Compare commits
4 commits
d519fb3c80
...
50fc9a35c0
| Author | SHA1 | Date | |
|---|---|---|---|
|
50fc9a35c0 | ||
|
|
6a99f7d6bb | ||
|
|
03e5c0d3ad | ||
|
|
609056615e |
27 changed files with 1160 additions and 24 deletions
43
2026/2026-08-17--decidim.md
Normal file
43
2026/2026-08-17--decidim.md
Normal file
|
|
@ -0,0 +1,43 @@
|
||||||
|
# Decidim — decidim.hacktivism.ch (2026-08-17)
|
||||||
|
|
||||||
|
Site: **https://decidim.hacktivism.ch/**
|
||||||
|
Port **9027** → Caddy. Stack: `koopa-decidim` + `koopa-decidim-sidekiq` + `koopa-decidim-db` + `koopa-decidim-redis`. Image `decidim/decidim:0.30.8`.
|
||||||
|
|
||||||
|
Live: `~/koopa-decidim/` (compose mirror `configs/decidim/`). Secrets only on host (`.env`, `users.env`).
|
||||||
|
|
||||||
|
Instance name **hacktivism**. Theme: exchange-dark (gold `#e8a838`, bg `#1a1410`) via `theme/hacktivism.css`. Analog: `configs/lemmy/`.
|
||||||
|
|
||||||
|
Admin users are on the host (`~/koopa-decidim/users.env`), not in this repo.
|
||||||
|
|
||||||
|
Caddy: `sudo /home/hernani/koopa-caddy/apply.sh`
|
||||||
|
Boot: `scripts/decidim/install-systemd.sh` (linger already yes on koopa).
|
||||||
|
|
||||||
|
## Cookie / privacy
|
||||||
|
|
||||||
|
Stock Decidim still emits `#dc-dialog-wrapper` (Accept all / essential / Settings). This instance has no third-party trackers; privacy is default.
|
||||||
|
|
||||||
|
- CSS: `#dc-dialog-wrapper, .cookies__container { display: none !important; }`
|
||||||
|
- JS: `/hacktivism-consent.js` sets `decidim-consent={"essential":true}` if missing
|
||||||
|
- Live 2026-08-17: HTML 200, CSS/JS 200, hide rules in public `/hacktivism.css`
|
||||||
|
|
||||||
|
## Reboot (checked 2026-08-17)
|
||||||
|
|
||||||
|
| Item | Value |
|
||||||
|
|------|--------|
|
||||||
|
| linger `hernani` | yes |
|
||||||
|
| `container-koopa-decidim-db` | enabled + active |
|
||||||
|
| `container-koopa-decidim` | enabled + active |
|
||||||
|
| `container-koopa-lemmy-db` / `container-koopa-lemmy` | enabled + active |
|
||||||
|
| listen | `:9027` `:9026` |
|
||||||
|
|
||||||
|
login-health: probes + containers + linger + these units enabled. Loopback HTTP on :9027 is **301** (app wants HTTPS; TLS is Caddy). Probe allows 301. After reboot: login-health only unless asked.
|
||||||
|
|
||||||
|
## Public example + isoc
|
||||||
|
|
||||||
|
- Process **example** (published, not private): `https://decidim.hacktivism.ch/processes/example`
|
||||||
|
— title **Öffentliche digitale Allmende** (public-by-default reading).
|
||||||
|
- Published meeting **Offene Runde: Lesen ohne Konto** + one public proposal + background page.
|
||||||
|
- Homepage block `highlighted_processes` published.
|
||||||
|
- Participant `isoc` on the host (`users.env`); password not in this repo.
|
||||||
|
- Avatar: gold ISOC globe (same crop as Bonfire `@isoc`); host file `~/koopa-decidim/assets/img/isoc-gold.png`, not in this repo.
|
||||||
|
- Seed: `scripts/decidim/seed-example.sh` / `configs/decidim/seed_example.rb`.
|
||||||
16
2026/2026-09-05--hernani-ollama-user+power.md
Normal file
16
2026/2026-09-05--hernani-ollama-user+power.md
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
# koopa: hernani user Ollama + power sampling (2026-09-05)
|
||||||
|
|
||||||
|
Freigabe: operator — install Ollama under hernani (no root package); loopback only; laptop tunnels.
|
||||||
|
|
||||||
|
## Ollama
|
||||||
|
|
||||||
|
- Binary: `~hernani/.local/bin/ollama` (v0.33.3 from GitHub `ollama-linux-amd64.tar.zst`)
|
||||||
|
- Unit: `~/.config/systemd/user/ollama.service` · `OLLAMA_HOST=127.0.0.1:11434` · enabled
|
||||||
|
- Access: SSH as **hernani** from clementine/magikoopa → LocalForward (helper `koopa-ollama-tunnel` → laptop `:11438`)
|
||||||
|
- Models: small + exotic pulls (see pull log `/tmp/ollama-koopa-pull-20260905.log`) — prefer ≤3B
|
||||||
|
|
||||||
|
## Power / energy
|
||||||
|
|
||||||
|
- Deployed `host-power.py` to `~hernani/.local/bin/host-power`
|
||||||
|
- Laptop: `remote-power koopa` / `koopa-power` → JSON watts; combo derives Wh
|
||||||
|
- RAPL `energy_uj` root-only → quality **estimated** until Freigabe for `enable-host-power-access.sh --apply`
|
||||||
|
|
@ -19,6 +19,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
|
||||||
|------|--------|------|
|
|------|--------|------|
|
||||||
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
|
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
|
||||||
| Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` |
|
| Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` |
|
||||||
|
| Decidim | host-only `~/koopa-decidim/{.env,users.env}` (compose mirror in admin-log `configs/decidim/`) | `~/koopa-decidim/` |
|
||||||
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
|
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
|
||||||
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
|
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
|
||||||
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
|
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
# Internal only (not in the browser URL):
|
# Internal only (not in the browser URL):
|
||||||
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
||||||
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
||||||
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh
|
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh
|
||||||
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
||||||
|
|
||||||
{
|
{
|
||||||
|
|
@ -39,28 +39,28 @@ taler.hacktivism.ch {
|
||||||
|
|
||||||
# surface + aptdeploy HTML (taler.hacktivism.ch only)
|
# surface + aptdeploy HTML (taler.hacktivism.ch only)
|
||||||
handle /taler-monitoring-surface_err {
|
handle /taler-monitoring-surface_err {
|
||||||
redir * /taler-monitoring-surface_err/ 302
|
redir /taler-monitoring-surface_err/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-surface_err* {
|
handle /taler-monitoring-surface_err* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-surface {
|
handle /taler-monitoring-surface {
|
||||||
redir * /taler-monitoring-surface/ 302
|
redir /taler-monitoring-surface/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-surface* {
|
handle /taler-monitoring-surface* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-aptdeploy_err {
|
handle /taler-monitoring-aptdeploy_err {
|
||||||
redir * /taler-monitoring-aptdeploy_err/ 302
|
redir /taler-monitoring-aptdeploy_err/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-aptdeploy_err* {
|
handle /taler-monitoring-aptdeploy_err* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-aptdeploy {
|
handle /taler-monitoring-aptdeploy {
|
||||||
redir * /taler-monitoring-aptdeploy/ 302
|
redir /taler-monitoring-aptdeploy/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-aptdeploy* {
|
handle /taler-monitoring-aptdeploy* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
|
|
@ -68,14 +68,14 @@ taler.hacktivism.ch {
|
||||||
}
|
}
|
||||||
|
|
||||||
handle /taler-monitoring-mattermost_err {
|
handle /taler-monitoring-mattermost_err {
|
||||||
redir * /taler-monitoring-mattermost_err/ 302
|
redir /taler-monitoring-mattermost_err/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mattermost_err* {
|
handle /taler-monitoring-mattermost_err* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mattermost {
|
handle /taler-monitoring-mattermost {
|
||||||
redir * /taler-monitoring-mattermost/ 302
|
redir /taler-monitoring-mattermost/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mattermost* {
|
handle /taler-monitoring-mattermost* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
|
|
@ -83,14 +83,14 @@ taler.hacktivism.ch {
|
||||||
}
|
}
|
||||||
|
|
||||||
handle /taler-monitoring-mail_err {
|
handle /taler-monitoring-mail_err {
|
||||||
redir * /taler-monitoring-mail_err/ 302
|
redir /taler-monitoring-mail_err/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mail_err* {
|
handle /taler-monitoring-mail_err* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mail {
|
handle /taler-monitoring-mail {
|
||||||
redir * /taler-monitoring-mail/ 302
|
redir /taler-monitoring-mail/ 302
|
||||||
}
|
}
|
||||||
handle /taler-monitoring-mail* {
|
handle /taler-monitoring-mail* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
|
|
@ -99,14 +99,14 @@ taler.hacktivism.ch {
|
||||||
|
|
||||||
# taler-monitoring console HTML (host static — not in app containers)
|
# taler-monitoring console HTML (host static — not in app containers)
|
||||||
handle /monitoring_err {
|
handle /monitoring_err {
|
||||||
redir * /monitoring_err/ 302
|
redir /monitoring_err/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring_err* {
|
handle /monitoring_err* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /monitoring {
|
handle /monitoring {
|
||||||
redir * /monitoring/ 302
|
redir /monitoring/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring* {
|
handle /monitoring* {
|
||||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||||
|
|
@ -143,14 +143,14 @@ exchange.hacktivism.ch {
|
||||||
|
|
||||||
# taler-monitoring console HTML (host static — not in app containers)
|
# taler-monitoring console HTML (host static — not in app containers)
|
||||||
handle /monitoring_err {
|
handle /monitoring_err {
|
||||||
redir * /monitoring_err/ 302
|
redir /monitoring_err/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring_err* {
|
handle /monitoring_err* {
|
||||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /monitoring {
|
handle /monitoring {
|
||||||
redir * /monitoring/ 302
|
redir /monitoring/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring* {
|
handle /monitoring* {
|
||||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||||
|
|
@ -177,14 +177,14 @@ bank.hacktivism.ch {
|
||||||
|
|
||||||
# taler-monitoring console HTML (host static — not in app containers)
|
# taler-monitoring console HTML (host static — not in app containers)
|
||||||
handle /monitoring_err {
|
handle /monitoring_err {
|
||||||
redir * /monitoring_err/ 302
|
redir /monitoring_err/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring_err* {
|
handle /monitoring_err* {
|
||||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||||
file_server
|
file_server
|
||||||
}
|
}
|
||||||
handle /monitoring {
|
handle /monitoring {
|
||||||
redir * /monitoring/ 302
|
redir /monitoring/ 302
|
||||||
}
|
}
|
||||||
handle /monitoring* {
|
handle /monitoring* {
|
||||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||||
|
|
@ -315,7 +315,24 @@ lemmy.hacktivism.ch {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch {
|
# 9027 decidim (rails)
|
||||||
|
decidim.hacktivism.ch {
|
||||||
|
header Alt-Svc "clear"
|
||||||
|
reverse_proxy 127.0.0.1:9027 {
|
||||||
|
header_up Host {host}
|
||||||
|
header_up X-Forwarded-For {remote_host}
|
||||||
|
header_up X-Forwarded-Host {host}
|
||||||
|
header_up X-Forwarded-Proto {scheme}
|
||||||
|
header_up X-Forwarded-Port 443
|
||||||
|
flush_interval -1
|
||||||
|
transport http {
|
||||||
|
read_timeout 3600s
|
||||||
|
write_timeout 3600s
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch {
|
||||||
handle /.well-known/acme-challenge/* {
|
handle /.well-known/acme-challenge/* {
|
||||||
root * /var/www/acme
|
root * /var/www/acme
|
||||||
file_server
|
file_server
|
||||||
|
|
|
||||||
17
configs/decidim/.env.example
Normal file
17
configs/decidim/.env.example
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
POSTGRES_PASSWORD=@inline-secret@
|
||||||
|
SECRET_KEY_BASE=@inline-secret@
|
||||||
|
DECIDIM_APPLICATION_NAME=hacktivism
|
||||||
|
DECIDIM_MAILER_SENDER=noreply@hacktivism.ch
|
||||||
|
DECIDIM_AVAILABLE_LOCALES=en,de,fr
|
||||||
|
DECIDIM_DEFAULT_LOCALE=en
|
||||||
|
DECIDIM_HOST=decidim.hacktivism.ch
|
||||||
|
SMTP_ADDRESS=127.0.0.1
|
||||||
|
SMTP_DOMAIN=hacktivism.ch
|
||||||
|
SMTP_USERNAME=unused
|
||||||
|
SMTP_PASSWORD=unused
|
||||||
|
SMTP_PORT=25
|
||||||
|
QUEUE_ADAPTER=sidekiq
|
||||||
|
DECIDIM_ISOC_EMAIL=isoc@hacktivism.ch
|
||||||
|
DECIDIM_ISOC_PASSWORD=@inline-secret@
|
||||||
|
DECIDIM_ISOC_NAME=isoc
|
||||||
|
DECIDIM_ISOC_NICKNAME=isoc
|
||||||
28
configs/decidim/README.md
Normal file
28
configs/decidim/README.md
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
# Decidim — decidim.hacktivism.ch
|
||||||
|
|
||||||
|
| Item | Value |
|
||||||
|
|------|--------|
|
||||||
|
| Live | `/home/hernani/koopa-decidim/` |
|
||||||
|
| Compose | `compose.yml` (mirror, no secrets) |
|
||||||
|
| Port | **9027** → Caddy |
|
||||||
|
| Site | https://decidim.hacktivism.ch/ |
|
||||||
|
| Image | `decidim/decidim:0.30.8` + postgres 16 + redis 7 + sidekiq |
|
||||||
|
|
||||||
|
Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo.
|
||||||
|
|
||||||
|
Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Lemmy/Bonfire). Analog stack: `configs/lemmy/`.
|
||||||
|
|
||||||
|
Privacy: no third-party trackers. Stock GDPR banner is hidden (`#dc-dialog-wrapper`); `theme/hacktivism-consent.js` sets essential-only `decidim-consent`.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d
|
||||||
|
scripts/decidim/install-systemd.sh
|
||||||
|
scripts/decidim/apply-branding.sh
|
||||||
|
scripts/decidim/seed-example.sh # public process /processes/example + optional isoc user
|
||||||
|
```
|
||||||
|
|
||||||
|
Public example (no account): `https://decidim.hacktivism.ch/processes/example`
|
||||||
|
|
||||||
|
Caddy: `sudo /home/hernani/koopa-caddy/apply.sh`
|
||||||
|
|
||||||
|
Daylog: `2026/2026-08-17--decidim.md`.
|
||||||
90
configs/decidim/assets/img/favicon.svg
Normal file
90
configs/decidim/assets/img/favicon.svg
Normal file
|
|
@ -0,0 +1,90 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
|
||||||
|
<!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
|
||||||
|
|
||||||
|
<!-- motion streaks -->
|
||||||
|
<line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
|
||||||
|
<line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
|
||||||
|
<line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
|
||||||
|
|
||||||
|
<!-- ground shadow -->
|
||||||
|
<ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
|
||||||
|
|
||||||
|
<!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
|
||||||
|
<!-- sits under the rider from lower-left to upper-right -->
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
|
||||||
|
|
||||||
|
<!-- wand jewel (front tip) -->
|
||||||
|
<circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
|
||||||
|
<circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
|
||||||
|
<!-- sparkles at tip -->
|
||||||
|
<polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
|
||||||
|
<polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
|
||||||
|
<circle cx="118" cy="78" r="2" fill="#bae6fd"/>
|
||||||
|
|
||||||
|
<!-- ===== RIDER on top of wand ===== -->
|
||||||
|
<!-- blue cape fluttering left -->
|
||||||
|
<path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
|
||||||
|
<path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
|
||||||
|
|
||||||
|
<!-- BLUE ROBE (body sitting ON shaft) -->
|
||||||
|
<ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
|
||||||
|
<ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
|
||||||
|
<!-- white trim -->
|
||||||
|
<path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
|
||||||
|
<path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
|
||||||
|
<!-- green shell -->
|
||||||
|
<ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
|
||||||
|
<ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
|
||||||
|
|
||||||
|
<!-- legs over the wand -->
|
||||||
|
<ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
|
||||||
|
<ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
|
||||||
|
<!-- yellow feet hanging past shaft -->
|
||||||
|
<ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
|
||||||
|
<ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
|
||||||
|
|
||||||
|
<!-- left arm forward -->
|
||||||
|
<ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
|
||||||
|
<circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
|
||||||
|
<!-- right arm up -->
|
||||||
|
<ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
|
||||||
|
<circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
|
||||||
|
<circle cx="82" cy="60" r="5" fill="#38bdf8"/>
|
||||||
|
<circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
|
||||||
|
|
||||||
|
<!-- ===== HEAD ===== -->
|
||||||
|
<ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
|
||||||
|
<ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
|
||||||
|
<ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
|
||||||
|
<ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
|
||||||
|
|
||||||
|
<!-- glasses -->
|
||||||
|
<circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
<line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
<circle cx="44" cy="50" r="3" fill="#0f172a"/>
|
||||||
|
<circle cx="68" cy="50" r="3" fill="#0f172a"/>
|
||||||
|
<circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
|
||||||
|
<circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
|
||||||
|
|
||||||
|
<!-- snout + mustache -->
|
||||||
|
<ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
|
||||||
|
<path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
|
||||||
|
<path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
|
||||||
|
|
||||||
|
<!-- BLUE pointed hat -->
|
||||||
|
<path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
|
||||||
|
<path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
|
||||||
|
<ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
|
||||||
|
<ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
|
||||||
|
<ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
|
||||||
|
<polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
|
||||||
|
<polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
|
||||||
|
<circle cx="54" cy="4" r="6" fill="#f8fafc"/>
|
||||||
|
</svg>
|
||||||
|
After Width: | Height: | Size: 4.9 KiB |
90
configs/decidim/assets/img/logo.svg
Normal file
90
configs/decidim/assets/img/logo.svg
Normal file
|
|
@ -0,0 +1,90 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
|
||||||
|
<!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
|
||||||
|
|
||||||
|
<!-- motion streaks -->
|
||||||
|
<line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
|
||||||
|
<line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
|
||||||
|
<line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
|
||||||
|
|
||||||
|
<!-- ground shadow -->
|
||||||
|
<ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
|
||||||
|
|
||||||
|
<!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
|
||||||
|
<!-- sits under the rider from lower-left to upper-right -->
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
|
||||||
|
<line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
|
||||||
|
|
||||||
|
<!-- wand jewel (front tip) -->
|
||||||
|
<circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
|
||||||
|
<circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
|
||||||
|
<!-- sparkles at tip -->
|
||||||
|
<polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
|
||||||
|
<polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
|
||||||
|
<circle cx="118" cy="78" r="2" fill="#bae6fd"/>
|
||||||
|
|
||||||
|
<!-- ===== RIDER on top of wand ===== -->
|
||||||
|
<!-- blue cape fluttering left -->
|
||||||
|
<path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
|
||||||
|
<path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
|
||||||
|
|
||||||
|
<!-- BLUE ROBE (body sitting ON shaft) -->
|
||||||
|
<ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
|
||||||
|
<ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
|
||||||
|
<!-- white trim -->
|
||||||
|
<path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
|
||||||
|
<path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
|
||||||
|
<!-- green shell -->
|
||||||
|
<ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
|
||||||
|
<ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
|
||||||
|
|
||||||
|
<!-- legs over the wand -->
|
||||||
|
<ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
|
||||||
|
<ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
|
||||||
|
<!-- yellow feet hanging past shaft -->
|
||||||
|
<ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
|
||||||
|
<ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
|
||||||
|
|
||||||
|
<!-- left arm forward -->
|
||||||
|
<ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
|
||||||
|
<circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
|
||||||
|
<!-- right arm up -->
|
||||||
|
<ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
|
||||||
|
<circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
|
||||||
|
<circle cx="82" cy="60" r="5" fill="#38bdf8"/>
|
||||||
|
<circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
|
||||||
|
|
||||||
|
<!-- ===== HEAD ===== -->
|
||||||
|
<ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
|
||||||
|
<ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
|
||||||
|
<ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
|
||||||
|
<ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
|
||||||
|
|
||||||
|
<!-- glasses -->
|
||||||
|
<circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
|
||||||
|
<line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
<line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
|
||||||
|
<circle cx="44" cy="50" r="3" fill="#0f172a"/>
|
||||||
|
<circle cx="68" cy="50" r="3" fill="#0f172a"/>
|
||||||
|
<circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
|
||||||
|
<circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
|
||||||
|
|
||||||
|
<!-- snout + mustache -->
|
||||||
|
<ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
|
||||||
|
<path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
|
||||||
|
<path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
|
||||||
|
|
||||||
|
<!-- BLUE pointed hat -->
|
||||||
|
<path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
|
||||||
|
<path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
|
||||||
|
<ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
|
||||||
|
<ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
|
||||||
|
<ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
|
||||||
|
<polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
|
||||||
|
<polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
|
||||||
|
<circle cx="54" cy="4" r="6" fill="#f8fafc"/>
|
||||||
|
</svg>
|
||||||
|
After Width: | Height: | Size: 4.9 KiB |
78
configs/decidim/bootstrap.rb
Normal file
78
configs/decidim/bootstrap.rb
Normal file
|
|
@ -0,0 +1,78 @@
|
||||||
|
# frozen_string_literal: true
|
||||||
|
# Create system admin + organization + org admin. Idempotent.
|
||||||
|
# Usage: bundle exec rails runner /code/lib/koopa_bootstrap.rb
|
||||||
|
|
||||||
|
host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
|
||||||
|
sys_email = ENV.fetch("DECIDIM_SYSTEM_EMAIL")
|
||||||
|
sys_password = ENV.fetch("DECIDIM_SYSTEM_PASSWORD")
|
||||||
|
admin_email = ENV.fetch("DECIDIM_ADMIN_EMAIL")
|
||||||
|
admin_password = ENV.fetch("DECIDIM_ADMIN_PASSWORD")
|
||||||
|
admin_name = ENV.fetch("DECIDIM_ADMIN_NAME", "hacktivism")
|
||||||
|
org_name = ENV.fetch("DECIDIM_APPLICATION_NAME", "hacktivism")
|
||||||
|
|
||||||
|
sys = Decidim::System::Admin.find_or_initialize_by(email: sys_email)
|
||||||
|
sys.password = sys_password
|
||||||
|
sys.password_confirmation = sys_password
|
||||||
|
sys.save!
|
||||||
|
puts "system admin: #{sys.email}"
|
||||||
|
|
||||||
|
org = Decidim::Organization.find_by(host: host)
|
||||||
|
if org.nil?
|
||||||
|
attrs = {
|
||||||
|
host: host,
|
||||||
|
default_locale: ENV.fetch("DECIDIM_DEFAULT_LOCALE", "en"),
|
||||||
|
available_locales: ENV.fetch("DECIDIM_AVAILABLE_LOCALES", "en,de,fr").split(","),
|
||||||
|
reference_prefix: "HCK",
|
||||||
|
time_zone: "Europe/Zurich",
|
||||||
|
users_registration_mode: "enabled",
|
||||||
|
force_users_to_authenticate_before_access_organization: false,
|
||||||
|
available_authorizations: [],
|
||||||
|
tos_version: Time.current,
|
||||||
|
colors: {
|
||||||
|
"primary" => "#e8a838",
|
||||||
|
"secondary" => "#3ecfbf",
|
||||||
|
"tertiary" => "#3d3128",
|
||||||
|
"success" => "#16a34a",
|
||||||
|
"warning" => "#f0d090",
|
||||||
|
"alert" => "#e7131a"
|
||||||
|
},
|
||||||
|
header_snippets: %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
|
||||||
|
}
|
||||||
|
name_val = { "en" => org_name, "de" => org_name, "fr" => org_name }
|
||||||
|
desc_val = { "en" => "hacktivism participatory platform", "de" => "hacktivism Partizipationsplattform", "fr" => "plateforme participative hacktivism" }
|
||||||
|
begin
|
||||||
|
org = Decidim::Organization.new(attrs.merge(name: name_val, description: desc_val))
|
||||||
|
org.save!
|
||||||
|
rescue StandardError
|
||||||
|
org = Decidim::Organization.new(attrs.merge(name: org_name, description: "hacktivism participatory platform"))
|
||||||
|
org.save!
|
||||||
|
end
|
||||||
|
Decidim::System::CreateDefaultPages.call(org) if defined?(Decidim::System::CreateDefaultPages)
|
||||||
|
Decidim::System::CreateDefaultContentBlocks.call(org) if defined?(Decidim::System::CreateDefaultContentBlocks)
|
||||||
|
puts "organization created host=#{org.host}"
|
||||||
|
else
|
||||||
|
org.colors = {
|
||||||
|
"primary" => "#e8a838",
|
||||||
|
"secondary" => "#3ecfbf",
|
||||||
|
"tertiary" => "#3d3128",
|
||||||
|
"success" => "#16a34a",
|
||||||
|
"warning" => "#f0d090",
|
||||||
|
"alert" => "#e7131a"
|
||||||
|
}
|
||||||
|
org.header_snippets = %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
|
||||||
|
org.save!
|
||||||
|
puts "organization updated host=#{org.host}"
|
||||||
|
end
|
||||||
|
|
||||||
|
user = Decidim::User.find_or_initialize_by(email: admin_email, organization: org)
|
||||||
|
user.name = admin_name
|
||||||
|
user.nickname = admin_name.downcase.gsub(/[^a-z0-9_]/, "")[0, 20]
|
||||||
|
user.password = admin_password
|
||||||
|
user.password_confirmation = admin_password
|
||||||
|
user.admin = true
|
||||||
|
user.confirmed_at ||= Time.current
|
||||||
|
user.tos_agreement = true
|
||||||
|
user.accepted_tos_version = org.tos_version
|
||||||
|
user.locale = org.default_locale
|
||||||
|
user.save!
|
||||||
|
puts "org admin: #{user.email}"
|
||||||
133
configs/decidim/compose.yml
Normal file
133
configs/decidim/compose.yml
Normal file
|
|
@ -0,0 +1,133 @@
|
||||||
|
# koopa-decidim — Decidim behind host Caddy on :9027
|
||||||
|
# Docs: https://docs.decidim.org/en/develop/install/
|
||||||
|
# Image: official pre-generated app (core modules only). No secrets in this file.
|
||||||
|
|
||||||
|
x-logging: &default-logging
|
||||||
|
driver: "json-file"
|
||||||
|
options:
|
||||||
|
max-size: "50m"
|
||||||
|
max-file: "4"
|
||||||
|
|
||||||
|
x-app-env: &app-env
|
||||||
|
RAILS_ENV: production
|
||||||
|
RAILS_SERVE_STATIC_FILES: "true"
|
||||||
|
RAILS_LOG_TO_STDOUT: "true"
|
||||||
|
DATABASE_URL: postgres://decidim:${POSTGRES_PASSWORD}@postgres:5432/decidim
|
||||||
|
REDIS_URL: redis://redis:6379/0
|
||||||
|
SECRET_KEY_BASE: ${SECRET_KEY_BASE}
|
||||||
|
DECIDIM_APPLICATION_NAME: ${DECIDIM_APPLICATION_NAME:-hacktivism}
|
||||||
|
DECIDIM_MAILER_SENDER: ${DECIDIM_MAILER_SENDER:-noreply@hacktivism.ch}
|
||||||
|
DECIDIM_AVAILABLE_LOCALES: ${DECIDIM_AVAILABLE_LOCALES:-en,de,fr}
|
||||||
|
DECIDIM_DEFAULT_LOCALE: ${DECIDIM_DEFAULT_LOCALE:-en}
|
||||||
|
SMTP_ADDRESS: ${SMTP_ADDRESS:-127.0.0.1}
|
||||||
|
SMTP_DOMAIN: ${SMTP_DOMAIN:-hacktivism.ch}
|
||||||
|
SMTP_USERNAME: ${SMTP_USERNAME:-unused}
|
||||||
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-unused}
|
||||||
|
SMTP_PORT: ${SMTP_PORT:-25}
|
||||||
|
SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain}
|
||||||
|
QUEUE_ADAPTER: ${QUEUE_ADAPTER:-sidekiq}
|
||||||
|
|
||||||
|
services:
|
||||||
|
decidim:
|
||||||
|
image: docker.io/decidim/decidim:0.30.8
|
||||||
|
container_name: koopa-decidim
|
||||||
|
hostname: decidim
|
||||||
|
ports:
|
||||||
|
- "9027:3000"
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
environment:
|
||||||
|
<<: *app-env
|
||||||
|
volumes:
|
||||||
|
- ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
|
||||||
|
- ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
|
||||||
|
- ./theme/hacktivism.css:/code/public/hacktivism.css:ro
|
||||||
|
- ./theme/hacktivism-consent.js:/code/public/hacktivism-consent.js:ro
|
||||||
|
- ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro
|
||||||
|
- ./seed_example.rb:/code/lib/koopa_seed_example.rb:ro
|
||||||
|
- ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro
|
||||||
|
- ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro
|
||||||
|
- decidim-storage:/code/storage
|
||||||
|
- decidim-uploads:/code/public/uploads
|
||||||
|
- decidim-tmp:/code/tmp
|
||||||
|
entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
|
||||||
|
command: ["bundle", "exec", "rails", "s", "-b", "0.0.0.0", "-p", "3000"]
|
||||||
|
restart: unless-stopped
|
||||||
|
logging: *default-logging
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_started
|
||||||
|
labels:
|
||||||
|
org.hacktivism.service: decidim
|
||||||
|
org.hacktivism.host_port: "9027"
|
||||||
|
org.hacktivism.site: decidim.hacktivism.ch
|
||||||
|
org.hacktivism.managed_by: koopa-admin
|
||||||
|
|
||||||
|
sidekiq:
|
||||||
|
image: docker.io/decidim/decidim:0.30.8
|
||||||
|
container_name: koopa-decidim-sidekiq
|
||||||
|
hostname: sidekiq
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
environment:
|
||||||
|
<<: *app-env
|
||||||
|
volumes:
|
||||||
|
- ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
|
||||||
|
- ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
|
||||||
|
- decidim-storage:/code/storage
|
||||||
|
- decidim-uploads:/code/public/uploads
|
||||||
|
- decidim-tmp:/code/tmp
|
||||||
|
entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
|
||||||
|
command: ["bundle", "exec", "sidekiq", "-C", "config/sidekiq.yml"]
|
||||||
|
restart: unless-stopped
|
||||||
|
logging: *default-logging
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_started
|
||||||
|
labels:
|
||||||
|
org.hacktivism.service: decidim
|
||||||
|
org.hacktivism.managed_by: koopa-admin
|
||||||
|
|
||||||
|
postgres:
|
||||||
|
image: docker.io/library/postgres:16-alpine
|
||||||
|
container_name: koopa-decidim-db
|
||||||
|
hostname: postgres
|
||||||
|
environment:
|
||||||
|
- POSTGRES_USER=decidim
|
||||||
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
||||||
|
- POSTGRES_DB=decidim
|
||||||
|
volumes:
|
||||||
|
- decidim-db:/var/lib/postgresql/data
|
||||||
|
restart: unless-stopped
|
||||||
|
logging: *default-logging
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "pg_isready -U decidim -d decidim"]
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 12
|
||||||
|
labels:
|
||||||
|
org.hacktivism.service: decidim
|
||||||
|
org.hacktivism.managed_by: koopa-admin
|
||||||
|
|
||||||
|
redis:
|
||||||
|
image: docker.io/library/redis:7-alpine
|
||||||
|
container_name: koopa-decidim-redis
|
||||||
|
hostname: redis
|
||||||
|
volumes:
|
||||||
|
- decidim-redis:/data
|
||||||
|
restart: unless-stopped
|
||||||
|
logging: *default-logging
|
||||||
|
labels:
|
||||||
|
org.hacktivism.service: decidim
|
||||||
|
org.hacktivism.managed_by: koopa-admin
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
decidim-db:
|
||||||
|
decidim-redis:
|
||||||
|
decidim-storage:
|
||||||
|
decidim-uploads:
|
||||||
|
decidim-tmp:
|
||||||
21
configs/decidim/container-koopa-decidim-db.service
Normal file
21
configs/decidim/container-koopa-decidim-db.service
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
# user systemd — Decidim postgres + redis
|
||||||
|
[Unit]
|
||||||
|
Description=Decidim postgres/redis (koopa-decidim-db)
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
RequiresMountsFor=%t/containers
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Environment=PODMAN_SYSTEMD_UNIT=%n
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=20
|
||||||
|
TimeoutStartSec=300
|
||||||
|
TimeoutStopSec=120
|
||||||
|
WorkingDirectory=/home/hernani/koopa-decidim
|
||||||
|
ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d postgres redis'
|
||||||
|
ExecStop=/usr/bin/podman stop -t 30 koopa-decidim-db koopa-decidim-redis
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=default.target
|
||||||
21
configs/decidim/container-koopa-decidim.service
Normal file
21
configs/decidim/container-koopa-decidim.service
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
# user systemd — Decidim stack (app + sidekiq)
|
||||||
|
[Unit]
|
||||||
|
Description=Decidim stack (koopa-decidim)
|
||||||
|
Wants=network-online.target container-koopa-decidim-db.service
|
||||||
|
After=network-online.target container-koopa-decidim-db.service
|
||||||
|
RequiresMountsFor=%t/containers
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Environment=PODMAN_SYSTEMD_UNIT=%n
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=20
|
||||||
|
TimeoutStartSec=600
|
||||||
|
TimeoutStopSec=120
|
||||||
|
WorkingDirectory=/home/hernani/koopa-decidim
|
||||||
|
ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
|
||||||
|
ExecStop=/usr/bin/podman stop -t 30 koopa-decidim koopa-decidim-sidekiq
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=default.target
|
||||||
22
configs/decidim/entrypoint.sh
Executable file
22
configs/decidim/entrypoint.sh
Executable file
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# Wait for Postgres, migrate, then exec CMD (rails or sidekiq).
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
export RAILS_ENV="${RAILS_ENV:-production}"
|
||||||
|
|
||||||
|
echo "koopa-decidim: waiting for postgres..."
|
||||||
|
i=0
|
||||||
|
until bundle exec rails runner 'ActiveRecord::Base.connection.execute("SELECT 1")' >/dev/null 2>&1; do
|
||||||
|
i=$((i + 1))
|
||||||
|
if [ "$i" -ge 60 ]; then
|
||||||
|
echo "koopa-decidim: postgres not ready after ${i} tries" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
sleep 3
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "koopa-decidim: db:prepare"
|
||||||
|
bundle exec rails db:prepare
|
||||||
|
|
||||||
|
echo "koopa-decidim: exec $*"
|
||||||
|
exec "$@"
|
||||||
247
configs/decidim/seed_example.rb
Normal file
247
configs/decidim/seed_example.rb
Normal file
|
|
@ -0,0 +1,247 @@
|
||||||
|
# frozen_string_literal: true
|
||||||
|
# Public process + meeting + page + proposal (readable without an account).
|
||||||
|
# Optional participant from env: DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD.
|
||||||
|
# Optional avatar: DECIDIM_ISOC_AVATAR (PNG path inside the container).
|
||||||
|
# Usage: bundle exec rails runner /code/lib/koopa_seed_example.rb
|
||||||
|
|
||||||
|
def t(en, de, fr)
|
||||||
|
{ "en" => en, "de" => de, "fr" => fr }
|
||||||
|
end
|
||||||
|
|
||||||
|
def fail_model!(record)
|
||||||
|
raise "#{record.class}: #{record.errors.full_messages.join("; ")}"
|
||||||
|
end
|
||||||
|
|
||||||
|
host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
|
||||||
|
org = Decidim::Organization.find_by!(host: host)
|
||||||
|
admin = Decidim::User.find_by!(email: ENV.fetch("DECIDIM_ADMIN_EMAIL"), organization: org)
|
||||||
|
|
||||||
|
org.update!(force_users_to_authenticate_before_access_organization: false)
|
||||||
|
|
||||||
|
slug = "example"
|
||||||
|
process = Decidim::ParticipatoryProcess.find_or_initialize_by(organization: org, slug: slug)
|
||||||
|
process.assign_attributes(
|
||||||
|
title: t(
|
||||||
|
"Public digital commons",
|
||||||
|
"Öffentliche digitale Allmende",
|
||||||
|
"Communs numériques publics"
|
||||||
|
),
|
||||||
|
subtitle: t(
|
||||||
|
"Which self-hosted services stay readable without an account?",
|
||||||
|
"Welche selbst gehosteten Dienste bleiben ohne Konto lesbar?",
|
||||||
|
"Quels services auto-hébergés restent lisibles sans compte ?"
|
||||||
|
),
|
||||||
|
short_description: t(
|
||||||
|
"<p>hacktivism.ch already runs Lemmy, Bonfire, Castopod and Decidim. This process asks what must stay readable without a login — and what may require an account to write.</p>",
|
||||||
|
"<p>hacktivism.ch betreibt bereits Lemmy, Bonfire, Castopod und Decidim. Dieser Prozess fragt, was ohne Anmeldung lesbar bleiben muss — und wofür ein Konto zum Schreiben reicht.</p>",
|
||||||
|
"<p>hacktivism.ch fait déjà tourner Lemmy, Bonfire, Castopod et Decidim. Ce processus demande ce qui doit rester lisible sans compte — et ce qui peut exiger un compte pour écrire.</p>"
|
||||||
|
),
|
||||||
|
description: t(
|
||||||
|
"<p>Reading civic material should not depend on creating an account. Writing (proposals, comments, votes) can.</p>" \
|
||||||
|
"<p>Concrete questions:</p><ul>" \
|
||||||
|
"<li>Process pages, meetings and last activities stay public.</li>" \
|
||||||
|
"<li>No third-party trackers; cookies only what the software needs.</li>" \
|
||||||
|
"<li>Which other stacks on hacktivism.ch (Lemmy feeds, Castopod episodes, Bonfire public posts) follow the same rule.</li>" \
|
||||||
|
"</ul><p>Anyone can read this process. Sign in only to take part.</p>",
|
||||||
|
"<p>Öffentliches Beteiligungsmaterial soll ohne Konto lesbar sein. Schreiben (Vorschläge, Kommentare, Stimmen) kann ein Konto brauchen.</p>" \
|
||||||
|
"<p>Konkrete Fragen:</p><ul>" \
|
||||||
|
"<li>Prozessseiten, Treffen und letzte Aktivitäten bleiben öffentlich.</li>" \
|
||||||
|
"<li>Keine Drittanbieter-Tracker; Cookies nur, was die Software braucht.</li>" \
|
||||||
|
"<li>Welche anderen Dienste auf hacktivism.ch (Lemmy, Castopod, Bonfire) derselben Regel folgen.</li>" \
|
||||||
|
"</ul><p>Lesen ohne Anmeldung. Anmelden nur zum Mitmachen.</p>",
|
||||||
|
"<p>Lire du matériel civique ne doit pas exiger un compte. Écrire (propositions, commentaires, votes) peut le faire.</p>" \
|
||||||
|
"<p>Questions concrètes :</p><ul>" \
|
||||||
|
"<li>Pages de processus, rencontres et dernières activités restent publiques.</li>" \
|
||||||
|
"<li>Pas de traqueurs tiers ; cookies uniquement pour le logiciel.</li>" \
|
||||||
|
"<li>Quels autres services sur hacktivism.ch (Lemmy, Castopod, Bonfire) suivent la même règle.</li>" \
|
||||||
|
"</ul><p>Lecture sans compte. Connexion seulement pour participer.</p>"
|
||||||
|
),
|
||||||
|
start_date: Date.current,
|
||||||
|
end_date: Date.current + 180,
|
||||||
|
published_at: process.published_at || Time.current,
|
||||||
|
private_space: false,
|
||||||
|
promoted: true,
|
||||||
|
scopes_enabled: false,
|
||||||
|
weight: 1
|
||||||
|
)
|
||||||
|
process.save || fail_model!(process)
|
||||||
|
puts "process id=#{process.id} slug=#{process.slug} published=#{process.published_at}"
|
||||||
|
|
||||||
|
step = process.steps.find_or_initialize_by(position: 1)
|
||||||
|
step.assign_attributes(
|
||||||
|
title: t("Open discussion", "Offene Diskussion", "Discussion ouverte"),
|
||||||
|
description: t(
|
||||||
|
"<p>Collect positions on public-by-default reading. No decision this step.</p>",
|
||||||
|
"<p>Positionen zum Lesen ohne Konto sammeln. In dieser Phase keine Entscheidung.</p>",
|
||||||
|
"<p>Recueillir les positions sur la lecture sans compte. Pas de décision à cette étape.</p>"
|
||||||
|
),
|
||||||
|
start_date: Date.current,
|
||||||
|
end_date: Date.current + 180,
|
||||||
|
active: true
|
||||||
|
)
|
||||||
|
step.save || fail_model!(step)
|
||||||
|
puts "step id=#{step.id} active=#{step.active}"
|
||||||
|
|
||||||
|
pages = Decidim::Component.find_or_initialize_by(
|
||||||
|
participatory_space: process,
|
||||||
|
manifest_name: "pages"
|
||||||
|
)
|
||||||
|
pages.assign_attributes(
|
||||||
|
name: t("Background", "Hintergrund", "Contexte"),
|
||||||
|
published_at: pages.published_at || Time.current,
|
||||||
|
visible: true,
|
||||||
|
weight: 0
|
||||||
|
)
|
||||||
|
pages.save || fail_model!(pages)
|
||||||
|
page = Decidim::Pages::Page.find_or_initialize_by(component: pages)
|
||||||
|
page.body = t(
|
||||||
|
"<p>ISOC-style public-interest internet: people should inspect how a civic tool works without first handing over an identity.</p>" \
|
||||||
|
"<p>On this instance the stock cookie banner is hidden; only essential consent is set. The same idea applies to participation spaces: the text of a process is not a privilege of registered users.</p>" \
|
||||||
|
"<p>This page is part of that argument. It is published on purpose.</p>",
|
||||||
|
"<p>Internet im öffentlichen Interesse: man soll sehen können, wie ein Beteiligungswerkzeug arbeitet, ohne zuerst eine Identität abzugeben.</p>" \
|
||||||
|
"<p>Auf dieser Instanz ist der Vorrats-Cookie-Banner ausgeblendet; es gilt nur essential. Dieselbe Idee gilt für Beteiligungsräume: der Text eines Prozesses ist kein Privileg registrierter Konten.</p>" \
|
||||||
|
"<p>Diese Seite ist absichtlich öffentlich.</p>",
|
||||||
|
"<p>Internet d'intérêt public : on doit pouvoir voir comment un outil civique fonctionne sans d'abord céder une identité.</p>" \
|
||||||
|
"<p>Ici, la bannière cookies par défaut est masquée ; seul l'essentiel est posé. Même idée pour les espaces de participation : le texte d'un processus n'est pas un privilège des comptes.</p>" \
|
||||||
|
"<p>Cette page est publique volontairement.</p>"
|
||||||
|
)
|
||||||
|
page.save || fail_model!(page)
|
||||||
|
puts "pages component id=#{pages.id} page=#{page.id}"
|
||||||
|
|
||||||
|
meetings = Decidim::Component.find_or_initialize_by(
|
||||||
|
participatory_space: process,
|
||||||
|
manifest_name: "meetings"
|
||||||
|
)
|
||||||
|
meetings.assign_attributes(
|
||||||
|
name: t("Meetings", "Treffen", "Rencontres"),
|
||||||
|
published_at: meetings.published_at || Time.current,
|
||||||
|
visible: true,
|
||||||
|
weight: 1
|
||||||
|
)
|
||||||
|
meetings.save || fail_model!(meetings)
|
||||||
|
puts "meetings component id=#{meetings.id} published=#{meetings.published_at}"
|
||||||
|
|
||||||
|
start_at = Time.current.utc.change(hour: 18, min: 0) + 7.days
|
||||||
|
finish_at = start_at + 2.hours
|
||||||
|
meeting = Decidim::Meetings::Meeting.find_or_initialize_by(
|
||||||
|
component: meetings,
|
||||||
|
author: admin
|
||||||
|
)
|
||||||
|
meeting.title = t(
|
||||||
|
"Open session: reading without an account",
|
||||||
|
"Offene Runde: Lesen ohne Konto",
|
||||||
|
"Séance ouverte : lire sans compte"
|
||||||
|
)
|
||||||
|
meeting.assign_attributes(
|
||||||
|
description: t(
|
||||||
|
"<p>Public agenda (no registration to read):</p><ol>" \
|
||||||
|
"<li>What is already public on hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
|
||||||
|
"<li>Privacy by default — no tracker banner as a gate.</li>" \
|
||||||
|
"<li>Where login is justified (writing, admin).</li>" \
|
||||||
|
"</ol><p>Online / public. Signing in is optional.</p>",
|
||||||
|
"<p>Öffentliche Traktanden (Lesen ohne Anmeldung):</p><ol>" \
|
||||||
|
"<li>Was auf hacktivism.ch schon öffentlich ist (Lemmy, Decidim, Castopod).</li>" \
|
||||||
|
"<li>Privatsphäre als Vorgabe — kein Tracker-Banner als Tür.</li>" \
|
||||||
|
"<li>Wo ein Login gerechtfertigt ist (Schreiben, Admin).</li>" \
|
||||||
|
"</ol><p>Online / öffentlich. Anmelden ist freiwillig.</p>",
|
||||||
|
"<p>Ordre du jour public (lecture sans inscription) :</p><ol>" \
|
||||||
|
"<li>Ce qui est déjà public sur hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
|
||||||
|
"<li>Vie privée par défaut — pas de bannière traqueur comme porte.</li>" \
|
||||||
|
"<li>Où un compte se justifie (écriture, admin).</li>" \
|
||||||
|
"</ol><p>En ligne / public. Connexion facultative.</p>"
|
||||||
|
),
|
||||||
|
start_time: meeting.start_time || start_at,
|
||||||
|
end_time: meeting.end_time || finish_at,
|
||||||
|
address: "hacktivism.ch",
|
||||||
|
location: t("Online, public stream notes", "Online, öffentliche Notizen", "En ligne, notes publiques"),
|
||||||
|
location_hints: t(
|
||||||
|
"No ticket. Page stays readable if you do not attend.",
|
||||||
|
"Kein Ticket. Die Seite bleibt lesbar, wenn man nicht teilnimmt.",
|
||||||
|
"Pas de billet. La page reste lisible sans y assister."
|
||||||
|
),
|
||||||
|
type_of_meeting: "in_person",
|
||||||
|
registration_type: "registration_disabled",
|
||||||
|
registrations_enabled: false,
|
||||||
|
private_meeting: false,
|
||||||
|
transparent: true,
|
||||||
|
published_at: meeting.published_at || Time.current,
|
||||||
|
comments_enabled: true
|
||||||
|
)
|
||||||
|
meeting.save || fail_model!(meeting)
|
||||||
|
puts "meeting id=#{meeting.id} published=#{meeting.published_at} start=#{meeting.start_time}"
|
||||||
|
|
||||||
|
proposals = Decidim::Component.find_or_initialize_by(
|
||||||
|
participatory_space: process,
|
||||||
|
manifest_name: "proposals"
|
||||||
|
)
|
||||||
|
proposals.assign_attributes(
|
||||||
|
name: t("Proposals", "Vorschläge", "Propositions"),
|
||||||
|
published_at: proposals.published_at || Time.current,
|
||||||
|
visible: true,
|
||||||
|
weight: 2
|
||||||
|
)
|
||||||
|
proposals.save || fail_model!(proposals)
|
||||||
|
|
||||||
|
proposal = Decidim::Proposals::Proposal.find_or_initialize_by(component: proposals)
|
||||||
|
if proposal.new_record? || proposal.title.blank?
|
||||||
|
proposal.title = t(
|
||||||
|
"Keep public processes readable without login",
|
||||||
|
"Öffentliche Prozesse ohne Anmeldung lesbar halten",
|
||||||
|
"Garder les processus publics lisibles sans connexion"
|
||||||
|
)
|
||||||
|
proposal.body = t(
|
||||||
|
"<p>Decide as a standing rule: published process pages, meetings and this proposal list stay readable without an account. Login is only for creating or endorsing proposals, commenting, and administration.</p>",
|
||||||
|
"<p>Als Regel festhalten: veröffentlichte Prozessseiten, Treffen und diese Vorschlagsliste bleiben ohne Konto lesbar. Login nur zum Erstellen oder Unterstützen von Vorschlägen, Kommentieren und für die Administration.</p>",
|
||||||
|
"<p>En faire une règle : les pages de processus publiées, les rencontres et cette liste de propositions restent lisibles sans compte. Connexion seulement pour créer ou soutenir, commenter, et pour l'administration.</p>"
|
||||||
|
)
|
||||||
|
proposal.add_coauthor(admin)
|
||||||
|
proposal.published_at = Time.current
|
||||||
|
end
|
||||||
|
proposal.save || fail_model!(proposal)
|
||||||
|
puts "proposal id=#{proposal.id} published=#{proposal.published_at}"
|
||||||
|
|
||||||
|
block = Decidim::ContentBlock.find_or_initialize_by(
|
||||||
|
organization: org,
|
||||||
|
scope_name: "homepage",
|
||||||
|
manifest_name: "highlighted_processes"
|
||||||
|
)
|
||||||
|
block.weight ||= 45
|
||||||
|
block.published_at ||= Time.current
|
||||||
|
block.save || fail_model!(block)
|
||||||
|
puts "homepage highlighted_processes published=#{block.published_at}"
|
||||||
|
|
||||||
|
isoc_email = ENV["DECIDIM_ISOC_EMAIL"].to_s.strip
|
||||||
|
isoc_password = ENV["DECIDIM_ISOC_PASSWORD"].to_s
|
||||||
|
if isoc_email.empty? || isoc_password.empty?
|
||||||
|
puts "isoc user skipped (DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD unset)"
|
||||||
|
else
|
||||||
|
isoc = Decidim::User.find_or_initialize_by(email: isoc_email, organization: org)
|
||||||
|
isoc.name = ENV.fetch("DECIDIM_ISOC_NAME", "isoc")
|
||||||
|
isoc.nickname = ENV.fetch("DECIDIM_ISOC_NICKNAME", "isoc")
|
||||||
|
isoc.password = isoc_password
|
||||||
|
isoc.password_confirmation = isoc_password
|
||||||
|
isoc.admin = false
|
||||||
|
isoc.confirmed_at ||= Time.current
|
||||||
|
isoc.tos_agreement = true
|
||||||
|
isoc.accepted_tos_version = org.tos_version
|
||||||
|
isoc.locale = org.default_locale
|
||||||
|
isoc.save || fail_model!(isoc)
|
||||||
|
avatar_path = ENV["DECIDIM_ISOC_AVATAR"].to_s
|
||||||
|
if !avatar_path.empty? && File.file?(avatar_path)
|
||||||
|
isoc.avatar.purge if isoc.avatar.attached?
|
||||||
|
isoc.avatar.attach(
|
||||||
|
io: File.open(avatar_path, "rb"),
|
||||||
|
filename: "isoc-gold.png",
|
||||||
|
content_type: "image/png"
|
||||||
|
)
|
||||||
|
isoc.save || fail_model!(isoc)
|
||||||
|
puts "isoc avatar attached from #{avatar_path} blob=#{isoc.avatar.blob&.byte_size}"
|
||||||
|
else
|
||||||
|
puts "isoc avatar skipped (DECIDIM_ISOC_AVATAR missing)"
|
||||||
|
end
|
||||||
|
puts "isoc user id=#{isoc.id} email=#{isoc.email} nick=#{isoc.nickname} admin=#{isoc.admin} confirmed=#{isoc.confirmed_at}"
|
||||||
|
end
|
||||||
|
|
||||||
|
puts "public process: https://#{host}/processes/#{process.slug}"
|
||||||
|
puts "public meeting: https://#{host}/processes/#{process.slug}/f/#{meetings.id}/meetings/#{meeting.id}"
|
||||||
|
puts "public proposal: https://#{host}/processes/#{process.slug}/f/#{proposals.id}/proposals/#{proposal.id}"
|
||||||
10
configs/decidim/theme/hacktivism-consent.js
Normal file
10
configs/decidim/theme/hacktivism-consent.js
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
/* Essential-only consent; banner hidden via CSS. */
|
||||||
|
(function () {
|
||||||
|
var name = "decidim-consent";
|
||||||
|
if (document.cookie.indexOf(name + "=") !== -1) return;
|
||||||
|
document.cookie =
|
||||||
|
name +
|
||||||
|
"=" +
|
||||||
|
encodeURIComponent(JSON.stringify({ essential: true })) +
|
||||||
|
"; path=/; max-age=31536000; SameSite=Lax";
|
||||||
|
})();
|
||||||
98
configs/decidim/theme/hacktivism.css
Normal file
98
configs/decidim/theme/hacktivism.css
Normal file
|
|
@ -0,0 +1,98 @@
|
||||||
|
/* hacktivism — same palette as bonfire/git/lemmy (exchange-dark) */
|
||||||
|
:root,
|
||||||
|
html {
|
||||||
|
--primary: #e8a838;
|
||||||
|
--primary-rgb: 232, 168, 56;
|
||||||
|
--secondary: #3ecfbf;
|
||||||
|
--secondary-rgb: 62, 207, 191;
|
||||||
|
--tertiary: #3d3128;
|
||||||
|
--success: #16a34a;
|
||||||
|
--warning: #f0d090;
|
||||||
|
--alert: #e7131a;
|
||||||
|
--highlight: #e8a838;
|
||||||
|
}
|
||||||
|
|
||||||
|
html,
|
||||||
|
body {
|
||||||
|
background-color: #1a1410 !important;
|
||||||
|
background-image:
|
||||||
|
radial-gradient(ellipse 90% 55% at 50% 108%, rgba(26, 107, 110, 0.35) 0%, transparent 55%),
|
||||||
|
radial-gradient(circle 420px at 12% 18%, rgba(232, 168, 56, 0.22) 0%, transparent 62%),
|
||||||
|
linear-gradient(165deg, #2c1e14 0%, #1a1410 38%, #12181a 72%, #0e1c1e 100%) !important;
|
||||||
|
background-attachment: fixed !important;
|
||||||
|
color: #fff6e8 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
a {
|
||||||
|
color: #e8a838 !important;
|
||||||
|
}
|
||||||
|
a:hover {
|
||||||
|
color: #f0d090 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.title-bar,
|
||||||
|
.main-bar,
|
||||||
|
.navbar,
|
||||||
|
.topbar,
|
||||||
|
header.header,
|
||||||
|
.main-nav,
|
||||||
|
.footer,
|
||||||
|
.mini-footer,
|
||||||
|
.off-canvas,
|
||||||
|
.sidebar {
|
||||||
|
background-color: #14110e !important;
|
||||||
|
color: #fff6e8 !important;
|
||||||
|
border-color: #2a2018 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.card,
|
||||||
|
.card__content,
|
||||||
|
.callout,
|
||||||
|
.flash,
|
||||||
|
.dialog,
|
||||||
|
.reveal,
|
||||||
|
.accordion-item,
|
||||||
|
.comment-thread,
|
||||||
|
.process-header,
|
||||||
|
.hero,
|
||||||
|
.home-section {
|
||||||
|
background-color: #221c16 !important;
|
||||||
|
color: #fff6e8 !important;
|
||||||
|
border-color: #2a2018 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.button,
|
||||||
|
.button.primary,
|
||||||
|
.button--sc,
|
||||||
|
input[type="submit"].button {
|
||||||
|
background-color: #e8a838 !important;
|
||||||
|
border-color: #e8a838 !important;
|
||||||
|
color: #1a1410 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.button.secondary {
|
||||||
|
background-color: #3d3128 !important;
|
||||||
|
border-color: #3d3128 !important;
|
||||||
|
color: #fff6e8 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
h1, h2, h3, h4, h5, h6,
|
||||||
|
.title-bar__title,
|
||||||
|
.card__title {
|
||||||
|
color: #f0c86a !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
input,
|
||||||
|
textarea,
|
||||||
|
select,
|
||||||
|
.input-group-field {
|
||||||
|
background-color: #221c16 !important;
|
||||||
|
color: #fff6e8 !important;
|
||||||
|
border-color: #3d3128 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* No third-party trackers; hide stock GDPR banner (privacy by default). */
|
||||||
|
#dc-dialog-wrapper,
|
||||||
|
.cookies__container {
|
||||||
|
display: none !important;
|
||||||
|
}
|
||||||
14
configs/decidim/theme/hacktivism.rb
Normal file
14
configs/decidim/theme/hacktivism.rb
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
# frozen_string_literal: true
|
||||||
|
# hacktivism theme + host allowlist for decidim.hacktivism.ch
|
||||||
|
|
||||||
|
Rails.application.config.hosts << "decidim.hacktivism.ch"
|
||||||
|
Rails.application.config.hosts << "127.0.0.1"
|
||||||
|
Rails.application.config.hosts << "localhost"
|
||||||
|
|
||||||
|
if Rails.application.config.respond_to?(:assume_ssl=)
|
||||||
|
Rails.application.config.assume_ssl = true
|
||||||
|
end
|
||||||
|
|
||||||
|
Decidim.configure do |config|
|
||||||
|
config.enable_html_header_snippets = true if config.respond_to?(:enable_html_header_snippets=)
|
||||||
|
end
|
||||||
|
|
@ -18,12 +18,13 @@
|
||||||
| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
|
| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
|
||||||
| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
|
| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
|
||||||
| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
|
| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
|
||||||
|
| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
|
||||||
| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
|
| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
|
||||||
| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
|
| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
|
||||||
| 8080 | Tor ORPort |
|
| 8080 | Tor ORPort |
|
||||||
|
|
||||||
VeciGate: WAN **80→9000**, WAN **443→9001**.
|
VeciGate: WAN **80→9000**, WAN **443→9001**.
|
||||||
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.
|
Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.
|
||||||
Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
|
Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
|
||||||
|
|
||||||
| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
|
| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
|
||||||
|
|
|
||||||
|
|
@ -36,6 +36,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080|9080|1789'
|
||||||
| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
|
| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
|
||||||
| **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` |
|
| **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` |
|
||||||
| `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` |
|
| `koopa-lemmy-proxy` (+ lemmy, ui, pictrs, db) | `lemmy:0.19.20` | **9026** | `lemmy.hacktivism.ch` |
|
||||||
|
| `koopa-decidim` (+ postgres, redis, sidekiq) | `decidim/decidim:0.30.8` | **9027** | `decidim.hacktivism.ch` |
|
||||||
| **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
|
| **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
|
||||||
| **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) |
|
| **`koopa-nym`** | `localhost/koopa-nym:latest` | **9080**, **1789**, **1790** (+ opt. WG) | Nym mixnet node (nym.com) |
|
||||||
| `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
|
| `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
|
||||||
|
|
@ -61,6 +62,7 @@ Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exc
|
||||||
| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
|
| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
|
||||||
| `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) |
|
| `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) |
|
||||||
| `lemmy.hacktivism.ch` | 9026 |
|
| `lemmy.hacktivism.ch` | 9026 |
|
||||||
|
| `decidim.hacktivism.ch` | 9027 |
|
||||||
| `tops.ng1.hacktivism.ch` | 9090 |
|
| `tops.ng1.hacktivism.ch` | 9090 |
|
||||||
| `tops.ng2.hacktivism.ch` | 9091 |
|
| `tops.ng2.hacktivism.ch` | 9091 |
|
||||||
| `tops.ng3.hacktivism.ch` | 9092 |
|
| `tops.ng3.hacktivism.ch` | 9092 |
|
||||||
|
|
@ -74,6 +76,7 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
|
||||||
| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
|
| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
|
||||||
| `~/koopa-castopod/` | Castopod compose |
|
| `~/koopa-castopod/` | Castopod compose |
|
||||||
| `~/koopa-lemmy/` | Lemmy compose |
|
| `~/koopa-lemmy/` | Lemmy compose |
|
||||||
|
| `~/koopa-decidim/` | Decidim compose |
|
||||||
| `~/koopa-bonfire/` | Bonfire compose + gitbot |
|
| `~/koopa-bonfire/` | Bonfire compose + gitbot |
|
||||||
| `~/koopa-prime/` | Jellyfin + qBittorrent |
|
| `~/koopa-prime/` | Jellyfin + qBittorrent |
|
||||||
| `~/koopa-forgejo/` | Forgejo rootless |
|
| `~/koopa-forgejo/` | Forgejo rootless |
|
||||||
|
|
@ -90,6 +93,8 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
|
||||||
| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` |
|
| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` |
|
||||||
| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` |
|
| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` |
|
||||||
| User apps | `cd ~/koopa-* && podman-compose up -d` |
|
| User apps | `cd ~/koopa-* && podman-compose up -d` |
|
||||||
|
| Lemmy | user units `container-koopa-lemmy-db` + `container-koopa-lemmy` (linger) |
|
||||||
|
| Decidim | user units `container-koopa-decidim-db` + `container-koopa-decidim` (linger) |
|
||||||
| tops (ng1–ng3) | user unit `container-koopa-tops.service` (linger) |
|
| tops (ng1–ng3) | user unit `container-koopa-tops.service` (linger) |
|
||||||
|
|
||||||
## Config mirrors in this repo (`configs/`)
|
## Config mirrors in this repo (`configs/`)
|
||||||
|
|
@ -111,3 +116,4 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
|
||||||
| Forgejo | `2026/2026-07-10--forgejo-rootless.md` |
|
| Forgejo | `2026/2026-07-10--forgejo-rootless.md` |
|
||||||
| Bonfire public feeds | `configs/bonfire/public-feeds.md` |
|
| Bonfire public feeds | `configs/bonfire/public-feeds.md` |
|
||||||
| Castopod content | `2026/2026-07-09--castopod-content.md` |
|
| Castopod content | `2026/2026-07-09--castopod-content.md` |
|
||||||
|
| Decidim | `2026/2026-08-17--decidim.md` · `configs/decidim/` |
|
||||||
|
|
|
||||||
|
|
@ -37,6 +37,7 @@ flowchart TB
|
||||||
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
|
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
|
||||||
Paivana["koopa-paivana\n:9025"]
|
Paivana["koopa-paivana\n:9025"]
|
||||||
Lemmy["koopa-lemmy-proxy\n:9026"]
|
Lemmy["koopa-lemmy-proxy\n:9026"]
|
||||||
|
Decidim["koopa-decidim\n:9027"]
|
||||||
end
|
end
|
||||||
|
|
||||||
Tor["tor ORPort :8080"]
|
Tor["tor ORPort :8080"]
|
||||||
|
|
@ -63,6 +64,7 @@ flowchart TB
|
||||||
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
|
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
|
||||||
CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
|
CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
|
||||||
CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy
|
CaddyHTTPS -->|lemmy.hacktivism.ch| Lemmy
|
||||||
|
CaddyHTTPS -->|decidim.hacktivism.ch| Decidim
|
||||||
```
|
```
|
||||||
|
|
||||||
## Port table
|
## Port table
|
||||||
|
|
@ -84,6 +86,7 @@ flowchart TB
|
||||||
| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
|
| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
|
||||||
| **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
|
| **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
|
||||||
| **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` |
|
| **9026** | podman | **lemmy** → `lemmy.hacktivism.ch` |
|
||||||
|
| **9027** | podman | **decidim** → `decidim.hacktivism.ch` |
|
||||||
| **9200** | podman | **forgejo** git-SSH (host-direct) |
|
| **9200** | podman | **forgejo** git-SSH (host-direct) |
|
||||||
| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
|
| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
|
||||||
| 8080 | tor | ORPort |
|
| 8080 | tor | ORPort |
|
||||||
|
|
|
||||||
22
scripts/decidim/apply-branding.sh
Executable file
22
scripts/decidim/apply-branding.sh
Executable file
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# Apply hacktivism colors + header CSS on the live organization.
|
||||||
|
set -euo pipefail
|
||||||
|
cd "${HOME}/koopa-decidim"
|
||||||
|
set -a
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source .env
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source users.env
|
||||||
|
set +a
|
||||||
|
podman exec \
|
||||||
|
-e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
|
||||||
|
-e DECIDIM_SYSTEM_EMAIL \
|
||||||
|
-e DECIDIM_SYSTEM_PASSWORD \
|
||||||
|
-e DECIDIM_ADMIN_EMAIL \
|
||||||
|
-e DECIDIM_ADMIN_PASSWORD \
|
||||||
|
-e DECIDIM_ADMIN_NAME \
|
||||||
|
-e DECIDIM_APPLICATION_NAME \
|
||||||
|
-e DECIDIM_DEFAULT_LOCALE \
|
||||||
|
-e DECIDIM_AVAILABLE_LOCALES \
|
||||||
|
koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb
|
||||||
|
echo "branding applied. public: https://decidim.hacktivism.ch/"
|
||||||
47
scripts/decidim/install-systemd.sh
Executable file
47
scripts/decidim/install-systemd.sh
Executable file
|
|
@ -0,0 +1,47 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# Install Decidim user systemd units on koopa (boot via linger).
|
||||||
|
set -euo pipefail
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
LIVE="${HOME}/koopa-decidim"
|
||||||
|
# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin
|
||||||
|
if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then
|
||||||
|
UNIT_SRC="${HERE}/../../configs/decidim"
|
||||||
|
elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then
|
||||||
|
UNIT_SRC="${LIVE}"
|
||||||
|
else
|
||||||
|
echo "ERROR: decidim unit files not found" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
UNIT_DIR="${HOME}/.config/systemd/user"
|
||||||
|
|
||||||
|
mkdir -p "${UNIT_DIR}"
|
||||||
|
cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/"
|
||||||
|
cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/"
|
||||||
|
|
||||||
|
systemctl --user daemon-reload
|
||||||
|
systemctl --user enable \
|
||||||
|
container-koopa-decidim-db.service \
|
||||||
|
container-koopa-decidim.service
|
||||||
|
|
||||||
|
if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then
|
||||||
|
(cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d)
|
||||||
|
fi
|
||||||
|
|
||||||
|
systemctl --user start \
|
||||||
|
container-koopa-decidim-db.service \
|
||||||
|
container-koopa-decidim.service
|
||||||
|
|
||||||
|
systemctl --user --no-pager --lines=0 status \
|
||||||
|
container-koopa-decidim-db.service \
|
||||||
|
container-koopa-decidim.service || true
|
||||||
|
|
||||||
|
if command -v loginctl >/dev/null 2>&1; then
|
||||||
|
if [ "$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no)" != "yes" ]; then
|
||||||
|
echo "NOTE: enable linger so units start after reboot without login:"
|
||||||
|
echo " sudo loginctl enable-linger $(id -un)"
|
||||||
|
else
|
||||||
|
echo "linger already enabled for $(id -un)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "OK. Public: https://decidim.hacktivism.ch/"
|
||||||
39
scripts/decidim/seed-example.sh
Executable file
39
scripts/decidim/seed-example.sh
Executable file
|
|
@ -0,0 +1,39 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# Publish public example process/meeting + optional isoc user from users.env.
|
||||||
|
set -euo pipefail
|
||||||
|
cd "${HOME}/koopa-decidim"
|
||||||
|
set -a
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source .env
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source users.env
|
||||||
|
set +a
|
||||||
|
|
||||||
|
src=""
|
||||||
|
if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then
|
||||||
|
src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb"
|
||||||
|
elif [ -f ./seed_example.rb ]; then
|
||||||
|
src="./seed_example.rb"
|
||||||
|
else
|
||||||
|
echo "ERROR: seed_example.rb not found" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb
|
||||||
|
|
||||||
|
avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}"
|
||||||
|
avatar_ctr=""
|
||||||
|
if [ -f "${avatar_host}" ]; then
|
||||||
|
avatar_ctr="/tmp/isoc-gold.png"
|
||||||
|
podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
podman exec \
|
||||||
|
-e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
|
||||||
|
-e DECIDIM_ADMIN_EMAIL \
|
||||||
|
-e DECIDIM_ISOC_EMAIL \
|
||||||
|
-e DECIDIM_ISOC_PASSWORD \
|
||||||
|
-e DECIDIM_ISOC_NAME \
|
||||||
|
-e DECIDIM_ISOC_NICKNAME \
|
||||||
|
-e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \
|
||||||
|
koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb
|
||||||
|
echo "seed done. public: https://decidim.hacktivism.ch/processes/example"
|
||||||
21
scripts/decidim/up.sh
Executable file
21
scripts/decidim/up.sh
Executable file
|
|
@ -0,0 +1,21 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
DIR="${HOME}/koopa-decidim"
|
||||||
|
cd "${DIR}"
|
||||||
|
set -a
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source .env
|
||||||
|
set +a
|
||||||
|
podman-compose up -d
|
||||||
|
echo "== wait for :9027 =="
|
||||||
|
ok=0
|
||||||
|
for i in $(seq 1 80); do
|
||||||
|
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true)
|
||||||
|
echo "try $i: $code"
|
||||||
|
case "$code" in
|
||||||
|
2*|3*) ok=1; break ;;
|
||||||
|
esac
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; }
|
||||||
|
echo "local ok. public: https://decidim.hacktivism.ch/"
|
||||||
|
|
@ -1,12 +1,21 @@
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
# Install Lemmy user systemd units on koopa (boot via linger).
|
# Install Lemmy user systemd units on koopa (boot via linger).
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
LIVE="${HOME}/koopa-lemmy"
|
||||||
|
if [ -f "${HERE}/../../configs/lemmy/container-koopa-lemmy.service" ]; then
|
||||||
|
UNIT_SRC="${HERE}/../../configs/lemmy"
|
||||||
|
elif [ -f "${LIVE}/container-koopa-lemmy.service" ]; then
|
||||||
|
UNIT_SRC="${LIVE}"
|
||||||
|
else
|
||||||
|
echo "ERROR: lemmy unit files not found" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
UNIT_DIR="${HOME}/.config/systemd/user"
|
UNIT_DIR="${HOME}/.config/systemd/user"
|
||||||
|
|
||||||
mkdir -p "${UNIT_DIR}"
|
mkdir -p "${UNIT_DIR}"
|
||||||
cp "${ROOT}/configs/lemmy/container-koopa-lemmy-db.service" "${UNIT_DIR}/"
|
cp "${UNIT_SRC}/container-koopa-lemmy-db.service" "${UNIT_DIR}/"
|
||||||
cp "${ROOT}/configs/lemmy/container-koopa-lemmy.service" "${UNIT_DIR}/"
|
cp "${UNIT_SRC}/container-koopa-lemmy.service" "${UNIT_DIR}/"
|
||||||
|
|
||||||
systemctl --user daemon-reload
|
systemctl --user daemon-reload
|
||||||
systemctl --user enable \
|
systemctl --user enable \
|
||||||
|
|
@ -25,4 +34,13 @@ systemctl --user --no-pager --lines=0 status \
|
||||||
container-koopa-lemmy-db.service \
|
container-koopa-lemmy-db.service \
|
||||||
container-koopa-lemmy.service || true
|
container-koopa-lemmy.service || true
|
||||||
|
|
||||||
|
if command -v loginctl >/dev/null 2>&1; then
|
||||||
|
if [ "$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no)" != "yes" ]; then
|
||||||
|
echo "NOTE: enable linger so units start after reboot without login:"
|
||||||
|
echo " sudo loginctl enable-linger $(id -un)"
|
||||||
|
else
|
||||||
|
echo "linger already enabled for $(id -un)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
echo "OK. Public: https://lemmy.hacktivism.ch/"
|
echo "OK. Public: https://lemmy.hacktivism.ch/"
|
||||||
|
|
|
||||||
|
|
@ -65,7 +65,9 @@ overall: OK ok=42 warn=0 fail=0
|
||||||
| Git SSH | TCP `:9200` |
|
| Git SSH | TCP `:9200` |
|
||||||
|
|
||||||
**Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports.
|
**Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports.
|
||||||
**Optional** (→ WARN): castopod, bonfire, lemmy, prime, bt, paivana, tops, tor, nym.
|
**Optional** (→ WARN): castopod, bonfire, lemmy, decidim, prime, bt, paivana, tops, tor, nym.
|
||||||
|
|
||||||
|
Collect also checks **linger** and that Lemmy/Decidim user units are **enabled** (reboot survival).
|
||||||
|
|
||||||
Read-only. No restarts, no secrets.
|
Read-only. No restarts, no secrets.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -151,6 +151,7 @@ EXPECT_CONTAINERS=(
|
||||||
koopa-castopod
|
koopa-castopod
|
||||||
koopa-bonfire
|
koopa-bonfire
|
||||||
koopa-lemmy-proxy
|
koopa-lemmy-proxy
|
||||||
|
koopa-decidim
|
||||||
koopa-prime-jellyfin
|
koopa-prime-jellyfin
|
||||||
koopa-prime-qbittorrent
|
koopa-prime-qbittorrent
|
||||||
koopa-forgejo
|
koopa-forgejo
|
||||||
|
|
@ -173,6 +174,7 @@ OPTIONAL_CONTAINERS=(
|
||||||
koopa-castopod
|
koopa-castopod
|
||||||
koopa-bonfire
|
koopa-bonfire
|
||||||
koopa-lemmy-proxy
|
koopa-lemmy-proxy
|
||||||
|
koopa-decidim
|
||||||
koopa-paivana
|
koopa-paivana
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
@ -185,6 +187,7 @@ PROBES=(
|
||||||
"castopod|http://127.0.0.1:9020/|200,302,303,307,308"
|
"castopod|http://127.0.0.1:9020/|200,302,303,307,308"
|
||||||
"bonfire|http://127.0.0.1:9021/|200,302,303,307,308"
|
"bonfire|http://127.0.0.1:9021/|200,302,303,307,308"
|
||||||
"lemmy|http://127.0.0.1:9026/|200,302,303,307,308"
|
"lemmy|http://127.0.0.1:9026/|200,302,303,307,308"
|
||||||
|
"decidim|http://127.0.0.1:9027/|200,301,302,303,307,308"
|
||||||
"prime|http://127.0.0.1:9022/|200,302,303,307,308"
|
"prime|http://127.0.0.1:9022/|200,302,303,307,308"
|
||||||
"bt|http://127.0.0.1:9023/|200,302,303,307,308,401"
|
"bt|http://127.0.0.1:9023/|200,302,303,307,308,401"
|
||||||
"paivana|http://127.0.0.1:9025/|200,302,303,307,308"
|
"paivana|http://127.0.0.1:9025/|200,302,303,307,308"
|
||||||
|
|
@ -193,7 +196,7 @@ PROBES=(
|
||||||
"tops-ng3|http://127.0.0.1:9092/|200,302,303"
|
"tops-ng3|http://127.0.0.1:9092/|200,302,303"
|
||||||
)
|
)
|
||||||
|
|
||||||
OPTIONAL_PROBES=(castopod bonfire lemmy prime bt paivana tops-ng1 tops-ng2 tops-ng3)
|
OPTIONAL_PROBES=(castopod bonfire lemmy decidim prime bt paivana tops-ng1 tops-ng2 tops-ng3)
|
||||||
|
|
||||||
C_OK=; C_WARN=; C_FAIL=; C_DIM=; C_RST=; C_BOLD=
|
C_OK=; C_WARN=; C_FAIL=; C_DIM=; C_RST=; C_BOLD=
|
||||||
# colors only when writing for a tty later; snapshots are plain + optional ANSI if COLLECT_COLOR=1
|
# colors only when writing for a tty later; snapshots are plain + optional ANSI if COLLECT_COLOR=1
|
||||||
|
|
@ -277,6 +280,34 @@ do_collect() {
|
||||||
record WARN "systemctl not available"
|
record WARN "systemctl not available"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# Reboot survival: linger + enabled user units (public stacks).
|
||||||
|
if command -v loginctl >/dev/null 2>&1; then
|
||||||
|
linger_st=$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null || echo no)
|
||||||
|
if [ "${linger_st}" = "yes" ]; then
|
||||||
|
record OK "linger=yes ($(id -un))"
|
||||||
|
else
|
||||||
|
record FAIL "linger=${linger_st} (user units will not start after reboot without login)"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
record WARN "loginctl not available (cannot check linger)"
|
||||||
|
fi
|
||||||
|
if command -v systemctl >/dev/null 2>&1 && [ "$(id -u 2>/dev/null)" != "0" ]; then
|
||||||
|
local u en
|
||||||
|
for u in \
|
||||||
|
container-koopa-lemmy-db.service \
|
||||||
|
container-koopa-lemmy.service \
|
||||||
|
container-koopa-decidim-db.service \
|
||||||
|
container-koopa-decidim.service
|
||||||
|
do
|
||||||
|
en=$(systemctl --user is-enabled "${u}" 2>/dev/null || echo unknown)
|
||||||
|
if [ "${en}" = "enabled" ]; then
|
||||||
|
record OK "unit ${u} enabled"
|
||||||
|
else
|
||||||
|
record WARN "unit ${u} is ${en} (will not start on reboot)"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
if command -v ss >/dev/null 2>&1; then
|
if command -v ss >/dev/null 2>&1; then
|
||||||
listen_blob=$(ss -lnt 2>/dev/null | awk '{print $4}' || true)
|
listen_blob=$(ss -lnt 2>/dev/null | awk '{print $4}' || true)
|
||||||
for port in 9000 9001 9010 9011 9012 9024 9200; do
|
for port in 9000 9001 9010 9011 9012 9024 9200; do
|
||||||
|
|
@ -286,7 +317,7 @@ do_collect() {
|
||||||
record FAIL "nothing listening on :${port}"
|
record FAIL "nothing listening on :${port}"
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
for port in 9020 9021 9022 9023 9025 9026 9090 9091 9092 8080 9080; do
|
for port in 9020 9021 9022 9023 9025 9026 9027 9090 9091 9092 8080 9080; do
|
||||||
if printf '%s\n' "${listen_blob}" | grep -qE "[:.]${port}\$"; then
|
if printf '%s\n' "${listen_blob}" | grep -qE "[:.]${port}\$"; then
|
||||||
record OK "listen :${port} (optional)"
|
record OK "listen :${port} (optional)"
|
||||||
else
|
else
|
||||||
|
|
@ -323,7 +354,7 @@ do_collect() {
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db; do
|
for dep in koopa-forgejo-db koopa-castopod-mariadb koopa-castopod-redis koopa-bonfire-db koopa-lemmy-db koopa-decidim-db koopa-decidim-redis; do
|
||||||
if printf '%s\n' "${running_names}" | grep -qxF "${dep}"; then
|
if printf '%s\n' "${running_names}" | grep -qxF "${dep}"; then
|
||||||
record INFO "dep ${dep} running"
|
record INFO "dep ${dep} running"
|
||||||
else
|
else
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue