lab: mytops-local on koopa and koopa-setup entry

2026/2026-09-04--goa-backup-regio-ng.md

@@ -0,0 +1,97 @@
+# 2026-09-04 — GOA backup (pre regio-ng)
+
+## Live (koopa)
+
+| Container | Ports | Site |
+|-----------|-------|------|
+| `taler-hacktivism-exchange-ansible` | 9011/9014 | exchange.hacktivism.ch |
+| `taler-hacktivism-bank` | 9012/9013 | bank.hacktivism.ch |
+| `taler-hacktivism` | 9010/9015 | taler.hacktivism.ch |
+| `koopa-paivana` | 9025 | paivana.hacktivism.ch |
+
+Currency **GOA**. Master pub (public): `TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10`.
+
+Probes 2026-09-04: exchange/bank/taler `/config` **200**. Monitoring user units mostly failed (apps/ladder) — separate.
+
+**Risk:** exchange/bank/merchant data sit in container **overlay** (no named volumes). Offline key: `/var/lib/taler-exchange/offline/master.priv` inside exchange container.
+
+## Backup location (ERPNext-style `backups/` + stamp + `current`)
+
+| Host | Path |
+|------|------|
+| koopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
+| magikoopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
+| **secrets** (keys + `*.secret.conf` + host_vars/paivana) | `koopa-admin-secrets/backups/goa/<stamp>/` · `…/current` |
+
+Stamp taken: **`20260904T1238Z`**.
+
+### Non-secret dumps (`~/backups/goa/`)
+
+`exchange/` `bank/` `merchant/` TGZs (PG + etc), `meta/`, optional `images/` (~2.2G).
+
+### Secrets (`koopa-admin-secrets/backups/goa/current/`)
+
+| Path | Content |
+|------|---------|
+| `exchange-offline/master.priv` | offline master (pub TW6K5…) |
+| `exchange-offline/secm_tofus.pub` | secmod TOFU |
+| `exchange/secrets/*.secret.conf` | DB + wire account creds |
+| `merchant/secrets/merchant-db.secret.conf` | merchant DB |
+| `ansible/host_vars/` | public.yml + secrets.yml |
+| `paivana/secrets/` | merchant-access-token, paivana-secret |
+
+Never Forgejo push for `koopa-admin-secrets`. Magikoopa: `~/git/admin-logs/koopa-admin-secrets` (symlink `~/src/koopa/koopa-admin-secrets`).
+
+## Local reproduce (magikoopa) — **one** container, few unprivileged ports
+
+Not the three `goa-local-*` snapshot containers. Use **`regio-local`** only:
+
+| Bind | Role |
+|------|------|
+| `127.0.0.1:9080` | nginx HTTP (`Host: *.goa.local`) |
+| `127.0.0.1:9222` | SSH ansible |
+
+Optional: `REGIO_PUBLISH_KOOPA_PORTS=1` also binds `9010–9012` (still unprivileged).
+
+Tree: `~/src/regio-local/` — see `RESTORE.md`, `README.md`.
+
+### koopa lab ports (2026-09-04)
+
+Same stack **on koopa** without touching live **9010–9015** or **9080** (nym):
+
+| Bind | Role |
+|------|------|
+| `127.0.0.1:9180` | `goa-regio-ng` HTTP |
+| `127.0.0.1:9322` | `goa-regio-ng` SSH |
+| `127.0.0.1:8288` | `mytops-local` HTTP |
+
+Canonical config: **`configs/lab-local/`** (`goa-regio-ng-koopa.yml`, `mytops-local.toml`, README).
+
+### `taler-deployment` branches
+
+```
+dev/hernani/regio-ng-apt-refresh
+  └─ dev/hernani/regio-ng-ensure-postgresql
+       └─ regio-goa-explorational-currency   # GOA profile + master pin/import + TCP 901x
+```
+
+Example inventory: `regional-currency-ng/examples/goa-explorational.yml`  
+(imports `master.priv` from admin-secrets; refuses greenfield when pub pinned).
+
+### Restore flow
+
+```bash
+podman stop goa-local-exchange goa-local-bank goa-local-merchant   # free 901x; leave koopa live alone
+cd ~/src/regio-local
+./scripts/01-build-run.sh
+./scripts/02-inventory.sh
+./scripts/03-deploy.sh          # ansible; master from admin-secrets
+./scripts/05-restore-data.sh    # optional PG dumps from ~/backups/goa/current
+./scripts/04-probe.sh           # expect 200 on :9010 :9011 :9012
+```
+
+## Push
+
+`koopa-admin-log` Push nötig — nur mit Freigabe / User-Push.  
+`taler-deployment` branch `regio-goa-explorational-currency` likewise Freigabe.  
+Live wipe: **no**.

2026/2026-09-04--mytops-local-podman.md

@@ -0,0 +1,47 @@
+# mytops-local on koopa (podman lab)
+
+**2026-09-04** — merchant http lab next to live goa (not 901x / nym 9080).
+
+## status
+
+| where | port | `/config` |
+|-------|------|-----------|
+| koopa | `127.0.0.1:8288` | 200 (`mytops-local` Up) |
+| magikoopa (ref) | `127.0.0.1:8088` | 200 |
+
+container: `mytops-local` · image `localhost/mytops-debian-systemd:trixie` ·
+bind `~/src/mytops-admin-log` (rsync from laptop; `.git` optional).
+
+docs/run: `mytops-admin-log` branch `mytops-local` → entry `mytops-local` /
+`mytops-local.md`. `STAGE_ENV` unused on this path.
+
+## setup (koopa)
+
+```bash
+rsync -az --delete --exclude .git --exclude .DS_Store \
+  ~/git/mytops-admin-log/ hernani@koopa:src/mytops-admin-log/
+ssh hernani@koopa
+cd ~/src/mytops-admin-log
+podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local .
+MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/apply-local-base-url.sh
+podman rm -f mytops-local 2>/dev/null || true
+podman run -d --name mytops-local --hostname mytops-local \
+  --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \
+  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+  -p 127.0.0.1:8288:80 \
+  -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:rw" \
+  localhost/mytops-debian-systemd:trixie /sbin/init
+podman exec mytops-local bash -lc \
+  'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh'
+```
+
+if dbconfig fails (`policy-rc.d`): start `postgresql`, then dbconfig + `taler-merchant.target`.
+
+## links
+
+| what | where |
+|------|--------|
+| koopa-setup | `koopa-setup` |
+| lab-local | `configs/lab-local/` · `configs/ports.md` |
+| mytops-admin-log | branch `mytops-local` |
+| regio lab | `configs/lab-local/goa-regio-ng-koopa.yml` · `~/src/regio-local/` |

README.md

@@ -6,6 +6,11 @@ Ops log and config mirror for host **koopa** (openSUSE Tumbleweed).
 
 **Secrets:** not in this repo — see **`SECRETS.md`** and sibling **`koopa-admin-secrets`**.
 
+## FIND / setup entry
+
+Plain file **`koopa-setup`** — lab + host pointers (mytops-local, regio-ng,
+ports, daylogs). Start there before hunting under `configs/` / `2026/`.
+
 ## Open issues
 
 **Visible issue list:** [`ISSUES.md`](ISSUES.md)

configs/goa-backups/README.md

@@ -0,0 +1,5 @@
+# GOA backup pointers
+
+Canonical dumps: **`~/backups/goa/`** on koopa and magikoopa (not in this git tree).
+
+See `2026/2026-09-04--goa-backup-regio-ng.md`.

configs/lab-local/README.md

@@ -0,0 +1,51 @@
+# Lab local on koopa (parallel to live)
+
+Does **not** touch live GOA (`taler-hacktivism*`, **9010–9015**) or **9080** (`koopa-nym`).
+
+| Lab | Container | Host binds (loopback only) |
+|-----|-----------|----------------------------|
+| **goa-regio-ng** | `goa-regio-ng` | `127.0.0.1:9180→80`, `127.0.0.1:9322→22` |
+| **mytops-local** | `mytops-local` | `127.0.0.1:8288→80` |
+
+## goa-regio-ng
+
+- Tree on laptop/koopa: `~/src/regio-local/`
+- Inventory (canonical copy here): [`goa-regio-ng-koopa.yml`](./goa-regio-ng-koopa.yml)
+- Ansible from magikoopa: ProxyCommand → `hernani@koopa` → `127.0.0.1:9322`
+- Master: `koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv`
+
+```bash
+rsync -az ~/src/regio-local/ hernani@koopa:src/regio-local/
+ssh hernani@koopa 'cd ~/src/regio-local && REGIO_HTTP_PORT=9180 REGIO_SSH_PORT=9322 REGIO_BIND=127.0.0.1 ./scripts/01-build-run.sh'
+REGIO_PODMAN_SSH=hernani@koopa REGIO_INVENTORY=$HOME/git/admin-logs/koopa-admin-log/configs/lab-local/goa-regio-ng-koopa.yml \
+  ~/src/regio-local/scripts/03-deploy.sh
+REGIO_HTTP_PORT=9180 REGIO_PROBE_SSH=hernani@koopa ~/src/regio-local/scripts/04-probe.sh
+```
+
+Never `REGIO_PUBLISH_KOOPA_PORTS=1` on koopa next to live GOA.
+
+## mytops-local
+
+- **Verified 2026-09-04:** koopa `127.0.0.1:8288/config` → **200**; laptop same stack on **8088** → **200**. Daylog: `2026/2026-09-04--mytops-local-podman.md`. FIND: [`../koopa-setup`](../koopa-setup) · ports: [`../ports.md`](../ports.md).
+- Tree: `mytops-admin-log` **`master`** (`mytops-local/wip:…`; rsync to `~/src/mytops-admin-log` on koopa; `.git` optional). Stage live-restore on betel still TODO.
+- Config snippet: [`mytops-local.toml`](./mytops-local.toml) — port **8288** on koopa
+- Orchestrator: `MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh`
+- If `taler-merchant-dbconfig` fails (no postgres socket): `systemctl enable --now postgresql` inside the container, then dbconfig + `taler-merchant.target` again
+
+```bash
+# on koopa: image + container (repo bind)
+podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local .
+podman rm -f mytops-local 2>/dev/null || true
+podman run -d --name mytops-local --hostname mytops-local \
+  --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \
+  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+  -p 127.0.0.1:8288:80 \
+  -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:ro" \
+  localhost/mytops-debian-systemd:trixie /sbin/init
+# apply koopa URL then setup (needs RW copy of config or run apply on host tree)
+podman exec mytops-local bash -lc \
+  'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh'
+curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8288/config   # expect 200
+```
+
+Laptop default remains **8088**; koopa lab uses **8288** so both can coexist with regio **9180**.

configs/lab-local/goa-regio-ng-koopa.yml

@@ -0,0 +1,59 @@
+# goa-regio-ng on koopa — parallel lab; does NOT use live 9010–9015 or 9080 (nym).
+# Host binds on koopa: 127.0.0.1:9180→80, 127.0.0.1:9322→22.
+# Ansible from magikoopa via ProxyCommand into koopa loopback.
+#
+# Live GOA (untouched): taler-hacktivism{,-bank,-exchange-ansible} on 9010–9015.
+
+regional_currency:
+  hosts:
+    goa-regio-ng:
+      ansible_host: 127.0.0.1
+      ansible_port: 9322
+      ansible_user: root
+      ansible_ssh_private_key_file: "{{ lookup('ansible.builtin.env', 'HOME') }}/src/regio-local/ssh/regio_local_ed25519"
+      ansible_ssh_common_args: >-
+        -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
+        -o ProxyCommand="ssh -W 127.0.0.1:%p -o StrictHostKeyChecking=no hernani@koopa"
+      ansible_python_interpreter: /usr/bin/python3
+
+      regional_currency_currency: GOA
+      regional_currency_currency_name: "GOA exploration currency"
+      regional_currency_domain: goa.local
+      regional_currency_bank_name: "GOA Exploration Bank"
+      regional_currency_bank_admin_password: "change-me"
+      regional_currency_bank_port: 8080
+      regional_currency_bank_bind: "127.0.0.1"
+      regional_currency_enable_tls: false
+      regional_currency_enable_conversion: false
+      regional_currency_testing_deployment: true
+      regional_currency_enable_exchange_terms: false
+      regional_currency_enable_exchange_privacy: false
+      regional_currency_podman_systemd_relax: true
+
+      # Dual merchant (CHF package + regional GOA); regio-style BASE_URLs (no :9180).
+      regional_currency_merchant_currency: CHF
+      regional_currency_merchant_regional_exchange_section: goa
+      regional_currency_merchant_disable_exchanges:
+        - kudos
+      regional_currency_merchant_disable_currencies:
+        - KUDOS
+      regional_currency_disable_currencies:
+        - kudos
+        - testkudos
+        - euro
+        - swiss-francs
+        - netzbon
+
+      regional_currency_round_unit: "GOA:0.00000001"
+      regional_currency_tiny_amount: "GOA:0.00000001"
+      regional_currency_fractional_input_digits: 8
+      regional_currency_fractional_normal_digits: 0
+      regional_currency_fractional_trailing_zero_digits: 0
+      regional_currency_alt_unit_names: '{"24":"Yotta-GOA","21":"Zetta-GOA","18":"Exa-GOA","15":"Peta-GOA","12":"Tera-GOA","9":"Giga-GOA","6":"Mega-GOA","3":"Kilo-GOA","0":"GOA","-1":"Deci-GOA","-2":"Centi-GOA","-3":"Milli-GOA","-6":"Micro-GOA","-7":"Deci-Micro-GOA","-8":"Atomic-GOA"}'
+      regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000"
+      regional_currency_static_coins_file: goa-exchange-coins.conf
+      regional_currency_coin_withdraw_duration: 7 days
+      regional_currency_default_debt_limit: "GOA:4503599627370496"
+
+      regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10"
+      regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv"

configs/lab-local/mytops-local.toml

@@ -0,0 +1,6 @@
+# Drop-in values for mytops-admin-log config.toml [mytops-local] when running on koopa.
+# Laptop lab keeps 8088; koopa lab uses 8288 (avoid 901x live GOA, 9080 nym, 9180 goa-regio-ng).
+
+[mytops-local]
+base_url = "http://127.0.0.1:8288/"
+forwarded_host = "127.0.0.1:8288"

configs/ports.md

@@ -32,4 +32,6 @@ Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
 | **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) |
 | **19000** | optional nym entry WS (gateway mode) |
 | **51822/udp** | optional nym WireGuard (dVPN path) |
-
+| **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) |
+| **9322** | lab **`goa-regio-ng`** SSH/ansible (loopback only) |
+| **8288** | lab **`mytops-local`** HTTP (loopback only) |

koopa-setup

@@ -0,0 +1,27 @@
+# koopa-setup
+
+# lab / host setup pointers (clone: ~/git/admin-logs/koopa-admin-log). stay on main.
+
+## lab local (loopback only — never 901x / 9080)
+
+configs/lab-local/README.md
+configs/lab-local/mytops-local.toml
+configs/lab-local/goa-regio-ng-koopa.yml
+configs/ports.md
+
+## mytops-local
+
+2026/2026-09-04--mytops-local-podman.md
+# outward: ~/git/mytops-admin-log → git switch mytops-local
+
+## goa-regio-ng
+
+2026/2026-09-04--goa-backup-regio-ng.md
+# outward: ~/src/regio-local/
+
+## host map
+
+host/overview/
+configs/caddy/
+SECRETS.md
+ISSUES.md