diff --git a/2026/2026-08-17--decidim.md b/2026/2026-08-17--decidim.md deleted file mode 100644 index f2481c1..0000000 --- a/2026/2026-08-17--decidim.md +++ /dev/null @@ -1,43 +0,0 @@ -# Decidim — decidim.hacktivism.ch (2026-08-17) - -Site: **https://decidim.hacktivism.ch/** -Port **9027** → Caddy. Stack: `koopa-decidim` + `koopa-decidim-sidekiq` + `koopa-decidim-db` + `koopa-decidim-redis`. Image `decidim/decidim:0.30.8`. - -Live: `~/koopa-decidim/` (compose mirror `configs/decidim/`). Secrets only on host (`.env`, `users.env`). - -Instance name **hacktivism**. Theme: exchange-dark (gold `#e8a838`, bg `#1a1410`) via `theme/hacktivism.css`. Analog: `configs/lemmy/`. - -Admin users are on the host (`~/koopa-decidim/users.env`), not in this repo. - -Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` -Boot: `scripts/decidim/install-systemd.sh` (linger already yes on koopa). - -## Cookie / privacy - -Stock Decidim still emits `#dc-dialog-wrapper` (Accept all / essential / Settings). This instance has no third-party trackers; privacy is default. - -- CSS: `#dc-dialog-wrapper, .cookies__container { display: none !important; }` -- JS: `/hacktivism-consent.js` sets `decidim-consent={"essential":true}` if missing -- Live 2026-08-17: HTML 200, CSS/JS 200, hide rules in public `/hacktivism.css` - -## Reboot (checked 2026-08-17) - -| Item | Value | -|------|--------| -| linger `hernani` | yes | -| `container-koopa-decidim-db` | enabled + active | -| `container-koopa-decidim` | enabled + active | -| `container-koopa-lemmy-db` / `container-koopa-lemmy` | enabled + active | -| listen | `:9027` `:9026` | - -login-health: probes + containers + linger + these units enabled. Loopback HTTP on :9027 is **301** (app wants HTTPS; TLS is Caddy). Probe allows 301. After reboot: login-health only unless asked. - -## Public example + isoc - -- Process **example** (published, not private): `https://decidim.hacktivism.ch/processes/example` - — title **Öffentliche digitale Allmende** (public-by-default reading). -- Published meeting **Offene Runde: Lesen ohne Konto** + one public proposal + background page. -- Homepage block `highlighted_processes` published. -- Participant `isoc` on the host (`users.env`); password not in this repo. -- Avatar: gold ISOC globe (same crop as Bonfire `@isoc`); host file `~/koopa-decidim/assets/img/isoc-gold.png`, not in this repo. -- Seed: `scripts/decidim/seed-example.sh` / `configs/decidim/seed_example.rb`. diff --git a/2026/2026-09-05--hernani-ollama-user+power.md b/2026/2026-09-05--hernani-ollama-user+power.md deleted file mode 100644 index b6a6e22..0000000 --- a/2026/2026-09-05--hernani-ollama-user+power.md +++ /dev/null @@ -1,16 +0,0 @@ -# koopa: hernani user Ollama + power sampling (2026-09-05) - -Freigabe: operator — install Ollama under hernani (no root package); loopback only; laptop tunnels. - -## Ollama - -- Binary: `~hernani/.local/bin/ollama` (v0.33.3 from GitHub `ollama-linux-amd64.tar.zst`) -- Unit: `~/.config/systemd/user/ollama.service` · `OLLAMA_HOST=127.0.0.1:11434` · enabled -- Access: SSH as **hernani** from clementine/magikoopa → LocalForward (helper `koopa-ollama-tunnel` → laptop `:11438`) -- Models: small + exotic pulls (see pull log `/tmp/ollama-koopa-pull-20260905.log`) — prefer ≤3B - -## Power / energy - -- Deployed `host-power.py` to `~hernani/.local/bin/host-power` -- Laptop: `remote-power koopa` / `koopa-power` → JSON watts; combo derives Wh -- RAPL `energy_uj` root-only → quality **estimated** until Freigabe for `enable-host-power-access.sh --apply` diff --git a/SECRETS.md b/SECRETS.md index 5b48906..7500471 100644 --- a/SECRETS.md +++ b/SECRETS.md @@ -19,7 +19,6 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**. |------|--------|------| | Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` | | Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` | -| Decidim | host-only `~/koopa-decidim/{.env,users.env}` (compose mirror in admin-log `configs/decidim/`) | `~/koopa-decidim/` | | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` | | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` | | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` | diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile index bacff1e..58fb8a5 100644 --- a/configs/caddy/Caddyfile +++ b/configs/caddy/Caddyfile @@ -1,7 +1,7 @@ # Internal only (not in the browser URL): # 9010 merchant API | 9011 exchange API | 9012 bank API # 9013 bank landing | 9014 exchange landing | 9015 merchant landing -# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh +# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 { @@ -39,28 +39,28 @@ taler.hacktivism.ch { # surface + aptdeploy HTML (taler.hacktivism.ch only) handle /taler-monitoring-surface_err { - redir /taler-monitoring-surface_err/ 302 + redir * /taler-monitoring-surface_err/ 302 } handle /taler-monitoring-surface_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-surface { - redir /taler-monitoring-surface/ 302 + redir * /taler-monitoring-surface/ 302 } handle /taler-monitoring-surface* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-aptdeploy_err { - redir /taler-monitoring-aptdeploy_err/ 302 + redir * /taler-monitoring-aptdeploy_err/ 302 } handle /taler-monitoring-aptdeploy_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-aptdeploy { - redir /taler-monitoring-aptdeploy/ 302 + redir * /taler-monitoring-aptdeploy/ 302 } handle /taler-monitoring-aptdeploy* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -68,14 +68,14 @@ taler.hacktivism.ch { } handle /taler-monitoring-mattermost_err { - redir /taler-monitoring-mattermost_err/ 302 + redir * /taler-monitoring-mattermost_err/ 302 } handle /taler-monitoring-mattermost_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-mattermost { - redir /taler-monitoring-mattermost/ 302 + redir * /taler-monitoring-mattermost/ 302 } handle /taler-monitoring-mattermost* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -83,14 +83,14 @@ taler.hacktivism.ch { } handle /taler-monitoring-mail_err { - redir /taler-monitoring-mail_err/ 302 + redir * /taler-monitoring-mail_err/ 302 } handle /taler-monitoring-mail_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /taler-monitoring-mail { - redir /taler-monitoring-mail/ 302 + redir * /taler-monitoring-mail/ 302 } handle /taler-monitoring-mail* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -99,14 +99,14 @@ taler.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/taler.hacktivism.ch @@ -143,14 +143,14 @@ exchange.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/exchange.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/exchange.hacktivism.ch @@ -177,14 +177,14 @@ bank.hacktivism.ch { # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } handle /monitoring_err* { root * /var/www/monitoring-sites/bank.hacktivism.ch file_server } handle /monitoring { - redir /monitoring/ 302 + redir * /monitoring/ 302 } handle /monitoring* { root * /var/www/monitoring-sites/bank.hacktivism.ch @@ -315,24 +315,7 @@ lemmy.hacktivism.ch { } } -# 9027 decidim (rails) -decidim.hacktivism.ch { - header Alt-Svc "clear" - reverse_proxy 127.0.0.1:9027 { - header_up Host {host} - header_up X-Forwarded-For {remote_host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Port 443 - flush_interval -1 - transport http { - read_timeout 3600s - write_timeout 3600s - } - } -} - -http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch { +http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch { handle /.well-known/acme-challenge/* { root * /var/www/acme file_server diff --git a/configs/decidim/.env.example b/configs/decidim/.env.example deleted file mode 100644 index 9fe9974..0000000 --- a/configs/decidim/.env.example +++ /dev/null @@ -1,17 +0,0 @@ -POSTGRES_PASSWORD=@inline-secret@ -SECRET_KEY_BASE=@inline-secret@ -DECIDIM_APPLICATION_NAME=hacktivism -DECIDIM_MAILER_SENDER=noreply@hacktivism.ch -DECIDIM_AVAILABLE_LOCALES=en,de,fr -DECIDIM_DEFAULT_LOCALE=en -DECIDIM_HOST=decidim.hacktivism.ch -SMTP_ADDRESS=127.0.0.1 -SMTP_DOMAIN=hacktivism.ch -SMTP_USERNAME=unused -SMTP_PASSWORD=unused -SMTP_PORT=25 -QUEUE_ADAPTER=sidekiq -DECIDIM_ISOC_EMAIL=isoc@hacktivism.ch -DECIDIM_ISOC_PASSWORD=@inline-secret@ -DECIDIM_ISOC_NAME=isoc -DECIDIM_ISOC_NICKNAME=isoc diff --git a/configs/decidim/README.md b/configs/decidim/README.md deleted file mode 100644 index 76c951e..0000000 --- a/configs/decidim/README.md +++ /dev/null @@ -1,28 +0,0 @@ -# Decidim — decidim.hacktivism.ch - -| Item | Value | -|------|--------| -| Live | `/home/hernani/koopa-decidim/` | -| Compose | `compose.yml` (mirror, no secrets) | -| Port | **9027** → Caddy | -| Site | https://decidim.hacktivism.ch/ | -| Image | `decidim/decidim:0.30.8` + postgres 16 + redis 7 + sidekiq | - -Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo. - -Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Lemmy/Bonfire). Analog stack: `configs/lemmy/`. - -Privacy: no third-party trackers. Stock GDPR banner is hidden (`#dc-dialog-wrapper`); `theme/hacktivism-consent.js` sets essential-only `decidim-consent`. - -```bash -cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d -scripts/decidim/install-systemd.sh -scripts/decidim/apply-branding.sh -scripts/decidim/seed-example.sh # public process /processes/example + optional isoc user -``` - -Public example (no account): `https://decidim.hacktivism.ch/processes/example` - -Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` - -Daylog: `2026/2026-08-17--decidim.md`. diff --git a/configs/decidim/assets/img/favicon.svg b/configs/decidim/assets/img/favicon.svg deleted file mode 100644 index e1d3dc3..0000000 --- a/configs/decidim/assets/img/favicon.svg +++ /dev/null @@ -1,90 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/configs/decidim/assets/img/logo.svg b/configs/decidim/assets/img/logo.svg deleted file mode 100644 index e1d3dc3..0000000 --- a/configs/decidim/assets/img/logo.svg +++ /dev/null @@ -1,90 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/configs/decidim/bootstrap.rb b/configs/decidim/bootstrap.rb deleted file mode 100644 index 8ec96a1..0000000 --- a/configs/decidim/bootstrap.rb +++ /dev/null @@ -1,78 +0,0 @@ -# frozen_string_literal: true -# Create system admin + organization + org admin. Idempotent. -# Usage: bundle exec rails runner /code/lib/koopa_bootstrap.rb - -host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch") -sys_email = ENV.fetch("DECIDIM_SYSTEM_EMAIL") -sys_password = ENV.fetch("DECIDIM_SYSTEM_PASSWORD") -admin_email = ENV.fetch("DECIDIM_ADMIN_EMAIL") -admin_password = ENV.fetch("DECIDIM_ADMIN_PASSWORD") -admin_name = ENV.fetch("DECIDIM_ADMIN_NAME", "hacktivism") -org_name = ENV.fetch("DECIDIM_APPLICATION_NAME", "hacktivism") - -sys = Decidim::System::Admin.find_or_initialize_by(email: sys_email) -sys.password = sys_password -sys.password_confirmation = sys_password -sys.save! -puts "system admin: #{sys.email}" - -org = Decidim::Organization.find_by(host: host) -if org.nil? - attrs = { - host: host, - default_locale: ENV.fetch("DECIDIM_DEFAULT_LOCALE", "en"), - available_locales: ENV.fetch("DECIDIM_AVAILABLE_LOCALES", "en,de,fr").split(","), - reference_prefix: "HCK", - time_zone: "Europe/Zurich", - users_registration_mode: "enabled", - force_users_to_authenticate_before_access_organization: false, - available_authorizations: [], - tos_version: Time.current, - colors: { - "primary" => "#e8a838", - "secondary" => "#3ecfbf", - "tertiary" => "#3d3128", - "success" => "#16a34a", - "warning" => "#f0d090", - "alert" => "#e7131a" - }, - header_snippets: %() - } - name_val = { "en" => org_name, "de" => org_name, "fr" => org_name } - desc_val = { "en" => "hacktivism participatory platform", "de" => "hacktivism Partizipationsplattform", "fr" => "plateforme participative hacktivism" } - begin - org = Decidim::Organization.new(attrs.merge(name: name_val, description: desc_val)) - org.save! - rescue StandardError - org = Decidim::Organization.new(attrs.merge(name: org_name, description: "hacktivism participatory platform")) - org.save! - end - Decidim::System::CreateDefaultPages.call(org) if defined?(Decidim::System::CreateDefaultPages) - Decidim::System::CreateDefaultContentBlocks.call(org) if defined?(Decidim::System::CreateDefaultContentBlocks) - puts "organization created host=#{org.host}" -else - org.colors = { - "primary" => "#e8a838", - "secondary" => "#3ecfbf", - "tertiary" => "#3d3128", - "success" => "#16a34a", - "warning" => "#f0d090", - "alert" => "#e7131a" - } - org.header_snippets = %() - org.save! - puts "organization updated host=#{org.host}" -end - -user = Decidim::User.find_or_initialize_by(email: admin_email, organization: org) -user.name = admin_name -user.nickname = admin_name.downcase.gsub(/[^a-z0-9_]/, "")[0, 20] -user.password = admin_password -user.password_confirmation = admin_password -user.admin = true -user.confirmed_at ||= Time.current -user.tos_agreement = true -user.accepted_tos_version = org.tos_version -user.locale = org.default_locale -user.save! -puts "org admin: #{user.email}" diff --git a/configs/decidim/compose.yml b/configs/decidim/compose.yml deleted file mode 100644 index 5d25d65..0000000 --- a/configs/decidim/compose.yml +++ /dev/null @@ -1,133 +0,0 @@ -# koopa-decidim — Decidim behind host Caddy on :9027 -# Docs: https://docs.decidim.org/en/develop/install/ -# Image: official pre-generated app (core modules only). No secrets in this file. - -x-logging: &default-logging - driver: "json-file" - options: - max-size: "50m" - max-file: "4" - -x-app-env: &app-env - RAILS_ENV: production - RAILS_SERVE_STATIC_FILES: "true" - RAILS_LOG_TO_STDOUT: "true" - DATABASE_URL: postgres://decidim:${POSTGRES_PASSWORD}@postgres:5432/decidim - REDIS_URL: redis://redis:6379/0 - SECRET_KEY_BASE: ${SECRET_KEY_BASE} - DECIDIM_APPLICATION_NAME: ${DECIDIM_APPLICATION_NAME:-hacktivism} - DECIDIM_MAILER_SENDER: ${DECIDIM_MAILER_SENDER:-noreply@hacktivism.ch} - DECIDIM_AVAILABLE_LOCALES: ${DECIDIM_AVAILABLE_LOCALES:-en,de,fr} - DECIDIM_DEFAULT_LOCALE: ${DECIDIM_DEFAULT_LOCALE:-en} - SMTP_ADDRESS: ${SMTP_ADDRESS:-127.0.0.1} - SMTP_DOMAIN: ${SMTP_DOMAIN:-hacktivism.ch} - SMTP_USERNAME: ${SMTP_USERNAME:-unused} - SMTP_PASSWORD: ${SMTP_PASSWORD:-unused} - SMTP_PORT: ${SMTP_PORT:-25} - SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain} - QUEUE_ADAPTER: ${QUEUE_ADAPTER:-sidekiq} - -services: - decidim: - image: docker.io/decidim/decidim:0.30.8 - container_name: koopa-decidim - hostname: decidim - ports: - - "9027:3000" - env_file: - - .env - environment: - <<: *app-env - volumes: - - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro - - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro - - ./theme/hacktivism.css:/code/public/hacktivism.css:ro - - ./theme/hacktivism-consent.js:/code/public/hacktivism-consent.js:ro - - ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro - - ./seed_example.rb:/code/lib/koopa_seed_example.rb:ro - - ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro - - ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro - - decidim-storage:/code/storage - - decidim-uploads:/code/public/uploads - - decidim-tmp:/code/tmp - entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"] - command: ["bundle", "exec", "rails", "s", "-b", "0.0.0.0", "-p", "3000"] - restart: unless-stopped - logging: *default-logging - depends_on: - postgres: - condition: service_healthy - redis: - condition: service_started - labels: - org.hacktivism.service: decidim - org.hacktivism.host_port: "9027" - org.hacktivism.site: decidim.hacktivism.ch - org.hacktivism.managed_by: koopa-admin - - sidekiq: - image: docker.io/decidim/decidim:0.30.8 - container_name: koopa-decidim-sidekiq - hostname: sidekiq - env_file: - - .env - environment: - <<: *app-env - volumes: - - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro - - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro - - decidim-storage:/code/storage - - decidim-uploads:/code/public/uploads - - decidim-tmp:/code/tmp - entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"] - command: ["bundle", "exec", "sidekiq", "-C", "config/sidekiq.yml"] - restart: unless-stopped - logging: *default-logging - depends_on: - postgres: - condition: service_healthy - redis: - condition: service_started - labels: - org.hacktivism.service: decidim - org.hacktivism.managed_by: koopa-admin - - postgres: - image: docker.io/library/postgres:16-alpine - container_name: koopa-decidim-db - hostname: postgres - environment: - - POSTGRES_USER=decidim - - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} - - POSTGRES_DB=decidim - volumes: - - decidim-db:/var/lib/postgresql/data - restart: unless-stopped - logging: *default-logging - healthcheck: - test: ["CMD-SHELL", "pg_isready -U decidim -d decidim"] - interval: 5s - timeout: 5s - retries: 12 - labels: - org.hacktivism.service: decidim - org.hacktivism.managed_by: koopa-admin - - redis: - image: docker.io/library/redis:7-alpine - container_name: koopa-decidim-redis - hostname: redis - volumes: - - decidim-redis:/data - restart: unless-stopped - logging: *default-logging - labels: - org.hacktivism.service: decidim - org.hacktivism.managed_by: koopa-admin - -volumes: - decidim-db: - decidim-redis: - decidim-storage: - decidim-uploads: - decidim-tmp: diff --git a/configs/decidim/container-koopa-decidim-db.service b/configs/decidim/container-koopa-decidim-db.service deleted file mode 100644 index c15c8c6..0000000 --- a/configs/decidim/container-koopa-decidim-db.service +++ /dev/null @@ -1,21 +0,0 @@ -# user systemd — Decidim postgres + redis -[Unit] -Description=Decidim postgres/redis (koopa-decidim-db) -Wants=network-online.target -After=network-online.target -RequiresMountsFor=%t/containers - -[Service] -Environment=PODMAN_SYSTEMD_UNIT=%n -Restart=on-failure -RestartSec=20 -TimeoutStartSec=300 -TimeoutStopSec=120 -WorkingDirectory=/home/hernani/koopa-decidim -ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d postgres redis' -ExecStop=/usr/bin/podman stop -t 30 koopa-decidim-db koopa-decidim-redis -Type=oneshot -RemainAfterExit=yes - -[Install] -WantedBy=default.target diff --git a/configs/decidim/container-koopa-decidim.service b/configs/decidim/container-koopa-decidim.service deleted file mode 100644 index c84ec49..0000000 --- a/configs/decidim/container-koopa-decidim.service +++ /dev/null @@ -1,21 +0,0 @@ -# user systemd — Decidim stack (app + sidekiq) -[Unit] -Description=Decidim stack (koopa-decidim) -Wants=network-online.target container-koopa-decidim-db.service -After=network-online.target container-koopa-decidim-db.service -RequiresMountsFor=%t/containers - -[Service] -Environment=PODMAN_SYSTEMD_UNIT=%n -Restart=on-failure -RestartSec=20 -TimeoutStartSec=600 -TimeoutStopSec=120 -WorkingDirectory=/home/hernani/koopa-decidim -ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d' -ExecStop=/usr/bin/podman stop -t 30 koopa-decidim koopa-decidim-sidekiq -Type=oneshot -RemainAfterExit=yes - -[Install] -WantedBy=default.target diff --git a/configs/decidim/entrypoint.sh b/configs/decidim/entrypoint.sh deleted file mode 100755 index b7af36d..0000000 --- a/configs/decidim/entrypoint.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/bash -# Wait for Postgres, migrate, then exec CMD (rails or sidekiq). -set -euo pipefail - -export RAILS_ENV="${RAILS_ENV:-production}" - -echo "koopa-decidim: waiting for postgres..." -i=0 -until bundle exec rails runner 'ActiveRecord::Base.connection.execute("SELECT 1")' >/dev/null 2>&1; do - i=$((i + 1)) - if [ "$i" -ge 60 ]; then - echo "koopa-decidim: postgres not ready after ${i} tries" >&2 - exit 1 - fi - sleep 3 -done - -echo "koopa-decidim: db:prepare" -bundle exec rails db:prepare - -echo "koopa-decidim: exec $*" -exec "$@" diff --git a/configs/decidim/seed_example.rb b/configs/decidim/seed_example.rb deleted file mode 100644 index e51525c..0000000 --- a/configs/decidim/seed_example.rb +++ /dev/null @@ -1,247 +0,0 @@ -# frozen_string_literal: true -# Public process + meeting + page + proposal (readable without an account). -# Optional participant from env: DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD. -# Optional avatar: DECIDIM_ISOC_AVATAR (PNG path inside the container). -# Usage: bundle exec rails runner /code/lib/koopa_seed_example.rb - -def t(en, de, fr) - { "en" => en, "de" => de, "fr" => fr } -end - -def fail_model!(record) - raise "#{record.class}: #{record.errors.full_messages.join("; ")}" -end - -host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch") -org = Decidim::Organization.find_by!(host: host) -admin = Decidim::User.find_by!(email: ENV.fetch("DECIDIM_ADMIN_EMAIL"), organization: org) - -org.update!(force_users_to_authenticate_before_access_organization: false) - -slug = "example" -process = Decidim::ParticipatoryProcess.find_or_initialize_by(organization: org, slug: slug) -process.assign_attributes( - title: t( - "Public digital commons", - "Öffentliche digitale Allmende", - "Communs numériques publics" - ), - subtitle: t( - "Which self-hosted services stay readable without an account?", - "Welche selbst gehosteten Dienste bleiben ohne Konto lesbar?", - "Quels services auto-hébergés restent lisibles sans compte ?" - ), - short_description: t( - "

hacktivism.ch already runs Lemmy, Bonfire, Castopod and Decidim. This process asks what must stay readable without a login — and what may require an account to write.

", - "

hacktivism.ch betreibt bereits Lemmy, Bonfire, Castopod und Decidim. Dieser Prozess fragt, was ohne Anmeldung lesbar bleiben muss — und wofür ein Konto zum Schreiben reicht.

", - "

hacktivism.ch fait déjà tourner Lemmy, Bonfire, Castopod et Decidim. Ce processus demande ce qui doit rester lisible sans compte — et ce qui peut exiger un compte pour écrire.

" - ), - description: t( - "

Reading civic material should not depend on creating an account. Writing (proposals, comments, votes) can.

" \ - "

Concrete questions:

Anyone can read this process. Sign in only to take part.

", - "

Öffentliches Beteiligungsmaterial soll ohne Konto lesbar sein. Schreiben (Vorschläge, Kommentare, Stimmen) kann ein Konto brauchen.

" \ - "

Konkrete Fragen:

Lesen ohne Anmeldung. Anmelden nur zum Mitmachen.

", - "

Lire du matériel civique ne doit pas exiger un compte. Écrire (propositions, commentaires, votes) peut le faire.

" \ - "

Questions concrètes :

Lecture sans compte. Connexion seulement pour participer.

" - ), - start_date: Date.current, - end_date: Date.current + 180, - published_at: process.published_at || Time.current, - private_space: false, - promoted: true, - scopes_enabled: false, - weight: 1 -) -process.save || fail_model!(process) -puts "process id=#{process.id} slug=#{process.slug} published=#{process.published_at}" - -step = process.steps.find_or_initialize_by(position: 1) -step.assign_attributes( - title: t("Open discussion", "Offene Diskussion", "Discussion ouverte"), - description: t( - "

Collect positions on public-by-default reading. No decision this step.

", - "

Positionen zum Lesen ohne Konto sammeln. In dieser Phase keine Entscheidung.

", - "

Recueillir les positions sur la lecture sans compte. Pas de décision à cette étape.

" - ), - start_date: Date.current, - end_date: Date.current + 180, - active: true -) -step.save || fail_model!(step) -puts "step id=#{step.id} active=#{step.active}" - -pages = Decidim::Component.find_or_initialize_by( - participatory_space: process, - manifest_name: "pages" -) -pages.assign_attributes( - name: t("Background", "Hintergrund", "Contexte"), - published_at: pages.published_at || Time.current, - visible: true, - weight: 0 -) -pages.save || fail_model!(pages) -page = Decidim::Pages::Page.find_or_initialize_by(component: pages) -page.body = t( - "

ISOC-style public-interest internet: people should inspect how a civic tool works without first handing over an identity.

" \ - "

On this instance the stock cookie banner is hidden; only essential consent is set. The same idea applies to participation spaces: the text of a process is not a privilege of registered users.

" \ - "

This page is part of that argument. It is published on purpose.

", - "

Internet im öffentlichen Interesse: man soll sehen können, wie ein Beteiligungswerkzeug arbeitet, ohne zuerst eine Identität abzugeben.

" \ - "

Auf dieser Instanz ist der Vorrats-Cookie-Banner ausgeblendet; es gilt nur essential. Dieselbe Idee gilt für Beteiligungsräume: der Text eines Prozesses ist kein Privileg registrierter Konten.

" \ - "

Diese Seite ist absichtlich öffentlich.

", - "

Internet d'intérêt public : on doit pouvoir voir comment un outil civique fonctionne sans d'abord céder une identité.

" \ - "

Ici, la bannière cookies par défaut est masquée ; seul l'essentiel est posé. Même idée pour les espaces de participation : le texte d'un processus n'est pas un privilège des comptes.

" \ - "

Cette page est publique volontairement.

" -) -page.save || fail_model!(page) -puts "pages component id=#{pages.id} page=#{page.id}" - -meetings = Decidim::Component.find_or_initialize_by( - participatory_space: process, - manifest_name: "meetings" -) -meetings.assign_attributes( - name: t("Meetings", "Treffen", "Rencontres"), - published_at: meetings.published_at || Time.current, - visible: true, - weight: 1 -) -meetings.save || fail_model!(meetings) -puts "meetings component id=#{meetings.id} published=#{meetings.published_at}" - -start_at = Time.current.utc.change(hour: 18, min: 0) + 7.days -finish_at = start_at + 2.hours -meeting = Decidim::Meetings::Meeting.find_or_initialize_by( - component: meetings, - author: admin -) -meeting.title = t( - "Open session: reading without an account", - "Offene Runde: Lesen ohne Konto", - "Séance ouverte : lire sans compte" -) -meeting.assign_attributes( - description: t( - "

Public agenda (no registration to read):

    " \ - "
  1. What is already public on hacktivism.ch (Lemmy, Decidim, Castopod).
    2. " \ - "
  2. Privacy by default — no tracker banner as a gate.
    3. " \ - "
  3. Where login is justified (writing, admin).
    4. " \ - "

Online / public. Signing in is optional.

", - "

Öffentliche Traktanden (Lesen ohne Anmeldung):

    " \ - "
  1. Was auf hacktivism.ch schon öffentlich ist (Lemmy, Decidim, Castopod).
    2. " \ - "
  2. Privatsphäre als Vorgabe — kein Tracker-Banner als Tür.
    3. " \ - "
  3. Wo ein Login gerechtfertigt ist (Schreiben, Admin).
    4. " \ - "

Online / öffentlich. Anmelden ist freiwillig.

", - "

Ordre du jour public (lecture sans inscription) :

    " \ - "
  1. Ce qui est déjà public sur hacktivism.ch (Lemmy, Decidim, Castopod).
    2. " \ - "
  2. Vie privée par défaut — pas de bannière traqueur comme porte.
    3. " \ - "
  3. Où un compte se justifie (écriture, admin).
    4. " \ - "

En ligne / public. Connexion facultative.

" - ), - start_time: meeting.start_time || start_at, - end_time: meeting.end_time || finish_at, - address: "hacktivism.ch", - location: t("Online, public stream notes", "Online, öffentliche Notizen", "En ligne, notes publiques"), - location_hints: t( - "No ticket. Page stays readable if you do not attend.", - "Kein Ticket. Die Seite bleibt lesbar, wenn man nicht teilnimmt.", - "Pas de billet. La page reste lisible sans y assister." - ), - type_of_meeting: "in_person", - registration_type: "registration_disabled", - registrations_enabled: false, - private_meeting: false, - transparent: true, - published_at: meeting.published_at || Time.current, - comments_enabled: true -) -meeting.save || fail_model!(meeting) -puts "meeting id=#{meeting.id} published=#{meeting.published_at} start=#{meeting.start_time}" - -proposals = Decidim::Component.find_or_initialize_by( - participatory_space: process, - manifest_name: "proposals" -) -proposals.assign_attributes( - name: t("Proposals", "Vorschläge", "Propositions"), - published_at: proposals.published_at || Time.current, - visible: true, - weight: 2 -) -proposals.save || fail_model!(proposals) - -proposal = Decidim::Proposals::Proposal.find_or_initialize_by(component: proposals) -if proposal.new_record? || proposal.title.blank? - proposal.title = t( - "Keep public processes readable without login", - "Öffentliche Prozesse ohne Anmeldung lesbar halten", - "Garder les processus publics lisibles sans connexion" - ) - proposal.body = t( - "

Decide as a standing rule: published process pages, meetings and this proposal list stay readable without an account. Login is only for creating or endorsing proposals, commenting, and administration.

", - "

Als Regel festhalten: veröffentlichte Prozessseiten, Treffen und diese Vorschlagsliste bleiben ohne Konto lesbar. Login nur zum Erstellen oder Unterstützen von Vorschlägen, Kommentieren und für die Administration.

", - "

En faire une règle : les pages de processus publiées, les rencontres et cette liste de propositions restent lisibles sans compte. Connexion seulement pour créer ou soutenir, commenter, et pour l'administration.

" - ) - proposal.add_coauthor(admin) - proposal.published_at = Time.current -end -proposal.save || fail_model!(proposal) -puts "proposal id=#{proposal.id} published=#{proposal.published_at}" - -block = Decidim::ContentBlock.find_or_initialize_by( - organization: org, - scope_name: "homepage", - manifest_name: "highlighted_processes" -) -block.weight ||= 45 -block.published_at ||= Time.current -block.save || fail_model!(block) -puts "homepage highlighted_processes published=#{block.published_at}" - -isoc_email = ENV["DECIDIM_ISOC_EMAIL"].to_s.strip -isoc_password = ENV["DECIDIM_ISOC_PASSWORD"].to_s -if isoc_email.empty? || isoc_password.empty? - puts "isoc user skipped (DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD unset)" -else - isoc = Decidim::User.find_or_initialize_by(email: isoc_email, organization: org) - isoc.name = ENV.fetch("DECIDIM_ISOC_NAME", "isoc") - isoc.nickname = ENV.fetch("DECIDIM_ISOC_NICKNAME", "isoc") - isoc.password = isoc_password - isoc.password_confirmation = isoc_password - isoc.admin = false - isoc.confirmed_at ||= Time.current - isoc.tos_agreement = true - isoc.accepted_tos_version = org.tos_version - isoc.locale = org.default_locale - isoc.save || fail_model!(isoc) - avatar_path = ENV["DECIDIM_ISOC_AVATAR"].to_s - if !avatar_path.empty? && File.file?(avatar_path) - isoc.avatar.purge if isoc.avatar.attached? - isoc.avatar.attach( - io: File.open(avatar_path, "rb"), - filename: "isoc-gold.png", - content_type: "image/png" - ) - isoc.save || fail_model!(isoc) - puts "isoc avatar attached from #{avatar_path} blob=#{isoc.avatar.blob&.byte_size}" - else - puts "isoc avatar skipped (DECIDIM_ISOC_AVATAR missing)" - end - puts "isoc user id=#{isoc.id} email=#{isoc.email} nick=#{isoc.nickname} admin=#{isoc.admin} confirmed=#{isoc.confirmed_at}" -end - -puts "public process: https://#{host}/processes/#{process.slug}" -puts "public meeting: https://#{host}/processes/#{process.slug}/f/#{meetings.id}/meetings/#{meeting.id}" -puts "public proposal: https://#{host}/processes/#{process.slug}/f/#{proposals.id}/proposals/#{proposal.id}" diff --git a/configs/decidim/theme/hacktivism-consent.js b/configs/decidim/theme/hacktivism-consent.js deleted file mode 100644 index 796f5d7..0000000 --- a/configs/decidim/theme/hacktivism-consent.js +++ /dev/null @@ -1,10 +0,0 @@ -/* Essential-only consent; banner hidden via CSS. */ -(function () { - var name = "decidim-consent"; - if (document.cookie.indexOf(name + "=") !== -1) return; - document.cookie = - name + - "=" + - encodeURIComponent(JSON.stringify({ essential: true })) + - "; path=/; max-age=31536000; SameSite=Lax"; -})(); diff --git a/configs/decidim/theme/hacktivism.css b/configs/decidim/theme/hacktivism.css deleted file mode 100644 index f38e96d..0000000 --- a/configs/decidim/theme/hacktivism.css +++ /dev/null @@ -1,98 +0,0 @@ -/* hacktivism — same palette as bonfire/git/lemmy (exchange-dark) */ -:root, -html { - --primary: #e8a838; - --primary-rgb: 232, 168, 56; - --secondary: #3ecfbf; - --secondary-rgb: 62, 207, 191; - --tertiary: #3d3128; - --success: #16a34a; - --warning: #f0d090; - --alert: #e7131a; - --highlight: #e8a838; -} - -html, -body { - background-color: #1a1410 !important; - background-image: - radial-gradient(ellipse 90% 55% at 50% 108%, rgba(26, 107, 110, 0.35) 0%, transparent 55%), - radial-gradient(circle 420px at 12% 18%, rgba(232, 168, 56, 0.22) 0%, transparent 62%), - linear-gradient(165deg, #2c1e14 0%, #1a1410 38%, #12181a 72%, #0e1c1e 100%) !important; - background-attachment: fixed !important; - color: #fff6e8 !important; -} - -a { - color: #e8a838 !important; -} -a:hover { - color: #f0d090 !important; -} - -.title-bar, -.main-bar, -.navbar, -.topbar, -header.header, -.main-nav, -.footer, -.mini-footer, -.off-canvas, -.sidebar { - background-color: #14110e !important; - color: #fff6e8 !important; - border-color: #2a2018 !important; -} - -.card, -.card__content, -.callout, -.flash, -.dialog, -.reveal, -.accordion-item, -.comment-thread, -.process-header, -.hero, -.home-section { - background-color: #221c16 !important; - color: #fff6e8 !important; - border-color: #2a2018 !important; -} - -.button, -.button.primary, -.button--sc, -input[type="submit"].button { - background-color: #e8a838 !important; - border-color: #e8a838 !important; - color: #1a1410 !important; -} - -.button.secondary { - background-color: #3d3128 !important; - border-color: #3d3128 !important; - color: #fff6e8 !important; -} - -h1, h2, h3, h4, h5, h6, -.title-bar__title, -.card__title { - color: #f0c86a !important; -} - -input, -textarea, -select, -.input-group-field { - background-color: #221c16 !important; - color: #fff6e8 !important; - border-color: #3d3128 !important; -} - -/* No third-party trackers; hide stock GDPR banner (privacy by default). */ -#dc-dialog-wrapper, -.cookies__container { - display: none !important; -} diff --git a/configs/decidim/theme/hacktivism.rb b/configs/decidim/theme/hacktivism.rb deleted file mode 100644 index 762e5d8..0000000 --- a/configs/decidim/theme/hacktivism.rb +++ /dev/null @@ -1,14 +0,0 @@ -# frozen_string_literal: true -# hacktivism theme + host allowlist for decidim.hacktivism.ch - -Rails.application.config.hosts << "decidim.hacktivism.ch" -Rails.application.config.hosts << "127.0.0.1" -Rails.application.config.hosts << "localhost" - -if Rails.application.config.respond_to?(:assume_ssl=) - Rails.application.config.assume_ssl = true -end - -Decidim.configure do |config| - config.enable_html_header_snippets = true if config.respond_to?(:enable_html_header_snippets=) -end diff --git a/configs/ports.md b/configs/ports.md index 872d09c..f8bdc8d 100644 --- a/configs/ports.md +++ b/configs/ports.md @@ -18,13 +18,12 @@ | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** | | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** | | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** | -| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** | | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) | | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` | | 8080 | Tor ORPort | VeciGate: WAN **80→9000**, WAN **443→9001**. -Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}. +Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}. Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN. | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) | diff --git a/host/overview/LIVE.md b/host/overview/LIVE.md index 11120be..46ee303 100644 --- a/host/overview/LIVE.md +++ b/host/overview/LIVE.md @@ -36,7 +36,6 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080|9080|1789' | `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` | | **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` | | `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` | -| `koopa-decidim` (+ postgres, redis, sidekiq) | `decidim/decidim:0.30.8` | **9027** | `decidim.hacktivism.ch` | | **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) | | **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) | | `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` | @@ -62,7 +61,6 @@ Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exc | `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct | | `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) | | `lemmy.hacktivism.ch` | 9026 | -| `decidim.hacktivism.ch` | 9027 | | `tops.ng1.hacktivism.ch` | 9090 | | `tops.ng2.hacktivism.ch` | 9091 | | `tops.ng3.hacktivism.ch` | 9092 | @@ -76,7 +74,6 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). | `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container | | `~/koopa-castopod/` | Castopod compose | | `~/koopa-lemmy/` | Lemmy compose | -| `~/koopa-decidim/` | Decidim compose | | `~/koopa-bonfire/` | Bonfire compose + gitbot | | `~/koopa-prime/` | Jellyfin + qBittorrent | | `~/koopa-forgejo/` | Forgejo rootless | @@ -93,8 +90,6 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). | Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` | | Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` | | User apps | `cd ~/koopa-* && podman-compose up -d` | -| Lemmy | user units `container-koopa-lemmy-db` + `container-koopa-lemmy` (linger) | -| Decidim | user units `container-koopa-decidim-db` + `container-koopa-decidim` (linger) | | tops (ng1–ng3) | user unit `container-koopa-tops.service` (linger) | ## Config mirrors in this repo (`configs/`) @@ -116,4 +111,3 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`). | Forgejo | `2026/2026-07-10--forgejo-rootless.md` | | Bonfire public feeds | `configs/bonfire/public-feeds.md` | | Castopod content | `2026/2026-07-09--castopod-content.md` | -| Decidim | `2026/2026-08-17--decidim.md` · `configs/decidim/` | diff --git a/host/overview/services.md b/host/overview/services.md index 6c72548..0c9daf2 100644 --- a/host/overview/services.md +++ b/host/overview/services.md @@ -37,7 +37,6 @@ flowchart TB Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"] Paivana["koopa-paivana\n:9025"] Lemmy["koopa-lemmy-proxy\n:9026"] - Decidim["koopa-decidim\n:9027"] end Tor["tor ORPort :8080"] @@ -64,7 +63,6 @@ flowchart TB CaddyHTTPS -->|git.hacktivism.ch| Forgejo CaddyHTTPS -->|paivana.hacktivism.ch| Paivana CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy - CaddyHTTPS -->|decidim.hacktivism.ch| Decidim ``` ## Port table @@ -86,7 +84,6 @@ flowchart TB | **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` | | **9025** | podman | **paivana** → `paivana.hacktivism.ch` | | **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` | -| **9027** | podman | **decidim** → `decidim.hacktivism.ch` | | **9200** | podman | **forgejo** git-SSH (host-direct) | | 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` | | 8080 | tor | ORPort | diff --git a/scripts/decidim/apply-branding.sh b/scripts/decidim/apply-branding.sh deleted file mode 100755 index 6327fe3..0000000 --- a/scripts/decidim/apply-branding.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env bash -# Apply hacktivism colors + header CSS on the live organization. -set -euo pipefail -cd "${HOME}/koopa-decidim" -set -a -# shellcheck disable=SC1091 -source .env -# shellcheck disable=SC1091 -source users.env -set +a -podman exec \ - -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \ - -e DECIDIM_SYSTEM_EMAIL \ - -e DECIDIM_SYSTEM_PASSWORD \ - -e DECIDIM_ADMIN_EMAIL \ - -e DECIDIM_ADMIN_PASSWORD \ - -e DECIDIM_ADMIN_NAME \ - -e DECIDIM_APPLICATION_NAME \ - -e DECIDIM_DEFAULT_LOCALE \ - -e DECIDIM_AVAILABLE_LOCALES \ - koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb -echo "branding applied. public: https://decidim.hacktivism.ch/" diff --git a/scripts/decidim/install-systemd.sh b/scripts/decidim/install-systemd.sh deleted file mode 100755 index 01934d3..0000000 --- a/scripts/decidim/install-systemd.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/usr/bin/env bash -# Install Decidim user systemd units on koopa (boot via linger). -set -euo pipefail -HERE="$(cd "$(dirname "$0")" && pwd)" -LIVE="${HOME}/koopa-decidim" -# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin -if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then - UNIT_SRC="${HERE}/../../configs/decidim" -elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then - UNIT_SRC="${LIVE}" -else - echo "ERROR: decidim unit files not found" >&2 - exit 1 -fi -UNIT_DIR="${HOME}/.config/systemd/user" - -mkdir -p "${UNIT_DIR}" -cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/" -cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/" - -systemctl --user daemon-reload -systemctl --user enable \ - container-koopa-decidim-db.service \ - container-koopa-decidim.service - -if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then - (cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d) -fi - -systemctl --user start \ - container-koopa-decidim-db.service \ - container-koopa-decidim.service - -systemctl --user --no-pager --lines=0 status \ - container-koopa-decidim-db.service \ - container-koopa-decidim.service || true - -if command -v loginctl >/dev/null 2>&1; then - if [ "$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no)" != "yes" ]; then - echo "NOTE: enable linger so units start after reboot without login:" - echo " sudo loginctl enable-linger $(id -un)" - else - echo "linger already enabled for $(id -un)" - fi -fi - -echo "OK. Public: https://decidim.hacktivism.ch/" diff --git a/scripts/decidim/seed-example.sh b/scripts/decidim/seed-example.sh deleted file mode 100755 index 51f1dba..0000000 --- a/scripts/decidim/seed-example.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/usr/bin/env bash -# Publish public example process/meeting + optional isoc user from users.env. -set -euo pipefail -cd "${HOME}/koopa-decidim" -set -a -# shellcheck disable=SC1091 -source .env -# shellcheck disable=SC1091 -source users.env -set +a - -src="" -if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then - src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" -elif [ -f ./seed_example.rb ]; then - src="./seed_example.rb" -else - echo "ERROR: seed_example.rb not found" >&2 - exit 1 -fi -podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb - -avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}" -avatar_ctr="" -if [ -f "${avatar_host}" ]; then - avatar_ctr="/tmp/isoc-gold.png" - podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}" -fi - -podman exec \ - -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \ - -e DECIDIM_ADMIN_EMAIL \ - -e DECIDIM_ISOC_EMAIL \ - -e DECIDIM_ISOC_PASSWORD \ - -e DECIDIM_ISOC_NAME \ - -e DECIDIM_ISOC_NICKNAME \ - -e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \ - koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb -echo "seed done. public: https://decidim.hacktivism.ch/processes/example" diff --git a/scripts/decidim/up.sh b/scripts/decidim/up.sh deleted file mode 100755 index 21a6a9d..0000000 --- a/scripts/decidim/up.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail -DIR="${HOME}/koopa-decidim" -cd "${DIR}" -set -a -# shellcheck disable=SC1091 -source .env -set +a -podman-compose up -d -echo "== wait for :9027 ==" -ok=0 -for i in $(seq 1 80); do - code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true) - echo "try $i: $code" - case "$code" in - 2*|3*) ok=1; break ;; - esac - sleep 5 -done -[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; } -echo "local ok. public: https://decidim.hacktivism.ch/" diff --git a/scripts/lemmy/install-systemd.sh b/scripts/lemmy/install-systemd.sh index f064f9f..626dc3b 100755 --- a/scripts/lemmy/install-systemd.sh +++ b/scripts/lemmy/install-systemd.sh @@ -1,21 +1,12 @@ #!/usr/bin/env bash # Install Lemmy user systemd units on koopa (boot via linger). set -euo pipefail -HERE="$(cd "$(dirname "$0")" && pwd)" -LIVE="${HOME}/koopa-lemmy" -if [ -f "${HERE}/../../configs/lemmy/container-koopa-lemmy.service" ]; then - UNIT_SRC="${HERE}/../../configs/lemmy" -elif [ -f "${LIVE}/container-koopa-lemmy.service" ]; then - UNIT_SRC="${LIVE}" -else - echo "ERROR: lemmy unit files not found" >&2 - exit 1 -fi +ROOT="$(cd "$(dirname "$0")/../.." && pwd)" UNIT_DIR="${HOME}/.config/systemd/user" mkdir -p "${UNIT_DIR}" -cp "${UNIT_SRC}/container-koopa-lemmy-db.service" "${UNIT_DIR}/" -cp "${UNIT_SRC}/container-koopa-lemmy.service" "${UNIT_DIR}/" +cp "${ROOT}/configs/lemmy/container-koopa-lemmy-db.service" "${UNIT_DIR}/" +cp "${ROOT}/configs/lemmy/container-koopa-lemmy.service" "${UNIT_DIR}/" systemctl --user daemon-reload systemctl --user enable \ @@ -34,13 +25,4 @@ systemctl --user --no-pager --lines=0 status \ container-koopa-lemmy-db.service \ container-koopa-lemmy.service || true -if command -v loginctl >/dev/null 2>&1; then - if [ "$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no)" != "yes" ]; then - echo "NOTE: enable linger so units start after reboot without login:" - echo " sudo loginctl enable-linger $(id -un)" - else - echo "linger already enabled for $(id -un)" - fi -fi - echo "OK. Public: https://lemmy.hacktivism.ch/" diff --git a/scripts/login-health/README.md b/scripts/login-health/README.md index 0003217..04b1a6b 100644 --- a/scripts/login-health/README.md +++ b/scripts/login-health/README.md @@ -65,9 +65,7 @@ overall: OK ok=42 warn=0 fail=0 | Git SSH | TCP `:9200` | **Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports. -**Optional** (→ WARN): castopod, bonfire, lemmy, decidim, prime, bt, paivana, tops, tor, nym. - -Collect also checks **linger** and that Lemmy/Decidim user units are **enabled** (reboot survival). +**Optional** (→ WARN): castopod, bonfire, lemmy, prime, bt, paivana, tops, tor, nym. Read-only. No restarts, no secrets. diff --git a/scripts/login-health/koopa-login-health.sh b/scripts/login-health/koopa-login-health.sh index 309a782..aa9c2db 100755 --- a/scripts/login-health/koopa-login-health.sh +++ b/scripts/login-health/koopa-login-health.sh @@ -151,7 +151,6 @@ EXPECT_CONTAINERS=( koopa-castopod koopa-bonfire koopa-lemmy-proxy - koopa-decidim koopa-prime-jellyfin koopa-prime-qbittorrent koopa-forgejo @@ -174,7 +173,6 @@ OPTIONAL_CONTAINERS=( koopa-castopod koopa-bonfire koopa-lemmy-proxy - koopa-decidim koopa-paivana ) @@ -187,7 +185,6 @@ PROBES=( "castopod|http://127.0.0.1:9020/|200,302,303,307,308" "bonfire|http://127.0.0.1:9021/|200,302,303,307,308" "lemmy|http://127.0.0.1:9026/|200,302,303,307,308" - "decidim|http://127.0.0.1:9027/|200,301,302,303,307,308" "prime|http://127.0.0.1:9022/|200,302,303,307,308" "bt|http://127.0.0.1:9023/|200,302,303,307,308,401" "paivana|http://127.0.0.1:9025/|200,302,303,307,308" @@ -196,7 +193,7 @@ PROBES=( "tops-ng3|http://127.0.0.1:9092/|200,302,303" ) -OPTIONAL_PROBES=(castopod bonfire lemmy decidim prime bt paivana tops-ng1 tops-ng2 tops-ng3) +OPTIONAL_PROBES=(castopod bonfire lemmy prime bt paivana tops-ng1 tops-ng2 tops-ng3) C_OK=; C_WARN=; C_FAIL=; C_DIM=; C_RST=; C_BOLD= # colors only when writing for a tty later; snapshots are plain + optional ANSI if COLLECT_COLOR=1 @@ -280,34 +277,6 @@ do_collect() { record WARN "systemctl not available" fi - # Reboot survival: linger + enabled user units (public stacks). - if command -v loginctl >/dev/null 2>&1; then - linger_st=$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no) - if [ "${linger_st}" = "yes" ]; then - record OK "linger=yes ($(id -un))" - else - record FAIL "linger=${linger_st} (user units will not start after reboot without login)" - fi - else - record WARN "loginctl not available (cannot check linger)" - fi - if command -v systemctl >/dev/null 2>&1 && [ "$(id -u 2>/dev/null)" != "0" ]; then - local u en - for u in \ - container-koopa-lemmy-db.service \ - container-koopa-lemmy.service \ - container-koopa-decidim-db.service \ - container-koopa-decidim.service - do - en=$(systemctl --user is-enabled "${u}" 2>/dev/null || echo unknown) - if [ "${en}" = "enabled" ]; then - record OK "unit ${u} enabled" - else - record WARN "unit ${u} is ${en} (will not start on reboot)" - fi - done - fi - if command -v ss >/dev/null 2>&1; then listen_blob=$(ss -lnt 2>/dev/null | awk '{print $4}' || true) for port in 9000 9001 9010 9011 9012 9024 9200; do @@ -317,7 +286,7 @@ do_collect() { record FAIL "nothing listening on :${port}" fi done - for port in 9020 9021 9022 9023 9025 9026 9027 9090 9091 9092 8080 9080; do + for port in 9020 9021 9022 9023 9025 9026 9090 9091 9092 8080 9080; do if printf '%s\n' "${listen_blob}" | grep -qE "[:.]${port}\$"; then record OK "listen :${port} (optional)" else @@ -354,7 +323,7 @@ do_collect() { fi fi done - for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db koopa-decidim-db koopa-decidim-redis; do + for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db; do if printf '%s\n' "${running_names}" | grep -qxF "${dep}"; then record INFO "dep ${dep} running" else