- Bank landing v45 - · content - · 0d881cd +
+ Bank landing v44 + · content + · 689ee59
diff --git a/configs/bank-landing/nginx-landing.conf b/configs/bank-landing/nginx-landing.conf index e0ff9fb..251a713 100644 --- a/configs/bank-landing/nginx-landing.conf +++ b/configs/bank-landing/nginx-landing.conf @@ -49,16 +49,6 @@ server { add_header Cache-Control "no-store" always; add_header Access-Control-Allow-Origin * always; } - # FP pattern: GET Integration via demo-api (inject suggested/required_exchange) - # Caddy @wdGet → :9013 → here → :19096; POST/other Integration stays on :9012 - location /taler-integration/withdrawal-operation/ { - proxy_pass http://127.0.0.1:19096; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_read_timeout 70s; - add_header Cache-Control "no-store" always; - add_header Access-Control-Allow-Origin * always; - } location /intro/ { alias /var/www/bank-landing/; } diff --git a/configs/bbb/Containerfile b/configs/bbb/Containerfile deleted file mode 100644 index ae85793..0000000 --- a/configs/bbb/Containerfile +++ /dev/null @@ -1,36 +0,0 @@ -# koopa-bbb-front — BigBlueButton front (Ubuntu) -# Exception to CachyOS policy: BBB packages and install scripts target Ubuntu. -# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu -# -# Placeholder reverse-proxy target (nginx) until Greenlight and/or BBB core -# (bbb-install on Ubuntu) is chosen. Not production BBB media. - -ARG UBUNTU_IMAGE=docker.io/library/ubuntu:24.04 -FROM ${UBUNTU_IMAGE} - -ENV DEBIAN_FRONTEND=noninteractive \ - TZ=Europe/Zurich - -RUN apt-get update \ - && apt-get install -y --no-install-recommends \ - ca-certificates curl nginx tini \ - && rm -rf /var/lib/apt/lists/* - -RUN printf '%s\n' \ - 'server {' \ - ' listen 80 default_server;' \ - ' root /var/www/html;' \ - ' index index.html;' \ - ' location = /health { access_log off; default_type text/plain; return 200 "ok\n"; }' \ - ' location / { try_files $uri $uri/ =404; }' \ - '}' > /etc/nginx/sites-available/default \ - && printf '%s\n' \ - 'BBB front stub (Ubuntu 24.04). Full BigBlueButton / Greenlight is a separate Ubuntu install step.
' \ - > /var/www/html/index.html - -COPY entrypoint.sh /docker-entrypoint.sh -RUN chmod 755 /docker-entrypoint.sh - -EXPOSE 80 -ENTRYPOINT ["/usr/bin/tini", "--", "/docker-entrypoint.sh"] diff --git a/configs/bbb/README.md b/configs/bbb/README.md deleted file mode 100644 index ac655e2..0000000 --- a/configs/bbb/README.md +++ /dev/null @@ -1,38 +0,0 @@ -# BBB (BigBlueButton) — Ubuntu container (koopa) - -CachyOS exception: BBB packages and `bbb-install` target **Ubuntu**. Front stub image is Ubuntu 24.04. - -| Item | Value | -|------|--------| -| Stack | BigBlueButton (front stub → core later) | -| Image | `localhost/koopa-bbb-front:ubuntu` (`FROM docker.io/library/ubuntu:24.04`) | -| Live dir | `/home/hernani/koopa-bbb/` | -| Container | `koopa-bbb-front` | -| Host port | **9032** | -| Public site | `bbb.hacktivism.ch` | - -## Phases - -1. **Front stub (this tree)** — nginx placeholder on `:9032` so Caddy + DNS can land. -2. **Greenlight (optional)** — Rails UI talking to a real BBB API; still Ubuntu-based images. -3. **BBB core** — FreeSWITCH / mediasoup / akka-apps. Prefer official Ubuntu install (`bbb-install.sh`) on a dedicated Ubuntu host/VM, or a known multi-container BBB compose. Not CachyOS. - -Media UDP/TCP and TURN are documented when core is chosen — not in this stub. - -## Build + up (koopa) - -```bash -bash /path/to/koopa-admin-log/scripts/bbb/build.sh -mkdir -p ~/koopa-bbb && cp -a /path/to/koopa-admin-log/configs/bbb/{compose.yml,Containerfile,entrypoint.sh} ~/koopa-bbb/ -cd ~/koopa-bbb && HOST_PORT=9032 podman-compose up -d -``` - -## Caddy - -```bash -sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \ - --snippet /path/to/koopa-admin-log/configs/caddy/bbb.hacktivism.ch.caddy \ - --site bbb.hacktivism.ch --port 9032 --label bbb -``` - -DNS + VeciGate for the hostname after apply Freigabe. diff --git a/configs/bbb/compose.yml b/configs/bbb/compose.yml deleted file mode 100644 index 961e9fd..0000000 --- a/configs/bbb/compose.yml +++ /dev/null @@ -1,31 +0,0 @@ -# koopa-bbb — BigBlueButton front on Ubuntu (exception to CachyOS) -# Live: /home/hernani/koopa-bbb/ -# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu -# -# HOST_PORT: 9032 → Caddy bbb.hacktivism.ch -# Core BBB / Greenlight: separate follow-up (Ubuntu), not this stub. -services: - bbb-front: - image: localhost/koopa-bbb-front:ubuntu - build: - context: . - dockerfile: Containerfile - container_name: koopa-bbb-front - restart: unless-stopped - environment: - - TZ=Europe/Zurich - ports: - - "${HOST_PORT:-9032}:80" - healthcheck: - test: ["CMD", "curl", "-fsS", "http://127.0.0.1/health"] - interval: 30s - timeout: 5s - retries: 3 - start_period: 10s - labels: - org.hacktivism.service: bbb - org.hacktivism.host_port: "${HOST_PORT:-9032}" - org.hacktivism.site: bbb.hacktivism.ch - org.hacktivism.managed_by: koopa-admin - org.hacktivism.port_status: allocated-9032 - org.hacktivism.image_base: ubuntu diff --git a/configs/bbb/entrypoint.sh b/configs/bbb/entrypoint.sh deleted file mode 100755 index d73c4e6..0000000 --- a/configs/bbb/entrypoint.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/bash -set -euo pipefail -exec nginx -g 'daemon off;' diff --git a/configs/bbb/vm/defaults.env b/configs/bbb/vm/defaults.env deleted file mode 100644 index f7ba7dd..0000000 --- a/configs/bbb/vm/defaults.env +++ /dev/null @@ -1,27 +0,0 @@ -# koopa BBB Ubuntu VM — lean defaults (host ~15 Gi / 4 cores) -# Override before sourcing: RAM_MIB=4096 VCPUS=2 … - -VM_NAME=koopa-bbb -# Official prod=16G; local-dev floor=8G. Koopa lean default=6G + guest swap. -RAM_MIB=6144 -VCPUS=2 -DISK_GB=50 -# Ubuntu 22.04 LTS (bbb-install 3.0). 24.04 only if docs for your branch say so. -OS_VARIANT=ubuntu22.04 -CLOUD_IMAGE_URL=https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-amd64.img -HOSTNAME=bbb.hacktivism.ch -# Bridged LAN (preferred for media DNAT). Set BRIDGE= after host-prep creates br0. -BRIDGE= -# Fallback: libvirt default NAT (media harder; ok for first boot/ssh) -NETWORK_SOURCE=default -# Guest swap (MiB) — important when RAM_MIB < 8192 -SWAP_MIB=4096 -# SSH pubkey injected via cloud-init (path on koopa host) -SSH_PUBKEY_FILE=/home/hernani/.ssh/id_ed25519.pub -# Disk pool -POOL_DIR=/var/lib/libvirt/images -# bbb-install branch + Greenlight -BBB_INSTALL_BRANCH=v3.0.x-release -BBB_INSTALL_EXTRA=-g -# After VM has IP: Caddy may stay on :9032 stub until cutover, or point at VM:80 -CADDY_BACKEND_HINT=VM_HTTP_80_OR_DNAT diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile index ee8dee5..58fb8a5 100644 --- a/configs/caddy/Caddyfile +++ b/configs/caddy/Caddyfile @@ -1,7 +1,7 @@ # Internal only (not in the browser URL): # 9010 merchant API | 9011 exchange API | 9012 bank API # 9013 bank landing | 9014 exchange landing | 9015 merchant landing -# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9028 silverbullet | 9200 forgejo-ssh +# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 { @@ -39,28 +39,28 @@ taler.hacktivism.ch { # surface + aptdeploy HTML (taler.hacktivism.ch only) handle /taler-monitoring-surface_err { - redir /taler-monitoring-surface_err/ 302 + redir * /taler-monitoring-surface_err/ 302 } handle /taler-monitoring-surface_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-surface { - redir /taler-monitoring-surface/ 302 + redir * /taler-monitoring-surface/ 302 } handle /taler-monitoring-surface* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-aptdeploy_err { - redir /taler-monitoring-aptdeploy_err/ 302 + redir * /taler-monitoring-aptdeploy_err/ 302 } handle /taler-monitoring-aptdeploy_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-aptdeploy { - redir /taler-monitoring-aptdeploy/ 302 + redir * /taler-monitoring-aptdeploy/ 302 } handle /taler-monitoring-aptdeploy* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -68,14 +68,14 @@ taler.hacktivism.ch { } handle /taler-monitoring-mattermost_err { - redir /taler-monitoring-mattermost_err/ 302 + redir * /taler-monitoring-mattermost_err/ 302 } handle /taler-monitoring-mattermost_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-mattermost { - redir /taler-monitoring-mattermost/ 302 + redir * /taler-monitoring-mattermost/ 302 } handle /taler-monitoring-mattermost* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -83,14 +83,14 @@ taler.hacktivism.ch { } handle /taler-monitoring-mail_err { - redir /taler-monitoring-mail_err/ 302 + redir * /taler-monitoring-mail_err/ 302 } handle /taler-monitoring-mail_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-mail { - redir /taler-monitoring-mail/ 302 + redir * /taler-monitoring-mail/ 302 } handle /taler-monitoring-mail* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -99,14 +99,14 @@ taler.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -143,14 +143,14 @@ exchange.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/exchange.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/exchange.hacktivism.ch @@ -177,14 +177,14 @@ bank.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/bank.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/bank.hacktivism.ch @@ -204,19 +204,6 @@ bank.hacktivism.ch { } } - # FP pattern (francpaysan-admin-log files/caddy/Caddyfile @wdGet): - # GET withdrawal-operation → landing :9013 → demo-api :19096 - # (injects suggested_exchange / required_exchange for Android/iOS) - @wdGet { - method GET - path /taler-integration/withdrawal-operation/* - } - handle @wdGet { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - reverse_proxy 127.0.0.1:9012 { import proxy_public } @@ -328,118 +315,7 @@ lemmy.hacktivism.ch { } } -# 9027 decidim (rails) -decidim.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9027 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9028 silverbullet / SilverBullet — allocated 2026-09-08 -# Merge into /etc/caddy/Caddyfile (sudo). -# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list. -silverbullet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9028 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9029 galene — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene -galene.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9029 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9030 cryptpad — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad -# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot. -cryptpad.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9030 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9031 meet (Jitsi) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet -# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later. -meet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9031 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9032 bbb (BigBlueButton) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb -# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install. -bbb.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9032 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch { +http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch { handle /.well-known/acme-challenge/* { root * /var/www/acme file_server diff --git a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954 b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954 deleted file mode 100644 index bacff1e..0000000 --- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954 +++ /dev/null @@ -1,343 +0,0 @@ -# Internal only (not in the browser URL): -# 9010 merchant API | 9011 exchange API | 9012 bank API -# 9013 bank landing | 9014 exchange landing | 9015 merchant landing -# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh -# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 - -{ - email info+koopa@hacktivism.ch - http_port 9000 - https_port 9001 - auto_https disable_redirects - # Caddy listens on 9001 behind VeciGate/https-proxy :443. - # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443. - servers { - protocols h1 h2 - } -} - -(proxy_public) { - header_up Host {host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1" -} - -taler.hacktivism.ch { - tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9015 { - import proxy_public - } - } - - # surface + aptdeploy HTML (taler.hacktivism.ch only) - handle /taler-monitoring-surface_err { - redir /taler-monitoring-surface_err/ 302 - } - handle /taler-monitoring-surface_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-surface { - redir /taler-monitoring-surface/ 302 - } - handle /taler-monitoring-surface* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy_err { - redir /taler-monitoring-aptdeploy_err/ 302 - } - handle /taler-monitoring-aptdeploy_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy { - redir /taler-monitoring-aptdeploy/ 302 - } - handle /taler-monitoring-aptdeploy* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mattermost_err { - redir /taler-monitoring-mattermost_err/ 302 - } - handle /taler-monitoring-mattermost_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mattermost { - redir /taler-monitoring-mattermost/ 302 - } - handle /taler-monitoring-mattermost* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mail_err { - redir /taler-monitoring-mail_err/ 302 - } - handle /taler-monitoring-mail_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mail { - redir /taler-monitoring-mail/ 302 - } - handle /taler-monitoring-mail* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - - - - # SPA: /webui → /webui/ - redir /webui /webui/ 302 - - # Merchant API + WebUI (nginx :9010 → unix socket) - reverse_proxy https://127.0.0.1:9010 { - transport http { - tls_insecure_skip_verify - } - import proxy_public - } -} - -exchange.hacktivism.ch { - tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9014 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - - - reverse_proxy 127.0.0.1:9011 { - import proxy_public - } -} - -bank.hacktivism.ch { - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - - - # Static terms/privacy on landing nginx :9013 - handle /terms* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - handle /privacy* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - reverse_proxy 127.0.0.1:9012 { - import proxy_public - } -} - -castopod.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9020 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -bonfire.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9021 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -prime.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9022 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -bt.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9023 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy) -git.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9024 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - - -# Taler Operations design previews (static nginx) -tops.ng1.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9090 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng2.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9091 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng3.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9092 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - - -# 9025 paivana-httpd (GOA paywall) -paivana.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9025 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - } -} - -# 9026 lemmy (+ ui/pictrs via internal nginx) -lemmy.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9026 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9027 decidim (rails) -decidim.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9027 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch { - handle /.well-known/acme-challenge/* { - root * /var/www/acme - file_server - } - handle { - redir https://{host}{uri} permanent - } -} diff --git a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955 b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955 deleted file mode 100644 index 9c7ed06..0000000 --- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955 +++ /dev/null @@ -1,399 +0,0 @@ -# Internal only (not in the browser URL): -# 9010 merchant API | 9011 exchange API | 9012 bank API -# 9013 bank landing | 9014 exchange landing | 9015 merchant landing -# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9200 forgejo-ssh -# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 - -{ - email info+koopa@hacktivism.ch - http_port 9000 - https_port 9001 - auto_https disable_redirects - # Caddy listens on 9001 behind VeciGate/https-proxy :443. - # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443. - servers { - protocols h1 h2 - } -} - -(proxy_public) { - header_up Host {host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1" -} - -taler.hacktivism.ch { - tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9015 { - import proxy_public - } - } - - # surface + aptdeploy HTML (taler.hacktivism.ch only) - handle /taler-monitoring-surface_err { - redir /taler-monitoring-surface_err/ 302 - } - handle /taler-monitoring-surface_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-surface { - redir /taler-monitoring-surface/ 302 - } - handle /taler-monitoring-surface* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy_err { - redir /taler-monitoring-aptdeploy_err/ 302 - } - handle /taler-monitoring-aptdeploy_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy { - redir /taler-monitoring-aptdeploy/ 302 - } - handle /taler-monitoring-aptdeploy* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mattermost_err { - redir /taler-monitoring-mattermost_err/ 302 - } - handle /taler-monitoring-mattermost_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mattermost { - redir /taler-monitoring-mattermost/ 302 - } - handle /taler-monitoring-mattermost* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mail_err { - redir /taler-monitoring-mail_err/ 302 - } - handle /taler-monitoring-mail_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mail { - redir /taler-monitoring-mail/ 302 - } - handle /taler-monitoring-mail* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - - - - # SPA: /webui → /webui/ - redir /webui /webui/ 302 - - # Merchant API + WebUI (nginx :9010 → unix socket) - reverse_proxy https://127.0.0.1:9010 { - transport http { - tls_insecure_skip_verify - } - import proxy_public - } -} - -exchange.hacktivism.ch { - tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9014 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - - - reverse_proxy 127.0.0.1:9011 { - import proxy_public - } -} - -bank.hacktivism.ch { - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - - - # Static terms/privacy on landing nginx :9013 - handle /terms* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - handle /privacy* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - reverse_proxy 127.0.0.1:9012 { - import proxy_public - } -} - -castopod.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9020 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -bonfire.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9021 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -prime.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9022 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -bt.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9023 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy) -git.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9024 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - - -# Taler Operations design previews (static nginx) -tops.ng1.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9090 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng2.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9091 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng3.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9092 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - - -# 9025 paivana-httpd (GOA paywall) -paivana.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9025 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - } -} - -# 9026 lemmy (+ ui/pictrs via internal nginx) -lemmy.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9026 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9027 decidim (rails) -decidim.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9027 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9029 galene — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene -galene.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9029 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9030 cryptpad — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad -# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot. -cryptpad.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9030 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9031 meet (Jitsi) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet -# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later. -meet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9031 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch { - handle /.well-known/acme-challenge/* { - root * /var/www/acme - file_server - } - handle { - redir https://{host}{uri} permanent - } -} diff --git a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821 b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821 deleted file mode 100644 index 70d8b08..0000000 --- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821 +++ /dev/null @@ -1,418 +0,0 @@ -# Internal only (not in the browser URL): -# 9010 merchant API | 9011 exchange API | 9012 bank API -# 9013 bank landing | 9014 exchange landing | 9015 merchant landing -# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9200 forgejo-ssh -# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 - -{ - email info+koopa@hacktivism.ch - http_port 9000 - https_port 9001 - auto_https disable_redirects - # Caddy listens on 9001 behind VeciGate/https-proxy :443. - # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443. - servers { - protocols h1 h2 - } -} - -(proxy_public) { - header_up Host {host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1" -} - -taler.hacktivism.ch { - tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9015 { - import proxy_public - } - } - - # surface + aptdeploy HTML (taler.hacktivism.ch only) - handle /taler-monitoring-surface_err { - redir /taler-monitoring-surface_err/ 302 - } - handle /taler-monitoring-surface_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-surface { - redir /taler-monitoring-surface/ 302 - } - handle /taler-monitoring-surface* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy_err { - redir /taler-monitoring-aptdeploy_err/ 302 - } - handle /taler-monitoring-aptdeploy_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-aptdeploy { - redir /taler-monitoring-aptdeploy/ 302 - } - handle /taler-monitoring-aptdeploy* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mattermost_err { - redir /taler-monitoring-mattermost_err/ 302 - } - handle /taler-monitoring-mattermost_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mattermost { - redir /taler-monitoring-mattermost/ 302 - } - handle /taler-monitoring-mattermost* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - handle /taler-monitoring-mail_err { - redir /taler-monitoring-mail_err/ 302 - } - handle /taler-monitoring-mail_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /taler-monitoring-mail { - redir /taler-monitoring-mail/ 302 - } - handle /taler-monitoring-mail* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server - } - - - - - # SPA: /webui → /webui/ - redir /webui /webui/ 302 - - # Merchant API + WebUI (nginx :9010 → unix socket) - reverse_proxy https://127.0.0.1:9010 { - transport http { - tls_insecure_skip_verify - } - import proxy_public - } -} - -exchange.hacktivism.ch { - tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9014 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/exchange.hacktivism.ch - file_server - } - - - reverse_proxy 127.0.0.1:9011 { - import proxy_public - } -} - -bank.hacktivism.ch { - header Alt-Svc "clear" - - # Public landing first - redir / /intro/ 302 - - handle /intro* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - # taler-monitoring console HTML (host static — not in app containers) - handle /monitoring_err { - redir /monitoring_err/ 302 - } - handle /monitoring_err* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - handle /monitoring { - redir /monitoring/ 302 - } - handle /monitoring* { - root * /var/www/monitoring-sites/bank.hacktivism.ch - file_server - } - - - # Static terms/privacy on landing nginx :9013 - handle /terms* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - handle /privacy* { - reverse_proxy 127.0.0.1:9013 { - import proxy_public - } - } - - reverse_proxy 127.0.0.1:9012 { - import proxy_public - } -} - -castopod.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9020 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -bonfire.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9021 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -prime.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9022 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - flush_interval -1 - } -} - -bt.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9023 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - } -} - -# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy) -git.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9024 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - - -# Taler Operations design previews (static nginx) -tops.ng1.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9090 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng2.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9091 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - -tops.ng3.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9092 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - } -} - - -# 9025 paivana-httpd (GOA paywall) -paivana.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9025 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - } -} - -# 9026 lemmy (+ ui/pictrs via internal nginx) -lemmy.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9026 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Proto {scheme} - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9027 decidim (rails) -decidim.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9027 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9029 galene — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene -galene.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9029 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9030 cryptpad — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad -# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot. -cryptpad.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9030 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9031 meet (Jitsi) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet -# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later. -meet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9031 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -# 9032 bbb (BigBlueButton) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb -# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install. -bbb.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9032 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch { - handle /.well-known/acme-challenge/* { - root * /var/www/acme - file_server - } - handle { - redir https://{host}{uri} permanent - } -} diff --git a/configs/caddy/README.md b/configs/caddy/README.md index 66283ff..c59d05e 100644 --- a/configs/caddy/README.md +++ b/configs/caddy/README.md @@ -4,7 +4,6 @@ |------|------| | **`Caddyfile`** | Multi-vhost config mirror (`/etc/caddy/Caddyfile` on host) | | `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo | -| `silverbullet.hacktivism.ch.caddy` | Site-block snippet for SilverBullet | | `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy | Also: `host/caddy/Caddyfile` (same as `Caddyfile` here). diff --git a/configs/caddy/bbb.hacktivism.ch.caddy b/configs/caddy/bbb.hacktivism.ch.caddy deleted file mode 100644 index c1c3b4b..0000000 --- a/configs/caddy/bbb.hacktivism.ch.caddy +++ /dev/null @@ -1,18 +0,0 @@ -# 9032 bbb (BigBlueButton) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb -# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install. -bbb.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9032 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} diff --git a/configs/caddy/cryptpad.hacktivism.ch.caddy b/configs/caddy/cryptpad.hacktivism.ch.caddy deleted file mode 100644 index 759c6ad..0000000 --- a/configs/caddy/cryptpad.hacktivism.ch.caddy +++ /dev/null @@ -1,18 +0,0 @@ -# 9030 cryptpad — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad -# Backend is koopa-cryptpad-edge (HTTP+WS). Sandbox subdomain (cryptpad-ui) — wire after first boot. -cryptpad.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9030 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} diff --git a/configs/caddy/galene.hacktivism.ch.caddy b/configs/caddy/galene.hacktivism.ch.caddy deleted file mode 100644 index 59aaef9..0000000 --- a/configs/caddy/galene.hacktivism.ch.caddy +++ /dev/null @@ -1,17 +0,0 @@ -# 9029 galene — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene -galene.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9029 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} diff --git a/configs/caddy/meet.hacktivism.ch.caddy b/configs/caddy/meet.hacktivism.ch.caddy deleted file mode 100644 index 5e54f99..0000000 --- a/configs/caddy/meet.hacktivism.ch.caddy +++ /dev/null @@ -1,18 +0,0 @@ -# 9031 meet (Jitsi) — allocated 2026-09-08 -# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet -# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later. -meet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9031 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} diff --git a/configs/caddy/silverbullet.hacktivism.ch.caddy b/configs/caddy/silverbullet.hacktivism.ch.caddy deleted file mode 100644 index 868b065..0000000 --- a/configs/caddy/silverbullet.hacktivism.ch.caddy +++ /dev/null @@ -1,18 +0,0 @@ -# 9028 silverbullet / SilverBullet — allocated 2026-09-08 -# Merge into /etc/caddy/Caddyfile (sudo). -# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list. -silverbullet.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9028 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} diff --git a/configs/cryptpad/Containerfile b/configs/cryptpad/Containerfile deleted file mode 100644 index e20fe10..0000000 --- a/configs/cryptpad/Containerfile +++ /dev/null @@ -1,47 +0,0 @@ -# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman -# Build on koopa (x86_64): -# bash ~/koopa-admin-log/scripts/cryptpad/build.sh -# → localhost/koopa-cryptpad:cachyos -# -# App tree from upstream release tarball (not the official Debian-ish image). - -ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest -FROM ${CACHYOS_IMAGE} - -ARG CRYPTPAD_VERSION=2025.9.0 -ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz - -ENV TZ=Europe/Zurich \ - PATH=/usr/local/bin:$PATH \ - CRYPTPAD_HOME=/cryptpad - -RUN pacman -Syu --noconfirm --needed \ - bash curl ca-certificates catatonit tar git \ - nodejs npm \ - && pacman -Scc --noconfirm \ - && rm -rf /var/cache/pacman/pkg/* /tmp/* - -# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs. -RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \ - && mkdir -p /cryptpad \ - && tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \ - && rm -f /tmp/cryptpad.tgz \ - && cd /cryptpad \ - && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \ - && git config --global url."https://github.com/".insteadOf "git@github.com:" \ - && git config --global url."https://".insteadOf "git://" \ - && printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \ - && (npm ci --omit=dev --allow-git=all --allow-remote=all \ - || npm install --omit=dev --allow-git=all --allow-remote=all) \ - && (npm run install:components || true) \ - && rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/* - -COPY entrypoint.sh /docker-entrypoint.sh -RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \ - /cryptpad/blobstage /cryptpad/data/logs -COPY config.example.js /cryptpad/config/config.js -RUN chmod 755 /docker-entrypoint.sh - -EXPOSE 3000 -WORKDIR /cryptpad -ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"] diff --git a/configs/cryptpad/README.md b/configs/cryptpad/README.md deleted file mode 100644 index 2a91ced..0000000 --- a/configs/cryptpad/README.md +++ /dev/null @@ -1,32 +0,0 @@ -# CryptPad — on CachyOS (koopa) - -| Item | Value | -|------|--------| -| Stack | [CryptPad](https://cryptpad.org/) | -| Image | `localhost/koopa-cryptpad:cachyos` | -| Live dir | `/home/hernani/koopa-cryptpad/` | -| Host port | **9030** = Paivana paywall; nginx edge backend **172.17.0.1:19130** → app (pasta host IP; Paivana DEST) | -| App ports (internal) | **3000** HTTP, **3003** websocket | -| Public site | `cryptpad.hacktivism.ch` | - -`websocketPort` must differ from `httpPort` (upstream default 3003). Compose runs `koopa-cryptpad-edge` (nginx) so Caddy still only targets **9030**. -Upstream wants a separate **safe/sandbox** origin for some builds — add a second vhost after first boot if the admin UI requires it. - -## Build + up - -```bash -bash /path/to/koopa-admin-log/scripts/cryptpad/build.sh -mkdir -p ~/koopa-cryptpad -cp -a /path/to/koopa-admin-log/configs/cryptpad/{compose.yml,config.example.js} ~/koopa-cryptpad/ -cp ~/koopa-cryptpad/config.example.js ~/koopa-cryptpad/config.js -# edit httpUnsafeOrigin / httpSafeOrigin in config.js -cd ~/koopa-cryptpad && podman-compose up -d -``` - -## Caddy - -```bash -sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \ - --snippet …/configs/caddy/cryptpad.hacktivism.ch.caddy \ - --site cryptpad.hacktivism.ch --port 9030 --label cryptpad -``` diff --git a/configs/cryptpad/compose.yml b/configs/cryptpad/compose.yml deleted file mode 100644 index 6452461..0000000 --- a/configs/cryptpad/compose.yml +++ /dev/null @@ -1,53 +0,0 @@ -# koopa-cryptpad — CryptPad on CachyOS + nginx edge (HTTP+WS on :9030) -# Live: /home/hernani/koopa-cryptpad/ -# Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos -# -# Public :9030 = koopa-paivana-cryptpad (shared paivana image). -# Edge on pasta host IP — Paivana DEST → 172.17.0.1:19130 (not LAN 0.0.0.0) -# App listens 3000 (http) + 3003 (websocket) inside the net. -services: - cryptpad: - image: localhost/koopa-cryptpad:cachyos - build: - context: . - dockerfile: Containerfile - args: - CRYPTPAD_VERSION: "${CRYPTPAD_VERSION:-2025.9.0}" - container_name: koopa-cryptpad - restart: unless-stopped - environment: - - TZ=Europe/Zurich - volumes: - - ./data:/cryptpad/data - - ./datastore:/cryptpad/datastore - - ./block:/cryptpad/block - - ./blob:/cryptpad/blob - - ./config.js:/cryptpad/config/config.js:ro - expose: - - "3000" - - "3003" - labels: - org.hacktivism.service: cryptpad - org.hacktivism.host_port: "9030" - org.hacktivism.backend_port: "${BACKEND_PORT:-19130}" - org.hacktivism.site: cryptpad.hacktivism.ch - org.hacktivism.managed_by: koopa-admin - org.hacktivism.port_status: backend-19130-paywall-9030 - org.hacktivism.image_base: cachyos - - edge: - image: docker.io/library/nginx:alpine - container_name: koopa-cryptpad-edge - restart: unless-stopped - depends_on: - - cryptpad - volumes: - - ./edge.conf:/etc/nginx/conf.d/default.conf:ro - ports: - - "172.17.0.1:${BACKEND_PORT:-19130}:80" - labels: - org.hacktivism.service: cryptpad-edge - org.hacktivism.host_port: "9030" - org.hacktivism.backend_port: "${BACKEND_PORT:-19130}" - org.hacktivism.site: cryptpad.hacktivism.ch - org.hacktivism.managed_by: koopa-admin diff --git a/configs/cryptpad/config.example.js b/configs/cryptpad/config.example.js deleted file mode 100644 index 6766565..0000000 --- a/configs/cryptpad/config.example.js +++ /dev/null @@ -1,13 +0,0 @@ -/* CryptPad config — http on 3000, websockets on 3003 (must differ). - * Live: mount ./config.js over /cryptpad/config/config.js - * Edge nginx in compose merges both onto host :9030 (Caddy unchanged). - */ -module.exports = { - httpUnsafeOrigin: 'https://cryptpad.hacktivism.ch', - httpSafeOrigin: 'https://cryptpad.hacktivism.ch', - httpAddress: '0.0.0.0', - httpPort: 3000, - websocketPort: 3003, - logToStdout: true, - maxWorkers: 2, -}; diff --git a/configs/cryptpad/edge.conf b/configs/cryptpad/edge.conf deleted file mode 100644 index 3d5b305..0000000 --- a/configs/cryptpad/edge.conf +++ /dev/null @@ -1,37 +0,0 @@ -# Front for koopa-cryptpad: HTTP :3000 + /cryptpad_websocket → :3003 -upstream cryptpad_http { - server cryptpad:3000; -} -upstream cryptpad_ws { - server cryptpad:3003; -} - -server { - listen 80 default_server; - server_name _; - client_max_body_size 150m; - - location /cryptpad_websocket { - proxy_pass http://cryptpad_ws; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_read_timeout 3600s; - proxy_send_timeout 3600s; - } - - location / { - proxy_pass http://cryptpad_http; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $host; - proxy_read_timeout 3600s; - proxy_send_timeout 3600s; - } -} diff --git a/configs/cryptpad/entrypoint.sh b/configs/cryptpad/entrypoint.sh deleted file mode 100755 index e128249..0000000 --- a/configs/cryptpad/entrypoint.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -set -euo pipefail -cd /cryptpad -# Expect config.js already present (compose mounts or image default). -exec node server.js "$@" diff --git a/configs/exchange-landing/index.html b/configs/exchange-landing/index.html index 75908bb..c57b486 100644 --- a/configs/exchange-landing/index.html +++ b/configs/exchange-landing/index.html @@ -289,22 +289,18 @@ - - -- Exchange landing v44 - · content - · 0d881cd +
+ Exchange landing v43 + · content + · d0594cb
diff --git a/configs/firewalld/public-ports.md b/configs/firewalld/public-ports.md index e9ce9de..2ae7378 100644 --- a/configs/firewalld/public-ports.md +++ b/configs/firewalld/public-ports.md @@ -18,7 +18,6 @@ sudo firewall-cmd --list-ports | 8080/tcp | Tor OR | — | | 23235/tcp | (legacy list; host SSH is :22, WAN via VeciGate 23235→22) | — | | **9200/tcp** | **Forgejo git-SSH** (podman rootlessport) | **OK** after add+reload | -| **6881/tcp+udp** | qBittorrent BT listen (`koopa-prime-qbittorrent`) | apply: `scripts/prime/apply-qbittorrent-bt-net.sh` | ### Not opened on purpose @@ -62,7 +61,6 @@ Forgejo advertises `SSH_PORT=9200`. Traffic hits **host:9200** (not Caddy). With |------|--------| | 2026-07-09 | 443/tcp re-added for IPv6 | | 2026-07-10 | **9200/tcp** for Forgejo git-SSH (verified LAN + hairpin + SSH auth) | -| 2026-09-25 | **6881/tcp+udp** for qBittorrent BT (`scripts/prime/apply-qbittorrent-bt-net.sh`); VeciGate wan+hairpin DNAT live; WAN/LAN `nc` OK | ## Nym (`koopa-nym`, nym.com) diff --git a/configs/forgejo/README.md b/configs/forgejo/README.md index 9359a0b..a5d9a6a 100644 --- a/configs/forgejo/README.md +++ b/configs/forgejo/README.md @@ -58,7 +58,3 @@ Or: Profile → Appearance → theme **hacktivism**, then hard-reload. ### Registration Public signup is disabled (`DISABLE_REGISTRATION`, no registration button). - -### pre-receive: gitleaks + *enc.git gate (TODO320, 2026-09-11) - -Live hooks under `~/koopa-forgejo/data/custom/hooks/pre-receive.d/` (gitleaks skip `*enc.git`; `git-crypt-enforce` Klartext-Sperre). Binary `data/custom/bin/gitleaks` v8.21.2. Installer + smoke: laptop `llm-configs/bin/forgejo-hooks/`. Ops note: `2026/2026-09-11--forgejo-gitleaks-enc-gate.md`. New repos → re-run `install-hooks-ht.sh`. diff --git a/configs/galene/Containerfile b/configs/galene/Containerfile deleted file mode 100644 index a2e620c..0000000 --- a/configs/galene/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# koopa-galene — Galene SFU on CachyOS base -# Build on koopa (x86_64): -# bash ~/koopa-admin-log/scripts/galene/build.sh -# → localhost/koopa-galene:cachyos -# -# Upstream no longer ships release tarballs; build from git tag/branch. - -ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest -FROM ${CACHYOS_IMAGE} - -ARG GALENE_REF=galene-0.96.3 -ARG GALENE_REPO=https://github.com/jech/galene.git - -ENV TZ=Europe/Zurich \ - PATH=/usr/local/bin:$PATH \ - GALENE_DATA=/data \ - GOPATH=/tmp/go \ - GOTOOLCHAIN=auto - -RUN pacman -Syu --noconfirm --needed \ - bash curl ca-certificates catatonit tar git go \ - && pacman -Scc --noconfirm \ - && rm -rf /var/cache/pacman/pkg/* /tmp/* - -RUN set -eux \ - && git clone --depth 1 --branch "$GALENE_REF" "$GALENE_REPO" /src/galene \ - && cd /src/galene \ - && CGO_ENABLED=0 go build -ldflags='-s -w' -o /usr/local/bin/galene . \ - && test -x /usr/local/bin/galene \ - && mkdir -p /opt/galene \ - && cp -a /src/galene/static /opt/galene/static \ - && rm -rf /src/galene /tmp/go /root/go /var/cache/pacman/pkg/* - -COPY entrypoint.sh /docker-entrypoint.sh -RUN chmod 755 /docker-entrypoint.sh \ - && mkdir -p /data/groups /data/recordings /data/data \ - && ln -sfn /opt/galene/static /data/static - -EXPOSE 8443 -WORKDIR /data -ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"] diff --git a/configs/galene/README.md b/configs/galene/README.md deleted file mode 100644 index 88eb6bb..0000000 --- a/configs/galene/README.md +++ /dev/null @@ -1,36 +0,0 @@ -# Galene — SFU on CachyOS (koopa) - -| Item | Value | -|------|--------| -| Stack | [Galene](https://galene.org/) | -| Image | `localhost/koopa-galene:cachyos` (`FROM docker.io/cachyos/cachyos`) | -| Build | Go from git tag `GALENE_REF` (default `galene-0.96.3`; no release tarballs) | -| Live dir | `/home/hernani/koopa-galene/` | -| Container | `koopa-galene` | -| Host port | **9029** = Paivana paywall; Galene HTTP backend **127.0.0.1:19129** (`-insecure`) | -| Public site | `galene.hacktivism.ch` | - -## Build + up (koopa) - -```bash -bash /path/to/koopa-admin-log/scripts/galene/build.sh -mkdir -p ~/koopa-galene && cp -a /path/to/koopa-admin-log/configs/galene/compose.yml ~/koopa-galene/ -cd ~/koopa-galene && podman-compose up -d -``` - -## Caddy - -```bash -sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \ - --snippet /path/to/koopa-admin-log/configs/caddy/galene.hacktivism.ch.caddy \ - --site galene.hacktivism.ch --port 9029 --label galene -``` - -DNS + VeciGate for the hostname; WebRTC UDP ports documented when first room is live. - -## Notes - -- Volume `./data` must not hide UI assets; entrypoint passes `-static /opt/galene/static`. -- Example group: copy `groups/hacktivism.json.example` → `~/koopa-galene/data/groups/hacktivism.json` (change op password). -- WebRTC UDP: compose publishes **10000–10099/udp**; set the same range in VeciGate DNAT → koopa. Entrypoint uses `-udp-range` (`GALENE_UDP_RANGE`). -- Built-in TURN (`-turn auto`) logs `no public addresses` until the host has a reachable public/mapped address; fix UDP/NAT first, then re-check logs. diff --git a/configs/galene/compose.yml b/configs/galene/compose.yml deleted file mode 100644 index 1919f87..0000000 --- a/configs/galene/compose.yml +++ /dev/null @@ -1,30 +0,0 @@ -# koopa-galene — Galene on CachyOS -# Live: /home/hernani/koopa-galene/ -# Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos -# -# Public :9029 = koopa-paivana-galene (shared paivana image). -# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19129 (HTTP -insecure; not LAN 0.0.0.0). -# WebRTC UDP: still published (see README / ports.md) -services: - galene: - image: localhost/koopa-galene:cachyos - container_name: koopa-galene - restart: unless-stopped - environment: - - TZ=Europe/Zurich - - GALENE_UDP_RANGE=${GALENE_UDP_RANGE:-10000-10099} - volumes: - - ./data:/data - - ./entrypoint.sh:/docker-entrypoint.sh:ro - ports: - - "172.17.0.1:${BACKEND_PORT:-19129}:8443" - - "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp" - labels: - org.hacktivism.service: galene - org.hacktivism.host_port: "9029" - org.hacktivism.backend_port: "${BACKEND_PORT:-19129}" - org.hacktivism.site: galene.hacktivism.ch - org.hacktivism.managed_by: koopa-admin - org.hacktivism.port_status: backend-19129-paywall-9029 - org.hacktivism.image_base: cachyos - diff --git a/configs/galene/entrypoint.sh b/configs/galene/entrypoint.sh deleted file mode 100755 index c686f21..0000000 --- a/configs/galene/entrypoint.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -set -euo pipefail -# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443 -# with -insecure (TLS terminated at Caddy). -# Static assets stay in the image (/opt/galene/static); the ./data volume must -# not shadow them — pass -static explicitly. -DATA="${GALENE_DATA:-/data}" -STATIC="${GALENE_STATIC:-/opt/galene/static}" -# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md). -UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}" -mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data" -cd "$DATA" -exec /usr/local/bin/galene \ - -http "0.0.0.0:8443" \ - -insecure \ - -static "$STATIC" \ - -udp-range "$UDP_RANGE" \ - -data "$DATA/data" \ - -groups "$DATA/groups" \ - -recordings "$DATA/recordings" \ - "$@" diff --git a/configs/galene/groups/hacktivism.json.example b/configs/galene/groups/hacktivism.json.example deleted file mode 100644 index 69bda83..0000000 --- a/configs/galene/groups/hacktivism.json.example +++ /dev/null @@ -1,7 +0,0 @@ -{ - "displayName": "hacktivism", - "public": true, - "op": [{"username": "op", "password": "changeme"}], - "presenter": [{}], - "other": [] -} diff --git a/configs/lab-local/goa-regio-ng-koopa.yml b/configs/lab-local/goa-regio-ng-koopa.yml index 00450d8..04d502e 100644 --- a/configs/lab-local/goa-regio-ng-koopa.yml +++ b/configs/lab-local/goa-regio-ng-koopa.yml @@ -53,7 +53,8 @@ regional_currency: regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000" regional_currency_static_coins_file: goa-exchange-coins.conf regional_currency_coin_withdraw_duration: 7 days - regional_currency_default_debt_limit: "GOA:4503599627370496" + # Must stay < 2^52 (libeufin amount overflow on withdraw confirm). + regional_currency_default_debt_limit: "GOA:1000000000000" regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10" regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv" diff --git a/configs/lab-local/lab-hosts.yml b/configs/lab-local/lab-hosts.yml deleted file mode 100644 index e899299..0000000 --- a/configs/lab-local/lab-hosts.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# lab-only: pin *.goa.local → 127.0.0.1 inside goa-regio-ng -# ephemeral on container recreate — re-run after recreate / before site.yml wait-on-bank -# inventory: goa-regio-ng-koopa.yml (same SSH ProxyCommand) -# -# ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml - -- name: lab hosts goa.local - hosts: regional_currency - gather_facts: false - tasks: - - name: /etc/hosts *.goa.local → 127.0.0.1 - ansible.builtin.blockinfile: - path: /etc/hosts - marker: "# {mark} ANSIBLE LAB goa.local" - # podman systemd: /etc/hosts often EBUSY on atomic rename - unsafe_writes: true - block: | - 127.0.0.1 bank.goa.local exchange.goa.local backend.goa.local goa.local diff --git a/configs/meet/Containerfile b/configs/meet/Containerfile deleted file mode 100644 index de1f36d..0000000 --- a/configs/meet/Containerfile +++ /dev/null @@ -1,55 +0,0 @@ -# koopa-meet-web — Jitsi Meet web assets on CachyOS -# Build: bash ~/koopa-admin-log/scripts/meet/build.sh → localhost/koopa-meet-web:cachyos -# -# Full Meet needs prosody + jicofo + jvb (see compose.yml). This image serves -# the static web UI via nginx from Arch/CachyOS packages + upstream meet tarball. -# Signaling/media containers are separate services in the same compose. - -ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest -FROM ${CACHYOS_IMAGE} - -ARG JITSI_MEET_VERSION=stable -ARG JITSI_MEET_URL=https://download.jitsi.org/jitsi-meet/src/jitsi-meet-1.0.0.tar.bz2 - -ENV TZ=Europe/Zurich - -RUN pacman -Syu --noconfirm --needed \ - bash curl ca-certificates catatonit tar nginx \ - && pacman -Scc --noconfirm \ - && rm -rf /var/cache/pacman/pkg/* /tmp/* - -# CachyOS/Arch nginx.conf embeds a default server and does NOT include http.d/. -# Replace it with a minimal conf that serves the branded landing. -RUN mkdir -p /usr/share/jitsi-meet /etc/nginx/http.d \ - && printf '%s\n' \ - 'worker_processes 1;' \ - 'events { worker_connections 1024; }' \ - 'http {' \ - ' include mime.types;' \ - ' default_type application/octet-stream;' \ - ' sendfile on;' \ - ' keepalive_timeout 65;' \ - ' server {' \ - ' listen 80 default_server;' \ - ' server_name _;' \ - ' root /usr/share/jitsi-meet;' \ - ' index index.html;' \ - ' location / { try_files $uri $uri/ /index.html; }' \ - ' }' \ - '}' > /etc/nginx/nginx.conf \ - && printf '%s\n' \ - '' \ - '' \ - 'meet.hacktivism.ch
' \ - 'Jitsi Meet web (CachyOS). Signaling/media (prosody / jicofo / jvb) is Phase 2 — see compose + README.
' \ - 'HTTP OK on host port 9031. Full rooms need UDP/JVB after Phase 2.
- Merchant landing v43 - · content - · 0d881cd +
+ Merchant landing v42 + · content + · 37ea4bb
diff --git a/configs/notes/.env.example b/configs/notes/.env.example deleted file mode 100644 index 03eb62b..0000000 --- a/configs/notes/.env.example +++ /dev/null @@ -1,5 +0,0 @@ -# Live on koopa: ~/koopa-silverbullet/.env (not git) -# Allocate HOST_PORT only after live `ss` + Freigabe + ports.md update. -HOST_PORT=9028 -# Optional SilverBullet app auth (prefer Caddy basicauth): -# SB_USER=hernani:changeme diff --git a/configs/notes/Containerfile b/configs/notes/Containerfile deleted file mode 100644 index f922feb..0000000 --- a/configs/notes/Containerfile +++ /dev/null @@ -1,44 +0,0 @@ -# koopa-silverbullet — SilverBullet on CachyOS base + server binary -# Build on koopa (x86_64): -# bash ~/koopa-admin-log/scripts/notes/build.sh -# → localhost/koopa-silverbullet:cachyos -# -# Base: docker.io/cachyos/cachyos (Arch-derived). App binary from upstream -# silverbullet-server-linux-x86_64 release (not the Alpine ghcr image). - -ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest -FROM ${CACHYOS_IMAGE} - -ARG SB_VERSION=2.10.0 -ARG SB_ZIP_URL=https://github.com/silverbulletmd/silverbullet/releases/download/${SB_VERSION}/silverbullet-server-linux-x86_64.zip - -ENV SB_HOSTNAME=0.0.0.0 \ - SB_FOLDER=/space \ - SB_PORT=3000 \ - SB_NAME=SilverBullet \ - TZ=Europe/Zurich \ - PATH=/usr/local/bin:$PATH - -# catatonit = Arch/CachyOS container init (tini not in repos) -RUN pacman -Syu --noconfirm --needed \ - bash curl git openssh catatonit unzip \ - && pacman -Scc --noconfirm \ - && rm -rf /var/cache/pacman/pkg/* /tmp/* - -# Fetch + install server binary (build-time; no Deno in image) -RUN curl -fsSL "$SB_ZIP_URL" -o /tmp/sb.zip \ - && unzip -o /tmp/sb.zip -d /tmp \ - && install -m 755 /tmp/silverbullet /silverbullet \ - && /silverbullet --version || true \ - && rm -rf /tmp/sb.zip /tmp/silverbullet - -COPY entrypoint.sh /docker-entrypoint.sh -RUN chmod 755 /docker-entrypoint.sh \ - && mkdir -p /space - -EXPOSE 3000 -HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \ - CMD curl -fsS "http://127.0.0.1:${SB_PORT}/.instance" || exit 1 - -WORKDIR /space -ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"] diff --git a/configs/notes/README.md b/configs/notes/README.md deleted file mode 100644 index 38b6deb..0000000 --- a/configs/notes/README.md +++ /dev/null @@ -1,65 +0,0 @@ -# SilverBullet — SilverBullet on CachyOS (koopa) - -Cross-host markdown notes (magikoopa + clementine). Stack name **SilverBullet** (parked web UI). Product **FreeNotes** = separate native enc notes (not this stack). - -| Item | Value | -|------|--------| -| Stack | [SilverBullet](https://silverbullet.md/) server binary | -| Image | `localhost/koopa-silverbullet:cachyos` (`FROM docker.io/cachyos/cachyos`) | -| Live dir | `/home/hernani/koopa-silverbullet/` | -| Container | `koopa-silverbullet` | -| Host port | **9028** = Paivana paywall; app backend **127.0.0.1:19128** | -| Public site | `silverbullet.hacktivism.ch` | -| Auth | Paivana (GOA:42); no Caddy basic_auth | -| Forgejo space backup | private `hernani/freenotes` (historical name; SB space only) | - -## Cutover freenotes → silverbullet (koopa) - -Live still may be `~/koopa-freenotes` / CT `koopa-freenotes`. Scripts default dry-run; `--apply` needs Freigabe. - -```bash -bash /path/to/koopa-admin-log/scripts/notes/status.sh -bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh -# Freigabe: -bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh --apply -``` - -See `scripts/notes/README.md` for seed + Caddy order. DNS: `silverbullet.hacktivism.ch`. - -## Build + recreate (koopa) - -```bash -# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone) -bash /path/to/koopa-admin-log/scripts/notes/build.sh -cd ~/koopa-silverbullet -podman-compose down -podman-compose up -d -bash /path/to/koopa-admin-log/scripts/notes/up.sh -``` - -## Caddy apply (sudo on koopa) - -```bash -sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh -# seed from secrets-enc SoT so apply does not rotate PASS -sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \ - bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh -``` - -Runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only). Never recreate `~/koopa-secrets`. - -## Space SoT (Forgejo) - -Private `hernani/freenotes` — live tree `~/koopa-silverbullet/space/` (git). On-koopa push uses oneshot HTTP token (no hernani SSH key in `~/.ssh`); laptop push via `git@git.hacktivism.ch:hernani/freenotes.git` (ProxyJump). - -## Client apps (hosts) - -Notes-like **system apps** (standalone Brave/Chrome `--app=` window + own profile): `configs/notes/client-apps/`. - -- magikoopa: `~/Applications/SilverBullet.app` — `bash client-apps/install-magikoopa.sh` -- clementine (on-box): `silverbullet.desktop` — `bash client-apps/install-clementine.sh` -- optional: browser **Install app** (PWA) for Dock identity - -## Plugs (SB) - -`space/_plug/`: `treeview.plug.js`, `silversearch.plug.js` — see `PLUGS.md`. diff --git a/configs/notes/client-apps/README.md b/configs/notes/client-apps/README.md deleted file mode 100644 index cf1687b..0000000 --- a/configs/notes/client-apps/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# SilverBullet — system Notes apps (hosts) - -Goal: **like Apple Notes** — a real system app window on each laptop, not a browser bookmark and not SilverBullet plugs. - -| Host | App | Behavior | -|------|-----|----------| -| magikoopa | `SilverBullet.app` → `~/Applications/` | Brave/Chrome **`--app=`** + own profile (`SilverBullet-BraveProfile`) — no tab bar | -| clementine | `silverbullet.desktop` | same `--app=` via Brave/Chromium + `~/.local/share/SilverBullet-browser` | -| both (optional) | Browser **Install app** / PWA | even closer to native Dock/menu identity | - -**Not this:** `space/_plug/` (TreeView/SilverSearch) — those are in-editor extensions. - -Install: - -```bash -# magikoopa -bash configs/notes/client-apps/install-magikoopa.sh - -# clementine (on-box) -bash configs/notes/client-apps/install-clementine.sh -``` - -First launch: log in once (Caddy basicauth); credentials stay in the app profile. diff --git a/configs/notes/client-apps/SilverBullet.app/Contents/Info.plist b/configs/notes/client-apps/SilverBullet.app/Contents/Info.plist deleted file mode 100644 index 495c9f3..0000000 --- a/configs/notes/client-apps/SilverBullet.app/Contents/Info.plist +++ /dev/null @@ -1,15 +0,0 @@ - - -Silversearch found 0 results for your query
\');function Ws(e,t){var n=Ys(),r=K(n);let i;Ut(()=>i=Is(r,"",i,{width:t.progress===null?"30%":`${t.progress}%`,animation:t.progress===null?"slide 1s linear infinite":"none"})),C(e,n)}var Gs=Y(\'
Indexed out of documents
Loading ...
\'),Xs=Y(\'Add the following to your query to refine the search:
- Use
path:"Library"to restrict your results\n to paths which include "Library" - Use
ext:pdf,jpgorext:png, or\n a plain.pngto restrict your search to certain filetypes - Use
"exact expressions"in quotes to further filter\n the results returned by the query - Use
-apple -pieto exclude notes containing the words\n "apple" and "pie"
|<|>|"|')/g;function Un(e,t){const n="silversearch-highlight";if(!t.length)return e;try{return e.split(si).map(r=>r.match(si)?r:r.replace(new RegExp(`(${t.map(i=>tl(i.match)).join("|")})`,"giu"),`$1`)).join("")}catch(r){return console.error("[Silversearch] Error in highlightText()",r),e}}var nl=Y("Press
Ctrl-Enter to open in new Tab. Use Tab to switch scope.",1);function rl(e,t){pt(t,!0);let n=[],r=null;async function i(f){let l=await syscall("silversearch.search",f,{singleFilePath:t.currentPath,silent:!0});return n=l[0].matches,r=l[0].name,l[0].excerpts}async function s(f,l,o){r&&await syscall("editor.navigate",`${r}@${f.offset}`,!1,l)}ii(e,{search:i,open:s,helpText:o=>{var a=nl();C(o,a)},elementDescription:(o,a=It)=>{var c=Le(),h=me(c);on(h,()=>Un(a().excerpt,n)),C(o,c)},$$slots:{helpText:!0,elementDescription:!0}}),_t()}function il(e,t){for(const n of e)if(n.type==="range"&&n.from<=t&&t<=n.to)return n.tail;return""}var sl=Y("Use Tab to switch scope.",1),ll=Y("Press Ctrl-Enter to open in new Tab and Alt-Enter to insert a link. ",1);function ol(e,t){pt(t,!1);const n=or("isDocumentEditor");async function r(f,l,o){var h,v;if(o)return await i(f);const a=((v=(h=f.matches)==null?void 0:h[0])==null?void 0:v.offset)??0;let c=`@${a}`;f.navigationMap&&(c=il(f.navigationMap,a)),await syscall("editor.navigate",`${f.name}${c}`,!1,l)}async function i(f){const l=`[[${f.name}]]`;await syscall("editor.insertAtCursor",l),await syscall("editor.hidePanel","modal")}async function s(f){return syscall("silversearch.search",f,{silent:!0})}Fs(),ii(e,{search:s,open:r,helpText:c=>{var h=ll(),v=he(me(h),5);{var p=d=>{var _=sl();C(d,_)};De(v,d=>{n||d(p)})}C(c,h)},elementTitle:(c,h=It)=>{var v=Le(),p=me(v);on(p,()=>Un(h().name,h().matchesName)),C(c,v)},elementDescription:(c,h=It)=>{var v=Le(),p=me(v);on(p,()=>Un(h().excerpts[0].excerpt,h().matches)),C(c,v)},elementInfo:(c,h=It)=>{var v=ys();Ut(()=>Fn(v,`${h().matches.length??""} Matches`)),C(c,v)},$$slots:{helpText:!0,elementTitle:!0,elementDescription:!0,elementInfo:!0}}),_t()}var fl=Y(" ",1);function al(e,t){pt(t,!0),syscall("clientStore.get","silversearch-history").then(h=>{k.history=h||[]});const n=or("isDocumentEditor");k.text=t.defaultQuery;let r=Z(!0);function i(h){h.stopPropagation(),h.key==="Tab"&&(n||(j(r,!E(r)),h.preventDefault()))}var s=fl(),f=me(s);on(f,()=>t.customStyles);var l=he(f,2),o=K(l);{var a=h=>{ol(h,{})},c=h=>{rl(h,{get currentPath(){return t.currentPath}})};De(o,h=>{E(r)?h(a):h(c,-1)})}Bt("keydown",l,i),C(e,s),_t()}In(["keydown"]);async function ul(){const e=syscall("editor.getCurrentPath"),t=syscall("editor.getCurrentEditor"),n=syscall("editor.getUiOption","customStyles");await Promise.race([new Promise(r=>setTimeout(r,75)),new Promise(r=>{const i=document.querySelector("link#stylesheet");i&&(i.onload=r)})]),bs(al,{target:document.querySelector("#container"),props:{defaultQuery:globalThis.DEFAULT_QUERY??"",currentPath:await e,customStyles:await n},context:new Map([["isDocumentEditor",await t!=="page"]])})}ul()})();\n';var Tt=`
-
-`;var Yi="ENTRIES",It="KEYS",zt="VALUES";var Y=class{constructor(e,n){let r=e._tree,i=Array.from(r.keys());this.set=e,this._type=n,this._path=i.length>0?[{node:r,keys:i}]:[]}next(){let e=this.dive();return this.backtrack(),e}dive(){if(this._path.length===0)return{done:!0,value:void 0};let{node:e,keys:n}=B(this._path);if(B(n)==="")return{done:!1,value:this.result()};let r=e.get(B(n));return this._path.push({node:r,keys:Array.from(r.keys())}),this.dive()}backtrack(){if(this._path.length===0)return;let e=B(this._path).keys;e.pop(),!(e.length>0)&&(this._path.pop(),this.backtrack())}key(){return this.set._prefix+this._path.map(({keys:e})=>B(e)).filter(e=>e!=="").join("")}value(){return B(this._path).node.get("")}result(){switch(this._type){case zt:return this.value();case It:return this.key();default:return[this.key(),this.value()]}}[Symbol.iterator](){return this}},B=t=>t[t.length-1],es=(t,e,n)=>{let r=new Map;if(e===void 0)return r;let i=e.length+1,s=i+n,o=new Uint8Array(s*i).fill(n+1);for(let u=0;u")}return t.trim()}async function pt(t,e,n){let r=await N();e=e.map(an);let i=Ts(e),s=t;r.ignoreDiacritics&&(t=$(t,r.ignoreArabicDiacritics));let o=new Date().getTime(),u=null,a=[],l=0;for(;(u=i.exec(t))!==null&&!(++l>=100||new Date().getTime()-o>50);){let f=u.index,p=f+u[0].length,h=s.substring(f,p).trim();h&&u.index>=0&&a.push({match:h,offset:u.index})}if(n&&(n.query.text.length>1||n.getExactTerms().length>0)){let f=t.indexOf(n.getBestStringForExcerpt());f>-1&&a.find(p=>p.offset===f)&&a.unshift({offset:f,match:n.getBestStringForExcerpt()})}return a.map(f=>({...f,match:ln(f.match,{renderLineReturnInExcerpts:r.renderLineReturnInExcerpts})}))}async function ht(t,e){let n=await N();try{let r=Math.max(0,e-qt),i=Math.min(t.length,e+ge);if(t=(r>0?"\u2026":"")+t.slice(r,i).trim()+(i
-
`,`
- ${r}
- ${a}
- initializeTreeViewPanel(${JSON.stringify(S)});
- `),await qe(!0),ce=n.position}async function Rt(){let n=await $e();await bt(!n),await j()}async function Pt(){await _.invokeCommand("Page: Delete")}var St=.1;async function wt(){let n=await Xe(),e=await Ee()??n.size;await Qe(e+St),await j()}async function Gt(){let n=await Xe(),e=await Ee()??n.size,t=Math.max(.1,e-St);await Qe(t),await j()}var Kt={hide:Ye,show:j,showIfEnabled:At,toggle:kt,reveal:j,deletePage:Pt,increaseWidth:wt,decreaseWidth:Gt,toggleHidden:Rt},Wt={name:"treeview",version:.15,assets:{"assets/treeview.css":{data:"data:text/css;base64,LyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgogKiBQYWdlIHZhcmlhYmxlcwogKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovCgogaHRtbCB7CiAgLS10cmVldmlldy1ub2RlLWJvcmRlci13aWR0aDogMnB4OwogIC0tdHJlZXZpZXctbm9kZS1ib3JkZXItcmFkaXVzOiA1cHg7CgogIC0tdHJlZXZpZXctcGFnZS1jb2xvcjogdmFyKC0tZWRpdG9yLXdpa2ktbGluay1wYWdlLWNvbG9yKTsKICAtLXRyZWV2aWV3LXBhZ2UtYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tZWRpdG9yLXdpa2ktbGluay1wYWdlLWJhY2tncm91bmQtY29sb3IpOwogIC0tdHJlZXZpZXctcGFnZS1ib3JkZXItY29sb3I6IHZhcigtLXRyZWV2aWV3LXBhZ2UtYmFja2dyb3VuZC1jb2xvcik7CgogIC0tdHJlZXZpZXctZm9sZGVyLWNvbG9yOiB2YXIoLS1lZGl0b3Itd2lraS1saW5rLXBhZ2UtbWlzc2luZy1jb2xvcik7CiAgLS10cmVldmlldy1mb2xkZXItYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tdHJlZXZpZXctcGFnZS1iYWNrZ3JvdW5kLWNvbG9yKTsKICAtLXRyZWV2aWV3LWZvbGRlci1ib3JkZXItY29sb3I6IHZhcigtLXRyZWV2aWV3LXBhZ2UtYmFja2dyb3VuZC1jb2xvcik7CgogIC0tdHJlZXZpZXctYXR0YWNobWVudC1jb2xvcjogdmFyKC0tc3VidGxlLWNvbG9yKTsKICAtLXRyZWV2aWV3LWF0dGFjaG1lbnQtYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tdHJlZXZpZXctcGFnZS1iYWNrZ3JvdW5kLWNvbG9yKTsKICAtLXRyZWV2aWV3LWF0dGFjaG1lbnQtYm9yZGVyLWNvbG9yOiB2YXIoLS10cmVldmlldy1wYWdlLWJhY2tncm91bmQtY29sb3IpOwoKICAtLXRyZWV2aWV3LWN1cnJlbnQtcGFnZS1jb2xvcjogI2VlZTsKCS0tdHJlZXZpZXctY3VycmVudC1wYWdlLWJhY2tncm91bmQtY29sb3I6IHZhcigtLXVpLWFjY2VudC1jb2xvcik7CiAgLS10cmVldmlldy1jdXJyZW50LXBhZ2UtYm9yZGVyLWNvbG9yOiB2YXIoLS10cmVldmlldy1wYWdlLWJvcmRlci1jb2xvcik7Cn0KCi50cmVldmlldy1yb290IHsKICAvKiBTb3J0YWJsZVRyZWUgdmFyaWFibGVzICovCiAgLS1zdC1sYWJlbC1oZWlnaHQ6IGF1dG87CiAgLS1zdC1zdWJub2Rlcy1wYWRkaW5nLWxlZnQ6IDEuMjVyZW07CiAgLS1zdC1jb2xsYXBzZS1pY29uLWhlaWdodDogMi4xcmVtOwogIC0tc3QtY29sbGFwc2UtaWNvbi13aWR0aDogMS4yNXJlbTsKICAtLXN0LWNvbGxhcHNlLWljb24tc2l6ZTogMXJlbTsKfQoKLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgogKiBQYWdlIHN0eWxlcwogKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovCgpodG1sLCBib2R5IHsKICBiYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS1yb290LWJhY2tncm91bmQtY29sb3IpOwogIHBhZGRpbmc6IDA7CiAgbWFyZ2luOiAwOwogIG92ZXJmbG93OiBpbml0aWFsICFpbXBvcnRhbnQ7Cn0KCi50cmVldmlldy1yb290IHsKICBiYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS1yb290LWJhY2tncm91bmQtY29sb3IpOwogIGNvbG9yOiB2YXIoLS1yb290LWNvbG9yKTsKICBmb250LWZhbWlseTogdmFyKC0tdWktZm9udCk7Cn0KCi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKICogSGVhZGVyIHN0eWxlcwogKgogKiBBY3Rpb24gc3R5bGVzIGFyZSBtZWFudCB0byBtaW1pYyB0aGUgVG9wIEJhciBpY29ucyAoYHNiLWFjdGlvbnNgKQogKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovCgoudHJlZXZpZXctaGVhZGVyIHsKICBwb3NpdGlvbjogc3RpY2t5OwogIHRvcDogMDsKICB6LWluZGV4OiAyOwogIHBhZGRpbmc6IDAuNXJlbSAwLjVyZW0gMHJlbTsKICBiYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS1yb290LWJhY2tncm91bmQtY29sb3IpOwp9CgoudHJlZXZpZXctYWN0aW9ucyB7CiAgZGlzcGxheTogZmxleDsKICBqdXN0aWZ5LWNvbnRlbnQ6IHNwYWNlLWJldHdlZW47CiAgYWxpZ24taXRlbXM6IGZsZXgtc3RhcnQ7CiAgYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tZWRpdG9yLXdpZGdldC1iYWNrZ3JvdW5kLWNvbG9yKTsKICBib3JkZXI6IHZhcigtLXRvcC1ib3JkZXItY29sb3IpIDFweCBzb2xpZDsKICBib3JkZXItcmFkaXVzOiA1cHg7CiAgY29sb3I6IHZhcigtLXRvcC1jb2xvcik7Cn0KCi50cmVldmlldy1hY3Rpb25zLWxlZnQsCi50cmVldmlldy1hY3Rpb25zLXJpZ2h0IHsKICBkaXNwbGF5OiBmbGV4Owp9CgoudHJlZXZpZXctYWN0aW9ucy1sZWZ0IHsKICBmbGV4OiAxOwogIGZsZXgtd3JhcDogd3JhcDsKfQoKLnRyZWV2aWV3LWFjdGlvbnMgYnV0dG9uIHsKICBkaXNwbGF5OiBmbGV4OwogIGFsaWduLWl0ZW1zOiBjZW50ZXI7CiAgbWFyZ2luOiAzcHg7CiAgcGFkZGluZzogNXB4OwogIGJhY2tncm91bmQtY29sb3I6IHZhcigtLWFjdGlvbi1idXR0b24tYmFja2dyb3VuZC1jb2xvcik7CiAgYm9yZGVyOiAwOwogIGNvbG9yOiB2YXIoLS1hY3Rpb24tYnV0dG9uLWNvbG9yKTsKICBjdXJzb3I6IHBvaW50ZXI7Cn0KCi50cmVldmlldy1hY3Rpb25zIGJ1dHRvbjpob3ZlciB7CiAgY29sb3I6IHZhcigtLWFjdGlvbi1idXR0b24taG92ZXItY29sb3IpOwp9CgoudHJlZXZpZXctYWN0aW9ucyBidXR0b246aG92ZXIgewogIGNvbG9yOiB2YXIoLS1hY3Rpb24tYnV0dG9uLWFjdGl2ZS1jb2xvcik7Cn0KCi50cmVldmlldy1hY3Rpb25zIGJ1dHRvbiA+IHN2ZyB7CiAgaGVpZ2h0OiAxOHB4OwogIHdpZHRoOiAxOHB4Owp9CgovKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqCiAqIFNvcnRhYmxlVHJlZSBzdHlsZXMKICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLwoKLnRyZWUgewoJZGlzcGxheTogZmxleDsKCWZsZXgtZGlyZWN0aW9uOiBjb2x1bW47CiAgbWFyZ2luOiAwLjI1cmVtIDAuNXJlbSAxcmVtOwogIHBhZGRpbmctbGVmdDogdmFyKC0tc3Qtc3Vibm9kZXMtcGFkZGluZy1sZWZ0KTsKfQoKLnRyZWVfX2xhYmVsIHsKICBkaXNwbGF5OiBmbGV4OwogIHBhZGRpbmc6IDJweDsKfQoKLnRyZWVfX2xhYmVsOmFmdGVyIHsKICBjb250ZW50OiAnICc7CiAgcG9zaXRpb246IGFic29sdXRlOwogIHotaW5kZXg6IDQ7CiAgaW5zZXQ6IGNhbGModmFyKC0tdHJlZXZpZXctbm9kZS1ib3JkZXItd2lkdGgpICogLTEpIHZhcigtLXRyZWV2aWV3LW5vZGUtYm9yZGVyLXdpZHRoKTsKICBib3JkZXItdG9wOiBjYWxjKHZhcigtLXRyZWV2aWV3LW5vZGUtYm9yZGVyLXdpZHRoKSAqIDIpIHNvbGlkIHRyYW5zcGFyZW50OwogIGJvcmRlci1ib3R0b206IGNhbGModmFyKC0tdHJlZXZpZXctbm9kZS1ib3JkZXItd2lkdGgpICogMikgc29saWQgdHJhbnNwYXJlbnQ7CiAgdHJhbnNpdGlvbjogYm9yZGVyLWNvbG9yIDAuMnM7CiAgcG9pbnRlci1ldmVudHM6IG5vbmU7Cn0KCi50cmVlX19ub2RlLS1kcm9wLWJlZm9yZSA+IC50cmVlX19sYWJlbDphZnRlciB7CiAgYm9yZGVyLXRvcC1jb2xvcjogdmFyKC0tdWktYWNjZW50LWNvbG9yKTsKfQoKLnRyZWVfX25vZGUtLWRyb3AtYWZ0ZXIgPiAudHJlZV9fbGFiZWw6YWZ0ZXIgewogIGJvcmRlci1ib3R0b20tY29sb3I6IHZhcigtLXVpLWFjY2VudC1jb2xvcik7Cn0KCi50cmVlX19sYWJlbCA+IHNwYW4gewogIG92ZXJmbG93OiBoaWRkZW47CiAgcGFkZGluZzogMCA1cHg7CiAgYm9yZGVyLWNvbG9yOiB0cmFuc3BhcmVudDsKICBib3JkZXItd2lkdGg6IHZhcigtLXRyZWV2aWV3LW5vZGUtYm9yZGVyLXdpZHRoKTsKICBib3JkZXItc3R5bGU6IHNvbGlkOwogIGJvcmRlci1yYWRpdXM6IHZhcigtLXRyZWV2aWV3LW5vZGUtYm9yZGVyLXJhZGl1cyk7CiAgY3Vyc29yOiBwb2ludGVyOwogIGZvbnQtZmFtaWx5OiB2YXIoLS1lZGl0b3ItZm9udCk7CiAgZm9udC1zaXplOiAxOHB4OwogIGxpbmUtaGVpZ2h0OiAxLjQ7CiAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogIHRleHQtb3ZlcmZsb3c6IGVsbGlwc2lzOwogIHdoaXRlLXNwYWNlOiBub3dyYXA7Cn0KCi50cmVlX19sYWJlbCA+IHNwYW5bZGF0YS1ub2RlLXR5cGU9InBhZ2UiXSB7CiAgYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tdHJlZXZpZXctcGFnZS1iYWNrZ3JvdW5kLWNvbG9yKTsKICBib3JkZXItY29sb3I6IHZhcigtLXRyZWV2aWV3LXBhZ2UtYm9yZGVyLWNvbG9yKTsKICBjb2xvcjogdmFyKC0tdHJlZXZpZXctcGFnZS1jb2xvcik7Cn0KCi50cmVlX19sYWJlbCA+IHNwYW5bZGF0YS1ub2RlLXR5cGU9ImZvbGRlciJdIHsKICBiYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS10cmVldmlldy1mb2xkZXItYmFja2dyb3VuZC1jb2xvcik7CiAgYm9yZGVyLWNvbG9yOiB2YXIoLS10cmVldmlldy1mb2xkZXItYm9yZGVyLWNvbG9yKTsKICBjb2xvcjogdmFyKC0tdHJlZXZpZXctZm9sZGVyLWNvbG9yKTsKfQoKLnRyZWVfX2xhYmVsID4gc3BhbltkYXRhLW5vZGUtdHlwZT0iYXR0YWNobWVudCJdIHsKICBiYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS10cmVldmlldy1hdHRhY2htZW50LWJhY2tncm91bmQtY29sb3IpOwogIGJvcmRlci1jb2xvcjogdmFyKC0tdHJlZXZpZXctYXR0YWNobWVudC1ib3JkZXItY29sb3IpOwogIGNvbG9yOiB2YXIoLS10cmVldmlldy1hdHRhY2htZW50LWNvbG9yKTsKfQoKCi50cmVlX19sYWJlbCA+IHNwYW5bZGF0YS1jdXJyZW50LXBhZ2U9InRydWUiXSB7CgliYWNrZ3JvdW5kLWNvbG9yOiB2YXIoLS10cmVldmlldy1jdXJyZW50LXBhZ2UtYmFja2dyb3VuZC1jb2xvcik7CiAgYm9yZGVyLWNvbG9yOiB2YXIoLS10cmVldmlldy1jdXJyZW50LXBhZ2UtYm9yZGVyLWNvbG9yKTsKCWNvbG9yOiB2YXIoLS10cmVldmlldy1jdXJyZW50LXBhZ2UtY29sb3IpOwp9CgoudHJlZV9fY29sbGFwc2UgewogIGNvbG9yOiB2YXIoLS1lZGl0b3ItY29tbWFuZC1idXR0b24tY29sb3IpOwp9CgoudHJlZV9fbm9kZS0tZHJhZ2dpbmcgewogIG1hcmdpbjogY2FsYyh2YXIoLS10cmVldmlldy1ub2RlLWJvcmRlci13aWR0aCkgKiAtMSk7CiAgYm9yZGVyOiB2YXIoLS10cmVldmlldy1ub2RlLWJvcmRlci13aWR0aCkgZGFzaGVkIHZhcigtLXN1YnRsZS1jb2xvcik7CiAgYm9yZGVyLXJhZGl1czogdmFyKC0tdHJlZXZpZXctbm9kZS1ib3JkZXItcmFkaXVzKTsKICBjdXJzb3I6IG1vdmUgIWltcG9ydGFudDsKfQoKLnRyZWVfX25vZGUtLWRyYWdnaW5nIC50cmVlX19sYWJlbCA+IHNwYW4gewogIG9wYWNpdHk6IDAuNzU7Cn0KCi50cmVlX19ub2RlLS1kcm9wLWluc2lkZSA+IC50cmVlX19sYWJlbCA+IHNwYW4gewogIHotaW5kZXg6IDM7CiAgYmFja2dyb3VuZC1jb2xvcjogdmFyKC0tc3VidGxlLWJhY2tncm91bmQtY29sb3IpOwogIGJvcmRlci1jb2xvcjogdmFyKC0tdWktYWNjZW50LWNvbG9yKTsKfQoKLnRyZWVfX25vZGUtLWRyb3AtaW5zaWRlID4gLnRyZWVfX2xhYmVsID4gc3BhbltkYXRhLWN1cnJlbnQtcGFnZT0idHJ1ZSJdIHsKCWNvbG9yOiB2YXIoLS10cmVldmlldy1wYWdlLWNvbG9yKTsKfQ==",mtime:1770926754871},"assets/sortable-tree/sortable-tree.css":{data:"data:text/css;base64,LyohIFNvcnRhYmxlIFRyZWUgMC43LjIsIChjKSAyMDIzIE1hcmMgQW50b24gRGFobWVuLCBNSVQgbGljZW5zZSAqLwo6cm9vdCB7CiAgICAtLXN0LWxhYmVsLWhlaWdodDogMi41cmVtOwogICAgLS1zdC1zdWJub2Rlcy1wYWRkaW5nLWxlZnQ6IDEuNXJlbTsKICAgIC0tc3QtY29sbGFwc2UtaWNvbi1oZWlnaHQ6IHZhcigtLXN0LWxhYmVsLWhlaWdodCk7CiAgICAtLXN0LWNvbGxhcHNlLWljb24td2lkdGg6IDEuMjVyZW07CiAgICAtLXN0LWNvbGxhcHNlLWljb24tc2l6ZTogMC43NXJlbTsKICB9CiAgc29ydGFibGUtdHJlZS1ub2RlIHsKICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsKICAgIHotaW5kZXg6IDE7CiAgICBkaXNwbGF5OiBmbGV4OwogICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsKICB9CiAgc29ydGFibGUtdHJlZS1ub2RlICogewogICAgdXNlci1zZWxlY3Q6IG5vbmU7CiAgfQogIHNvcnRhYmxlLXRyZWUtbm9kZSA+IDpmaXJzdC1jaGlsZCB7CiAgICBkaXNwbGF5OiBmbGV4OwogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsKICAgIGhlaWdodDogdmFyKC0tc3QtbGFiZWwtaGVpZ2h0KTsKICB9CiAgc29ydGFibGUtdHJlZS1ub2RlID4gOm50aC1jaGlsZCgyKSB7CiAgICBkaXNwbGF5OiBub25lOwogICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsKICAgIHBhZGRpbmctbGVmdDogdmFyKC0tc3Qtc3Vibm9kZXMtcGFkZGluZy1sZWZ0KTsKICB9CiAgc29ydGFibGUtdHJlZS1ub2RlW29wZW5dID4gZGl2Om50aC1jaGlsZCgyKSB7CiAgICBkaXNwbGF5OiBmbGV4OwogIH0KICBzb3J0YWJsZS10cmVlLW5vZGUgPiA6bnRoLWNoaWxkKDMpIHsKICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKICAgIGRpc3BsYXk6IGZsZXg7CiAgICBhbGlnbi1pdGVtczogY2VudGVyOwogICAgdG9wOiAwOwogICAgbGVmdDogY2FsYyh2YXIoLS1zdC1jb2xsYXBzZS1pY29uLXdpZHRoKSAqIC0xKTsKICAgIGhlaWdodDogdmFyKC0tc3QtY29sbGFwc2UtaWNvbi1oZWlnaHQpOwogICAgZm9udC1zaXplOiB2YXIoLS1zdC1jb2xsYXBzZS1pY29uLXNpemUpOwogICAgY3Vyc29yOiBwb2ludGVyOwogIH0KICBzb3J0YWJsZS10cmVlLW5vZGUgPiA6bnRoLWNoaWxkKDIpOmVtcHR5ICsgc3BhbiB7CiAgICBkaXNwbGF5OiBub25lOwogIH0KICAKICA=",mtime:1770926754872},"assets/sortable-tree/sortable-tree.js":{data:"data:application/javascript;base64,LyohIFNvcnRhYmxlIFRyZWUgMC43LjIsIChjKSAyMDI0IE1hcmMgQW50b24gRGFobWVuLCBNSVQgbGljZW5zZSAqLwovKiBNb2RpZmllZCBieSBNck11Z2FtZSAoaHR0cHM6Ly9naXRodWIuY29tL21hcmNhbnRvbmRhaG1lbi9zb3J0YWJsZS10cmVlL3B1bGwvMTEpICovCiFmdW5jdGlvbiAoZSwgdCkgeyAib2JqZWN0IiA9PSB0eXBlb2YgZXhwb3J0cyAmJiAib2JqZWN0IiA9PSB0eXBlb2YgbW9kdWxlID8gbW9kdWxlLmV4cG9ydHMgPSB0KCkgOiAiZnVuY3Rpb24iID09IHR5cGVvZiBkZWZpbmUgJiYgZGVmaW5lLmFtZCA/IGRlZmluZShbXSwgdCkgOiAib2JqZWN0IiA9PSB0eXBlb2YgZXhwb3J0cyA/IGV4cG9ydHMuU29ydGFibGVUcmVlID0gdCgpIDogZS5Tb3J0YWJsZVRyZWUgPSB0KCkgfShzZWxmLCAoKCkgPT4gKCgpID0+IHsgInVzZSBzdHJpY3QiOyB2YXIgZSA9IHsgZDogKHQsIG4pID0+IHsgZm9yICh2YXIgbyBpbiBuKSBlLm8obiwgbykgJiYgIWUubyh0LCBvKSAmJiBPYmplY3QuZGVmaW5lUHJvcGVydHkodCwgbywgeyBlbnVtZXJhYmxlOiAhMCwgZ2V0OiBuW29dIH0pIH0sIG86IChlLCB0KSA9PiBPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoZSwgdCkgfSwgdCA9IHt9OyBlLmQodCwgeyBkZWZhdWx0OiAoKSA9PiBMIH0pOyB2YXIgbiA9IGZ1bmN0aW9uIChlLCB0LCBuLCBvKSB7IHJldHVybiBuZXcgKG4gfHwgKG4gPSBQcm9taXNlKSkoKGZ1bmN0aW9uIChyLCBzKSB7IGZ1bmN0aW9uIGkoZSkgeyB0cnkgeyBsKG8ubmV4dChlKSkgfSBjYXRjaCAoZSkgeyBzKGUpIH0gfSBmdW5jdGlvbiBhKGUpIHsgdHJ5IHsgbChvLnRocm93KGUpKSB9IGNhdGNoIChlKSB7IHMoZSkgfSB9IGZ1bmN0aW9uIGwoZSkgeyB2YXIgdDsgZS5kb25lID8gcihlLnZhbHVlKSA6ICh0ID0gZS52YWx1ZSwgdCBpbnN0YW5jZW9mIG4gPyB0IDogbmV3IG4oKGZ1bmN0aW9uIChlKSB7IGUodCkgfSkpKS50aGVuKGksIGEpIH0gbCgobyA9IG8uYXBwbHkoZSwgdCB8fCBbXSkpLm5leHQoKSkgfSkpIH07IGNvbnN0IG8gPSBlID0+IGA8c3Bhbj4ke2UudGl0bGV9PC9zcGFuPmAsIHIgPSB7IGNvbGxhcHNlZDogJ1xuXHRcdDxzdmdcblx0XHR4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIFxuXHRcdHdpZHRoPSIxZW0iIFxuXHRcdGhlaWdodD0iMWVtIiBcblx0XHRmaWxsPSJjdXJyZW50Q29sb3IiIFxuXHRcdGNsYXNzPSJiaSBiaS1jYXJldC1yaWdodC1maWxsIiBcblx0XHR2aWV3Qm94PSIwIDAgMTYgMTYiPlxuXHRcdFx0PHBhdGggZD0ibTEyLjE0IDguNzUzLTUuNDgyIDQuNzk2Yy0uNjQ2LjU2Ni0xLjY1OC4xMDYtMS42NTgtLjc1M1YzLjIwNGExIDEgMCAwIDEgMS42NTktLjc1M2w1LjQ4IDQuNzk2YTEgMSAwIDAgMSAwIDEuNTA2eiIvPlxuXHRcdDwvc3ZnPicsIG9wZW46ICdcblx0XHQ8c3ZnIFxuXHRcdHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgXG5cdFx0d2lkdGg9IjFlbSIgXG5cdFx0aGVpZ2h0PSIxZW0iIFxuXHRcdGZpbGw9ImN1cnJlbnRDb2xvciIgXG5cdFx0Y2xhc3M9ImJpIGJpLWNhcmV0LWRvd24tZmlsbCIgXG5cdFx0dmlld0JveD0iMCAwIDE2IDE2Ij5cblx0XHRcdDxwYXRoIGQ9Ik03LjI0NyAxMS4xNCAyLjQ1MSA1LjY1OEMxLjg4NSA1LjAxMyAyLjM0NSA0IDMuMjA0IDRoOS41OTJhMSAxIDAgMCAxIC43NTMgMS42NTlsLTQuNzk2IDUuNDhhMSAxIDAgMCAxLTEuNTA2IDB6Ii8+XG5cdFx0PC9zdmc+XG5cdCcgfSwgcyA9IHsgdHJlZTogInRyZWUiLCBub2RlOiAidHJlZV9fbm9kZSIsIG5vZGVIb3ZlcjogInRyZWVfX25vZGUtLWhvdmVyIiwgbm9kZURyYWdnaW5nOiAidHJlZV9fbm9kZS0tZHJhZ2dpbmciLCBub2RlRHJvcEJlZm9yZTogInRyZWVfX25vZGUtLWRyb3AtYmVmb3JlIiwgbm9kZURyb3BJbnNpZGU6ICJ0cmVlX19ub2RlLS1kcm9wLWluc2lkZSIsIG5vZGVEcm9wQWZ0ZXI6ICJ0cmVlX19ub2RlLS1kcm9wLWFmdGVyIiwgbGFiZWw6ICJ0cmVlX19sYWJlbCIsIHN1Ym5vZGVzOiAidHJlZV9fc3Vibm9kZXMiLCBjb2xsYXBzZTogInRyZWVfX2NvbGxhcHNlIiB9LCBpID0gKHsgbm9kZXM6IGUsIG1vdmVkTm9kZTogdCwgc3JjUGFyZW50Tm9kZTogbywgdGFyZ2V0UGFyZW50Tm9kZTogciB9KSA9PiBuKHZvaWQgMCwgdm9pZCAwLCB2b2lkIDAsIChmdW5jdGlvbiogKCkgeyB9KSksIGEgPSAoZSwgdCkgPT4gbih2b2lkIDAsIHZvaWQgMCwgdm9pZCAwLCAoZnVuY3Rpb24qICgpIHsgfSkpLCBsID0gKGUsIHQpID0+IG4odm9pZCAwLCB2b2lkIDAsIHZvaWQgMCwgKGZ1bmN0aW9uKiAoKSB7IHJldHVybiAhMCB9KSk7IGNvbnN0IGQgPSAoZSwgdCA9IFtdLCBuID0gbnVsbCkgPT4geyBjb25zdCBvID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudChlKTsgcmV0dXJuIHQuZm9yRWFjaCgoZSA9PiB7IG8uY2xhc3NMaXN0LmFkZChlKSB9KSksIG4gJiYgbi5hcHBlbmRDaGlsZChvKSwgbyB9LCBjID0gKCkgPT4gKChlID0gMjEpID0+IGNyeXB0by5nZXRSYW5kb21WYWx1ZXMobmV3IFVpbnQ4QXJyYXkoZSkpLnJlZHVjZSgoKGUsIHQpID0+IGUgKyAoKHQgJj0gNjMpIDwgMzYgPyB0LnRvU3RyaW5nKDM2KSA6IHQgPCA2MiA/ICh0IC0gMjYpLnRvU3RyaW5nKDM2KS50b1VwcGVyQ2FzZSgpIDogdCA+IDYyID8gIi0iIDogIl8iKSksICIiKSkoKTsgY2xhc3MgdSBleHRlbmRzIEhUTUxFbGVtZW50IHsgc3RhdGljIGNyZWF0ZSh7IGRhdGE6IGUsIHJlbmRlckxhYmVsOiB0LCBpY29uczogbiwgc3R5bGVzOiBvLCBwYXJlbnQ6IHIsIG9uQ2xpY2s6IHMsIGRyYWdnYWJsZTogaSB9KSB7IGNvbnN0IGEgPSBkKHUuVEFHX05BTUUsIFtvLm5vZGVdLCByKSwgbCA9IGQoImRpdiIsIFtvLmxhYmVsXSwgYSksIGMgPSBkKCJkaXYiLCBbby5zdWJub2Rlc10sIGEpLCBoID0gZCgic3BhbiIsIFtvLmNvbGxhcHNlXSwgYSk7IHJldHVybiBsLmlubmVySFRNTCA9IHQoZSksIGguaW5uZXJIVE1MID0gbi5jb2xsYXBzZWQsIGguYWRkRXZlbnRMaXN0ZW5lcigiY2xpY2siLCBhLnRvZ2dsZS5iaW5kKGEpKSwgbC5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsIChlID0+IHsgcyhlLCBhKSB9KSksIGkgJiYgYS5zZXRBdHRyaWJ1dGUoImRyYWdnYWJsZSIsICJ0cnVlIiksIGEuX2RhdGEgPSBlLCBhLl9pY29ucyA9IG4sIGEuX2xhYmVsID0gbCwgYS5fbm9kZXMgPSBjLCBhLl9jb2xsYXBzZUJ1dHRvbiA9IGgsIGEgfSBnZXQgZGF0YSgpIHsgcmV0dXJuIHRoaXMuX2RhdGEgfSBnZXQgbGFiZWwoKSB7IHJldHVybiB0aGlzLl9sYWJlbCB9IGdldCBzdWJub2RlcygpIHsgcmV0dXJuIHRoaXMuX25vZGVzIH0gZ2V0IHN1Ym5vZGVzRGF0YSgpIHsgY29uc3QgZSA9IFtdOyByZXR1cm4gQXJyYXkuZnJvbSh0aGlzLl9ub2Rlcy5jaGlsZHJlbikuZm9yRWFjaCgodCA9PiB7IGUucHVzaCh0LmRhdGEpIH0pKSwgZSB9IGdldCBpZCgpIHsgcmV0dXJuIHRoaXMuX2lkIH0gY29uc3RydWN0b3IoKSB7IHN1cGVyKCksIHRoaXMuX2lkID0gYygpIH0gY29sbGFwc2UoZSkgeyBlID8gKHRoaXMucmVtb3ZlQXR0cmlidXRlKCJvcGVuIiksIHRoaXMuX2NvbGxhcHNlQnV0dG9uLmlubmVySFRNTCA9IHRoaXMuX2ljb25zLmNvbGxhcHNlZCkgOiAodGhpcy5zZXRBdHRyaWJ1dGUoIm9wZW4iLCAidHJ1ZSIpLCB0aGlzLl9jb2xsYXBzZUJ1dHRvbi5pbm5lckhUTUwgPSB0aGlzLl9pY29ucy5vcGVuKSB9IHRvZ2dsZSgpIHsgdGhpcy5jb2xsYXBzZSh0aGlzLmhhc0F0dHJpYnV0ZSgib3BlbiIpKSB9IHJldmVhbCgpIHsgKChlLCB0KSA9PiB7IGNvbnN0IG4gPSBbXTsgbGV0IG8gPSB0LmNsb3Nlc3QoZSk7IGZvciAoOyBudWxsICE9PSBvOyluLnB1c2gobyksIG8gPSBvLnBhcmVudE5vZGUuY2xvc2VzdChlKTsgcmV0dXJuIG4gfSkodS5UQUdfTkFNRSwgdGhpcykuZm9yRWFjaCgoZSA9PiB7IGUuY29sbGFwc2UoITEpIH0pKSB9IH0gdS5UQUdfTkFNRSA9ICJzb3J0YWJsZS10cmVlLW5vZGUiOyB2YXIgaCA9IGZ1bmN0aW9uIChlLCB0LCBuLCBvKSB7IHJldHVybiBuZXcgKG4gfHwgKG4gPSBQcm9taXNlKSkoKGZ1bmN0aW9uIChyLCBzKSB7IGZ1bmN0aW9uIGkoZSkgeyB0cnkgeyBsKG8ubmV4dChlKSkgfSBjYXRjaCAoZSkgeyBzKGUpIH0gfSBmdW5jdGlvbiBhKGUpIHsgdHJ5IHsgbChvLnRocm93KGUpKSB9IGNhdGNoIChlKSB7IHMoZSkgfSB9IGZ1bmN0aW9uIGwoZSkgeyB2YXIgdDsgZS5kb25lID8gcihlLnZhbHVlKSA6ICh0ID0gZS52YWx1ZSwgdCBpbnN0YW5jZW9mIG4gPyB0IDogbmV3IG4oKGZ1bmN0aW9uIChlKSB7IGUodCkgfSkpKS50aGVuKGksIGEpIH0gbCgobyA9IG8uYXBwbHkoZSwgdCB8fCBbXSkpLm5leHQoKSkgfSkpIH07IGNvbnN0IHAgPSAoeyBub2RlOiBlLCBldmVudE5hbWU6IHQsIGhhbmRsZXI6IG4sIHRyZWU6IG8gfSkgPT4geyBlLmFkZEV2ZW50TGlzdGVuZXIodCwgKGUgPT4geyBuKGUsIG8pIH0pLCAhMSkgfTsgdmFyIGY7ICFmdW5jdGlvbiAoZSkgeyBlLkJFRk9SRSA9ICJCRUZPUkUiLCBlLklOU0lERSA9ICJJTlNJREUiLCBlLkFGVEVSID0gIkFGVEVSIiB9KGYgfHwgKGYgPSB7fSkpOyBjb25zdCBnID0gZSA9PiB7IGNvbnN0IHQgPSBlLmNsaWVudFksIG4gPSB2KGUpLmxhYmVsLmdldEJvdW5kaW5nQ2xpZW50UmVjdCgpLCBvID0gTWF0aC5yb3VuZChuLmhlaWdodCAvIDQpOyByZXR1cm4gbi50b3AgKyBvID4gdCA/IGYuQkVGT1JFIDogbi5ib3R0b20gLSBvIDwgdCA/IGYuQUZURVIgOiBmLklOU0lERSB9LCB2ID0gZSA9PiBlLnRhcmdldC5jbG9zZXN0KHUuVEFHX05BTUUpLCBiID0gZSA9PiB7IGNvbnN0IHQgPSBudWxsID09IGUgPyB2b2lkIDAgOiBlLnBhcmVudEVsZW1lbnQucGFyZW50RWxlbWVudDsgcmV0dXJuIChudWxsID09IHQgPyB2b2lkIDAgOiB0LnRhZ05hbWUudG9Mb3dlckNhc2UoKSkgIT09IHUuVEFHX05BTUUgPyBudWxsIDogdCB9LCBtID0gKGUsIHQpID0+IHsgdihlKS5jbGFzc0xpc3QucmVtb3ZlKHQuc3R5bGVzLm5vZGVEcm9wQWZ0ZXIsIHQuc3R5bGVzLm5vZGVEcm9wQmVmb3JlLCB0LnN0eWxlcy5ub2RlRHJvcEluc2lkZSkgfSwgRSA9IChlLCB0KSA9PiB7IGUuc3RvcFByb3BhZ2F0aW9uKCk7IGNvbnN0IG4gPSBlLnRhcmdldDsgbi50YWdOYW1lLnRvTG93ZXJDYXNlKCkgPT09IHUuVEFHX05BTUUgJiYgKGUuZGF0YVRyYW5zZmVyLnNldERhdGEoInRleHQiLCBuLmlkKSwgZS5kYXRhVHJhbnNmZXIuZWZmZWN0QWxsb3dlZCA9ICJtb3ZlIiwgbi5jbGFzc0xpc3QuYWRkKHQuc3R5bGVzLm5vZGVEcmFnZ2luZykpIH0sIF8gPSAoZSwgdCkgPT4gaCh2b2lkIDAsIHZvaWQgMCwgdm9pZCAwLCAoZnVuY3Rpb24qICgpIHsgZS5zdG9wUHJvcGFnYXRpb24oKSwgZS5wcmV2ZW50RGVmYXVsdCgpLCBtKGUsIHQpOyBjb25zdCBuID0gdihlKTsgaWYgKCFuKSByZXR1cm4gITE7IGNvbnN0IG8gPSBiKG4pLCByID0gZS5kYXRhVHJhbnNmZXIuZ2V0RGF0YSgidGV4dCIpLCBzID0gZyhlKSwgaSA9IHQuZ2V0Tm9kZShyKTsgaWYgKCFpIHx8IChudWxsID09IGkgPyB2b2lkIDAgOiBpLmNvbnRhaW5zKG4pKSkgcmV0dXJuICExOyBjb25zdCBhID0gYihpKTsgaWYgKHQubG9ja1Jvb3RMZXZlbCAmJiAhKG51bGwgPT0gbiA/IHZvaWQgMCA6IG4ucGFyZW50RWxlbWVudC5jbG9zZXN0KHUuVEFHX05BTUUpKSAmJiAocyA9PT0gZi5CRUZPUkUgfHwgcyA9PT0gZi5BRlRFUikpIHJldHVybiAhMTsgaWYgKHMgPT09IGYuQkVGT1JFKSByZXR1cm4gISEoeWllbGQgdC5jb25maXJtKGksIG8pKSAmJiAobi5wYXJlbnROb2RlLmluc2VydEJlZm9yZShpLCBuKSwgdC5vbkRyb3AoaSwgYSwgbyksICExKTsgaWYgKHMgPT09IGYuQUZURVIpIHsgaWYgKCEoeWllbGQgdC5jb25maXJtKGksIG8pKSkgcmV0dXJuICExOyBjb25zdCBlID0gbi5uZXh0RWxlbWVudFNpYmxpbmc7IHJldHVybiBlID8gKG4ucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoaSwgZSksIHQub25Ecm9wKGksIGEsIG8pKSA6IChuLnBhcmVudE5vZGUuYXBwZW5kQ2hpbGQoaSksIHQub25Ecm9wKGksIGEsIG8pKSwgITEgfSByZXR1cm4gISEoeWllbGQgdC5jb25maXJtKGksIG4pKSAmJiAobi5zdWJub2Rlcy5hcHBlbmRDaGlsZChpKSwgdC5vbkRyb3AoaSwgYSwgbiksICExKSB9KSksIHkgPSAoZSwgdCkgPT4geyBlLnByZXZlbnREZWZhdWx0KCksIGUuZGF0YVRyYW5zZmVyLmRyb3BFZmZlY3QgPSAibW92ZSIsICgoZSwgdCkgPT4geyBjb25zdCBuID0gdihlKSwgbyA9IGcoZSk7IG4uY2xhc3NMaXN0LnRvZ2dsZSh0LnN0eWxlcy5ub2RlRHJvcEJlZm9yZSwgbyA9PT0gZi5CRUZPUkUpLCBuLmNsYXNzTGlzdC50b2dnbGUodC5zdHlsZXMubm9kZURyb3BJbnNpZGUsIG8gPT09IGYuSU5TSURFKSwgbi5jbGFzc0xpc3QudG9nZ2xlKHQuc3R5bGVzLm5vZGVEcm9wQWZ0ZXIsIG8gPT09IGYuQUZURVIpIH0pKGUsIHQpIH0sIEEgPSAoZSwgdCkgPT4geyBtKGUsIHQpIH0sIFQgPSAoZSwgdCkgPT4geyBlLnRhcmdldC5jbGFzc0xpc3QucmVtb3ZlKHQuc3R5bGVzLm5vZGVEcmFnZ2luZyksIG0oZSwgdCkgfSwgTiA9IGUgPT4gYHNvcnRhYmxlVHJlZVN0YXRlLSR7ZS5yZXBsYWNlKC9bXlx3XSsvLCAiLSIpfWA7IGNvbnN0IEwgPSBjbGFzcyB7IGNvbnN0cnVjdG9yKHsgbm9kZXM6IGUsIGVsZW1lbnQ6IHQsIHJlbmRlckxhYmVsOiBuLCBpY29uczogZCwgc3R5bGVzOiBjLCBsb2NrUm9vdExldmVsOiB1LCBvbkNoYW5nZTogaCwgb25DbGljazogcCwgaW5pdENvbGxhcHNlTGV2ZWw6IGYsIGNvbmZpcm06IGcsIGRpc2FibGVTb3J0aW5nOiB2LCBzdGF0ZUlkOiBiIH0pIHsgdGhpcy5ub2RlQ29sbGVjdGlvbiA9IHt9LCBlICYmICh0ID8gKHRoaXMuZGVmaW5lRWxlbWVudHMoKSwgdGhpcy5yb290ID0gdCwgdGhpcy5pY29ucyA9IE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSwgciksIGQpLCB0aGlzLnN0eWxlcyA9IE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSwgcyksIGMpLCB0aGlzLnJlbmRlckxhYmVsID0gbiB8fCBvLCB0aGlzLmxvY2tSb290TGV2ZWwgPSB2b2lkIDAgPT09IHUgfHwgdSwgdGhpcy5vbkNoYW5nZSA9IGggfHwgaSwgdGhpcy5vbkNsaWNrID0gcCB8fCBhLCB0aGlzLmNvbmZpcm0gPSBnIHx8IGwsIHRoaXMuaW5pdENvbGxhcHNlTGV2ZWwgPSB2b2lkIDAgPT09IGYgPyAyIDogZiwgdGhpcy5kaXNhYmxlU29ydGluZyA9IHYgfHwgITEsIHQuY2xhc3NMaXN0LmFkZCh0aGlzLnN0eWxlcy50cmVlKSwgdGhpcy5yZW5kZXIoeyBub2RlczogZSwgZWxlbWVudDogdCB9KSwgYiAmJiAoKChlLCB0KSA9PiB7IGNvbnN0IG4gPSBzZXNzaW9uU3RvcmFnZS5nZXRJdGVtKE4oZSkpOyBpZiAoIW4pIHJldHVybjsgY29uc3QgbyA9IEpTT04ucGFyc2UobiksIHIgPSAoZSwgdCkgPT4geyBjb25zdCBbbiwgb10gPSB0OyBlLmVsZW1lbnQuY29sbGFwc2UoMCA9PT0gbiksIG8gJiYgZS5zdWJub2Rlcy5mb3JFYWNoKCgoZSwgdCkgPT4geyB2b2lkIDAgIT09IG9bdF0gJiYgcihlLCBvW3RdKSB9KSkgfTsgdC5mb3JFYWNoKCgoZSwgdCkgPT4geyB2b2lkIDAgIT09IG9bdF0gJiYgcihlLCBvW3RdKSB9KSkgfSkoYiwgdGhpcy5wYXJzZVRyZWUodGhpcy5yb290KSksIHRoaXMuaW5pdFN0YXRlT2JzZXJ2ZXIoYikpKSA6IGNvbnNvbGUuZXJyb3IoJ0Vycm9yOiAiZWxlbWVudCIgaXMgbm90IGEgdmFsaWQgSFRNTCBlbGVtZW50IScpKSB9IGdldE5vZGUoZSkgeyByZXR1cm4gdGhpcy5ub2RlQ29sbGVjdGlvbltlXSB9IGZpbmROb2RlKGUsIHQpIHsgY29uc3QgbiA9IE9iamVjdC52YWx1ZXModGhpcy5ub2RlQ29sbGVjdGlvbik7IGZvciAobGV0IG8gPSAwOyBvIDwgbi5sZW5ndGg7IG8rKykgeyBjb25zdCByID0gbltvXSwgcyA9IHIuZGF0YTsgaWYgKGUgaW4gcyAmJiBzW2VdID09IHQpIHJldHVybiByIH0gcmV0dXJuIG51bGwgfSBvbkRyb3AoZSwgdCwgbikgeyBjb25zdCBvID0geyBub2RlczogdGhpcy5wYXJzZVRyZWUodGhpcy5yb290KSwgbW92ZWROb2RlOiBlLCBzcmNQYXJlbnROb2RlOiB0LCB0YXJnZXRQYXJlbnROb2RlOiBuIH07IG51bGwgPT0gbiB8fCBuLmNvbGxhcHNlKCExKSwgdGhpcy5vbkNoYW5nZShvKSB9IGRlc3Ryb3koKSB7IHRoaXMub2JzZXJ2ZXIuZGlzY29ubmVjdCgpLCB0aGlzLm9ic2VydmVyID0gbnVsbCB9IGluaXRTdGF0ZU9ic2VydmVyKGUpIHsgdGhpcy5vYnNlcnZlciA9IG5ldyBNdXRhdGlvbk9ic2VydmVyKCgoKSA9PiB7ICgoZSwgdCkgPT4geyBjb25zdCBuID0gW10sIG8gPSBlID0+IHsgY29uc3QgdCA9IFtdLCBuID0gW2UuZWxlbWVudC5nZXRBdHRyaWJ1dGUoIm9wZW4iKSA/IDEgOiAwLCB0XTsgcmV0dXJuIGUuc3Vibm9kZXMuZm9yRWFjaCgoZSA9PiB7IHQucHVzaChvKGUpKSB9KSksIG4gfTsgdC5mb3JFYWNoKChlID0+IHsgbi5wdXNoKG8oZSkpIH0pKSwgc2Vzc2lvblN0b3JhZ2Uuc2V0SXRlbShOKGUpLCBKU09OLnN0cmluZ2lmeShuKSkgfSkoZSwgdGhpcy5wYXJzZVRyZWUodGhpcy5yb290KSkgfSkpLCB0aGlzLm9ic2VydmVyLm9ic2VydmUodGhpcy5yb290LCB7IGNoaWxkTGlzdDogITAsIGF0dHJpYnV0ZXM6ICEwLCBzdWJ0cmVlOiAhMCB9KSB9IGRlZmluZUVsZW1lbnRzKCkgeyB0cnkgeyBjdXN0b21FbGVtZW50cy5kZWZpbmUodS5UQUdfTkFNRSwgdSkgfSBjYXRjaCAoZSkgeyB9IH0gcmVuZGVyKHsgbm9kZXM6IGUsIGVsZW1lbnQ6IHQgfSwgbiA9IDApIHsgbisrLCBlLmZvckVhY2goKGUgPT4geyBjb25zdCBvID0gdS5jcmVhdGUoeyBpY29uczogdGhpcy5pY29ucywgc3R5bGVzOiB0aGlzLnN0eWxlcywgcGFyZW50OiB0LCByZW5kZXJMYWJlbDogdGhpcy5yZW5kZXJMYWJlbCwgZGF0YTogZS5kYXRhLCBvbkNsaWNrOiB0aGlzLm9uQ2xpY2ssIGRyYWdnYWJsZTogIXRoaXMuZGlzYWJsZVNvcnRpbmcgfSk7IHRoaXMuZGlzYWJsZVNvcnRpbmcgfHwgKChlLCB0KSA9PiB7IGNvbnN0IG4gPSB7IGRyYWdzdGFydDogRSwgZHJvcDogXywgZHJhZ292ZXI6IHksIGRyYWdlbmQ6IFQsIGRyYWdsZWF2ZTogQSB9OyBmb3IgKGNvbnN0IFtvLCByXSBvZiBPYmplY3QuZW50cmllcyhuKSkgcCh7IG5vZGU6IGUsIGV2ZW50TmFtZTogbywgaGFuZGxlcjogciwgdHJlZTogdCB9KSB9KShvLCB0aGlzKSwgby5jb2xsYXBzZShuID4gdGhpcy5pbml0Q29sbGFwc2VMZXZlbCksIHRoaXMubm9kZUNvbGxlY3Rpb25bby5pZF0gPSBvLCBlLm5vZGVzICYmIHRoaXMucmVuZGVyKHsgbm9kZXM6IGUubm9kZXMsIGVsZW1lbnQ6IG8uc3Vibm9kZXMgfSwgbikgfSkpIH0gcGFyc2VUcmVlKGUpIHsgY29uc3QgdCA9IEFycmF5LmZyb20oZS5xdWVyeVNlbGVjdG9yQWxsKGA6c2NvcGUgPiAke3UuVEFHX05BTUV9YCkpLCBuID0gW107IHJldHVybiB0LmZvckVhY2goKGUgPT4geyBuLnB1c2goeyBlbGVtZW50OiBlLCBpZDogZS5pZCwgc3Vibm9kZXM6IHRoaXMucGFyc2VUcmVlKGUuc3Vibm9kZXMpIH0pIH0pKSwgbiB9IH07IHJldHVybiB0ID0gdC5kZWZhdWx0IH0pKCkpKTs=",mtime:1770926754872},"assets/icons/navigation-2.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIgogICAgc3Ryb2tlPSJjdXJyZW50Q29sb3IiIHN0cm9rZS13aWR0aD0iMiIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHJva2UtbGluZWpvaW49InJvdW5kIgogICAgY2xhc3M9ImZlYXRoZXIgZmVhdGhlci1uYXZpZ2F0aW9uLTIiPgogICAgPHBvbHlnb24gcG9pbnRzPSIxMiAyIDE5IDIxIDEyIDE3IDUgMjEgMTIgMiI+PC9wb2x5Z29uPgo8L3N2Zz4=",mtime:1770926754873},"assets/icons/eye-off.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPjxwYXRoIGQ9Ik0xNy45NCAxNy45NEExMC4wNyAxMC4wNyAwIDAgMSAxMiAyMGMtNyAwLTExLTgtMTEtOGExOC40NSAxOC40NSAwIDAgMSA1LjA2LTUuOTRNOS45IDQuMjRBOS4xMiA5LjEyIDAgMCAxIDEyIDRjNyAwIDExIDggMTEgOGExOC41IDE4LjUgMCAwIDEtMi4xNiAzLjE5bS02LjcyLTEuMDdhMyAzIDAgMSAxLTQuMjQtNC4yNCI+PC9wYXRoPjxsaW5lIHgxPSIxIiB5MT0iMSIgeDI9IjIzIiB5Mj0iMjMiPjwvbGluZT48L3N2Zz4K",mtime:1770926754873},"assets/icons/x-circle.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXIteC1jaXJjbGUiPjxjaXJjbGUgY3g9IjEyIiBjeT0iMTIiIHI9IjEwIj48L2NpcmNsZT48bGluZSB4MT0iMTUiIHkxPSI5IiB4Mj0iOSIgeTI9IjE1Ij48L2xpbmU+PGxpbmUgeDE9IjkiIHkxPSI5IiB4Mj0iMTUiIHkyPSIxNSI+PC9saW5lPjwvc3ZnPg==",mtime:1770926754873},"assets/icons/eye.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPjxwYXRoIGQ9Ik0xIDEyczQtOCAxMS04IDExIDggMTEgOC00IDgtMTEgOC0xMS04LTExLTh6Ij48L3BhdGg+PGNpcmNsZSBjeD0iMTIiIGN5PSIxMiIgcj0iMyI+PC9jaXJjbGU+PC9zdmc+Cg==",mtime:1770926754873},"assets/icons/folder-minus.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItZm9sZGVyLW1pbnVzIj48cGF0aCBkPSJNMjIgMTlhMiAyIDAgMCAxLTIgMkg0YTIgMiAwIDAgMS0yLTJWNWEyIDIgMCAwIDEgMi0yaDVsMiAzaDlhMiAyIDAgMCAxIDIgMnoiPjwvcGF0aD48bGluZSB4MT0iOSIgeTE9IjE0IiB4Mj0iMTUiIHkyPSIxNCI+PC9saW5lPjwvc3ZnPg==",mtime:1770926754873},"assets/icons/folder-plus.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItZm9sZGVyLXBsdXMiPjxwYXRoIGQ9Ik0yMiAxOWEyIDIgMCAwIDEtMiAySDRhMiAyIDAgMCAxLTItMlY1YTIgMiAwIDAgMSAyLTJoNWwyIDNoOWEyIDIgMCAwIDEgMiAyeiI+PC9wYXRoPjxsaW5lIHgxPSIxMiIgeTE9IjExIiB4Mj0iMTIiIHkyPSIxNyI+PC9saW5lPjxsaW5lIHgxPSI5IiB5MT0iMTQiIHgyPSIxNSIgeTI9IjE0Ij48L2xpbmU+PC9zdmc+",mtime:1770926754873},"assets/icons/refresh-cw.svg":{data:"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItcmVmcmVzaC1jdyI+PHBvbHlsaW5lIHBvaW50cz0iMjMgNCAyMyAxMCAxNyAxMCI+PC9wb2x5bGluZT48cG9seWxpbmUgcG9pbnRzPSIxIDIwIDEgMTQgNyAxNCI+PC9wb2x5bGluZT48cGF0aCBkPSJNMy41MSA5YTkgOSAwIDAgMSAxNC44NS0zLjM2TDIzIDEwTTEgMTRsNC42NCA0LjM2QTkgOSAwIDAgMCAyMC40OSAxNSI+PC9wYXRoPjwvc3ZnPg==",mtime:1770926754873},"assets/treeview.js":{data:"data:application/javascript;base64,LyoqCiAqIEB0eXBlZGVmIHtpbXBvcnQoIi4uL2FwaS50cyIpLlRyZWVOb2RlfSBUcmVlTm9kZQogKi8KCi8qKgogKiBAdHlwZWRlZiBTb3J0YWJsZVRyZWVOb2RlCiAqIEB0eXBlIHtPYmplY3R9CiAqIEBwcm9wZXJ0eSB7VHJlZU5vZGVbImRhdGEiXX0gZGF0YQogKi8KCi8qKgogKgogKiBAdHlwZWRlZiBUcmVlVmlld0NvbmZpZwogKiBAdHlwZSB7T2JqZWN0fQogKiBAcHJvcGVydHkge3N0cmluZ30gY3VycmVudFBhZ2UgLSB0aGUgY3VycmVudCBwYWdlIHNob3duIGluIFNpbHZlckJ1bGxldC4KICogQHByb3BlcnR5IHtUcmVlTm9kZVtdfSBub2RlcyAtIGEgdHJlZSBvZiBhbGwgcGFnZXMgaW4gdGhlIGN1cnJlbnQgc3BhY2UuCiAqIEBwcm9wZXJ0eSB7T2JqZWN0fSBkcmFnQW5kRHJvcCAtIGRyYWcgYW5kIGRyb3AgcmVsYXRlZCBjb25maWcKICogQHByb3BlcnR5IHtib29sZWFufSBkcmFnQW5kRHJvcC5lbmFibGVkIC0gdHJ1ZSBpZiBkcmFnIGFuZCBkcm9wIGlzIGVuYWJsZWQKICogQHByb3BlcnR5IHtib29sZWFufSBkcmFnQW5kRHJvcC5jb25maXJtT25SZW5hbWUgLSB0cnVlIGlmIGEgY29uZmlybWF0aW9uIHNob3VsZCBiZSBzaG93bgogKiAgd2hlbiBhIG5vZGUgaXMgZHJhZ2dlZCBhbmQgZHJvcHBlZC4KKi8KCgpjb25zdCBUUkVFX1NUQVRFX0lEID0gInRyZWV2aWV3IjsKCi8qKgogKiBJbml0aWFsaXplcyB0aGUgVHJlZVZpZXcncyBgU29ydGFibGVUcmVlYCBpbnN0YW5jZS4KICogQHBhcmFtIHtUcmVlVmlld0NvbmZpZ30gY29uZmlnCiAqIEByZXR1cm5zIHtTb3J0YWJsZVRyZWV9CiAqLwpmdW5jdGlvbiBjcmVhdGVUcmVlVmlldyhjb25maWcpIHsKICByZXR1cm4gbmV3IFNvcnRhYmxlVHJlZSh7CiAgICBub2RlczogY29uZmlnLm5vZGVzLAogICAgZGlzYWJsZVNvcnRpbmc6ICFjb25maWcuZHJhZ0FuZERyb3AuZW5hYmxlZCwKICAgIGVsZW1lbnQ6IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGNvbmZpZy50cmVlRWxlbWVudElkKSwKICAgIHN0YXRlSWQ6IFRSRUVfU1RBVEVfSUQsCiAgICBpbml0Q29sbGFwc2VMZXZlbDogMCwKICAgIGxvY2tSb290TGV2ZWw6IGZhbHNlLAoKICAgIC8qKgogICAgICogQHBhcmFtIHtTb3J0YWJsZVRyZWVOb2RlfSBtb3ZlZE5vZGUKICAgICAqIEBwYXJhbSB7U29ydGFibGVUcmVlTm9kZX0gdGFyZ2V0UGFyZW50Tm9kZQogICAgICovCiAgICBjb25maXJtOiBhc3luYyAobW92ZWROb2RlLCB0YXJnZXRQYXJlbnROb2RlKSA9PiB7CiAgICAgIGNvbnN0IG9sZFByZWZpeCA9IG1vdmVkTm9kZS5kYXRhLm5hbWU7CiAgICAgIGNvbnN0IG5ld1ByZWZpeCA9IHRhcmdldFBhcmVudE5vZGUgPyBgJHt0YXJnZXRQYXJlbnROb2RlLmRhdGEubmFtZX0vJHttb3ZlZE5vZGUuZGF0YS50aXRsZX1gIDogbW92ZWROb2RlLmRhdGEudGl0bGU7CgogICAgICBpZiAob2xkUHJlZml4ID09PSBuZXdQcmVmaXgpIHsKICAgICAgICByZXR1cm47CiAgICAgIH0KCiAgICAgIGNvbnN0IHN1Y2Nlc3MgPSBhd2FpdCBzeXNjYWxsKCJzeXN0ZW0uaW52b2tlRnVuY3Rpb24iLCAiaW5kZXgucmVuYW1lUHJlZml4Q29tbWFuZCIsIHsKICAgICAgICBvbGRQcmVmaXgsCiAgICAgICAgbmV3UHJlZml4LAogICAgICAgIGRpc2FibGVDb25maXJtYXRpb246ICFjb25maWcuZHJhZ0FuZERyb3AuY29uZmlybU9uUmVuYW1lLAogICAgICB9KTsKCiAgICAgIGlmIChzdWNjZXNzICYmIGNvbmZpZy5jdXJyZW50UGFnZS5pbmRleE9mKG9sZFByZWZpeCkgPT09IDApIHsKICAgICAgICAvLyBJZiB0aGlzIHJlbmFtZWQgdGhlIGN1cnJlbnQgcGFnZSwgbmF2aWdhdGUgdG8gaXQgYXQgaXQncyB1cGRhdGVkIG5hbWUuCiAgICAgICAgYXdhaXQgc3lzY2FsbCgiZWRpdG9yLm5hdmlnYXRlIiwgY29uZmlnLmN1cnJlbnRQYWdlLnJlcGxhY2Uob2xkUHJlZml4LCBuZXdQcmVmaXgpLCBmYWxzZSwgZmFsc2UpOwogICAgICB9CgogICAgICByZXR1cm4gc3VjY2VzczsKICAgIH0sCgogICAgb25DaGFuZ2U6IGFzeW5jICgpID0+IHsKICAgICAgYXdhaXQgc3lzY2FsbCgic3lzdGVtLmludm9rZUZ1bmN0aW9uIiwgInRyZWV2aWV3LnNob3ciKTsKICAgIH0sCgogICAgLyoqCiAgICAgKiBAcGFyYW0ge1NvcnRhYmxlVHJlZU5vZGV9IG5vZGUKICAgICAqLwogICAgb25DbGljazogYXN5bmMgKF9ldmVudCwgbm9kZSkgPT4gewogICAgICBpZiAobm9kZS5kYXRhLm5vZGVUeXBlID09PSAiYXR0YWNobWVudCIpIHsKICAgICAgICAvLyBPcGVuIGF0dGFjaG1lbnQgaW4gbmV3IHRhYgogICAgICAgIHdpbmRvdy5vcGVuKGAvJHtub2RlLmRhdGEubmFtZX1gLCAiX2JsYW5rIik7CiAgICAgIH0gZWxzZSB7CiAgICAgICAgYXdhaXQgc3lzY2FsbCgiZWRpdG9yLm5hdmlnYXRlIiwgbm9kZS5kYXRhLm5hbWUsIGZhbHNlLCBmYWxzZSk7CiAgICAgIH0KICAgIH0sCgogICAgLyoqCiAgICAgKiBAcGFyYW0ge1NvcnRhYmxlVHJlZU5vZGVbImRhdGEiXX0gZGF0YQogICAgICogQHJldHVybnMge3N0cmluZ30KICAgICAqLwogICAgcmVuZGVyTGFiZWw6IChkYXRhKSA9PiBgCiAgICAgIDxzcGFuCiAgICAgICAgZGF0YS1jdXJyZW50LXBhZ2U9IiR7SlNPTi5zdHJpbmdpZnkoZGF0YS5pc0N1cnJlbnRQYWdlIHx8IGZhbHNlKX0iCiAgICAgICAgZGF0YS1ub2RlLXR5cGU9IiR7ZGF0YS5ub2RlVHlwZX0iCiAgICAgICAgZGF0YS1wZXJtaXNzaW9uPSIke2RhdGEucGVybX0iCiAgICAgICAgdGl0bGU9IiR7ZGF0YS5uYW1lfSIgPgogICAgICAgICR7ZGF0YS50aXRsZX0KICAgICAgPC9zcGFuPmAKICAgICwKICB9KTsKfQoKLyoqCiAqIEluaXRpYWxpemVzIHRoZSB0cmVlIHZpZXcgYW5kIGl0J3MgYWN0aW9uIGJhci4KICogQHBhcmFtIHtUcmVlVmlld0NvbmZpZ30gY29uZmlnCiAqLwovLyBkZW5vLWxpbnQtaWdub3JlIG5vLXVudXNlZC12YXJzCmZ1bmN0aW9uIGluaXRpYWxpemVUcmVlVmlld1BhbmVsKGNvbmZpZykgewogIGNvbnN0IHRyZWUgPSBjcmVhdGVUcmVlVmlldyhjb25maWcpOwogIGNvbnN0IGhhbmRsZUFjdGlvbiA9IChhY3Rpb24pID0+IHsKICAgIHN3aXRjaCAoYWN0aW9uKSB7CiAgICAgIGNhc2UgImNvbGxhcHNlLWFsbCI6IHsKICAgICAgICBkb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCJzb3J0YWJsZS10cmVlLW5vZGVbb3Blbj0ndHJ1ZSddIikuZm9yRWFjaCgobm9kZSkgPT4gbm9kZS5jb2xsYXBzZSh0cnVlKSk7CiAgICAgICAgcmV0dXJuIHRydWU7CiAgICAgIH0KICAgICAgY2FzZSAiZXhwYW5kLWFsbCI6IHsKICAgICAgICBkb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCJzb3J0YWJsZS10cmVlLW5vZGU6bm90KFtvcGVuPSd0cnVlJ10pIikuZm9yRWFjaCgobm9kZSkgPT4gbm9kZS5jb2xsYXBzZShmYWxzZSkpOwogICAgICAgIHJldHVybiB0cnVlOwogICAgICB9CiAgICAgIGNhc2UgImNsb3NlLXBhbmVsIjogewogICAgICAgIHN5c2NhbGwoInN5c3RlbS5pbnZva2VGdW5jdGlvbiIsICJ0cmVldmlldy5oaWRlIik7CiAgICAgICAgcmV0dXJuIHRydWU7CiAgICAgIH0KICAgICAgY2FzZSAicmVmcmVzaCI6IHsKICAgICAgICBzeXNjYWxsKCJzeXN0ZW0uaW52b2tlRnVuY3Rpb24iLCAidHJlZXZpZXcuc2hvdyIpOwogICAgICAgIHJldHVybiB0cnVlOwogICAgICB9CiAgICAgIGNhc2UgInJldmVhbC1jdXJyZW50LXBhZ2UiOiB7CiAgICAgICAgY29uc3QgY3VycmVudE5vZGUgPSB0cmVlLmZpbmROb2RlKCJpc0N1cnJlbnRQYWdlIiwgdHJ1ZSk7CiAgICAgICAgaWYgKGN1cnJlbnROb2RlKSB7CiAgICAgICAgICBjdXJyZW50Tm9kZS5yZXZlYWwoKTsKICAgICAgICAgIGN1cnJlbnROb2RlLnNjcm9sbEludG9WaWV3KHsKICAgICAgICAgICAgYmVoYXZpb3I6ICJhdXRvIiwKICAgICAgICAgICAgYmxvY2s6ICJuZWFyZXN0IiwKICAgICAgICAgICAgaW5saW5lOiAibmVhcmVzdCIsCiAgICAgICAgICB9KTsKICAgICAgICAgIHJldHVybiB0cnVlOwogICAgICAgIH0KICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgIH0KICAgICAgY2FzZSAiaW5jcmVhc2Utd2lkdGgiOiB7CiAgICAgICAgc3lzY2FsbCgic3lzdGVtLmludm9rZUZ1bmN0aW9uIiwgInRyZWV2aWV3LmluY3JlYXNlV2lkdGgiKTsKICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICAgfQogICAgICBjYXNlICJkZWNyZWFzZS13aWR0aCI6IHsKICAgICAgICBzeXNjYWxsKCJzeXN0ZW0uaW52b2tlRnVuY3Rpb24iLCAidHJlZXZpZXcuZGVjcmVhc2VXaWR0aCIpOwogICAgICAgIHJldHVybiB0cnVlOwogICAgICB9CiAgICAgIGNhc2UgInRvZ2dsZS1oaWRkZW4iOiB7CiAgICAgICAgc3lzY2FsbCgic3lzdGVtLmludm9rZUZ1bmN0aW9uIiwgInRyZWV2aWV3LnRvZ2dsZUhpZGRlbiIpOwogICAgICAgIHJldHVybiB0cnVlOwogICAgICB9CiAgICB9CgogICAgcmV0dXJuIGZhbHNlOwogIH0KCiAgaWYgKGNvbmZpZy5yZXZlYWxPbkxvYWQpIHsKICAgIGhhbmRsZUFjdGlvbigicmV2ZWFsLWN1cnJlbnQtcGFnZSIpOwogIH0KCiAgZG9jdW1lbnQucXVlcnlTZWxlY3RvckFsbCgiW2RhdGEtdHJlZXZpZXctYWN0aW9uXSIpLmZvckVhY2goKGVsKSA9PiB7CiAgICBlbC5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsIChlKSA9PiB7CiAgICAgIGlmIChoYW5kbGVBY3Rpb24oZWwuZGF0YXNldFsidHJlZXZpZXdBY3Rpb24iXSkpIHsKICAgICAgICBlLnN0b3BQcm9wYWdhdGlvbigpOwogICAgICAgIGUucHJldmVudERlZmF1bHQoKTsKICAgICAgfQogICAgfSk7CiAgfSkKfQo=",mtime:1770926754873}},functions:{hide:{path:"./treeview.ts:hideTree"},show:{path:"./treeview.ts:showTree"},showIfEnabled:{path:"./treeview.ts:showTreeIfEnabled",events:["editor:init","editor:pageLoaded","editor:pageSaved","file:deleted"]},toggle:{path:"./treeview.ts:toggleTree",command:{name:"Tree View: Toggle",key:"Ctrl-alt-b",mac:"Cmd-alt-b"}},reveal:{path:"./treeview.ts:showTree",command:{name:"Tree View: Reveal Current Page"}},deletePage:{path:"./treeview.ts:deletePage",command:{name:"Page: Delete (shortcut)",key:"Ctrl-Shift-d",mac:"Cmd-Shift-d"}},increaseWidth:{path:"./treeview.ts:increaseWidth",command:{name:"Tree View: Increase Width"}},decreaseWidth:{path:"./treeview.ts:decreaseWidth",command:{name:"Tree View: Decrease Width"}},toggleHidden:{path:"./treeview.ts:toggleHidden",command:{name:"Tree View: Toggle Hidden Files"}}}},No={manifest:Wt,functionMapping:Kt};tt(Kt,Wt,self.postMessage);export{No as plug};
diff --git a/configs/notes/space/inbox.md b/configs/notes/space/inbox.md
deleted file mode 100644
index 16341df..0000000
--- a/configs/notes/space/inbox.md
+++ /dev/null
@@ -1,13 +0,0 @@
-# Inbox
-
-Apple **Quick Note** analogue. Dump here first; triage into [[TODO]] (Now / Next / Waiting / Someday) or a dedicated page.
-
-Rules:
-
-- Empty capture OK — fill the next `- [ ]` line and save.
-- Do not create a new folder just to capture.
-- After triage, clear or check off lines so Inbox stays short.
-
-## Capture
-
-- [ ]
diff --git a/configs/notes/space/index.md b/configs/notes/space/index.md
deleted file mode 100644
index bfa625c..0000000
--- a/configs/notes/space/index.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-# SilverBullet index page (SB_INDEX_PAGE=index)
-# Apple-Notes-like home: pins + capture path + search
----
-
-# Notes
-
-Cross-host notes (magikoopa + clementine) via koopa SilverBullet.
-Mental model = Apple Notes: **folders/pages · list · editor**, pin primary TODO, Quick Note → triage.
-
-| Page | Apple analogue | Role |
-|------|----------------|------|
-| [[TODO]] | Pinned primary note | ADHD SoT: Now≤3 / Next / Waiting / Someday / Stats |
-| [[inbox]] | Quick Note | Capture before triage |
-
-## Pins
-
-- [[TODO]]
-- [[inbox]]
-
-## How to use (Apple habits → here)
-
-1. **Capture** into [[inbox]] (or SB quick-note if enabled) — do not invent folders first.
-2. **Triage** into [[TODO]] sections (Now max 3). Same rules as former Apple Notes guide.
-3. **Find** with Page Picker / search (**Cmd/Ctrl-K**).
-4. **New page** when a topic is not a todo (meetings, dumps) — link from TODO by title, do not dump transcripts into TODO.
-5. Optional later: TreeView plug (folder sidebar), Space Lua query page = “smart folder” for `#tag` open tasks.
-
-## Shortcuts (target)
-
-| Action | Typical SB |
-|--------|------------|
-| Open page / filter | Cmd/Ctrl-K (Page Picker) |
-| Quick note | Ctrl-q (if client supports) → prefer landing in [[inbox]] |
-| Search body | built-in search / SilverSearch plug |
-
-## Hygiene (from Apple Notes ADHD pack)
-
-- One primary [[TODO]] — no competing systems.
-- Capture first; tags (`#taler` …) optional and light.
-- On “I’m back”: re-read **Now** only.
-- No passwords/tokens in notes.
-
-## Apps
-
-- [[PLUGS]] — TreeView + SilverSearch
diff --git a/configs/paivana/README.md b/configs/paivana/README.md
index 285cec8..643fdb4 100644
--- a/configs/paivana/README.md
+++ b/configs/paivana/README.md
@@ -2,32 +2,27 @@
GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.
-One process = one `BASE_URL` + one `DESTINATION_BASE_URL` + one `MERCHANT_BACKEND_URL`.
-Shared **image / secrets / entrypoint / conf template**; per-service env sets
-`PAIVANA_BASE_URL` + `PAIVANA_DESTINATION_BASE_URL`. Portal on **9025**; app
-paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only
-(`19128` SilverBullet, `19129` Galene HTTP, `19130` CryptPad edge, `19131` Meet).
-
| Item | Value |
|------|--------|
| Live | `/home/hernani/koopa-paivana/` |
-| Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` |
+| Containers | `koopa-paivana`, `koopa-paivana-upstream` |
| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
-| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via pasta host IP `172.17.0.1:19128–19131` (compose publish, not `127.0.0.1`) |
-| Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy |
-| Currency | **multi** via goa-shop template `paivana` choices (CHF / FLOODS / GOA / TESTPAYSAN); wallet still filters by held coins |
+| Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
+| Host port | **9025** → Caddy `paivana.hacktivism.ch` |
+| Currency | **GOA** |
| Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
-| Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) |
-| Access | **`-g`** site-wide: pay once → that hostname free to browse |
+| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
+| Access | **`-g`** site-wide: pay once → example upstream free to browse |
+| Upstream | example site in `upstream/` (compose service) |
## Layout
| Path | Role |
|------|------|
| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
-| `compose.yml` | portal + 4 app paywalls + nginx upstream (YAML anchor `x-paivana-common`) |
-| `conf/paivana.conf.template` | Shared conf; `@BASE_URL@` / `@DESTINATION_BASE_URL@` / secrets at start |
-| `entrypoint.sh` | Env + secrets → run `paivana-httpd -g -f` |
+| `compose.yml` | `koopa-paivana` + nginx upstream |
+| `conf/paivana.conf.template` | Config; secrets substituted at start |
+| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
| `secrets/` | **not in git** — live only |
| `upstream/` | Protected demo content |
| `container-koopa-paivana.service` | systemd --user oneshot compose up |
@@ -95,10 +90,9 @@ extra_hosts:
| Check | Expect |
|-------|--------|
| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` |
-| `curl -si http://127.0.0.1:902{8,9,0}/` | **302** same template path (per-host BASE_URL) |
-| `https://{paivana,silverbullet,galene,cryptpad,meet}.hacktivism.ch/` | unpaid → **302** `…/templates/paivana#…` (or paywall HTML) |
+| `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` |
| monitoring `urls` | `www.paivana` OK |
-| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:42** (wenn `E2E_PAIVANA=1`) |
+| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:4200** (wenn `E2E_PAIVANA=1`) |
---
@@ -143,26 +137,22 @@ Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).
## Merchant template
-Create (or replace via PATCH / DELETE+POST — see live merchant API):
-
```bash
curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
-H "Authorization: Bearer secret-token:…" \
-H 'Content-Type: application/json' \
-d '{
"template_id": "paivana",
- "template_description": "Paivana paywall portal (GOA)",
+ "template_description": "Paivana paywall (GOA)",
"template_contract": {
"template_type": "paivana",
- "summary": "Access to paivana.hacktivism.ch portal",
+ "summary": "Access to paivana.hacktivism.ch",
"website_regex": ".*",
- "choices": [{ "amount": "GOA:42", "description": "Unlock portal (cryptpad / galene / silverbullet links)" }]
+ "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
}
}'
```
-goa-shop template `paivana` exposes multi-currency **choices**. Wallet/UI still only offers currencies the wallet holds. Live conf must use `instances/goa-shop/` + matching merchant token (not `goa-demo-*`).
-
## Docs
- https://docs.taler.net/taler-paivana-manual.html
diff --git a/configs/paivana/compose.yml b/configs/paivana/compose.yml
index 160cfb7..221ec41 100644
--- a/configs/paivana/compose.yml
+++ b/configs/paivana/compose.yml
@@ -1,45 +1,29 @@
-# koopa-paivana — shared image/secrets/entrypoint for portal + app paywalls
+# koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
# Live: /home/hernani/koopa-paivana/
-#
-# Public Caddy targets (unchanged):
-# 9025 → portal (paivana.hacktivism.ch)
-# 9028 → paywall silverbullet
-# 9029 → paywall galene
-# 9030 → paywall cryptpad
-# 9031 → paywall meet (Jitsi web)
-# App backends on pasta host IP (see app compose; not LAN 0.0.0.0):
-# 172.17.0.1:19128 / 19129 / 19130 / 19131
-
-x-paivana-common: &paivana-common
- image: localhost/koopa-paivana:latest
- restart: unless-stopped
- user: "1000:1000"
- userns_mode: keep-id
- extra_hosts:
- - "taler.hacktivism.ch:172.17.0.1"
- - "bank.hacktivism.ch:172.17.0.1"
- - "exchange.hacktivism.ch:172.17.0.1"
- volumes:
- - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
- - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
- - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
- - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
- labels:
- org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
-
services:
paivana:
- <<: *paivana-common
build:
context: .
dockerfile: Containerfile
+ image: localhost/koopa-paivana:latest
container_name: koopa-paivana
+ restart: unless-stopped
+ # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
+ user: "1000:1000"
+ userns_mode: keep-id
ports:
- "9025:9967"
- environment:
- PAIVANA_BASE_URL: https://paivana.hacktivism.ch/
- PAIVANA_DESTINATION_BASE_URL: http://upstream:8080/
+ extra_hosts:
+ # pasta publishes merchant on host :9010. Prefer fixed IPv4 — host-gateway
+ # alone still loses to public AAAA and times out from the container.
+ - "taler.hacktivism.ch:172.17.0.1"
+ - "bank.hacktivism.ch:172.17.0.1"
+ - "exchange.hacktivism.ch:172.17.0.1"
+ volumes:
+ - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
+ - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
+ - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
+ - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
depends_on:
- upstream
labels:
@@ -47,70 +31,10 @@ services:
org.hacktivism.host_port: "9025"
org.hacktivism.site: paivana.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
-
- # App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031.
- paivana-silverbullet:
- <<: *paivana-common
- container_name: koopa-paivana-silverbullet
- ports:
- - "9028:9967"
- environment:
- PAIVANA_BASE_URL: https://silverbullet.hacktivism.ch/
- PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19128/
- labels:
- org.hacktivism.service: paivana-silverbullet
- org.hacktivism.host_port: "9028"
- org.hacktivism.site: silverbullet.hacktivism.ch
- org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
-
- paivana-galene:
- <<: *paivana-common
- container_name: koopa-paivana-galene
- ports:
- - "9029:9967"
- environment:
- PAIVANA_BASE_URL: https://galene.hacktivism.ch/
- PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19129/
- labels:
- org.hacktivism.service: paivana-galene
- org.hacktivism.host_port: "9029"
- org.hacktivism.site: galene.hacktivism.ch
- org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
-
- paivana-cryptpad:
- <<: *paivana-common
- container_name: koopa-paivana-cryptpad
- ports:
- - "9030:9967"
- environment:
- PAIVANA_BASE_URL: https://cryptpad.hacktivism.ch/
- PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19130/
- labels:
- org.hacktivism.service: paivana-cryptpad
- org.hacktivism.host_port: "9030"
- org.hacktivism.site: cryptpad.hacktivism.ch
- org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
-
- paivana-meet:
- <<: *paivana-common
- container_name: koopa-paivana-meet
- ports:
- - "9031:9967"
- environment:
- PAIVANA_BASE_URL: https://meet.hacktivism.ch/
- PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19131/
- labels:
- org.hacktivism.service: paivana-meet
- org.hacktivism.host_port: "9031"
- org.hacktivism.site: meet.hacktivism.ch
- org.hacktivism.managed_by: koopa-admin
- org.hacktivism.currency: multi
+ org.hacktivism.currency: GOA
upstream:
+ # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
container_name: koopa-paivana-upstream
restart: unless-stopped
diff --git a/configs/paivana/conf/paivana.conf.template b/configs/paivana/conf/paivana.conf.template
index fe8996c..6dec110 100644
--- a/configs/paivana/conf/paivana.conf.template
+++ b/configs/paivana/conf/paivana.conf.template
@@ -1,14 +1,14 @@
-# Shared paivana-httpd conf — BASE/DEST injected by entrypoint (env).
-# Secrets injected from /run/secrets/
+# paivana.hacktivism.ch — paywall reverse proxy
+# Secrets injected by entrypoint from /run/secrets/
[paivana]
SERVE = tcp
PORT = 9967
BIND_TO = 0.0.0.0
-BASE_URL = @BASE_URL@
+BASE_URL = https://paivana.hacktivism.ch/
-DESTINATION_BASE_URL = @DESTINATION_BASE_URL@
+DESTINATION_BASE_URL = http://upstream:8080/
MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/
MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@
diff --git a/configs/paivana/entrypoint.sh b/configs/paivana/entrypoint.sh
index 56461e4..e751b47 100755
--- a/configs/paivana/entrypoint.sh
+++ b/configs/paivana/entrypoint.sh
@@ -5,10 +5,6 @@ SECRET_FILE="${PAIVANA_SECRET_FILE:-/run/secrets/paivana-secret}"
TEMPLATE="${PAIVANA_CONF_TEMPLATE:-/etc/paivana/paivana.conf.template}"
OUT="${PAIVANA_CONF:-/tmp/paivana.conf}"
-# Per-instance (portal + app paywalls share this entrypoint/image).
-BASE_URL="${PAIVANA_BASE_URL:-https://paivana.hacktivism.ch/}"
-DEST_URL="${PAIVANA_DESTINATION_BASE_URL:-http://upstream:8080/}"
-
if [ ! -r "$TOKEN_FILE" ]; then
echo "missing merchant token: $TOKEN_FILE" >&2
exit 1
@@ -21,12 +17,10 @@ fi
TOKEN=$(tr -d '\n\r' < "$TOKEN_FILE")
SECRET=$(tr -d '\n\r' < "$SECRET_FILE")
-awk -v t="$TOKEN" -v s="$SECRET" -v b="$BASE_URL" -v d="$DEST_URL" '
+awk -v t="$TOKEN" -v s="$SECRET" '
{
gsub(/@MERCHANT_ACCESS_TOKEN@/, t)
gsub(/@PAIVANA_SECRET@/, s)
- gsub(/@BASE_URL@/, b)
- gsub(/@DESTINATION_BASE_URL@/, d)
print
}
' "$TEMPLATE" > "$OUT"
diff --git a/configs/paivana/upstream/index.html b/configs/paivana/upstream/index.html
index fe9706b..064d3d7 100644
--- a/configs/paivana/upstream/index.html
+++ b/configs/paivana/upstream/index.html
@@ -3,7 +3,7 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- hacktivism tools
+Example site
- You paid once via GNU Taler / Paivana
- (template paivana on goa-shop: CHF / FLOODS / GOA / TESTPAYSAN choices).
- Site-wide access cookie is set for paivana.hacktivism.ch.
+ You paid GOA:4200 once via GNU Taler / Paivana.
+ This whole example site is now free for you to browse (site-wide access cookie).
-
diff --git a/configs/ports.md b/configs/ports.md
index d8febbe..52ca815 100644
--- a/configs/ports.md
+++ b/configs/ports.md
@@ -1,4 +1,4 @@
-# Port map (koopa)
+# Port map (see also host/overview/services.md)
| Port | Role |
|------|------|
@@ -7,44 +7,31 @@
| 443 | systemd `https-proxy.socket` → Caddy **9001** |
| 9000 | Caddy HTTP + ACME webroot |
| 9001 | Caddy HTTPS (vhosts) |
-| **9010** | `goa-regio-ng` merchant API (HTTPS in CTR) |
-| **9011** | `goa-regio-ng` exchange |
-| **9012** | `goa-regio-ng` libeufin-bank |
-| **9013–9015** | bank / exchange / merchant public landings (host nginx) |
-| 9020 | `koopa-castopod` → `castopod.hacktivism.ch` |
-| 9021 | `koopa-bonfire` → `bonfire.hacktivism.ch` |
-| 9022 | `koopa-prime` (Jellyfin) → `prime.hacktivism.ch` |
-| 9023 | qBittorrent WebUI → `bt.hacktivism.ch` |
-| **6881** | qBittorrent BT listen (tcp+udp; firewalld + VeciGate DNAT) |
-| **9024** | `koopa-forgejo` (HTTP) → **`git.hacktivism.ch`** |
-| **9025** | `koopa-paivana` → `paivana.hacktivism.ch` |
-| **9026** | `koopa-lemmy-proxy` → `lemmy.hacktivism.ch` |
-| **9027** | `koopa-decidim` → `decidim.hacktivism.ch` |
-| **9028** | `koopa-paivana-silverbullet` → `silverbullet.hacktivism.ch` |
-| **9029** | `koopa-paivana-galene` → `galene.hacktivism.ch` |
-| **9030** | `koopa-paivana-cryptpad` → `cryptpad.hacktivism.ch` |
-| **9031** | `koopa-paivana-meet` → `meet.hacktivism.ch` |
-| **9032** | `koopa-bbb-front` → `bbb.hacktivism.ch` |
-| **9200** | Forgejo git-SSH (host-direct; not Caddy) |
-| 9090–9092 | `koopa-tops-ng1`…`ng3` → `tops.ng{1,2,3}.hacktivism.ch` |
-| **8080** | host `tor.service` ORPort |
-| **9051** | host Tor ControlPort (loopback) |
+| 9010 | podman `taler-hacktivism` (merchant) |
+| 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) |
+| 9012 | podman `taler-hacktivism-bank` (libeufin-bank) |
+| 9013–9015 | bank / exchange / merchant public landings |
+| 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` |
+| 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |
+| 9022 | podman `koopa-prime` (Jellyfin) → Caddy `prime.hacktivism.ch` |
+| 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
+| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
+| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
+| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
+| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
+| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
+| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
+| 8080 | Tor ORPort |
VeciGate: WAN **80→9000**, WAN **443→9001**.
-Public apps: Caddy on **9001** → 127.0.0.1:{9010–9015, 9020–9032, 9090–9092}.
-Git SSH needs **9200/tcp** if exposed to WAN.
+Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.
+Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
-| UDP range | Role |
-|-----------|------|
-| **10000–10099/udp** | Galene WebRTC |
-
-| Extra | Role |
-|-------|------|
-| **1789** | `koopa-nym` mixnet |
-| **1790** | `koopa-nym` verloc |
-| **9080** | `koopa-nym` HTTP API |
-| **9180** | lab `goa-regio-ng` HTTP (loopback; `configs/lab-local/`) |
-| **9322** | lab `goa-regio-ng` SSH/ansible (loopback) |
-| **8288** | lab `mytops-local` HTTP (loopback) |
-
-login-health inventory: `scripts/login-health/koopa-login-health.sh`.
+| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
+| **1790** | podman **`koopa-nym`** verloc |
+| **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) |
+| **19000** | optional nym entry WS (gateway mode) |
+| **51822/udp** | optional nym WireGuard (dVPN path) |
+| **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) |
+| **9322** | lab **`goa-regio-ng`** SSH/ansible (loopback only) |
+| **8288** | lab **`mytops-local`** HTTP (loopback only) |
diff --git a/configs/prime/README.md b/configs/prime/README.md
index 5a81f79..2b0c287 100644
--- a/configs/prime/README.md
+++ b/configs/prime/README.md
@@ -6,7 +6,6 @@
| Compose | `compose.yml` (this dir; **no secret values**) |
| Jellyfin | **9022** → Caddy `prime.hacktivism.ch` |
| qBittorrent | **9023** → Caddy `bt.hacktivism.ch` |
-| BT listen | **6881** tcp+udp (firewalld + VeciGate DNAT); apply `scripts/prime/apply-qbittorrent-bt-net.sh` |
| Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` |
`WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in
diff --git a/configs/shared/landing-stack-versions.json b/configs/shared/landing-stack-versions.json
deleted file mode 100644
index a453057..0000000
--- a/configs/shared/landing-stack-versions.json
+++ /dev/null
@@ -1,79 +0,0 @@
-{
- "updated_iso": "2026-09-16T23:19:33+02:00",
- "updated_human": "2026-09-16 23:19 CEST",
- "ctr": "goa-regio-ng",
- "ssh": "hernani@192.168.100.95",
- "packages": {
- "libeufin-bank": {
- "dpkg": "1.6.10-0+trixie",
- "display": "1.6.10"
- },
- "libeufin-bank-webui": {
- "dpkg": "1.6.38-0+trixie",
- "display": "1.6.38"
- },
- "libeufin-common": {
- "dpkg": "1.6.10-0+trixie",
- "display": "1.6.10"
- },
- "libtalerexchange": {
- "dpkg": "1.6.15-0+trixie",
- "display": "1.6.15"
- },
- "libtalermerchant": {
- "dpkg": "1.6.23-0+trixie",
- "display": "1.6.23"
- },
- "taler-exchange": {
- "dpkg": "1.6.15-0+trixie",
- "display": "1.6.15"
- },
- "taler-exchange-database": {
- "dpkg": "1.6.15-0+trixie",
- "display": "1.6.15"
- },
- "taler-exchange-offline": {
- "dpkg": "1.6.15-0+trixie",
- "display": "1.6.15"
- },
- "taler-merchant": {
- "dpkg": "1.6.23-0+trixie",
- "display": "1.6.23"
- },
- "taler-merchant-webui": {
- "dpkg": "1.6.38-0+trixie",
- "display": "1.6.38"
- },
- "taler-terms-generator": {
- "dpkg": "1.6.15-0+trixie",
- "display": "1.6.15"
- }
- },
- "sites": {
- "bank": {
- "packages": {
- "libeufin-bank": "1.6.10",
- "libeufin-common": "1.6.10",
- "libeufin-bank-webui": "1.6.38"
- }
- },
- "exchange": {
- "packages": {
- "taler-exchange": "1.6.15",
- "libtalerexchange": "1.6.15",
- "taler-exchange-database": "1.6.15",
- "taler-exchange-offline": "1.6.15",
- "taler-terms-generator": "1.6.15"
- }
- },
- "merchant": {
- "packages": {
- "taler-merchant": "1.6.23",
- "taler-merchant-webui": "1.6.38",
- "libtalermerchant": "1.6.23",
- "libtalerexchange": "1.6.15",
- "taler-terms-generator": "1.6.15"
- }
- }
- }
-}
diff --git a/configs/shared/landing-stack.json b/configs/shared/landing-stack.json
deleted file mode 100644
index 0ab1749..0000000
--- a/configs/shared/landing-stack.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
- "note": "Stack-bar package lists per landing. Versions filled by scripts/taler-landing/stamp-landing-stack.sh from live CTR dpkg. Only hard link = vanilla branch.",
- "vanilla_href": "https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla",
- "vanilla_title": "taler-deployment branch dev/hernani/goa-regio-ng-vanilla",
- "sites": {
- "bank": {
- "title": "Taler software on this bank service (goa-regio-ng vanilla)",
- "packages": [
- "libeufin-bank",
- "libeufin-common",
- "libeufin-bank-webui"
- ]
- },
- "exchange": {
- "title": "Taler software on this exchange service (goa-regio-ng vanilla)",
- "packages": [
- "taler-exchange",
- "libtalerexchange",
- "taler-exchange-database",
- "taler-exchange-offline",
- "taler-terms-generator"
- ]
- },
- "merchant": {
- "title": "Taler software on this merchant service (goa-regio-ng vanilla)",
- "packages": [
- "taler-merchant",
- "taler-merchant-webui",
- "libtalermerchant",
- "libtalerexchange",
- "taler-terms-generator"
- ]
- }
- }
-}
diff --git a/configs/shared/landing-version.json b/configs/shared/landing-version.json
index 59af0fd..722ff4e 100644
--- a/configs/shared/landing-version.json
+++ b/configs/shared/landing-version.json
@@ -2,34 +2,34 @@
"note": "Per-site landing content versions (start 42). Bump: scripts/taler-landing/stamp-landing-version.sh --bump bank|exchange|merchant",
"sites": {
"bank": {
- "version": 45,
+ "version": 44,
"label": "Bank landing",
"path": "configs/bank-landing",
- "updated_iso": "2026-09-16T23:19:33+02:00",
- "updated_human": "2026-09-16 23:19 CEST",
- "commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6",
- "commit_short": "0d881cd",
- "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6"
+ "updated_iso": "2026-07-17T18:31:49+02:00",
+ "updated_human": "2026-07-17 18:31 CEST",
+ "commit": "689ee595e08f3880c1e4068aac8e972574e20d21",
+ "commit_short": "689ee59",
+ "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/689ee595e08f3880c1e4068aac8e972574e20d21"
},
"exchange": {
- "version": 44,
+ "version": 43,
"label": "Exchange landing",
"path": "configs/exchange-landing",
- "updated_iso": "2026-09-16T23:19:33+02:00",
- "updated_human": "2026-09-16 23:19 CEST",
- "commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6",
- "commit_short": "0d881cd",
- "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6"
+ "updated_iso": "2026-07-17T18:33:13+02:00",
+ "updated_human": "2026-07-17 18:33 CEST",
+ "commit": "d0594cb44ffb1bec2e009f6812167cbbf216eda9",
+ "commit_short": "d0594cb",
+ "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/d0594cb44ffb1bec2e009f6812167cbbf216eda9"
},
"merchant": {
- "version": 43,
+ "version": 42,
"label": "Merchant landing",
"path": "configs/merchant-landing",
- "updated_iso": "2026-09-16T23:19:33+02:00",
- "updated_human": "2026-09-16 23:19 CEST",
- "commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6",
- "commit_short": "0d881cd",
- "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6"
+ "updated_iso": "2026-07-17T18:27:48+02:00",
+ "updated_human": "2026-07-17 18:27 CEST",
+ "commit": "37ea4bb8396691e3ea69ae61374e6623bf6c5ea7",
+ "commit_short": "37ea4bb",
+ "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/37ea4bb8396691e3ea69ae61374e6623bf6c5ea7"
}
}
}
diff --git a/configs/systemd/user/container-koopa-paivana.service.d/order.conf b/configs/systemd/user/container-koopa-paivana.service.d/order.conf
index 92b7e6f..c0678cc 100644
--- a/configs/systemd/user/container-koopa-paivana.service.d/order.conf
+++ b/configs/systemd/user/container-koopa-paivana.service.d/order.conf
@@ -1,4 +1,4 @@
[Unit]
# Paivana needs merchant private API — start after merchant apps, not only container shell
-After=taler-merchant-apps.service goa-regio-ng.service
+After=taler-merchant-apps.service container-taler-hacktivism.service
Wants=taler-merchant-apps.service
diff --git a/configs/systemd/user/container-koopa-tor-relay.service b/configs/systemd/user/container-koopa-tor-relay.service
deleted file mode 100644
index b65e1ce..0000000
--- a/configs/systemd/user/container-koopa-tor-relay.service
+++ /dev/null
@@ -1,21 +0,0 @@
-# container-koopa-tor-relay.service — regenerated by tor.sh 2026-10-24T21:47:24+02:00
-# Prefer simple over podman-generate-systemd forking+PIDFile (stale CID storm).
-
-[Unit]
-Description=Podman koopa-tor-relay
-Wants=network-online.target
-After=network-online.target
-RequiresMountsFor=%t/containers
-
-[Service]
-Environment=PODMAN_SYSTEMD_UNIT=%n
-Restart=always
-RestartSec=5
-TimeoutStartSec=120
-TimeoutStopSec=70
-ExecStart=/usr/bin/podman start --attach koopa-tor-relay
-ExecStop=/usr/bin/podman stop -t 10 koopa-tor-relay
-Type=simple
-
-[Install]
-WantedBy=default.target
diff --git a/configs/systemd/user/dossiers-ngi-branch-status.service b/configs/systemd/user/dossiers-ngi-branch-status.service
deleted file mode 100644
index 971c93b..0000000
--- a/configs/systemd/user/dossiers-ngi-branch-status.service
+++ /dev/null
@@ -1,25 +0,0 @@
-[Unit]
-Description=dossiers.ngi branch-status JSON + on-demand edition rebuild
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/README.md
-After=default.target
-
-[Service]
-Type=oneshot
-Nice=10
-RemainAfterExit=no
-# Full freezes per changed tip can take a while; skip overlap via flock
-TimeoutStartSec=1h
-Environment=TZ=Europe/Zurich
-Environment=ADMIN_LOG=%h/src/koopa/koopa-admin-log
-Environment=TDPD_ROOT=%h/git/src/ngi/tech-dossier-project-data
-Environment=OUT=/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/branch-status.json
-Environment=EDITIONS_ROOT=/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/editions
-# Rebuild only when current tip freeze_ok is not already true (never force from timer)
-Environment=REBUILD=1
-EnvironmentFile=-%h/.config/dossiers-ngi/branch-status.env
-# flock -n: second fire while busy exits 0 without stacking garbage
-ExecStart=/usr/bin/flock -n %t/dossiers-ngi-branch-status.lock /usr/bin/python3 %h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/branch-status-hourly.py --rebuild
-SuccessExitStatus=0 1
-
-[Install]
-WantedBy=default.target
diff --git a/configs/systemd/user/dossiers-ngi-branch-status.timer b/configs/systemd/user/dossiers-ngi-branch-status.timer
deleted file mode 100644
index ba283a6..0000000
--- a/configs/systemd/user/dossiers-ngi-branch-status.timer
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=Timer · dossiers.ngi branch-status JSON (every 10 min)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/README.md
-
-[Timer]
-OnBootSec=3min
-OnUnitActiveSec=10min
-AccuracySec=1min
-RandomizedDelaySec=30
-Persistent=true
-Unit=dossiers-ngi-branch-status.service
-
-[Install]
-WantedBy=timers.target
diff --git a/configs/systemd/user/goa-regio-ng.service b/configs/systemd/user/goa-regio-ng.service
deleted file mode 100644
index ace6f55..0000000
--- a/configs/systemd/user/goa-regio-ng.service
+++ /dev/null
@@ -1,15 +0,0 @@
-[Unit]
-Description=goa-regio-ng Taler AIO container (vanilla live 9010-9015)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-shared/goa-regio-ng/README.md
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-TimeoutStartSec=120
-ExecStart=/usr/bin/podman start goa-regio-ng
-ExecStop=/usr/bin/podman stop -t 20 goa-regio-ng
-
-[Install]
-WantedBy=default.target
diff --git a/configs/systemd/user/goa-regio-ng.service.d/apps.conf b/configs/systemd/user/goa-regio-ng.service.d/apps.conf
deleted file mode 100644
index 332262d..0000000
--- a/configs/systemd/user/goa-regio-ng.service.d/apps.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-[Unit]
-# Pull in in-container bank/merchant apps after the AIO shell is up
-Wants=taler-bank-apps.service taler-merchant-apps.service
-Before=taler-bank-apps.service taler-merchant-apps.service
diff --git a/configs/systemd/user/koopa-amanita-probe.service b/configs/systemd/user/koopa-amanita-probe.service
deleted file mode 100644
index 508003f..0000000
--- a/configs/systemd/user/koopa-amanita-probe.service
+++ /dev/null
@@ -1,16 +0,0 @@
-[Unit]
-Description=External amanita freeze probe (ICMP+SSH last-alive)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/amanita-probe/README.md
-After=default.target
-
-[Service]
-Type=oneshot
-ExecStart=%h/.local/bin/koopa-amanita-probe once
-# Probe outcomes are data in the log; never fail the timer
-SuccessExitStatus=0 1
-Nice=10
-IOSchedulingClass=best-effort
-IOSchedulingPriority=6
-
-[Install]
-WantedBy=default.target
diff --git a/configs/systemd/user/koopa-amanita-probe.timer b/configs/systemd/user/koopa-amanita-probe.timer
deleted file mode 100644
index 049fee7..0000000
--- a/configs/systemd/user/koopa-amanita-probe.timer
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Timer · external amanita probe (~15s)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/amanita-probe/README.md
-
-[Timer]
-OnBootSec=30s
-OnUnitActiveSec=15s
-AccuracySec=5s
-Persistent=false
-Unit=koopa-amanita-probe.service
-
-[Install]
-WantedBy=timers.target
diff --git a/configs/systemd/user/koopa-firecuda-probe.service b/configs/systemd/user/koopa-firecuda-probe.service
deleted file mode 100644
index 5a672e9..0000000
--- a/configs/systemd/user/koopa-firecuda-probe.service
+++ /dev/null
@@ -1,16 +0,0 @@
-[Unit]
-Description=External firecuda crash probe (ICMP+SSH last-alive)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/firecuda-probe/README.md
-After=default.target
-
-[Service]
-Type=oneshot
-ExecStart=%h/.local/bin/koopa-firecuda-probe once
-# Probe outcomes are data in the log; never fail the timer
-SuccessExitStatus=0 1
-Nice=10
-IOSchedulingClass=best-effort
-IOSchedulingPriority=6
-
-[Install]
-WantedBy=default.target
diff --git a/configs/systemd/user/koopa-firecuda-probe.timer b/configs/systemd/user/koopa-firecuda-probe.timer
deleted file mode 100644
index 25f6712..0000000
--- a/configs/systemd/user/koopa-firecuda-probe.timer
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Timer · external firecuda probe (~15s)
-Documentation=file:%h/src/koopa/koopa-admin-log/scripts/firecuda-probe/README.md
-
-[Timer]
-OnBootSec=30s
-OnUnitActiveSec=15s
-AccuracySec=5s
-Persistent=false
-Unit=koopa-firecuda-probe.service
-
-[Install]
-WantedBy=timers.target
diff --git a/configs/systemd/user/taler-bank-apps.service b/configs/systemd/user/taler-bank-apps.service
index 0dada1f..7eb3ef2 100644
--- a/configs/systemd/user/taler-bank-apps.service
+++ b/configs/systemd/user/taler-bank-apps.service
@@ -1,14 +1,13 @@
[Unit]
-Description=Start Taler bank apps inside goa-regio-ng (auto-confirm + demo-withdraw)
+Description=Start Taler bank apps inside taler-hacktivism-bank
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-shared/ensure-taler-apps.sh
-After=network-online.target goa-regio-ng.service
-Wants=network-online.target goa-regio-ng.service
+After=network-online.target container-taler-hacktivism-bank.service
+Wants=network-online.target container-taler-hacktivism-bank.service
[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutStartSec=300
-EnvironmentFile=-%h/.config/taler-landing/stack.env
ExecStart=%h/.local/bin/ensure-taler-apps.sh bank
[Install]
diff --git a/configs/systemd/user/taler-landing-stats.service b/configs/systemd/user/taler-landing-stats.service
index f9e49b5..cc6bd88 100644
--- a/configs/systemd/user/taler-landing-stats.service
+++ b/configs/systemd/user/taler-landing-stats.service
@@ -3,8 +3,8 @@ Description=Taler landing stats (bank full scan + exchange/merchant)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-landing/README.md
After=network-online.target
Wants=network-online.target
-# Prefer after AIO container + in-container apps are up
-After=goa-regio-ng.service
+# Prefer after containers are up (ignore if unit names differ)
+After=container-taler-hacktivism-bank.service container-taler-hacktivism.service
After=taler-bank-apps.service taler-merchant-apps.service
[Service]
diff --git a/configs/systemd/user/taler-landing-stats.timer b/configs/systemd/user/taler-landing-stats.timer
index 2fc1d21..7106c8a 100644
--- a/configs/systemd/user/taler-landing-stats.timer
+++ b/configs/systemd/user/taler-landing-stats.timer
@@ -1,11 +1,11 @@
[Unit]
-Description=Timer · Taler landing stats (every 4h)
+Description=Timer · Taler landing stats (every 2 min)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-landing/README.md
[Timer]
OnBootSec=90s
-OnUnitActiveSec=4h
-AccuracySec=5min
+OnUnitActiveSec=2min
+AccuracySec=20s
Persistent=true
Unit=taler-landing-stats.service
diff --git a/configs/systemd/user/taler-merchant-apps.service b/configs/systemd/user/taler-merchant-apps.service
index e4d24bc..22deacd 100644
--- a/configs/systemd/user/taler-merchant-apps.service
+++ b/configs/systemd/user/taler-merchant-apps.service
@@ -1,15 +1,14 @@
[Unit]
-Description=Start Taler merchant apps inside goa-regio-ng
+Description=Start Taler merchant apps inside taler-hacktivism
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-shared/ensure-taler-apps.sh
-After=network-online.target goa-regio-ng.service
-Wants=network-online.target goa-regio-ng.service
+After=network-online.target container-taler-hacktivism.service
+Wants=network-online.target container-taler-hacktivism.service
[Service]
Type=oneshot
RemainAfterExit=yes
# Merchant start_base + helpers can take a while after cold boot
TimeoutStartSec=300
-EnvironmentFile=-%h/.config/taler-landing/stack.env
ExecStart=%h/.local/bin/ensure-taler-apps.sh merchant
[Install]
diff --git a/configs/tor/Containerfile b/configs/tor/Containerfile
new file mode 100644
index 0000000..0e1fb31
--- /dev/null
+++ b/configs/tor/Containerfile
@@ -0,0 +1,18 @@
+# koopa-tor-relay — Tor non-exit relay
+# Process is NOT root: debian-tor remapped to uid/gid 1000 for rootless
+# podman + host volumes (~/koopa-tor-relay/{data,log} owned by hernani).
+# Recreate container with: --user 1000:1000 --userns=keep-id (see README).
+FROM docker.io/library/debian:stable-slim
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends tor nyx ca-certificates tor-geoipdb \
+ && rm -rf /var/lib/apt/lists/* \
+ && mkdir -p /var/lib/tor /var/log/tor \
+ && groupmod --gid 1000 debian-tor \
+ && usermod --uid 1000 --gid 1000 debian-tor \
+ && chown -R debian-tor:debian-tor /var/lib/tor /var/log/tor \
+ && chmod 700 /var/lib/tor
+EXPOSE 8080 9051
+USER debian-tor:debian-tor
+ENTRYPOINT ["/usr/bin/tor"]
+CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]
diff --git a/configs/tor/README.md b/configs/tor/README.md
new file mode 100644
index 0000000..4f618f6
--- /dev/null
+++ b/configs/tor/README.md
@@ -0,0 +1,64 @@
+# Tor relay — koopa (`KoopaRelay`)
+
+Live: **podman** container **`koopa-tor-relay`** (rootless hernani, `--network host`).
+Host layout: `~/koopa-tor-relay/{torrc,data,log,build}`.
+Mirror in this repo: `configs/tor/`.
+
+| Setting | Value |
+|---------|--------|
+| Nickname | `KoopaRelay` |
+| Fingerprint | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` |
+| ORPort | **8080** (IPv4 + IPv6; VeciGate WAN DNAT → koopa:8080) |
+| ControlPort | **127.0.0.1:9051** |
+| ExitRelay | **0** (non-exit) |
+| SocksPort | **0** |
+| MyFamily | `52BB94DDC1292F950CF728708AC48523E018A718` |
+| Bandwidth* | 2000 MBytes rate/burst |
+| Image | `localhost/koopa-tor-relay:latest` (Debian stable + tor + nyx) |
+| Process user | **non-root** `debian-tor` remapped to **uid/gid 1000** (`USER` in image) |
+| Rootless note | recreate with `--user 1000:1000 --userns=keep-id` so `~/koopa-tor-relay/data` (hernani) stays writable |
+
+## Files
+
+| File | Role |
+|------|------|
+| `torrc` | Active policy (mounted read-only into container) |
+| `Containerfile` | Image build (tor, nyx, tor-geoipdb); **not** root process |
+| `create-container.sh` | Recreate container non-root + host net + volume mounts |
+| `migrate-identity.sh` | One-shot copy of `/var/lib/tor` → container data (same identity) |
+| `container-koopa-tor-relay.service` | systemd --user unit template |
+| `torrc.minimal` / `torrc.sample` | Distro templates (reference) |
+
+## Ops
+
+```bash
+# build image + recreate non-root container (as hernani)
+cd ~/koopa-tor-relay/build # or configs/tor mirror
+podman build -t localhost/koopa-tor-relay:latest -f Containerfile .
+./create-container.sh # or: bash configs/tor/create-container.sh
+podman start koopa-tor-relay
+systemctl --user enable --now container-koopa-tor-relay.service
+
+# status
+podman ps --filter name=koopa-tor-relay
+podman exec koopa-tor-relay id # expect uid=1000(debian-tor)
+systemctl --user status container-koopa-tor-relay
+ss -lntp | grep -E '8080|9051'
+tail -f ~/koopa-tor-relay/log/notices.log
+
+# monitor
+podman exec -it koopa-tor-relay nyx
+```
+
+### Cutover (host package → container)
+
+1. `sudo systemctl stop tor && sudo systemctl disable tor` (prefer `mask` so it never returns)
+2. `sudo ~/koopa-tor-relay/migrate-identity.sh` (or copy of this script)
+3. `podman start koopa-tor-relay` / user unit enable
+4. Confirm fingerprint and ORPort reachability
+
+Do **not** run host `tor.service` and the container at the same time.
+
+Monitoring helpers: `scripts/monitoring/tor_*.sh`.
+Firewall: `configs/firewalld/public-ports.md` (**8080/tcp**).
+Router: `../vecigate-admin-log` (WAN :8080 → koopa).
diff --git a/configs/tor/build/Containerfile b/configs/tor/build/Containerfile
deleted file mode 100644
index c57a137..0000000
--- a/configs/tor/build/Containerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-# koopa-tor-relay — Tor non-exit relay on CachyOS (Arch extra/tor)
-# Same pattern as koopa-meet-web:cachyos. Rootless: tor user -> uid/gid 1000.
-# Recreate: --user 1000:1000 --userns=keep-id (see README / tor.sh)
-ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
-FROM ${CACHYOS_IMAGE}
-ENV TZ=Europe/Zurich
-RUN pacman -Syu --noconfirm --needed tor nyx ca-certificates \
- && pacman -Scc --noconfirm \
- && rm -rf /var/cache/pacman/pkg/* /tmp/* \
- && mkdir -p /var/lib/tor /var/log/tor \
- && if id tor >/dev/null 2>&1; then \
- groupmod -g 1000 tor 2>/dev/null || true; \
- usermod -u 1000 -g 1000 tor 2>/dev/null || true; \
- elif id debian-tor >/dev/null 2>&1; then \
- groupmod -g 1000 debian-tor; usermod -u 1000 -g 1000 debian-tor; \
- else \
- groupadd -g 1000 tor; useradd -u 1000 -g 1000 -d /var/lib/tor -s /usr/bin/nologin tor; \
- fi \
- && chown -R 1000:1000 /var/lib/tor /var/log/tor \
- && chmod 700 /var/lib/tor
-EXPOSE 8080 9051
-USER 1000:1000
-ENTRYPOINT ["/usr/bin/tor"]
-CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]
diff --git a/configs/tor/container-koopa-tor-relay.service b/configs/tor/container-koopa-tor-relay.service
new file mode 100644
index 0000000..051b56e
--- /dev/null
+++ b/configs/tor/container-koopa-tor-relay.service
@@ -0,0 +1,28 @@
+# container-koopa-tor-relay.service
+# Install on koopa as hernani:
+# mkdir -p ~/.config/systemd/user
+# cp configs/tor/container-koopa-tor-relay.service ~/.config/systemd/user/
+# systemctl --user daemon-reload
+# systemctl --user enable --now container-koopa-tor-relay.service
+# Requires: loginctl enable-linger hernani (root, once)
+#
+# autogenerated by Podman 5.8.3 (paths are host-specific; regenerate if container id changes)
+
+[Unit]
+Description=Podman container-koopa-tor-relay.service
+Documentation=man:podman-generate-systemd(1)
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=/run/user/1000/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=always
+TimeoutStopSec=70
+ExecStart=/usr/bin/podman start koopa-tor-relay
+ExecStop=/usr/bin/podman stop -t 10 koopa-tor-relay
+ExecStopPost=/usr/bin/podman stop -t 10 koopa-tor-relay
+Type=forking
+
+[Install]
+WantedBy=default.target
diff --git a/configs/tor/create-container.sh b/configs/tor/create-container.sh
new file mode 100755
index 0000000..2f7156a
--- /dev/null
+++ b/configs/tor/create-container.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# Recreate koopa-tor-relay as non-root (uid 1000) under rootless podman keep-id.
+# Run as hernani on koopa (not root). Stops/removes existing container first.
+set -euo pipefail
+
+NAME=koopa-tor-relay
+IMAGE="${TOR_IMAGE:-localhost/koopa-tor-relay:latest}"
+BASE="${KOOPA_TOR_BASE:-$HOME/koopa-tor-relay}"
+
+if [[ ! -f "$BASE/torrc" ]]; then
+ echo "ERROR: missing $BASE/torrc" >&2
+ exit 1
+fi
+mkdir -p "$BASE/data" "$BASE/log"
+# Host ownership: hernani (uid 1000) ↔ container debian-tor (uid 1000) via keep-id
+chmod 700 "$BASE/data" 2>/dev/null || true
+
+if podman ps -a --format '{{.Names}}' | grep -qx "$NAME"; then
+ podman stop "$NAME" 2>/dev/null || true
+ podman rm "$NAME"
+fi
+
+podman create \
+ --name "$NAME" \
+ --replace \
+ --network host \
+ --user 1000:1000 \
+ --userns keep-id \
+ --restart unless-stopped \
+ -v "$BASE/torrc:/etc/tor/torrc:ro" \
+ -v "$BASE/data:/var/lib/tor:Z" \
+ -v "$BASE/log:/var/log/tor:Z" \
+ --label org.hacktivism.service=tor \
+ --label org.hacktivism.container=koopa-tor-relay \
+ --label org.hacktivism.managed_by=koopa-admin \
+ "$IMAGE"
+
+echo "created $NAME (user 1000:1000, userns=keep-id, host net)"
+echo "start: podman start $NAME # or systemctl --user start container-koopa-tor-relay"
diff --git a/configs/tor/migrate-identity.sh b/configs/tor/migrate-identity.sh
new file mode 100755
index 0000000..344fddd
--- /dev/null
+++ b/configs/tor/migrate-identity.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# Copy host Tor identity → container data. Works with: sudo ./migrate-identity.sh
+set -euo pipefail
+
+if [[ "$(id -u)" -ne 0 ]]; then
+ exec sudo -H "$0" "$@"
+fi
+
+OWNER="${SUDO_USER:-hernani}"
+if [[ "$OWNER" == root ]]; then OWNER=hernani; fi
+BASE="$(getent passwd "$OWNER" | cut -d: -f6)/koopa-tor-relay"
+SRC=/var/lib/tor
+DST="$BASE/data"
+
+if [[ ! -d "$BASE" ]]; then
+ echo "ERROR: missing $BASE" >&2
+ exit 1
+fi
+if systemctl is-active --quiet tor 2>/dev/null; then
+ echo "ERROR: stop host tor first: systemctl stop tor" >&2
+ exit 1
+fi
+if command -v podman >/dev/null 2>&1; then
+ if runuser -u "$OWNER" -- podman ps --format "{{.Names}}" 2>/dev/null | grep -qx koopa-tor-relay; then
+ echo "ERROR: stop container first: podman stop koopa-tor-relay" >&2
+ exit 1
+ fi
+fi
+
+echo "Copying $SRC → $DST (identity keys as $OWNER)…"
+mkdir -p "$DST"
+rsync -aHAX --delete "$SRC"/ "$DST"/
+chown -R "${OWNER}:${OWNER}" "$DST"
+chmod 700 "$DST"
+
+echo "--- fingerprint ---"
+[[ -f "$DST/fingerprint" ]] && cat "$DST/fingerprint" || echo "(no fingerprint file yet)"
+[[ -f "$DST/fingerprint-ed25519" ]] && cat "$DST/fingerprint-ed25519" || true
+echo "OK — $DST ready. Then: podman start koopa-tor-relay"
diff --git a/configs/tor/torrc b/configs/tor/torrc
index 9f1705f..63cd8cf 100644
--- a/configs/tor/torrc
+++ b/configs/tor/torrc
@@ -1,13 +1,11 @@
-# KoopaRelay — same policy as live /etc/tor/torrc + admin-log configs/tor/torrc
-# Identity: keys in DataDirectory (migrate from host /var/lib/tor)
+# KoopaRelay — active policy (podman koopa-tor-relay, host network)
+# Live paths: ~/koopa-tor-relay/{torrc,data,log} on koopa
Log notice file /var/log/tor/notices.log
Nickname KoopaRelay
ContactInfo info+koopa@hacktivism.ch
-# dual-stack: bind all addresses on 8080 (IPv4 + IPv6), same as host tor
+# dual-stack ORPort (IPv4 + IPv6)
ORPort 8080
ControlPort 127.0.0.1:9051
-CookieAuthentication 1
-CookieAuthFile /var/lib/tor/control_auth_cookie
ExitRelay 0
SocksPort 0
MyFamily 52BB94DDC1292F950CF728708AC48523E018A718
diff --git a/configs/tor/torrc.minimal b/configs/tor/torrc.minimal
new file mode 100644
index 0000000..a05f52c
--- /dev/null
+++ b/configs/tor/torrc.minimal
@@ -0,0 +1,192 @@
+## Configuration file for a typical Tor user
+## Last updated 9 October 2013 for Tor 0.2.5.2-alpha.
+## (may or may not work for much older or much newer versions of Tor.)
+##
+## Lines that begin with "## " try to explain what's going on. Lines
+## that begin with just "#" are disabled commands: you can enable them
+## by removing the "#" symbol.
+##
+## See 'man tor', or https://www.torproject.org/docs/tor-manual.html,
+## for more options you can use in this file.
+##
+## Tor will look for this file in various places based on your platform:
+## https://www.torproject.org/docs/faq#torrc
+
+## Tor opens a socks proxy on port 9050 by default -- even if you don't
+## configure one below. Set "SocksPort 0" if you plan to run Tor only
+## as a relay, and not make any local application connections yourself.
+#SocksPort 9050 # Default: Bind to localhost:9050 for local connections.
+#SocksPort 192.168.0.1:9100 # Bind to this address:port too.
+
+## Entry policies to allow/deny SOCKS requests based on IP address.
+## First entry that matches wins. If no SocksPolicy is set, we accept
+## all (and only) requests that reach a SocksPort. Untrusted users who
+## can access your SocksPort may be able to learn about the connections
+## you make.
+#SocksPolicy accept 192.168.0.0/16
+#SocksPolicy reject *
+
+## Logs go to stdout at level "notice" unless redirected by something
+## else, like one of the below lines. You can have as many Log lines as
+## you want.
+##
+## We advise using "notice" in most cases, since anything more verbose
+## may provide sensitive information to an attacker who obtains the logs.
+##
+## Send all messages of level 'notice' or higher to /var/log/tor/notices.log
+#Log notice file /var/log/tor/notices.log
+## Send every possible message to /var/log/tor/debug.log
+#Log debug file /var/log/tor/debug.log
+## Use the system log instead of Tor's logfiles
+#Log notice syslog
+## To send all messages to stderr:
+#Log debug stderr
+
+## Uncomment this to start the process in the background... or use
+## --runasdaemon 1 on the command line. This is ignored on Windows;
+## see the FAQ entry if you want Tor to run as an NT service.
+#RunAsDaemon 1
+
+## The directory for keeping all the keys/etc. By default, we store
+## things in $HOME/.tor on Unix, and in Application Data\tor on Windows.
+#DataDirectory /var/lib/tor
+
+## The port on which Tor will listen for local connections from Tor
+## controller applications, as documented in control-spec.txt.
+#ControlPort 9051
+## If you enable the controlport, be sure to enable one of these
+## authentication methods, to prevent attackers from accessing it.
+#HashedControlPassword 16:872860B76453A77D60CA2BB8C1A7042072093276A3D701AD684053EC4C
+#CookieAuthentication 1
+
+############### This section is just for location-hidden services ###
+
+## Once you have configured a hidden service, you can look at the
+## contents of the file ".../hidden_service/hostname" for the address
+## to tell people.
+##
+## HiddenServicePort x y:z says to redirect requests on port x to the
+## address y:z.
+
+#HiddenServiceDir /var/lib/tor/hidden_service/
+#HiddenServicePort 80 127.0.0.1:80
+
+#HiddenServiceDir /var/lib/tor/other_hidden_service/
+#HiddenServicePort 80 127.0.0.1:80
+#HiddenServicePort 22 127.0.0.1:22
+
+################ This section is just for relays #####################
+#
+## See https://www.torproject.org/docs/tor-doc-relay for details.
+
+## Required: what port to advertise for incoming Tor connections.
+#ORPort 9001
+## If you want to listen on a port other than the one advertised in
+## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as
+## follows. You'll need to do ipchains or other port forwarding
+## yourself to make this work.
+#ORPort 443 NoListen
+#ORPort 127.0.0.1:9090 NoAdvertise
+
+## The IP address or full DNS name for incoming connections to your
+## relay. Leave commented out and Tor will guess.
+#Address noname.example.com
+
+## If you have multiple network interfaces, you can specify one for
+## outgoing traffic to use.
+# OutboundBindAddress 10.0.0.5
+
+## A handle for your relay, so people don't have to refer to it by key.
+#Nickname ididnteditheconfig
+
+## Define these to limit how much relayed traffic you will allow. Your
+## own traffic is still unthrottled. Note that RelayBandwidthRate must
+## be at least 20 KB.
+## Note that units for these config options are bytes per second, not bits
+## per second, and that prefixes are binary prefixes, i.e. 2^10, 2^20, etc.
+#RelayBandwidthRate 100 KB # Throttle traffic to 100KB/s (800Kbps)
+#RelayBandwidthBurst 200 KB # But allow bursts up to 200KB/s (1600Kbps)
+
+## Use these to restrict the maximum traffic per day, week, or month.
+## Note that this threshold applies separately to sent and received bytes,
+## not to their sum: setting "4 GB" may allow up to 8 GB total before
+## hibernating.
+##
+## Set a maximum of 4 gigabytes each way per period.
+#AccountingMax 4 GB
+## Each period starts daily at midnight (AccountingMax is per day)
+#AccountingStart day 00:00
+## Each period starts on the 3rd of the month at 15:00 (AccountingMax
+## is per month)
+#AccountingStart month 3 15:00
+
+## Administrative contact information for this relay or bridge. This line
+## can be used to contact you if your relay or bridge is misconfigured or
+## something else goes wrong. Note that we archive and publish all
+## descriptors containing these lines and that Google indexes them, so
+## spammers might also collect them. You may want to obscure the fact that
+## it's an email address and/or generate a new address for this purpose.
+#ContactInfo Random Person Notes
+What this demonstrates
-
-
- One Paivana process = one
DESTINATION_BASE_URL→ this portal is the gated upstream.
- - Merchant:
goa-shop· templatepaivana(multi-currency choices).
- - Host:
https://paivana.hacktivism.ch/
+ - Paywall:
paivana-httpdin front of a normal upstream HTTP site
+ - Currency: exploration money
GOAon exchange.hacktivism.ch
+ - After payment: no further charge for pages behind this proxy
Host: https://paivana.hacktivism.ch/
edition pending
\n", - encoding="utf-8", - ) - tip_path = dest / ".edition-tip" - if not tip_path.exists(): - tip_path.write_text(tip + "\n", encoding="utf-8") - - -def tip_recorded(editions: Path, slug: str) -> str: - p = editions / slug / ".edition-tip" - if not p.is_file(): - return "" - return p.read_text(encoding="utf-8").strip() - - - -def diff_numstat(repo: Path, a: str, b: str) -> tuple[int, int]: - """Insertions/deletions of b vs a (git diff --numstat).""" - if not a or not b or a == b: - return 0, 0 - cp = git(repo, "diff", "--numstat", a, b, check=False) - if cp.returncode != 0: - return 0, 0 - plus = minus = 0 - for line in (cp.stdout or "").splitlines(): - parts = line.split(" ") - if len(parts) < 3: - continue - a, d = parts[0], parts[1] - if a == "-" or d == "-": - continue - try: - plus += int(a) - minus += int(d) - except ValueError: - continue - return plus, minus - - -def empty_tree_oid(repo: Path) -> str: - cp = git(repo, "hash-object", "-t", "tree", "/dev/null") - return (cp.stdout or "").strip() - - -def loc_at_tip(repo: Path, tip: str, empty: str) -> int: - """Text-file line count of tip vs the empty tree.""" - plus, _ = diff_numstat(repo, empty, tip) - return plus - - -def tip_commit_time(repo: Path, tip: str) -> str: - """Committer ISO time of tip (empty on failure).""" - cp = git(repo, "log", "-1", "--format=%cI", tip, check=False) - if cp.returncode != 0: - return "" - return (cp.stdout or "").strip() - - -def read_build_meta(editions: Path, slug: str) -> dict: - dest = editions / slug - out: dict = {} - at = dest / ".edition-built-at" - sec = dest / ".edition-build-seconds" - if at.is_file(): - out["built_at"] = at.read_text(encoding="utf-8").strip() - if sec.is_file(): - raw = sec.read_text(encoding="utf-8").strip() - try: - out["build_seconds"] = float(raw) - except ValueError: - pass - return out - - -def write_build_meta(editions: Path, slug: str, seconds: float) -> None: - dest = editions / slug - dest.mkdir(parents=True, exist_ok=True) - now = datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds") - (dest / ".edition-built-at").write_text(now + "\n", encoding="utf-8") - (dest / ".edition-build-seconds").write_text(f"{seconds:.3f}\n", encoding="utf-8") - - -def write_freeze_status(editions: Path, slug: str, ok: bool, error: str = "") -> None: - dest = editions / slug - dest.mkdir(parents=True, exist_ok=True) - (dest / ".edition-freeze-ok").write_text("1\n" if ok else "0\n", encoding="utf-8") - errp = dest / ".edition-freeze-error" - if ok or not error: - if errp.exists(): - errp.unlink() - return - errp.write_text(error[:500] + "\n", encoding="utf-8") - - -def freeze_ok_for(editions: Path | None, slug: str, tip_full: str) -> tuple[bool, str]: - """Current origin tip freeze succeeded (green ✓) or not (red ✗).""" - if editions is None or not tip_full: - return False, "" - dest = editions / slug - err = "" - errp = dest / ".edition-freeze-error" - if errp.is_file(): - err = errp.read_text(encoding="utf-8").strip() - recorded = tip_recorded(editions, slug) - okp = dest / ".edition-freeze-ok" - if okp.is_file(): - file_ok = okp.read_text(encoding="utf-8").strip().lower() in ( - "1", - "true", - "ok", - "yes", - ) - else: - file_ok = (dest / ".edition-built-at").is_file() - ok = bool(file_ok and recorded == tip_full and (dest / "index.html").is_file()) - return ok, err - - -def cleanup_stale_editions(editions: Path, tips: dict[str, str]) -> list[str]: - """Drop edition dirs whose branch tip is gone (keep flask alias).""" - keep = {edition_slug(b) for b in tips} | {"flask"} - removed: list[str] = [] - if not editions.is_dir(): - return removed - for child in list(editions.iterdir()): - if not child.is_dir(): - continue - if child.name in keep: - continue - shutil.rmtree(child, ignore_errors=True) - removed.append(child.name) - return removed - - -def cleanup_orphan_tmps(max_age_sec: int = 3600) -> int: - """Remove leftover tdpd-* workdirs older than max_age_sec.""" - bases: list[Path] = [] - home_tmp = Path.home() / "tmp" - if home_tmp.is_dir(): - bases.append(home_tmp) - bases.append(Path(tempfile.gettempdir())) - cutoff = time.time() - max_age_sec - n = 0 - for base in bases: - try: - kids = list(base.glob("tdpd-*")) - except OSError: - continue - for path in kids: - if not path.is_dir(): - continue - try: - if path.stat().st_mtime >= cutoff: - continue - except OSError: - continue - shutil.rmtree(path, ignore_errors=True) - n += 1 - return n - - -def cleanup_repo(repo: Path) -> None: - git(repo, "worktree", "prune", check=False) - - -def _attach_venv(work: Path) -> None: - """Worktrees lack .venv; reuse TDPD_VENV or sibling checkout .venv via symlink.""" - if (work / ".venv" / "bin" / "python").exists(): - return - candidates: list[Path] = [] - raw = os.environ.get("TDPD_VENV", "").strip() - if raw: - candidates.append(Path(raw).expanduser()) - root = tdpd_root() - candidates.append(root / ".venv") - # laptop SoT checkout even when TDPD_ROOT is git-dir-only on koopa - candidates.append(DEFAULT_TDPD / ".venv") - for venv in candidates: - py = venv / "bin" / "python" - if py.is_file(): - dest = work / ".venv" - if dest.exists() or dest.is_symlink(): - return - dest.symlink_to(venv.resolve()) - return - - -def run_freeze(work: Path, branch: str, slug: str) -> None: - tmpl = os.environ.get("FREEZE_CMD", "").strip() - env = os.environ.copy() - env["TDPD_BRANCH"] = branch - env["TDPD_SLUG"] = slug - if tmpl: - cmd = tmpl.format(root=str(work), branch=branch, slug=slug) - subprocess.run(cmd, shell=True, check=True, cwd=str(work), env=env) - return - _attach_venv(work) - # Older branches hardcode `python3 -m website.freeze` without .venv; - # prefer the attached venv interpreter directly. - py = work / ".venv" / "bin" / "python" - freeze_mod = work / "website" / "freeze.py" - if py.is_file() and freeze_mod.is_file(): - build = work / "website" / "build" - if build.exists(): - shutil.rmtree(build) - subprocess.run( - [str(py), "-m", "website.freeze"], - check=True, - cwd=str(work), - env=env, - ) - return - makefile = work / "Makefile" - if not makefile.is_file(): - raise FileNotFoundError(f"no Makefile in {work}") - subprocess.run(["make", "html"], check=True, cwd=str(work), env=env) - - -def inject_bar(edition_dir: Path) -> None: - if not INJECT.is_file(): - print(f"WARN: inject script missing: {INJECT}", file=sys.stderr) - return - cp = subprocess.run( - [sys.executable, str(INJECT), str(edition_dir)], - check=False, - capture_output=True, - text=True, - ) - if cp.stdout: - print(cp.stdout, end="" if str(cp.stdout).endswith("\n") else "\n", file=sys.stderr) - if cp.returncode != 0: - err = (cp.stderr or "").strip()[:300] - print(f"WARN: inject_bar {edition_dir}: {err}", file=sys.stderr) - - -def rebuild_edition(repo: Path, branch: str, tip: str, editions: Path) -> dict: - """Return {status, seconds} — status skipped|built|placeholder|error:…""" - slug = edition_slug(branch) - dest = editions / slug - t0 = time.perf_counter() - force = os.environ.get("FORCE_REBUILD", "").strip() in ("1", "true", "yes") - if not force and freeze_ok_for(editions, slug, tip)[0]: - inject_bar(dest) - if not (dest / ".edition-freeze-ok").is_file(): - write_freeze_status(editions, slug, True) - return {"status": "skipped", "seconds": round(time.perf_counter() - t0, 3)} - - wt: Path | None = None - try: - tmp_base = Path.home() / "tmp" if (Path.home() / "tmp").is_dir() else Path(tempfile.gettempdir()) - wt = Path(tempfile.mkdtemp(prefix=f"tdpd-{slug}-", dir=str(tmp_base))) - cp = git(repo, "worktree", "add", "--detach", str(wt), tip, check=False) - if cp.returncode != 0: - git(repo, "worktree", "prune", check=False) - cp = git(repo, "worktree", "add", "--detach", str(wt), tip, check=False) - if cp.returncode != 0: - st = f"error:worktree:{cp.stderr.strip()[:200]}" - ensure_placeholder(editions, slug, tip) - write_freeze_status(editions, slug, False, st) - inject_bar(dest) - return { - "status": st, - "seconds": round(time.perf_counter() - t0, 3), - } - - run_freeze(wt, branch, slug) - build = wt / "website" / "build" - if not build.is_dir(): - ensure_placeholder(editions, slug, tip) - write_freeze_status(editions, slug, False, "error:no-build") - inject_bar(dest) - return {"status": "error:no-build", "seconds": round(time.perf_counter() - t0, 3)} - - dest.mkdir(parents=True, exist_ok=True) - keep_meta = { - ".edition-tip", - ".edition-built-at", - ".edition-build-seconds", - ".edition-freeze-ok", - ".edition-freeze-error", - } - for child in list(dest.iterdir()): - if child.name in keep_meta: - continue - if child.is_dir(): - shutil.rmtree(child) - else: - child.unlink() - for child in build.iterdir(): - target = dest / child.name - if child.is_dir(): - shutil.copytree(child, target) - else: - shutil.copy2(child, target) - secs = round(time.perf_counter() - t0, 3) - (dest / ".edition-tip").write_text(tip + "\n", encoding="utf-8") - write_build_meta(editions, slug, secs) - write_freeze_status(editions, slug, True) - inject_bar(dest) - return {"status": "built", "seconds": secs} - except Exception as exc: # noqa: BLE001 — hourly must continue - st = f"error:{type(exc).__name__}:{exc}" - ensure_placeholder(editions, slug, tip) - write_freeze_status(editions, slug, False, st) - inject_bar(dest) - return { - "status": st, - "seconds": round(time.perf_counter() - t0, 3), - } - finally: - if wt is not None: - git(repo, "worktree", "remove", "--force", str(wt), check=False) - shutil.rmtree(wt, ignore_errors=True) - - -def _edition_built_at(editions: Path, slug: str) -> str: - p = editions / slug / ".edition-built-at" - if not p.is_file(): - return "" - return p.read_text(encoding="utf-8").strip() - - -def sync_flask_alias(editions: Path, tips: dict[str, str]) -> None: - """Keep editions/flask in sync with DEFAULT_BRANCH freeze when present.""" - src_branch = default_branch() - if src_branch not in tips: - return - src_slug = edition_slug(src_branch) - src = editions / src_slug - dst = editions / "flask" - tip = tips[src_branch] - flask_ok, _ = freeze_ok_for(editions, "flask", tip) - src_built = _edition_built_at(editions, src_slug) - flask_built = _edition_built_at(editions, "flask") - if flask_ok and src_built and src_built == flask_built: - return - if not (src / "index.html").is_file(): - ensure_placeholder(editions, "flask", tip) - return - if dst.exists(): - shutil.rmtree(dst) - shutil.copytree(src, dst) - (dst / ".edition-tip").write_text(tip + "\n", encoding="utf-8") - # reuse src build meta if present - for name in ( - ".edition-built-at", - ".edition-build-seconds", - ".edition-freeze-ok", - ".edition-freeze-error", - ): - s = src / name - if s.is_file(): - shutil.copy2(s, dst / name) - else: - p = dst / name - if p.exists(): - p.unlink() - inject_bar(dst) - - -def build_payload(repo: Path, tips: dict[str, str], rebuild: bool) -> dict: - parents = nearest_parents(repo, tips) - rows = walk_tree(parents, tips) - rebuild_status: dict[str, dict] = {} - rebuild_timing: dict | None = None - ed_root = editions_root() - cleanup_repo(repo) - n_tmp = cleanup_orphan_tmps() - if n_tmp: - print(f"cleanup_tmp removed={n_tmp}", file=sys.stderr) - if ed_root is not None: - ed_root.mkdir(parents=True, exist_ok=True) - removed = cleanup_stale_editions(ed_root, tips) - if removed: - print(f"cleanup_editions removed={removed}", file=sys.stderr) - if rebuild and ed_root is not None: - wall0 = time.perf_counter() - for name, tip in sorted(tips.items()): - # rebuild_edition itself skips when .edition-tip matches tip - rebuild_status[name] = rebuild_edition(repo, name, tip, ed_root) - sync_flask_alias(ed_root, tips) - cleanup_repo(repo) - cleanup_orphan_tmps(max_age_sec=600) - wall = round(time.perf_counter() - wall0, 3) - built_secs = [ - v["seconds"] - for v in rebuild_status.values() - if v.get("status") == "built" - ] - rebuild_timing = { - "wall_seconds": wall, - "branches": len(tips), - "built": sum(1 for v in rebuild_status.values() if v.get("status") == "built"), - "skipped": sum(1 for v in rebuild_status.values() if v.get("status") == "skipped"), - "errors": sum( - 1 for v in rebuild_status.values() if str(v.get("status", "")).startswith("error") - ), - "built_seconds_sum": round(sum(built_secs), 3) if built_secs else 0.0, - "built_seconds_max": round(max(built_secs), 3) if built_secs else 0.0, - } - print( - f"REBUILD_TIMING wall_seconds={wall} built={rebuild_timing['built']} " - f"skipped={rebuild_timing['skipped']} errors={rebuild_timing['errors']} " - f"built_seconds_sum={rebuild_timing['built_seconds_sum']} " - f"built_seconds_max={rebuild_timing['built_seconds_max']}", - file=sys.stderr, - ) - elif ed_root is not None: - ed_root.mkdir(parents=True, exist_ok=True) - for name, tip in tips.items(): - slug = edition_slug(name) - if not (ed_root / slug / "index.html").is_file(): - ensure_placeholder(ed_root, slug, tip) - write_freeze_status(ed_root, slug, False, "placeholder") - rebuild_status[name] = {"status": "placeholder", "seconds": 0.0} - if not (ed_root / "flask" / "index.html").is_file(): - sync_flask_alias(ed_root, tips) - - tip_times = {name: tip_commit_time(repo, tip) for name, tip in tips.items()} - empty = empty_tree_oid(repo) - branches_out = [] - for row in rows: - name = row["branch"] - slug = row["edition"] - meta = read_build_meta(ed_root, slug) if ed_root is not None else {} - # prefer this-run built seconds when present - rb = rebuild_status.get(name) or {} - if rb.get("status") == "built" and "seconds" in rb: - meta = { - **meta, - "build_seconds": rb["seconds"], - } - entry = { - "branch": name, - "edition": slug, - "tip": row["tip"], - "tip_time": tip_times.get(name, ""), - "parent": row["parent"], - "prefix": row["prefix"], - "url": row["url"], - } - if meta.get("built_at"): - entry["built_at"] = meta["built_at"] - if "build_seconds" in meta: - entry["build_seconds"] = meta["build_seconds"] - freeze_ok, freeze_err = freeze_ok_for(ed_root, slug, tips[name]) - st = str(rb.get("status") or "") - if st == "built": - freeze_ok, freeze_err = True, "" - elif st.startswith("error") or st == "placeholder": - freeze_ok, freeze_err = False, st - entry["freeze_ok"] = freeze_ok - if freeze_err: - entry["freeze_error"] = freeze_err - # sticky bar: +grün/−rot vs parent tip; gray loc when no parent in tree - parent = row["parent"] - if parent and parent in tips: - plus, minus = diff_numstat(repo, tips[parent], row["tip"]) - entry["vs_parent_plus"] = plus - entry["vs_parent_minus"] = minus - else: - entry["loc"] = loc_at_tip(repo, row["tip"], empty) - branches_out.append(entry) - - payload = { - "generated": datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds"), - "host": host(), - "default_branch": default_branch(), - "default_edition": "flask", - "branches": branches_out, - } - if rebuild_status: - payload["rebuild"] = rebuild_status - if rebuild_timing is not None: - payload["rebuild_timing"] = rebuild_timing - return payload - - -def parse_args(argv: list[str] | None = None) -> argparse.Namespace: - p = argparse.ArgumentParser(description=__doc__) - p.add_argument( - "--rebuild", - action="store_true", - help="rebuild stale editions into EDITIONS_ROOT", - ) - p.add_argument( - "--force", - action="store_true", - help="rebuild every edition even when .edition-tip matches (timing)", - ) - p.add_argument( - "--no-fetch", - action="store_true", - help="skip git fetch --prune origin", - ) - return p.parse_args(argv) - - -def main(argv: list[str] | None = None) -> int: - args = parse_args(argv) - repo = tdpd_root() - if not (repo / ".git").exists() and not (repo / "HEAD").exists(): - # allow bare / gitfile - gitfile = repo / ".git" - if not repo.is_dir(): - print(f"TDPD_ROOT missing or not a dir: {repo}", file=sys.stderr) - return 1 - if not gitfile.exists() and not (repo / "objects").exists(): - print(f"TDPD_ROOT has no git metadata: {repo}", file=sys.stderr) - return 1 - - if args.no_fetch: - os.environ["FETCH"] = "0" - if args.force: - os.environ["FORCE_REBUILD"] = "1" - fetch_origin(repo) - - tips = list_origin_branches(repo) - if not tips: - print("no origin/* branches found", file=sys.stderr) - return 1 - - rebuild = ( - args.rebuild - or args.force - or os.environ.get("REBUILD", "").strip() in ("1", "true", "yes") - ) - if rebuild and editions_root() is None: - print("REBUILD set but EDITIONS_ROOT missing", file=sys.stderr) - return 1 - - payload = build_payload(repo, tips, rebuild) - dest = out_path() - dest.parent.mkdir(parents=True, exist_ok=True) - dest.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8") - print(f"wrote {dest} branches={len(payload['branches'])}", file=sys.stderr) - if "rebuild" in payload: - print(f"rebuild={payload['rebuild']}", file=sys.stderr) - return 0 - - -if __name__ == "__main__": - raise SystemExit(main()) diff --git a/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet b/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet deleted file mode 100644 index 7e02a41..0000000 --- a/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet +++ /dev/null @@ -1,68 +0,0 @@ -# Stanza body for dossiers.ngi.hacktivism.ch only (hand-check / re-seed). -# Apply on koopa (host-local): -# bash ~/bin/apply-dossiers-ngi-edition-switch.sh -# sudo ~/bin/caddy-apply -# -# Sticky bar switches build via cookie tdpd_edition → editions/{branch}
" > "{root}/website/build/index.html"' - -mkdir -p "$EDITIONS" -# seed a Makefile so non-stub path would find one; stub overrides via FREEZE_CMD -FETCH=0 TDPD_ROOT="$CLONE" OUT="$OUT" EDITIONS_ROOT="$EDITIONS" \ - FREEZE_CMD="$FREEZE_CMD" REBUILD=1 \ - python3 "$SCRIPT" --rebuild --no-fetch - -python3 - "$OUT" <<'PY' -import json, sys -from pathlib import Path -data = json.loads(Path(sys.argv[1]).read_text()) -branches = {b["branch"]: b for b in data["branches"]} -assert "main" in branches -assert "feat/a" in branches -assert "feat/b" in branches -assert "smoke/temp-sibling" in branches -assert branches["feat/a"]["parent"] == "main", branches["feat/a"] -assert branches["feat/b"]["parent"] == "feat/a", branches["feat/b"] -assert branches["smoke/temp-sibling"]["parent"] == "main", branches["smoke/temp-sibling"] -for b in data["branches"]: - assert b.get("freeze_ok") is True, b -# prefixes semi-graphic -prefs = {b["branch"]: b["prefix"] for b in data["branches"]} -assert any("├──" in p or "└──" in p for p in prefs.values()), prefs -# editions built -print("OK tree:") -for b in data["branches"]: - print(f" {b['prefix']}{b['branch']} @ {b['tip']} -> {b['edition']} parent={b['parent']!r}") -print("rebuild", data.get("rebuild")) -PY - -# editions exist with stub content -test -f "$EDITIONS/feat-a/index.html" -test -f "$EDITIONS/smoke-temp-sibling/index.html" -grep -q "feat/a" "$EDITIONS/feat-a/index.html" -grep -q "smoke/temp-sibling" "$EDITIONS/smoke-temp-sibling/index.html" -test "$(cat "$EDITIONS/feat-a/.edition-freeze-ok")" = "1" - -# red ✗ when last freeze of this tip failed -printf '0\n' > "$EDITIONS/feat-a/.edition-freeze-ok" -printf 'error:smoke\n' > "$EDITIONS/feat-a/.edition-freeze-error" -FETCH=0 TDPD_ROOT="$CLONE" OUT="$OUT" EDITIONS_ROOT="$EDITIONS" \ - FREEZE_CMD="$FREEZE_CMD" \ - python3 "$SCRIPT" --no-fetch -python3 - "$OUT" <<'PY' -import json, sys -from pathlib import Path -data = json.loads(Path(sys.argv[1]).read_text()) -rows = {b["branch"]: b for b in data["branches"]} -assert rows["feat/a"]["freeze_ok"] is False, rows["feat/a"] -assert rows["feat/a"].get("freeze_error") == "error:smoke", rows["feat/a"] -assert rows["main"]["freeze_ok"] is True, rows["main"] -print("OK freeze_ok false after failed mark") -PY -printf '1\n' > "$EDITIONS/feat-a/.edition-freeze-ok" -rm -f "$EDITIONS/feat-a/.edition-freeze-error" - -# flask alias: matching tip + stale HTML must copy from DEFAULT_BRANCH -MAIN_TIP="$(tr -d '\n' < "$EDITIONS/main/.edition-tip")" -mkdir -p "$EDITIONS/flask" -printf '%s\n' "$MAIN_TIP" > "$EDITIONS/flask/.edition-tip" -printf '%s\n' 'stale-flask' > "$EDITIONS/flask/index.html" -printf '%s\n' '2026-09-30T17:35:26+02:00' > "$EDITIONS/flask/.edition-built-at" -FETCH=0 TDPD_ROOT="$CLONE" OUT="$OUT" EDITIONS_ROOT="$EDITIONS" \ - FREEZE_CMD="$FREEZE_CMD" REBUILD=1 DEFAULT_BRANCH=main \ - python3 "$SCRIPT" --rebuild --no-fetch -grep -q "main" "$EDITIONS/flask/index.html" -if grep -q "stale-flask" "$EDITIONS/flask/index.html"; then - echo "FAIL flask alias kept stale HTML" - exit 1 -fi -test "$(tr -d '\n' < "$EDITIONS/flask/.edition-freeze-ok")" = "1" -test "$(tr -d '\n' < "$EDITIONS/flask/.edition-built-at")" = "$(tr -d '\n' < "$EDITIONS/main/.edition-built-at")" -echo "OK flask alias copied after stale skip" - -# delete smoke branch on origin; fetch --prune drops remote-tracking ref -cd "$CLONE" -git push origin --delete smoke/temp-sibling >/dev/null 2>&1 -git branch -D smoke/temp-sibling >/dev/null 2>&1 || true -TDPD_ROOT="$CLONE" OUT="$OUT" EDITIONS_ROOT="$EDITIONS" \ - FREEZE_CMD="$FREEZE_CMD" \ - python3 "$SCRIPT" -python3 - "$OUT" <<'PY' -import json, sys -from pathlib import Path -data = json.loads(Path(sys.argv[1]).read_text()) -names = {b["branch"] for b in data["branches"]} -assert "smoke/temp-sibling" not in names, names -assert names == {"main", "feat/a", "feat/b"}, names -print("OK smoke branch removed from tree") -PY - -echo "SMOKE_OK" diff --git a/scripts/firecuda-probe/README.md b/scripts/firecuda-probe/README.md deleted file mode 100644 index 1b0e217..0000000 --- a/scripts/firecuda-probe/README.md +++ /dev/null @@ -1,80 +0,0 @@ -# firecuda-probe — external last-alive from koopa - -**Why:** firecuda panics (e.g. 1GbE PCIe completion timeout 2026-09-20) and hard hangs leave the internal HB dead with the box. External ICMP+SSH from **koopa** distinguishes: - -| Pattern | Likely meaning | -|---------|----------------| -| ICMP fail + SSH fail, long gap | hang, power cut, or NIC/kernel down | -| ICMP ok + SSH fail | userspace/sshd stuck, or max lock | -| both ok, HB stamp stale vs wall | rare clock skew / forced-cmd path oddity / HB LaunchDaemon stopped | -| both ok, HB fresh | alive | - -Log is **hernani-readable** on koopa (`~/.local/state/firecuda-probe/`). -SSH key is **max-only** on firecuda, restricted to koopa LAN IP + forced `cat` of HB mirror. - -Requires firecuda crash-debug HB live (`/usr/local/var/lib/firecuda/heartbeat.last`) — see `firecuda-admin-log/configs/crash-debug/`. - -## Pieces - -| Piece | Path | -|-------|------| -| Script | `scripts/firecuda-probe/koopa-firecuda-probe.sh` → `~/.local/bin/koopa-firecuda-probe` | -| Timer | `configs/systemd/user/koopa-firecuda-probe.{service,timer}` (~15 s) | -| Key | `~/.ssh/id_ed25519_firecuda_probe` (hernani on koopa) | -| Log | `~/.local/state/firecuda-probe/firecuda-probe.log` (+ `.last` / `.meta`) | -| SSH Host | `firecuda-probe` → `max@192.168.100.84` with that IdentityFile | - -## Install (koopa as hernani) — Freigabe - -Laptop SoT: `$HOME/git/admin-logs/local/koopa-admin-log`. Live mirror: `~/src/koopa/koopa-admin-log` (no git commit on koopa). - -```bash -# on koopa after syncing the tree: -cd ~/src/koopa/koopa-admin-log -./scripts/firecuda-probe/install-firecuda-probe.sh --keygen -# copy the printed authorized_keys line → firecuda max (see below) -./scripts/firecuda-probe/install-firecuda-probe.sh # units + first probe -``` - -Linger already yes for hernani → timer survives logout. - -## firecuda max authorized_keys (one line) - -After `--keygen`, install prints the exact line. Template: - -```text -from="192.168.100.95",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,command="/bin/cat /usr/local/var/lib/firecuda/heartbeat.last" ssh-ed25519');
- for (var i = 0; i < list.length; i++) {
- var row = list[i];
- var edition = row.edition || "";
- var branch = row.branch || "";
- var prefix = row.prefix || "";
- var parent = row.parent || "";
- var isDefault = branch === defaultBranch;
- html.push(
- '' +
- freezeMarkHtml(row) +
- '' +
- esc(prefix) +
- "
");
- var t = timingText(timing, list.length);
- if (t) {
- html.push('" +
- esc(branch) +
- "" +
- '' +
- esc(shortTime(row.tip_time || "")) +
- "" +
- '' +
- esc(builtText(row)) +
- "" +
- '' +
- plusHtml(row) +
- "" +
- '' +
- minusHtml(row) +
- "" +
- ""
- );
- }
- html.push("' + esc(t) + "
");
- }
- mount.innerHTML = html.join("");
- mount.setAttribute("data-structure", structureKey(list));
- markActive(mount, cookieEdition());
- pinBar(t);
- }
-
- function loadStatus(soft) {
- var mount = document.getElementById("cascade-tree");
- return fetch("/branch-status.json", { cache: "no-store" })
- .then(function (res) {
- if (!res.ok) throw new Error("status");
- return res.json();
- })
- .then(function (data) {
- renderTree(data, !!soft);
- })
- .catch(function () {
- if (!soft && mount && !mount.querySelector("a[data-edition]")) {
- mount.innerHTML =
- 'flask' +
- ' (branch-status unavailable)';
- markActive(mount, cookieEdition());
- pinBar();
- }
- });
- }
-
- document.addEventListener("click", function (ev) {
- var a = ev.target.closest
- ? ev.target.closest("a.cascade-tree-row[data-edition]")
- : null;
- if (!a || ev.defaultPrevented) return;
- if (ev.button !== 0 || ev.metaKey || ev.ctrlKey || ev.shiftKey || ev.altKey)
- return;
- ev.preventDefault();
- switchEdition(
- a.getAttribute("data-edition"),
- a.getAttribute("data-branch") || a.getAttribute("data-edition")
- );
- });
-
- if (document.body && document.body.classList.contains("cascade-missing")) {
- showHint(
- "This path is not in the current branch. Choose another branch above."
- );
- }
-
- loadStatus(false);
- setInterval(function () {
- loadStatus(true);
- }, POLL_MS);
- window.addEventListener("resize", function () {
- pinBar();
- });
-})();
diff --git a/sites/dossiers.ngi.hacktivism.ch/_cascade/index.html b/sites/dossiers.ngi.hacktivism.ch/_cascade/index.html
deleted file mode 100644
index db0bc96..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/_cascade/index.html
+++ /dev/null
@@ -1,17 +0,0 @@
-
-
-
-
-
-Stuck on an edition without a bar? Pick a build above, or reset to flask.
- - - diff --git a/sites/dossiers.ngi.hacktivism.ch/_cascade/missing.html b/sites/dossiers.ngi.hacktivism.ch/_cascade/missing.html deleted file mode 100644 index 449d470..0000000 --- a/sites/dossiers.ngi.hacktivism.ch/_cascade/missing.html +++ /dev/null @@ -1,17 +0,0 @@ - - - - - -This address is not in the current branch. Choose another branch above.
- - - diff --git a/sites/dossiers.ngi.hacktivism.ch/_edition-placeholder/index.html b/sites/dossiers.ngi.hacktivism.ch/_edition-placeholder/index.html deleted file mode 100644 index 369b971..0000000 --- a/sites/dossiers.ngi.hacktivism.ch/_edition-placeholder/index.html +++ /dev/null @@ -1,17 +0,0 @@ - - - - - -edition pending
-Full freeze for this tip is not staged under editions/ yet. Sticky bar still switches other builds.
');
- for (var i = 0; i < list.length; i++) {
- var row = list[i];
- var edition = row.edition || "";
- var branch = row.branch || "";
- var prefix = row.prefix || "";
- var parent = row.parent || "";
- var isDefault = branch === defaultBranch;
- html.push(
- '' +
- freezeMarkHtml(row) +
- '' +
- esc(prefix) +
- "
");
- var t = timingText(timing, list.length);
- if (t) {
- html.push('" +
- esc(branch) +
- "" +
- '' +
- esc(shortTime(row.tip_time || "")) +
- "" +
- '' +
- esc(builtText(row)) +
- "" +
- '' +
- plusHtml(row) +
- "" +
- '' +
- minusHtml(row) +
- "" +
- ""
- );
- }
- html.push("' + esc(t) + "
");
- }
- mount.innerHTML = html.join("");
- mount.setAttribute("data-structure", structureKey(list));
- markActive(mount, cookieEdition());
- pinBar(t);
- }
-
- function loadStatus(soft) {
- var mount = document.getElementById("cascade-tree");
- return fetch("/branch-status.json", { cache: "no-store" })
- .then(function (res) {
- if (!res.ok) throw new Error("status");
- return res.json();
- })
- .then(function (data) {
- renderTree(data, !!soft);
- })
- .catch(function () {
- if (!soft && mount && !mount.querySelector("a[data-edition]")) {
- mount.innerHTML =
- 'flask' +
- ' (branch-status unavailable)';
- markActive(mount, cookieEdition());
- pinBar();
- }
- });
- }
-
- document.addEventListener("click", function (ev) {
- var a = ev.target.closest
- ? ev.target.closest("a.cascade-tree-row[data-edition]")
- : null;
- if (!a || ev.defaultPrevented) return;
- if (ev.button !== 0 || ev.metaKey || ev.ctrlKey || ev.shiftKey || ev.altKey)
- return;
- ev.preventDefault();
- switchEdition(
- a.getAttribute("data-edition"),
- a.getAttribute("data-branch") || a.getAttribute("data-edition")
- );
- });
-
- if (document.body && document.body.classList.contains("cascade-missing")) {
- showHint(
- "This path is not in the current branch. Choose another branch above."
- );
- }
-
- loadStatus(false);
- setInterval(function () {
- loadStatus(true);
- }, POLL_MS);
- window.addEventListener("resize", function () {
- pinBar();
- });
-})();
diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/_cascade/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/_cascade/index.html
deleted file mode 100644
index db0bc96..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/cascade/_cascade/index.html
+++ /dev/null
@@ -1,17 +0,0 @@
-
-
-
-
-
-Stuck on an edition without a bar? Pick a build above, or reset to flask.
- - - diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-sm-content/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/feat-sm-content/index.html deleted file mode 100644 index 13f4285..0000000 --- a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-sm-content/index.html +++ /dev/null @@ -1,31 +0,0 @@ - - - - - -/feat-sm-content/
-
-
-
diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-design/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-design/index.html
deleted file mode 100644
index 142b80e..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-design/index.html
+++ /dev/null
@@ -1,31 +0,0 @@
-
-
-
-
-
-/feat-website-design/
-
-
-
diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-features/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-features/index.html
deleted file mode 100644
index 3271f8f..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-features/index.html
+++ /dev/null
@@ -1,31 +0,0 @@
-
-
-
-
-
-/feat-website-features/
-
-
-
diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-views/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-views/index.html
deleted file mode 100644
index 5896890..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/cascade/feat-website-views/index.html
+++ /dev/null
@@ -1,31 +0,0 @@
-
-
-
-
-
-/feat-website-views/
-
-
-
diff --git a/sites/dossiers.ngi.hacktivism.ch/cascade/index.html b/sites/dossiers.ngi.hacktivism.ch/cascade/index.html
deleted file mode 100644
index 71a5d33..0000000
--- a/sites/dossiers.ngi.hacktivism.ch/cascade/index.html
+++ /dev/null
@@ -1,39 +0,0 @@
-
-
-
-
-
-cascade
- - --
-
/main/·main@d2fbd79
- /feat-sm-content/·feat/sm-content@089ef1f
- /feat-website-features/·feat/website-features@53a3176
- /feat-website-design/·feat/website-design@2e26c80
- /feat-website-views/·feat/website-views@bbafc38
-