so both can coexist with regio **9180**. diff --git a/configs/lab-local/goa-regio-ng-koopa.yml b/configs/lab-local/goa-regio-ng-koopa.yml new file mode 100644 index 0000000..00450d8 --- /dev/null +++ b/configs/lab-local/goa-regio-ng-koopa.yml @@ -0,0 +1,59 @@ +# goa-regio-ng on koopa — parallel lab; does NOT use live 9010–9015 or 9080 (nym). +# Host binds on koopa: 127.0.0.1:9180→80, 127.0.0.1:9322→22. +# Ansible from magikoopa via ProxyCommand into koopa loopback. +# +# Live GOA (untouched): taler-hacktivism{,-bank,-exchange-ansible} on 9010–9015. + +regional_currency: + hosts: + goa-regio-ng: + ansible_host: 127.0.0.1 + ansible_port: 9322 + ansible_user: root + ansible_ssh_private_key_file: "{{ lookup('ansible.builtin.env', 'HOME') }}/src/regio-local/ssh/regio_local_ed25519" + ansible_ssh_common_args: >- + -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null + -o ProxyCommand="ssh -W 127.0.0.1:%p -o StrictHostKeyChecking=no hernani@koopa" + ansible_python_interpreter: /usr/bin/python3 + + regional_currency_currency: GOA + regional_currency_currency_name: "GOA exploration currency" + regional_currency_domain: goa.local + regional_currency_bank_name: "GOA Exploration Bank" + regional_currency_bank_admin_password: "change-me" + regional_currency_bank_port: 8080 + regional_currency_bank_bind: "127.0.0.1" + regional_currency_enable_tls: false + regional_currency_enable_conversion: false + regional_currency_testing_deployment: true + regional_currency_enable_exchange_terms: false + regional_currency_enable_exchange_privacy: false + regional_currency_podman_systemd_relax: true + + # Dual merchant (CHF package + regional GOA); regio-style BASE_URLs (no :9180). + regional_currency_merchant_currency: CHF + regional_currency_merchant_regional_exchange_section: goa + regional_currency_merchant_disable_exchanges: + - kudos + regional_currency_merchant_disable_currencies: + - KUDOS + regional_currency_disable_currencies: + - kudos + - testkudos + - euro + - swiss-francs + - netzbon + + regional_currency_round_unit: "GOA:0.00000001" + regional_currency_tiny_amount: "GOA:0.00000001" + regional_currency_fractional_input_digits: 8 + regional_currency_fractional_normal_digits: 0 + regional_currency_fractional_trailing_zero_digits: 0 + regional_currency_alt_unit_names: '{"24":"Yotta-GOA","21":"Zetta-GOA","18":"Exa-GOA","15":"Peta-GOA","12":"Tera-GOA","9":"Giga-GOA","6":"Mega-GOA","3":"Kilo-GOA","0":"GOA","-1":"Deci-GOA","-2":"Centi-GOA","-3":"Milli-GOA","-6":"Micro-GOA","-7":"Deci-Micro-GOA","-8":"Atomic-GOA"}' + regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000" + regional_currency_static_coins_file: goa-exchange-coins.conf + regional_currency_coin_withdraw_duration: 7 days + regional_currency_default_debt_limit: "GOA:4503599627370496" + + regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10" + regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv" diff --git a/configs/lab-local/mytops-local.toml b/configs/lab-local/mytops-local.toml new file mode 100644 index 0000000..57aa6e9 --- /dev/null +++ b/configs/lab-local/mytops-local.toml @@ -0,0 +1,6 @@ +# Drop-in values for mytops-admin-log config.toml [mytops-local] when running on koopa. +# Laptop lab keeps 8088; koopa lab uses 8288 (avoid 901x live GOA, 9080 nym, 9180 goa-regio-ng). + +[mytops-local] +base_url = "http://127.0.0.1:8288/" +forwarded_host = "127.0.0.1:8288" diff --git a/configs/ports.md b/configs/ports.md index 872d09c..52ca815 100644 --- a/configs/ports.md +++ b/configs/ports.md @@ -32,4 +32,6 @@ Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN. | **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) | | **19000** | optional nym entry WS (gateway mode) | | **51822/udp** | optional nym WireGuard (dVPN path) | - +| **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) | +| **9322** | lab **`goa-regio-ng`** SSH/ansible (loopback only) | +| **8288** | lab **`mytops-local`** HTTP (loopback only) | diff --git a/koopa-setup b/koopa-setup new file mode 100644 index 0000000..0a18930 --- /dev/null +++ b/koopa-setup @@ -0,0 +1,27 @@ +# koopa-setup + +# lab / host setup pointers (clone: ~/git/admin-logs/koopa-admin-log). stay on main. + +## lab local (loopback only — never 901x / 9080) + +configs/lab-local/README.md +configs/lab-local/mytops-local.toml +configs/lab-local/goa-regio-ng-koopa.yml +configs/ports.md + +## mytops-local + +2026/2026-09-04--mytops-local-podman.md +# outward: ~/git/mytops-admin-log → git switch mytops-local + +## goa-regio-ng + +2026/2026-09-04--goa-backup-regio-ng.md +# outward: ~/src/regio-local/ + +## host map + +host/overview/ +configs/caddy/ +SECRETS.md +ISSUES.md