koopa: hernani user ollama loopback + host-power sampling

decidim: public-commons process text + isoc avatar hook
decidim: public example process + isoc participant seed
2026-09-05 03:57:08 +02:00 · 2026-08-17 15:55:23 +02:00 · 2026-08-17 15:38:43 +02:00 · 2026-08-17 15:31:10 +02:00
217 changed files with 1330 additions and 13039 deletions
--- a/2026/2026-07-19.md
+++ b/2026/2026-07-19.md
@ -3,8 +3,3 @@
 - **Caddy mon bare paths:** `redir /path/ 302` inside `handle` → Location `302` → merchant code 21; fix `redir * /path/ 302`
 - **apply-monitoring-live.sh:** smoke for-loop syntax (missing `\`); use absolute `/home/hernani/koopa-caddy/…` (root `~` = `/root`)
 - Re-apply: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh`
- **clementine-magikoopa-share** (`~/clementine-magikoopa-share/`): openssl AES-256-CBC + PBKDF2 iter 600000; `lock.sh`/`unlock.sh` + `ANLEITUNG.md` (usage). Inventory only after decrypt: `EXPECTED-REPOS.md` (includes vecigate-admin-log/secrets expected from magikoopa). Usage mirror in `koopa-admin-secrets/docs/clementine-magikoopa-share.md`.
- **Share payload = all local-only / never-pushed repos:** canonical list in `koopa-admin-secrets/docs/share-payload-dirs.txt` (+ `local-only-share-repos.md`). On clementine archived: `taler-monitoring-env`, `llm`, `grok-work-log`, **`koopa-admin-secrets`**, **`francpaysan-secrets`**, **`dot-grok`** (`~/.grok` full profile); still MISSING until magikoopa locks them: `vecigate-admin-log`, `vecigate-admin-secrets`.
- **Share README:** other machine must treat `dot-grok` / profile rules **system-wide** (install to `~/.grok`, same operator rules on clementine and magikoopa).
-
- **secret-languages:** extracted from local branches `local/merchant-secret-ui` / `local/secret-ui-scrub` into standalone local-only repo `~/src/koopa/secret-languages` (never push). Those branches deleted on this clone. Pack via clementine-magikoopa-share.
--- a/2026/2026-09-04--goa-backup-regio-ng.md
+++ b/2026/2026-09-04--goa-backup-regio-ng.md
@ -1,97 +0,0 @@
-# 2026-09-04 — GOA backup (pre regio-ng)
-
-## Live (koopa)
-
-| Container | Ports | Site |
-|-----------|-------|------|
-| `taler-hacktivism-exchange-ansible` | 9011/9014 | exchange.hacktivism.ch |
-| `taler-hacktivism-bank` | 9012/9013 | bank.hacktivism.ch |
-| `taler-hacktivism` | 9010/9015 | taler.hacktivism.ch |
-| `koopa-paivana` | 9025 | paivana.hacktivism.ch |
-
-Currency **GOA**. Master pub (public): `TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10`.
-
-Probes 2026-09-04: exchange/bank/taler `/config` **200**. Monitoring user units mostly failed (apps/ladder) — separate.
-
-**Risk:** exchange/bank/merchant data sit in container **overlay** (no named volumes). Offline key: `/var/lib/taler-exchange/offline/master.priv` inside exchange container.
-
-## Backup location (ERPNext-style `backups/` + stamp + `current`)
-
-| Host | Path |
-|------|------|
-| koopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
-| magikoopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
-| **secrets** (keys + `*.secret.conf` + host_vars/paivana) | `koopa-admin-secrets/backups/goa/<stamp>/` · `…/current` |
-
-Stamp taken: **`20260904T1238Z`**.
-
-### Non-secret dumps (`~/backups/goa/`)
-
-`exchange/` `bank/` `merchant/` TGZs (PG + etc), `meta/`, optional `images/` (~2.2G).
-
-### Secrets (`koopa-admin-secrets/backups/goa/current/`)
-
-| Path | Content |
-|------|---------|
-| `exchange-offline/master.priv` | offline master (pub TW6K5…) |
-| `exchange-offline/secm_tofus.pub` | secmod TOFU |
-| `exchange/secrets/*.secret.conf` | DB + wire account creds |
-| `merchant/secrets/merchant-db.secret.conf` | merchant DB |
-| `ansible/host_vars/` | public.yml + secrets.yml |
-| `paivana/secrets/` | merchant-access-token, paivana-secret |
-
-Never Forgejo push for `koopa-admin-secrets`. Magikoopa: `~/git/admin-logs/koopa-admin-secrets` (symlink `~/src/koopa/koopa-admin-secrets`).
-
-## Local reproduce (magikoopa) — **one** container, few unprivileged ports
-
-Not the three `goa-local-*` snapshot containers. Use **`regio-local`** only:
-
-| Bind | Role |
-|------|------|
-| `127.0.0.1:9080` | nginx HTTP (`Host: *.goa.local`) |
-| `127.0.0.1:9222` | SSH ansible |
-
-Optional: `REGIO_PUBLISH_KOOPA_PORTS=1` also binds `9010–9012` (still unprivileged).
-
-Tree: `~/src/regio-local/` — see `RESTORE.md`, `README.md`.
-
-### koopa lab ports (2026-09-04)
-
-Same stack **on koopa** without touching live **9010–9015** or **9080** (nym):
-
-| Bind | Role |
-|------|------|
-| `127.0.0.1:9180` | `goa-regio-ng` HTTP |
-| `127.0.0.1:9322` | `goa-regio-ng` SSH |
-| `127.0.0.1:8288` | `mytops-local` HTTP |
-
-Canonical config: **`configs/lab-local/`** (`goa-regio-ng-koopa.yml`, `mytops-local.toml`, README).
-
-### `taler-deployment` branches
-
-```
-dev/hernani/regio-ng-apt-refresh
-  └─ dev/hernani/regio-ng-ensure-postgresql
-       └─ regio-goa-explorational-currency   # GOA profile + master pin/import + TCP 901x
-```
-
-Example inventory: `regional-currency-ng/examples/goa-explorational.yml`  
-(imports `master.priv` from admin-secrets; refuses greenfield when pub pinned).
-
-### Restore flow
-
-```bash
-podman stop goa-local-exchange goa-local-bank goa-local-merchant   # free 901x; leave koopa live alone
-cd ~/src/regio-local
-./scripts/01-build-run.sh
-./scripts/02-inventory.sh
-./scripts/03-deploy.sh          # ansible; master from admin-secrets
-./scripts/05-restore-data.sh    # optional PG dumps from ~/backups/goa/current
-./scripts/04-probe.sh           # expect 200 on :9010 :9011 :9012
-```
-
-## Push
-
-`koopa-admin-log` Push nötig — nur mit Freigabe / User-Push.  
-`taler-deployment` branch `regio-goa-explorational-currency` likewise Freigabe.  
-Live wipe: **no**.
--- a/2026/2026-09-04--mytops-local-podman.md
+++ b/2026/2026-09-04--mytops-local-podman.md
@ -1,47 +0,0 @@
-# mytops-local on koopa (podman lab)
-
-**2026-09-04** — merchant http lab next to live goa (not 901x / nym 9080).
-
-## status
-
-| where | port | `/config` |
-|-------|------|-----------|
-| koopa | `127.0.0.1:8288` | 200 (`mytops-local` Up) |
-| magikoopa (ref) | `127.0.0.1:8088` | 200 |
-
-container: `mytops-local` · image `localhost/mytops-debian-systemd:trixie` ·
-bind `~/src/mytops-admin-log` (rsync from laptop; `.git` optional).
-
-docs/run: `mytops-admin-log` branch `mytops-local` → entry `mytops-local` /
-`mytops-local.md`. `STAGE_ENV` unused on this path.
-
-## setup (koopa)
-
-```bash
-rsync -az --delete --exclude .git --exclude .DS_Store \
-  ~/git/mytops-admin-log/ hernani@koopa:src/mytops-admin-log/
-ssh hernani@koopa
-cd ~/src/mytops-admin-log
-podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local .
-MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/apply-local-base-url.sh
-podman rm -f mytops-local 2>/dev/null || true
-podman run -d --name mytops-local --hostname mytops-local \
-  --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \
-  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
-  -p 127.0.0.1:8288:80 \
-  -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:rw" \
-  localhost/mytops-debian-systemd:trixie /sbin/init
-podman exec mytops-local bash -lc \
-  'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh'
-```
-
-if dbconfig fails (`policy-rc.d`): start `postgresql`, then dbconfig + `taler-merchant.target`.
-
-## links
-
-| what | where |
-|------|--------|
-| koopa-setup | `koopa-setup` |
-| lab-local | `configs/lab-local/` · `configs/ports.md` |
-| mytops-admin-log | branch `mytops-local` |
-| regio lab | `configs/lab-local/goa-regio-ng-koopa.yml` · `~/src/regio-local/` |
--- a/2026/2026-09-05--taler-apt-src-ubuntu.md
+++ b/2026/2026-09-05--taler-apt-src-ubuntu.md
@ -1,24 +0,0 @@
-# taler apt-src ubuntu (noble) on koopa
-
-**2026-09-05** — Freigabe: create Ubuntu track next to existing trixie apt-src pods.
-
-## container
-
-| name | base | suite | image |
-|------|------|-------|-------|
-| `koopa-taler-deploy-test-apt-src-ubuntu` | `ubuntu:24.04` | `noble` @ `deb.taler.net/apt/ubuntu` | `localhost/…:setup` after commit |
-
-ensure: `~/src/taler-monitoring/host-agent/ensure-apt-deploy-test-containers.sh ubuntu`  
-(branch `llm-lightweight-monitoring` / tip after `v1.27.0`)
-
-## verify
-
-```bash
-podman ps -a --filter name=koopa-taler-deploy-test-apt-src-ubuntu
-ANSIBLE_SMOKE_PODMAN=1 ANSIBLE_SMOKE_REQUIRE_UBUNTU=1 \
-  ./taler-monitoring.sh ansible-smoke
-```
-
-## notes
-
-Debian trixie×4 unchanged. Spam mailbox secrets / durable monitord still separate Freigabe items.
--- a/2026/2026-09-07--git-meta-origin-forgejo.md
+++ b/2026/2026-09-07--git-meta-origin-forgejo.md
@ -1,55 +0,0 @@
-# `$HOME/git/` meta-repo origin on git.hacktivism.ch (2026-09-07)
-
-## Remote
-
-| Item | Value |
-|------|--------|
-| Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
-| Repo | **hernani/git** (meta-repo: non-secret globals only) |
-| Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) |
-| Default branch | `master` (forgejo/ht SoT — never `main`) |
-| SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` |
-| SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` |
-| Local tree | `$HOME/git/` (`PATH[git-root]`) |
-
-Unauth HTTPS browse of a private repo → **404** (expected).
-
-## Local setup (done 2026-09-07 ~14:21)
-
-```bash
-cd "$HOME/git"
-git remote add origin git@git.hacktivism.ch:hernani/git.git
-git push -u origin master
-```
-
-SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`.
-
-## Create via One-Shot-Token (on koopa)
-
-Do **not** use xAI / host-expert-ssh mutate for this. SSH as `hernani` → local HTTP **9024**.
-
-```bash
-# unique token name (default gitea-admin may already exist)
-podman exec koopa-forgejo gitea admin user generate-access-token \
-  --username hernani \
-  --token-name "oneshot-git-meta-$(date +%s)" \
-  --scopes write:repository,write:admin \
-  --raw
-# → TOKEN (never log / never commit)
-
-curl -sS -X POST \
-  -H "Authorization: token ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"git","private":true,"auto_init":false,"default_branch":"master"}' \
-  http://127.0.0.1:9024/api/v1/admin/users/hernani/repos
-# expect HTTP 201, full_name=hernani/git
-```
-
-Token delete via API often **403** with those scopes — purge leftover `oneshot-*` in Forgejo UI if needed.
-
-## Related
-
- This admin-log’s own origin: `2026-07-10--admin-log-origin-forgejo.md` (public)
- Forgejo install: `2026-07-10--forgejo-rootless.md`
- Host skill quirk: private repos need explicit `private:true`
- Meta Must: no secrets / no child worktrees in this Forgejo repo
--- a/2026/2026-09-09--forgejo-tip-master-only.md
+++ b/2026/2026-09-09--forgejo-tip-master-only.md
@ -1,31 +0,0 @@
-# Forgejo HT tip = `master` only (2026-09-09)
-
-## Rule
-
-On `git.hacktivism.ch` every hernani tip is **`master` only** — no dual `main`+`master`, no tip named `main`.
-
- Instance: `[repository] DEFAULT_BRANCH = master` in Forgejo `app.ini` (live after container restart).
- Sync/clone/push defaults: `origin/master`.
- Docs: `llm-configs` → `git-skills.md`, `ESYNC-RULE.md`, `REPOS-INDEX.md`, `forgejo-llm-config.md`.
-
-## Unify (done)
-
-Authenticated inventory: 32 hernani repos. Mutated 15 NEED → verify **OK 32 / BAD 0**.
-
-Notable:
-
-| Case | Repos |
-|------|--------|
-| MAIN_ONLY → master + drop main | `_grok_sync`, admin-logs, `elelmon` (kept `main-legacy`), `silverbucket` (ex-`freenotes` space), `grok-work-log`, `llm-work-output-enc`, `openkknd-ng`, `taler-monitoring`, `taler-wallets-enc`, `vecirex-www`, … |
-| EMPTY | `vecigate-admin-log` (PATCH default only) |
-| DUAL_DIFF (stale master dropped; tip from former main) | `git`, `llm-configs` |
-
-Feature branches left in place where present (`koopa-admin-log`, `taler-monitoring`, …).
-
-## Rename (same day)
-
-Forgejo space repo **`hernani/freenotes` → `hernani/silverbucket`** (tip `master`). Local clone: `~/git/freenotes-space` → origin `silverbucket`. **Not** the FreeNotes tool/apps tree (`~/git/freenotes`).
-
-## Local clones
-
-Retarget checkout/tracking to `origin/master` on magikoopa trees that had `origin`.
--- a/2026/2026-09-11--forgejo-gitleaks-enc-gate.md
+++ b/2026/2026-09-11--forgejo-gitleaks-enc-gate.md
@ -1,55 +0,0 @@
-# 2026-09-11 — Forgejo/ht gitleaks + *enc.git Klartext-Sperre (TODO320)
-
-**Status:** live on koopa Forgejo (`koopa-forgejo` / `git.hacktivism.ch`)  
-**Freigabe:** Auftrag `TODO=320` this session (host mutation ht)  
-**Analog:** firefly/taler `admin-log/firefly/28-gitolite-enc-gitleaks.md` + `hooks/common/pre-receive.d-gitleaks`  
-**Tip:** k stays **319** (no tip-advance)
-
-## What
-
-1. **gitleaks** pre-receive on non-`*enc.git` — reject pushes with detected secrets.  
-2. **Skip** `*enc.git` for gitleaks (ciphertext / FP).  
-3. **`git-crypt-enforce`** on `*enc.git` — require `.gitattributes` + `.git-crypt/`; reject blobs under `filter=git-crypt` missing `\0GITCRYPT` (9-byte header).
-
-## Live paths (koopa)
-
-| Item | Path |
-|------|------|
-| Data root | `~/koopa-forgejo/data` → container `/var/lib/gitea` |
-| Binary | `data/custom/bin/gitleaks` (v8.21.2 linux_x64) |
-| Shared hooks | `data/custom/hooks/pre-receive.d/{gitleaks,git-crypt-enforce}` |
-| Smoke | `data/custom/bin/smoke-todo320.sh` (run **inside** container) |
-| Per-repo | `data/git/repositories/*/*.git/hooks/pre-receive.d/` → symlinks to shared hooks (container paths) |
-| Staging / installer SoT | laptop `PATH[llm-configs]/bin/forgejo-hooks/` + koopa `~/koopa-forgejo/hooks-staging/` |
-
-Installer: `install-hooks-ht.sh` (idempotent; podman; does not restart container).  
-After install: **~32** repos linked. **New repos:** re-run installer (custom/hooks alone not relied on for auto-sync into every bare repo).
-
-## Smoke (Done-when a/b/c) — PASSED 2026-09-11
-
-```bash
-podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
-# ALL SMOKES PASSED
-# (a) secret push denied — private-key fixture (not AWS EXAMPLE keys)
-# (b) enc ciphertext allowed
-# (c) enc plaintext denied
-```
-
-Fixes needed during smoke: park incoming objects on `refs/tmp/*` (not `refs/heads/*`, else `rev-list tip --not --branches` is empty); magic check `head -c 9` for `\0GITCRYPT`.
-
-## Rollback
-
-```bash
-# Per repo or all: remove custom hooks from pre-receive.d (keep Forgejo `gitea` hook)
-rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/gitleaks
-rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/git-crypt-enforce
-# Optional: remove shared copies under data/custom/hooks/pre-receive.d/
-```
-
-## Ops notes
-
- Use **podman** (not docker sock) for `koopa-forgejo`.  
- Symlink targets must be **container** paths (`/var/lib/gitea/custom/...`).  
- Hook logs redact via gitleaks `--redact`; do not echo secrets.  
- Laptop SSH: `Host git.hacktivism.ch` ProxyJump koopa, Port 9200, User git.  
- Local SoT scripts: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`.
--- a/2026/2026-09-12--enc-inventur-rewrite-hooks.md
+++ b/2026/2026-09-12--enc-inventur-rewrite-hooks.md
@ -1,60 +0,0 @@
-# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY)
-
-**Status:** report only — **no** admin-log / firefly / Taler push this stretch  
-**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only  
-**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`)  
-**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0%  
-**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt`
-
-## Priority table (tip)
-
-| Priority | Repo | Outcome |
-|----------|------|---------|
-| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). |
-| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). |
-| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. |
-| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. |
-| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. |
-| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. |
-
-## Wrong origin (cleared)
-
-Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`.
-
-## Hooks (TODO320) — reinstall + smoke 2026-09-12
-
-Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`  
-Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh`
-
-```
-OK gitleaks=8.21.2 repos_linked=32
-podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
-ALL SMOKES PASSED
-  (a) secret push denied
-  (b) enc ciphertext allowed
-  (c) enc plaintext denied
-```
-
-`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks.  
-Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING).
-
-**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext).  
-Inventur STATUS close block appended same turn.
-
-## GPG recipients (credit + control)
-
- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep)
- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa)
-
-## Blocked / needs next Freigabe
-
-1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks.  
-2. Optional: commit/push work-output dirty overlay (2090) after review.  
-3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy.  
-4. Admin-log **push** of this file (report-only until Freigabe).
-
-## HALT (unchanged)
-
- No ladder restart `@START_N=333`  
- No admin-log / firefly / Taler push without Freigabe  
- No force-push to `hernani/git.git`
--- a/2026/2026-09-15--goa-ansible-merchant-first.md
+++ b/2026/2026-09-15--goa-ansible-merchant-first.md
@ -1,124 +0,0 @@
-# 2026-09-15 — GOA Ansible Merchant-first
-
-**Freigabe:** Live-Stop / Caddy = nein bis Chat-OK.  
-**Feed:** `taler-deployment` `origin/dev/hernani/regio-goa-explorational-currency`  
-**Work branch:** `dev/hernani/goa-regio-ng-vanilla`
-
-## Naming
-
-| | |
-|--|--|
-| **vanilla** | Ansible Vollkomposition (Merchant+Exchange+Bank+nginx/pg); GOA-Ersatz-Kandidat |
-| **local** | Lab only: loopback / `goa.local` |
-
-`configs/lab-local/goa-regio-ng` = **vanilla** @ **local**. Nie `REGIO_PUBLISH_KOOPA_PORTS=1` neben Live.
-
-## Ist (lab green)
-
-```bash
-ssh hernani@koopa 'podman ps --format "{{.Names}} {{.Status}} {{.Ports}}" | grep -E "goa-regio|taler-hacktivism"'
-# taler-hacktivism* Up  9010–9015
-# goa-regio-ng      Up  127.0.0.1:9180→80, 127.0.0.1:9322→22
-
-ssh hernani@koopa "podman exec goa-regio-ng sh -c '
-  for u in nginx postgresql libeufin-bank taler-merchant-httpd taler-exchange-httpd taler-merchant.target; do
-    printf \"%s=\"; systemctl is-active \$u
-  done'"
-# all=active
-
-ssh hernani@koopa 'for h in bank.goa.local exchange.goa.local backend.goa.local; do
-  curl -sS -o /dev/null -w "$h %{http_code}\n" -H "Host: $h" http://127.0.0.1:9180/config
-done'
-# all 200
-
-ssh hernani@koopa 'curl -sS -H "Host: exchange.goa.local" http://127.0.0.1:9180/keys' \
-  | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["master_public_key"],d["currency"],len(d.get("denominations",[])))'
-# TW6K5… GOA 27
-```
-
-| Piece | Live | Lab vanilla@local |
-|-------|------|-------------------|
-| Merchant | :9010 | **active** · instance `default` |
-| Exchange | :9011 | **active** · master TW6K5 · 27 denoms |
-| Bank | :9012 | libeufin-bank OK |
-| MASTER | TW6K5… | sha256 match enc `current/exchange-offline/master.priv` |
-
-Playbook: `ok=92 changed=20 failed=0` after `/etc/hosts` pin (bank.goa.local NXDOMAIN once).
-
-## Lab hosts (ephemeral)
-
-Container recreate drops hosts. Re-pin:
-
-```bash
-cd $HOME/git/admin-logs/local/koopa-admin-log/configs/lab-local
-ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
-# unsafe_writes — /etc/hosts EBUSY on atomic rename inside podman
-```
-
-## Merchant token (lab)
-
-SoT: `koopa-admin-secrets-enc/backups/goa/lab-local/merchant/secrets/merchant-default-access-token`  
-passwd = PLAIN; Bearer = file value as-is (`secret-token:…`). `/instances/default/private/products` **200**.  
-`/config` `"currency":"CHF"` = tip dual-merchant; GOA under `currencies.GOA`.
-
-## t2 — wire + order + withdraw + pay (lab) **done**
-
-Bank acct `lab-merchant` via `libeufin-bank create-account`; secrets under `…/lab-local/merchant/secrets/`. Wire `x-taler-bank`.
-
-```bash
-# POST /instances/default/private/accounts → 200 salt/h_wire
-# POST orders GOA:1 → 200 unpaid
-# create-token labwallet; POST withdrawals; wallet-cli withdraw; POST confirm → 204
-# handle-uri --yes "$taler_pay_uri"
-```
-
-| | |
-|--|--|
-| WID | `1eab9b0d-a3a8-41a8-b070-d7645b25ab25` |
-| withdraw | `txn:withdrawal:2EBFWF7GK415A151KP56MWCVK2CYMDHMR55Q9BG11VT6NR55YC80` final |
-| pay | `txn:payment:D4H75B5YDNJ52G8T6ADBDCXVWXCVZBG5HVSGE7G4S0XBQ6K8H3Y0` done |
-| order | `2026.257-6E75WGDBR32M4` **paid** |
-| wallet | GOA:9 (GOA:10 − GOA:1); CLI 1.6.43 **inside** `goa-regio-ng` |
-
-## Zielbild
-
-Ansible = SoT. Zwei Formen, gleiche Playbooks: **Full-stack Podman** · **Recreate-Fabrik**.  
-Branch: **master = stage**; anderer = **prod**. Kein `STAGE_ENV`.  
-**Reihenfolge:** **1 GOA** → **2 FP/Stage** (zwei Stacks) → **3 mytops-***. Merchant-Probleme → mytops vorziehen.  
-Gate: elelmon moderate → purse/withdraw → lab harden → Live-Merchant cutover nur wenn 1–3 grün → restore-back. Greenfield `*.2.*` PARK.
-
-## APPLY 20260915T0013Z
-
-BACKUP+APT+COMMIT OK. APPLY_SMOKE_FAIL was `sm=$(smoke)` capture; driver now `if smoke; then` → **APPLY_OK**. Smoke endpoints 200. Live bank/exchange/merchant Up; lab `goa-regio-ng` Up. Images retagged `:live` / `:landing`.
-
-## Arbeit 1 — live confirm overflow (2026-09-16) **FAIL**
-
-Smoke: `$HOME/git/llm/llm-work-input/goa-confirm-smoke.sh` (fresh scratch wallet; WCLI `$HOME/.local/bin/taler-wallet-cli.mjs`).
-
-| | |
-|--|--|
-| user | `cfm18923` 2026-09-16T00:35:23Z |
-| max_debt | acct#1=1e12 · **#2=1e8** · #3=1e12 |
-| credit | GOA:4798.5 **200** |
-| TOS | `exchanges add` + `update` + `accept-tos` **OK** |
-| GOA:20 WID | `062e3112-e235-4fea-95d1-644773100224` |
-| create | body `amount` + `exchange_url` → **200** |
-| force-select | rpub + epayto from `/keys` → **200** `selected` |
-| confirm | POST `/accounts/{user}/withdrawals/{wid}/confirm` → **500** code **5110** P0001 `amount value overflowed` |
-| GOA:4200 | same scratch rpub → **409** code **5114** Reserve pub already used (script; skip until GOA:20 green) |
-
-`CONFIRM_SMOKE_FAIL`. Select+TOS+RPUB green for GOA:20; overflow still at confirm. Next: dump `make_incoming` / `bank_wire_transfer` for that WID; lower remaining 1e12 if dump confirms.
-
-## Pointers
-
-| | |
-|--|--|
-| inventory | `configs/lab-local/goa-regio-ng-koopa.yml` |
-| lab hosts | `configs/lab-local/lab-hosts.yml` |
-| Lab README | `configs/lab-local/README.md` |
-| backup daylog | `2026/2026-09-04--goa-backup-regio-ng.md` |
-| APPLY driver | `scripts/taler-shared/goa-live-backup-upgrade.sh` |
-| dumps | koopa `~/backups/goa/current` → `20260904T1238Z` |
-| Caddy | taler→9010 · exchange→9011 · bank→9012 |
-
-Leave-off: t1+t2 lab green. Live confirm **5110**. No Live-Stop / no Caddy.
--- a/2026/2026-09-18--amanita-external-probe.md
+++ b/2026/2026-09-18--amanita-external-probe.md
@ -1,39 +0,0 @@
-# 2026-09-18 — koopa as external amanita probe logger
-
-## Why
-
-Amanita hard hangs leave no panic; internal heartbeat stops with the box.
-External ICMP+SSH from **koopa** records last-alive independently so hang vs
-power/PSU can be separated after the next freeze.
-
-## Live (hernani@koopa)
-
-| Piece | Detail |
-|-------|--------|
-| Key | `~/.ssh/id_ed25519_amanita_probe` — fingerprint `SHA256:R2i2nZfI1svR6Ts3DaSw5eZj2fvnGgm1R9PoMFS4Jj0` |
-| SSH Host | `amanita-probe` → `vx@192.168.100.6`, IdentityFile that key only |
-| Script | `~/.local/bin/koopa-amanita-probe` (SoT: `scripts/amanita-probe/`) |
-| Timer | user `koopa-amanita-probe.timer` ~15 s, linger yes |
-| Log | `~/.local/state/amanita-probe/amanita-probe.{log,last,meta}` — owned by hernani, mode 644 |
-
-## amanita vx (only)
-
-Restricted `authorized_keys` line (not on root):
-
-```text
-from="192.168.100.95",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,command="/bin/cat /var/lib/amanita/heartbeat.last" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeMenvp0D9EarfAEUtu49Q7bCbGhw+R/E1nJPQSSmZc koopa-amanita-probe@hernani-koopa
-```
-
-Forced command only cats the world-readable HB mirror. No shell, no agent/X11/port forward.
-
-## Verify (2026-09-18 ~15:09 CEST)
-
- `systemctl --user is-active koopa-amanita-probe.timer` → active
- `ssh amanita-probe` → EXIT 0, one HB line
- meta: `icmp=ok ssh=ok gap_s≈15`
- hernani can read the probe log dir on koopa (owner)
-
-## Docs / install
-
-`scripts/amanita-probe/README.md` + `install-amanita-probe.sh`.
-Do **not** put this key on root AK; do **not** bare `modprobe ramoops`.
--- a/2026/2026-09-19--goa-regio-ng-login-health+monitoring.md
+++ b/2026/2026-09-19--goa-regio-ng-login-health+monitoring.md
@ -1,46 +0,0 @@
-# 2026-09-19 — GOA single-CTR: login-health + monitoring
-
-## Why
-
-`koopa-login-health` FAIL×3 on dead `taler-hacktivism*` + WARN `koopa-tor-relay`.
-Live stack is **`goa-regio-ng`** (pasta 9010–9015) + host **`tor.service`** (ORPort 8080).
-
-## Live SoT (hernani@koopa)
-
-| Piece | Detail |
-|-------|--------|
-| GOA CTR | `goa-regio-ng` — image `localhost/goa-regio-ng:empty-current` |
-| Scripts | `~/scripts/taler-shared/goa-regio-ng/` · `goa-all-in-one.sh` |
-| Bak | `~/backups/goa/current` |
-| Landings | host `/var/www/*-landing/` + `~/goa-landing-deploy` · Caddy outside CTR |
-| Tor | host `tor.service` — **not** container `koopa-tor-relay` |
-| Forgejo | `:9024/:9200` · edge Caddy `:9000/:9001` |
-
-## Repo changes (magikoopa, no push yet)
-
-**koopa-admin-log**
- `scripts/login-health/`: CRITICAL/EXPECT → `goa-regio-ng` (+ forgejo); drop legacy + tor-relay; host `tor.service` check; probes 9010–9012
- delete `host/overview/{LIVE,services}.*` · delete `configs/tor/*`
- rewrite `host/tor/README.md` · shorten README / ports / koopa-setup / login-health README
- ISSUES I-07 → host Tor SoT
-
-**elelmon + taler-monitoring** (EQ scripts mirrored)
- BANK=EX=MER=`goa-regio-ng`; drop nginx-in-bank; host stats.json fallback
- `check_{server,inside,urls,versions,e2e,sanity}.sh` · `metrics.sh` · `lib.sh` · docs
-
-## Verify (after deploy on koopa — Freigabe)
-
-```bash
-koopa-login-health show -v
-# expect: goa-regio-ng OK · no taler-hacktivism* · tor.service OK|WARN
-```
-
-STATE dir name `taler-hacktivism-monitoring` kept (host-agent path, not CTR).
-
-## Follow-up (same day) — elelmon-only SoT
-
- Forgejo `hernani/taler-monitoring` **archived**; push fails. Do not maintain twin.
- Parity leftover (mail-deliverability) → **elelmon** only (`check_mail_deliverability.sh`,
-  `mail_deliv_probe.py`, host-agent timer, wrapper phase `mail-deliverability|maildeliv`).
- Canonical clone/install path: `~/src/elelmon` — see `scripts/taler-monitoring/README.md`.
- Modular Python rewrite scaffold under elelmon package `elelmon/` (not flat TM `check_*.sh` layout).
--- a/2026/2026-09-23--goa-merchant-terms-privacy+mon.md
+++ b/2026/2026-09-23--goa-merchant-terms-privacy+mon.md
@ -1,32 +0,0 @@
-# 2026-09-23 — GOA merchant /terms+/privacy + mon green
-
-## Why
-
-Public merchant `taler.hacktivism.ch` lacked `/terms` + `/privacy` (501).
-elelmon still assumed legacy multi-CTR `taler-hacktivism*`; live SoT is single
-CTR **`goa-regio-ng`** (pasta 9010–9015).
-
-## Live (hernani@koopa)
-
-| Piece | Detail |
-|-------|--------|
-| CTR | `goa-regio-ng` · BANK=EX=MER same |
-| Terms | `TERMS_ETAG=merchant-tos-dual-v2` · en under `/var/lib/taler-merchant/terms/` |
-| Privacy | `PRIVACY_ETAG=merchant-pp-swiss-v0` |
-| Drop-in | `/etc/taler-merchant/conf.d/terms-privacy.conf` · httpd restart |
-| Public | `https://taler.hacktivism.ch/{terms,privacy}` → **200** |
-| Mon stamp | `20260923T075931Z` · LOG `~/.local/state/elelmon-runs/hacktivism-full-….log` |
-| Mon result | EXIT=0 · 182 OK · 0 ERROR · 21 WARN · 21 INFO |
-| Public mon | staging → `/var/www/monitoring-sites/{host}/monitoring/` |
-
-## Repo SoT (magikoopa)
-
-**koopa-admin-log** — profile/scripts already had ETAGs + install helpers;
-runtime apply on CTR today. Caddyfile dossiers `try_files` → `{path} {path}/ {path}/index.html`
-(separate commit).
-
-**elelmon** — laptop tip goa-aware (clean); koopa WT may still need SSH pull.
-
-## Hold
-
-Cutover locked. No `taler-deployment` master push. Next: T3 vanilla Ansible lokal → T2 APT (Freigabe).
--- a/2026/2026-09-25--qbittorrent-bt-net.md
+++ b/2026/2026-09-25--qbittorrent-bt-net.md
@ -1,39 +0,0 @@
-# 2026-09-25 — qBittorrent BT net (flame / firewalled)
-
-## Goal
-Inbound BT listen **6881** tcp+udp reachable so WebUI connection status leaves the firewalled (flame) state.
-
-## Live on koopa
- CTR `koopa-prime-qbittorrent` (linuxserver): host **6881** tcp+udp, WebUI **9023**→8080 → `bt.hacktivism.ch`
- Conf: `Session\Port=6881`, `PortForwardingEnabled=true`, `Connection\UPnP=true`
- Temp: `/downloads/incomplete/` (abc / host uid 100999)
- Durable apply: `scripts/prime/apply-qbittorrent-bt-net.sh` (+ wrapper `koopa-bt-fix.sh`)
- Clone on host: `~/koopa-admin-log/scripts/prime/`
-
-## firewalld
- Doc: `configs/firewalld/public-ports.md` — **6881/tcp+udp**
- Agent cannot list without sudo/polkit; human opens with:
-  ```bash
-  sudo firewall-cmd --permanent --add-port=6881/tcp
-  sudo firewall-cmd --permanent --add-port=6881/udp
-  sudo firewall-cmd --reload
-  ```
- WAN probe success (below) implies the path through host firewall is open.
-
-## VeciGate (2026-09-25)
- wan `dstnat` tcp+udp **6881** → `192.168.100.95:6881`
- hairpin LAN `192.168.100.0/24` and LAN2 `192.168.88.0/24` → `212.51.151.254:6881` tcp+udp
- Comments: `koopa: qBittorrent BT …` / `hairpin: LAN[2] qBittorrent BT …`
- Detail: vecigate-admin-log `2026/2026-09-25--qbittorrent-bt-dnat.md`
-
-## Verify (2026-09-25, from magikoopa)
-| Probe | Result |
-|-------|--------|
-| `nc -vz 192.168.100.95 6881` | LAN_TCP_OK |
-| `nc -vz 212.51.151.254 6881` | WAN_TCP_OK |
-| `nc -zu 212.51.151.254 6881` | WAN_UDP_OK |
-
-WebUI API (`/api/v2/…`) still auth-gated from agent — human glance at connection icon on `bt.hacktivism.ch`.
-
-## Freigabe
-Session Freigabe covered podman conf/restart + VeciGate NAT. No git push of admin-log unless asked.
--- a/2026/2026-09-28--tech-dossier-freeze-cascade.md
+++ b/2026/2026-09-28--tech-dossier-freeze-cascade.md
@ -1,51 +0,0 @@
-# tech-dossier Freeze cascade — 2026-09-28
-
-Repo: `$HOME/git/src/ngi/tech-dossier-project-data`  
-Ladder (each tip autonomously `make html`; each depends on the previous):
-
-| # | Branch | Tip | Local serve | Live ht root |
-|---|--------|-----|-------------|--------------|
-| 1 | `main` | `d2fbd79` | http://127.0.0.1:8101/ | — |
-| 2 | `feat/sm-content` | `089ef1f` | http://127.0.0.1:8102/ | `dossiers.3.ngi.hacktivism.ch` (optional) |
-| 3 | `feat/website-features` | `53a3176` | http://127.0.0.1:8103/ | `dossiers.2.ngi.hacktivism.ch` (optional) |
-| 4 | `feat/website-design` | `2e26c80` | http://127.0.0.1:8104/ | — (no public host after views deploy) |
-| 5 | `feat/website-views` | `bbafc38` (origin tip; local soft-reset dropped bad `1b2fcf7`/`7aca0e8`) | http://127.0.0.1:8105/ | path roots under blank landing (see Live) |
-
-Caddy roots (SoT `scripts/caddy/Caddyfile.koopa-live-wdGet`):
-
- `/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch`
- `/var/www/monitoring-sites/dossiers.2.ngi.hacktivism.ch`
- `/var/www/monitoring-sites/dossiers.3.ngi.hacktivism.ch`
-
-basic_auth: `scripts/caddy/apply-dossiers-ngi-basicauth.sh`
-
-## Local cascade links
-
- [main](http://127.0.0.1:8101/)
- [feat/sm-content](http://127.0.0.1:8102/)
- [feat/website-features](http://127.0.0.1:8103/)
- [feat/website-design](http://127.0.0.1:8104/)
- [feat/website-views](http://127.0.0.1:8105/)
-
-## Live
-
- [dossiers.ngi](https://dossiers.ngi.hacktivism.ch/) ← **blank cascade landing** (kal `sites/dossiers.ngi.hacktivism.ch/`; EN + ASCII ladder; views tip cite `bbafc38`)
- Path editions: `/main/`, `/feat-sm-content/`, `/feat-website-features/`, `/feat-website-design/`, `/feat-website-views/`
- Hourly branch-status builder: **kal** `scripts/dossiers-ngi/branch-status-hourly.py` → `sites/…/branch-status.json` (+ user timer); **not** inside tdpd
- tdpd `feat/website-views` local HEAD = origin = `bbafc38` (NO_PUSH; bad tips discarded locally)
- [dossiers.2.ngi](https://dossiers.2.ngi.hacktivism.ch/) ← website-features (optional)
- [dossiers.3.ngi](https://dossiers.3.ngi.hacktivism.ch/) ← sm-content (optional)
-
-## Deploy (Freigabe 2026-09-28 design; Freigabe 2026-09-29 views; Freigabe blank landing same day)
-
-Earlier primary: rsync `website/build/` from tip `feat/website-views` →
-`hernani@koopa:/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/`
-(`--delete`, exclude `.DS_Store`).
-
-**Result 2026-09-28 ~22:25+02 (design @ `2e26c80`):** `RSYNC_OK` — ~2698 files / ~27M; live `dossier/sm/index.html` 41693 bytes.
-
-**Result 2026-09-29 ~04:30+02 (views-era freeze):** `RSYNC_OK` — live `/` HTTP 200. Local tdpd later briefly carried wrong tips `1b2fcf7` → `7aca0e8` (ladder rewrite + hourly in tdpd); those were **dropped** locally back to `bbafc38` (TODO=430). Never push those tips.
-
-**Result 2026-09-29 (blank landing kal @ `56ee97a`):** `RSYNC_OK` — live `/` HTTP 200 SIZE=3505 title `cascade landing`; path-root editions owned by koopa-admin-log `sites/dossiers.ngi.hacktivism.ch/`; NO_PUSH.
-
-**TODO=430 follow-up (local, NO_PUSH):** kal landing EN/ASCII + tip cite `bbafc38`; hourly builder + systemd under kal; daylog tip table corrected. Deploy landing / enable timer on koopa needs Freigabe.
--- a/2026/2026-10-20--forgejo-host-ro-users.md
+++ b/2026/2026-10-20--forgejo-host-ro-users.md
@ -1,57 +0,0 @@
-# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)
-
-Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).
-
-## Users
-
-| Username | ID | Email | Flags |
-|----------|----|-------|-------|
-| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
-| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
-| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |
-
-## Repo access
-
- Collaborator **read** on `hernani/waldpfad` (all three).
- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.
-
-## Secrets (enc only)
-
-Laptop SoT (git-crypt):
-
-`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`
-
-Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.
-
-## Create recipe (idempotent)
-
-On koopa as `hernani`, Forgejo HTTP **9024**:
-
-```bash
-podman exec koopa-forgejo gitea admin user create \
-  --username USER --email USER@hosts.hacktivism.ch \
-  --random-password --must-change-password=false --restricted
-```
-
-SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:
-
- `POST /admin/users/USER/keys` with `{"title","key"}`
- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`
-
-Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.
-
-## Clone pattern (on target host)
-
-```bash
-GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
-  git clone --depth 1 --single-branch --branch master \
-  ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
-```
-
-Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).
-
-## Related
-
- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`
--- a/2026/2026-10-21--castopod-php-stay-off.md
+++ b/2026/2026-10-21--castopod-php-stay-off.md
@ -1,13 +0,0 @@
-# Castopod stays off
-
-Rechecked 2026-10-21 after the stop note. Web unit container-koopa-castopod.service is disabled, inactive, dead. Container koopa-castopod is exited, finished 2026-10-21 22:48:06 +0200. Nothing listens on :9020. MariaDB and Redis user units stay loaded and active. No second stop. Caddy vhost unchanged.
-
-Log review found no sign of a successful remote code execution. Overlay file /tmp/fw-cp.php (1448 bytes, mode 600, sha256 7bb279bffa12dbb81787183108a2641b78a6657b069cbef7967950d80e13b5bc, mtime 2026-09-07 03:25:59 +0200) is a local database script for cp_users, outside the docroot, not a web shell. /tmp/os-dry.out is an apt dry-run. Five theme files differ by one branding line from 2026-07-13. Media volume has no scripts. Access logs run 2026-10-17 through the stop and show no 2xx on a non-index script. Critical lines on 2026-09-07 match other days.
-
-Limits: access logs start 2026-10-17, so HTTP from 2026-09-07 is absent. A memory-only or already rotated request is not ruled out. Whether the local script ran is not in the logs. MariaDB was not opened.
-
-Stays down until an image ships PHP newer than 8.4.18. Hub tag :1 from 2026-02-24 is not that image. Parent 537, slug castopod-restart-after-php-fix.
-
-Restore only then:
-
- systemctl --user enable --now container-koopa-castopod.service
--- a/2026/2026-10-21--castopod-php-stop.md
+++ b/2026/2026-10-21--castopod-php-stop.md
@ -1,23 +0,0 @@
-# Castopod PHP stopped
-
-Checked 2026-10-21. Host has no php-fpm and no php package. The only PHP process was Castopod FrankenPHP in container koopa-castopod.
-
-| Item | Value |
-|------|--------|
-| image | docker.io/castopod/castopod:1 |
-| repo digest | sha256:4e4f0440520f45257bfeac7be4347defd20048b4efef8f53d73ec9ed3a4f7966 |
-| amd64 digest | sha256:757f3c2a96b31b81753c23bc092dfcf05039d9df4d13cc12c428bb752fce882b |
-| image created | 2026-02-24 |
-| hub tags 1 / latest / 1.15.5 | same digest, pushed 2026-02-24 |
-| PHP | 8.4.18 (12 Feb 2026) |
-| FrankenPHP | v2.10.2 |
-| listen | 0.0.0.0:9020 -> 8080 |
-| public | https://castopod.hacktivism.ch/ |
-
-Stable Hub tags have not moved since 2026-02-24. develop last push 2026-06-05 and is not a stable security update. php.net lists 8.4.26 (24 Sep 2026) and 8.4.27 (22 Oct 2026) after 8.4.18, with a banner to update for critical remote code execution. Pulling :1 repeats the same image. FrankenPHP ships its own PHP binary.
-
-Stopped and disabled user unit container-koopa-castopod.service. ExecStop is `podman stop -t 30 koopa-castopod`. Container status after stop: Exited (0). :9020 not listening. MariaDB and Redis units left running. Caddy vhost unchanged.
-
-Bring the web container back only when a newer image exists:
-
- systemctl --user enable --now container-koopa-castopod.service
--- a/2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
+++ b/2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
@ -1,41 +0,0 @@
-# TODO=704 Tor CachyOS CTR + CookieAuth (koopa)
-
-Relay was down (stale PIDFile / start-timeout on forking unit), keys intact. Recreated **same identity** on CachyOS container; CookieAuth for ControlPort; host tor disabled.
-
-## Stand after APPLY (2026-10-24 ~21:47–21:51 Europe/Zurich)
-
-| Item | Value |
-|------|--------|
-| CTR | `koopa-tor-relay` Up, image `localhost/koopa-tor-relay:latest` (=`:cachyos`) |
-| Tor | 0.4.9.14 (CachyOS/Arch extra) |
-| Unit | `container-koopa-tor-relay.service` Type=simple, active |
-| Host tor | `tor.service` disabled + failed/inactive |
-| FP | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` (keys mtime 2024-11-14) |
-| ORPort | 8080 |
-| ControlPort | 127.0.0.1:9051 CookieAuthentication=1, CookieAuthFile=/var/lib/tor/control_auth_cookie |
-| Bootstrap | PROGRESS=100 done; status/circuit-established=1 |
-| Unauth ControlPort | 514 Authentication required |
-| Cookie AUTH | 250 OK |
-
-## Steps
-
-1. Dry-run `/tmp/tor.sh` on koopa → STATUS=dry-run-ok; NEXT=`sudo APPLY=1 /tmp/tor.sh` (host tor was still enabled).
-2. Human: `systemctl disable --now tor.service`, then `sudo APPLY=1 /tmp/tor.sh`.
-3. APPLY: wrote CachyOS Containerfile, pulled `docker.io/cachyos/cachyos:latest`, build (cache hit), `podman create --replace --network host --user 1000:1000 --userns keep-id`, torrc bak `torrc.bak-cookie-20261024-214720`, CookieAuth on.
-4. First APPLY hit dbus fail under sudo (`$DBUS_SESSION_BUS_ADDRESS` / `$XDG_RUNTIME_DIR` unset). Unit rewrite + enable finished with XDG/DBUS set; script path re-exec as SUDO_USER for later runs.
-5. Verify from magikoopa SSH: unit active, CTR Up, FP match, circuit-established=1, unauth 514.
-
-## Live paths
-
- `~/koopa-tor-relay/{torrc,data,log,build/Containerfile}`
- `~/.config/systemd/user/container-koopa-tor-relay.service`
- Driver: `/tmp/tor.sh` (TARGET=koopa); upgrade later: `~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay`
-
-## Akte mirrors
-
- `configs/tor/torrc`
- `configs/tor/build/Containerfile`
- `configs/systemd/user/container-koopa-tor-relay.service`
- `host/tor/README.md` updated (was stale host `tor.service`)
-
-Sibling: firecuda brew tor CookieAuth same day (FP `52BB94DDC1292F950CF728708AC48523E018A718`, MyFamily both ways). Parent TODO=704.
--- a/AGENTS.md
+++ b/AGENTS.md
@ -1,5 +0,0 @@
-# AGENTS.md
-
-Session Must / Must not: `$HOME/.grok/AGENTS.md` only — do not duplicate.
-
-**Sync (must-sync trees / wenn Git allein nicht reicht):** siehe [SYNC.md](SYNC.md).
--- a/ISSUES.md
+++ b/ISSUES.md
@ -12,7 +12,7 @@ Stand **2026-07-18** (koopa, live). Keine Secrets.
 | [I-04](#i-2026-07-16-04) | low | open | Stray `kind_taussig` |
 | [I-05](#i-2026-07-16-05) | low | open | Alte exited Podman-Container |
 | [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` |
-| [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor = host `tor.service` (not container) |
+| [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` |
 | [I-08](#i-2026-07-17-08) | medium | open | Landing-stats → standalone `taler-landing-stats` |
 | [I-09](#i-2026-07-18-09) | high | open | Monitoring-HTML öffentlich: Caddy/www (code 21) |

@ -36,7 +36,7 @@ sudo ~/koopa-caddy/apply-monitoring-live.sh
 ```

 Details: `2026/2026-07-18--monitoring-public-caddy.md`  
-Suite: https://git.hacktivism.ch/hernani/elelmon (`taler-monitoring.sh`; archived twin not SoT)
+Suite: https://git.hacktivism.ch/hernani/taler-monitoring (v1.7.1+)


 ### I-2026-07-16-01
@ -134,18 +134,24 @@ Hinweis: `nym-node` startet intern mit `--http-bind-address [::]:8080` (Containe

 ### I-2026-07-16-07

-**Tor = host `tor.service` (ORPort 8080)**  
-Severity: medium · Host: koopa · Status: **fixed** (SoT 2026-09)
+**`koopa-tor-relay` vs host `tor.service` (Port-Clash)**  
+Severity: medium · Host: koopa · Status: **fixed** 2026-07-16

-**Live:** host **`tor.service`** · ORPort **8080** · ControlPort **9051** · non-exit.  
-Legacy CTR `koopa-tor-relay` / `configs/tor/` removed from inventory (git history keeps them).
+**War:** Nach Reboot crash-loopte `koopa-tor-relay` — Host-`tor.service` hielt **8080**/**9051**.  
+**Soll:** nur Container (`KoopaRelay`, ORPort **8080**, VeciGate WAN→koopa:8080).
+
+**Fix:** Host-Tor gestoppt/disabled; ggf. hängenden Prozess gekillt; User-Unit:

 ```bash
-systemctl status tor
+sudo systemctl disable --now tor
+sudo systemctl mask tor   # optional
+systemctl --user enable --now container-koopa-tor-relay.service
 ss -lntp | grep -E '8080|9051'
-# login-health: WARN if tor.service not active
+podman ps --filter name=koopa-tor-relay
 ```

+**Live (nach Fix):** Host-`tor` inactive/disabled; `koopa-tor-relay` Up; 8080 + 127.0.0.1:9051 vom Relay-Prozess.
+
 ---

 ### I-2026-07-17-08
@ -171,4 +177,4 @@ Severity: medium · Host: koopa · Status: open · **TODO (noch nicht umsetzen a
 - Prod-Container mit Boot-Autostart: Up
 - Taler-Ports 9010–9015 antworten (401/302 OK)
 - Linger=yes, container-*-Units enabled
- Tor-OR: host `tor.service` (I-07)
+- Tor-OR: Container-Pfad (I-07 fixed)
--- a/README.md
+++ b/README.md
@ -6,10 +6,6 @@ Ops log and config mirror for host **koopa** (openSUSE Tumbleweed).

 **Secrets:** not in this repo — see **`SECRETS.md`** and sibling **`koopa-admin-secrets`**.

-## FIND / setup entry
-
-Plain file **`koopa-setup`** — lab + host pointers (goa-regio-ng, ports, daylogs). Start there.
-
 ## Open issues

 **Visible issue list:** [`ISSUES.md`](ISSUES.md)
@ -27,32 +23,69 @@ Hosted on **Forgejo rootless** (this host). See `2026/2026-07-10--admin-log-orig
 ## Layout

 ```
-koopa-setup                # FIND: lab/host setup pointers
-host/                      # openSUSE host-level (caddy, tor, systemd, …)
-configs/                   # mirrored app configs (caddy, forgejo, …)
-scripts/                   # login-health, GOA helpers, …
-  login-health/            # SSH login snapshot
-  taler-shared/goa-regio-ng/  # live GOA SoT
+host/                      # openSUSE host-level config + overview
+  overview/services.md     # graphical service map
+  systemd/ firewalld/ caddy/ network/
+configs/                   # mirrored app configs (caddy, taler, forgejo, …)
+  taler-hacktivism/        # merchant container taler-hacktivism
+  taler-hacktivism-bank/   # bank container (image …-banking)
+  taler-exchange/          # exchange conf (inside ansible container)
+  taler-exchange-ansible/  # container taler-hacktivism-exchange-ansible
+  forgejo/                 # rootless git.hacktivism.ch
+  castopod/ bonfire/ lemmy/ prime/ # compose mirrors (no secret values)
+  tops/                    # koopa-tops-ng1…ng3 + autostart unit
+  tor/                     # KoopaRelay ORPort 8080
+scripts/                   # merchant, exchange, monitoring helpers
+  taler-merchant/          # merchant-model start scripts
+  taler-exchange/          # same model; archive/ = greenfield bootstrap
 2026/                      # day logs + dated topic notes
 ```

-## Live GOA + public stack
+## Live containers (podman)

-| Name | Role | Host ports |
-|------|------|------------|
-| **`goa-regio-ng`** | bank + exchange + merchant (one CTR, pasta) | **9010–9012** APIs · **9013–9015** landings (host nginx) |
+**Authoritative snapshot of host koopa:** [`host/overview/LIVE.md`](host/overview/LIVE.md) (refreshed from live).
+
+| Name (podman) | Role | Host port |
+|---------------|------|-----------|
+| `taler-hacktivism` | merchant | **9010** (+ landing **9015**) |
+| **`taler-hacktivism-exchange-ansible`** | exchange (Ansible/systemd) | **9011** (+ landing **9014**) |
+| `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) |
+| `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** |
+| `koopa-bonfire` (+ postgres) | Bonfire | **9021** |
+| `koopa-lemmy-proxy` (+ lemmy/ui/pictrs/db) | Lemmy | **9026** |
+| `koopa-prime-jellyfin` | Jellyfin | **9022** |
+| `koopa-prime-qbittorrent` | qBittorrent | **9023** |
 | `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** |
-| `koopa-castopod` / bonfire / lemmy / decidim / … | optional apps | **9020+** |
-| `koopa-tops-ng1`…`ng3` | static nginx | **9090–9092** |
-| host **`tor.service`** | Tor relay | ORPort **8080** · ControlPort **9051** |
+| `koopa-tops-ng1` … `ng3` | static nginx | **9090**–**9092** |

-Start GOA: `scripts/taler-shared/goa-regio-ng/` · bak `~/backups/goa/current` · landings `~/goa-landing-deploy`.  
-Edge: Caddy **9000/9001** → 127.0.0.1 backends.  
-Login snapshot: `scripts/login-health/` (`koopa-login-health`).
+Start model (Taler merchant/bank): **root** `start_base_services_*` → `/usr/local/bin/start_*.sh`.  
+Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh` + `deploy-hacktivism-goa.sh`.  
+Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.  
+Start model (tops): user unit `container-koopa-tops.service` (linger).

+Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `lemmy.` / `tops.ng1`–`ng3`.hacktivism.ch  
+(Caddy → 9010–9015 / 9020–**9026** / **9090–9092**; git-SSH host **9200** direct).
+
+Service **details**: `configs/taler-hacktivism*`, `configs/taler-exchange*`, `configs/forgejo/`, `configs/tops/`, `scripts/*`.  
+Host-wide picture: **`host/overview/services.md`**.  
 Port table: **`configs/ports.md`**.  
-Tor: **`host/tor/README.md`**.  
 Router: **`../vecigate-admin-log`**.

-**Benchmarks:** `benchmarks/`  
-**Forgejo:** `2026/2026-07-10--forgejo-rootless.md` → https://git.hacktivism.ch/
+**Benchmarks** (drive from the local machine, measure on koopa): **`benchmarks/`**  
+→ amount ladder: `benchmarks/amount-ladder/`.
+
+**Exchange snapshot/restore (GOA, local images only):**  
+→ `2026/2026-07-09--exchange-snapshot-and-restore.md`
+
+**Exchange `/keys` + Wire + bank account (diagram):**  
+`configs/taler-exchange/README.md` (section “/keys, Wire and Account”).
+
+**Castopod (stack/accounts/boot — not podcast content):**  
+`2026/2026-07-09--castopod-content.md` → https://castopod.hacktivism.ch/
+
+**Bonfire FEDERATE + guest public (2026-07-10):**  
+`2026/2026-07-10--bonfire-federate.md` → https://bonfire.hacktivism.ch/  
+(ground zero: `2026/2026-07-09--bonfire-ground-zero.md`)
+
+**Forgejo rootless (git.hacktivism.ch, no free registration, SSH :9200):**  
+`2026/2026-07-10--forgejo-rootless.md` → https://git.hacktivism.ch/
--- a/SECRETS.md
+++ b/SECRETS.md
@ -1,12 +1,12 @@
 # Secrets — not stored in this repo

-Live passwords/keys live in sibling **`koopa-admin-secrets-enc-enc`**.
+Live passwords/keys live in sibling **`koopa-admin-secrets`**.

 ## Map

 ### Taler — host `/root`

-| What | Mirror (`koopa-admin-secrets-enc/…`) | Live |
+| What | Mirror (`koopa-admin-secrets/…`) | Live |
 |------|----------------------------------|------|
 | Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
 | Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
@ -19,6 +19,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets-enc-enc`**.
 |------|--------|------|
 | Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
 | Lemmy | host-only `~/koopa-lemmy/{.env,lemmy.hjson}` (compose mirror in admin-log `configs/lemmy/`) | `~/koopa-lemmy/` |
+| Decidim | host-only `~/koopa-decidim/{.env,users.env}` (compose mirror in admin-log `configs/decidim/`) | `~/koopa-decidim/` |
 | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
@ -28,8 +29,8 @@ Live passwords/keys live in sibling **`koopa-admin-secrets-enc-enc`**.
 ## Rules

 - **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
- Pull/deploy: `koopa-admin-secrets-enc/scripts/{pull,deploy}-from-koopa.sh`
- Full inventory: `koopa-admin-secrets-enc/MAP.md`
+- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
+- Full inventory: `koopa-admin-secrets/MAP.md`

 ## Public (OK here)

--- a/SYNC.md
+++ b/SYNC.md
@ -1,146 +0,0 @@
-# SYNC.md — must-sync (pull.sh / push.sh)
-
-**SoT:** Git tip auf ht/Forgejo (`hernani/*`), nicht grok-all-Pack, nicht ASC-only.
-**Dieses Set:** Profile `grok` + `llm` (=`combo`) + `hernani`.
-**Nicht in diesem Set:** `taler` / `admin-logs/taler/` (eigenes Profil).
-**Parties (local crossover):** magikoopa · clementine · koopatroopa (plus weitere Hosts unter `admin-logs/local/`).
-**Meta-Skripte:** `$HOME/git/pull.sh` · `$HOME/git/push.sh` · `$HOME/git/profiles/*.repos`
-
-Agents sollen diese Bäume **laufend** auf dem gleichen Tip halten (pull oft; push nur mit Freigabe).
-
---
-
-## 1. Schnell: was Agents tun
-
-| Wann | Aktion | Freigabe? |
-|------|--------|-----------|
-| Session-Start / Host-Wechsel / „sync“ | `$HOME/git/pull.sh grok llm hernani` | nein (read/ff) |
-| Repo fehlt auf Disk | gleiches `pull.sh` (cloned + unlock) | nein |
-| Nur Status / Dry-Run | `$HOME/git/pull.sh --list grok llm hernani` bzw. `--dry-run …` | nein |
-| Commits hoch | `$HOME/git/push.sh grok llm hernani` (oder `--dry-run`) | **ja** Push-Freigabe |
-| Dirty tree committen | `/g` bzw. git-worker — **kein** Push aus Worker | Commit-Freigabe ≠ Push |
-
-`combo` ≡ `llm` (Alias). Nie `$HOME/git/dot-grok-enc` anlegen — Live-SoT ist flat `$HOME/.grok`.
-
---
-
-## 2. Wenn Git allein nicht reicht
-
-Reines `git pull` / `git clone` reicht oft **nicht**, weil: Profile-DEST, git-crypt, ff-only-Policy, ACCESS_DENIED, retired grok-all.
-
-### A) Clone / Update über Profile (bevorzugt)
-
-```bash
-$HOME/git/pull.sh grok llm hernani
-# optional:
-$HOME/git/pull.sh --dry-run grok llm hernani
-$HOME/git/pull.sh --list grok llm hernani    # zeigt u.a. ACCESS_DENIED
-```
-
- Existierendes Repo: fetch + **ff-only** pull (kein stilles Merge).
- `--force`: fetch + `reset --hard` auf Remote (tracked überschreiben; untracked bleiben). **Nur mit Absicht / Freigabe**, nie blind auf dirty Work.
- Kein `.git`: init + fetch + reset, dann Unlock.
-
-### B) git-crypt (*-enc und `$HOME/.grok`)
-
-Nach erfolgreichem Git-Stand kann der Tree noch **Ciphertext** sein:
-
-```bash
-cd "$DEST" && git-crypt unlock
-# oder: git-crypt status -e   # noch encrypted?
-```
-
-| Symptom | Ursache | Fix |
-|---------|---------|-----|
-| Dateien sind Blob/binär / `git-crypt status` zeigt encrypted | Key fehlt / nie unlocked | `git-crypt unlock` mit GPG-Key der Collaborators |
-| Unlock schlägt fehl, Tree dirty | Unlock überspringt dirty+already-unlocked Policy in pull.sh | erst commit/stash/clean klären, dann unlock |
-| Agent liest Müll / leere Secrets | Unlock vergessen | unlock, dann erneut lesen — nicht raten |
-| „Permission denied“ SSH ht | Key/ACL | SSH-Agent laden; ACL auf Forgejo — nicht Pfade erfinden |
-
-### C) Push / Divergenz
-
-```bash
-$HOME/git/push.sh --dry-run grok llm hernani
-$HOME/git/push.sh grok llm hernani   # nur mit Freigabe
-```
-
-| Farbe/Lage (push.sh) | Bedeutung | Agent |
-|----------------------|-----------|-------|
-| GREEN | synced / push ok | weiter |
-| YELLOW | behind / mergeable | erst `pull.sh` (ff); diverged → Human |
-| RED | conflict / diverged hard | **HALT** — kein force ohne Freigabe |
-| INFO blue | Repo fehlt auf Disk | `pull.sh` clone |
-
-### D) Explizit verboten / retired
-
- **grok-all / pack-push / passphrase-Pack** — retired. `magikoopa-unlock-enc.sh unlock` → exit 2.
- ASC-Board (`SYNC-TODO.md.asc`) optional; Sync läuft über Git-Tip + diese SYNC.md.
- `taler`-Profile hier **nicht** mitziehen (außer Human sagt explizit taler).
- Keine Secrets in Klartext-Chat; *enc nur nach unlock lesen.
-
---
-
-## 3. DEST-Übersicht (dieses Set)
-
-### Profile `grok`
-
-| DEST | Remote (kurz) |
-|------|----------------|
-| `$HOME/.grok` | `hernani/dot-grok-enc` |
-| `$HOME/git/src/_hernani-private/grokd` | `hernani/grokd` |
-
-### Profile `llm` (= `combo`)
-
-Alles unter `$HOME/git/llm/…` laut `profiles/llm.repos` (configs, knowledge-mirror, work-*-enc, input, control-data-enc, work-logs).
-
-### Profile `hernani` (local crossover — **nicht** taler)
-
-| DEST-Bereich | Inhalt |
-|--------------|--------|
-| `$HOME/git/admin-logs/local/*` | Host admin-logs + `*-secrets-enc` (amanita, clementine, firecuda, koopa, koopatroopa, magikoopa, vecigate, …) + `hernani-common-secrets-enc` |
-| `$HOME/git/buerokratie-enc` | Bürokratie *enc |
-
-firefly-Vault-Pfad laut HOSTS: unter shared secrets (`admin-secrets-enc/firefly/` bzw. common) — **nicht** Clem-only Blob; Host-Zeile in `$HOME/git/llm/HOSTS.md`. SSH Host+Key für firefly braucht Freigabe / ACL, nicht nur Sync-Datei.
-
---
-
-## 4. Dauerbetrieb — Ansätze (llm-controld · grokd · hernanid · …)
-
-Agents halten Tips **laufend**; dafür gibt es (bzw. sollen) Host-Daemons/`ensure`-Hooks geben. **Nicht verwechseln:** Git-Tip-Sync (`pull.sh`) ≠ Controld-Snapshots ≠ Statusline-Keepalive ≠ Combo-Write-Push.
-
-| Name | Rolle | SoT / Bin | Start-Ansatz | Freigabe? |
-|------|--------|-----------|--------------|-----------|
-| **llm-controld** | Fleet/Letter-Probes → `status.json` (Statusline-Daten) | `$HOME/git/llm/llm-configs/bin/llm-controld` · DATA `llm-control-data-enc` | **Mit Tunnel**, nicht Boot: Tunnel-Skripte → `llm-controld ensure`. Nach Unlock ggf. `llm-control-data-peel.sh` (Doppel-*enc*). Stats: `$HOME/.local/state/llm-controld/` | `ensure` ok; dauerhafte Boot-Units nur mit Freigabe |
-| **grokd** | Grok-Statusline keep-alive (`ensure-statusline.sh`) | `$HOME/git/src/_hernani-private/grokd` (Profil `grok`) | `grokd ensure` (auch via `ensure-statusline`). Optional Scheduler: `install-grokd.sh --load` — macOS LaunchAgent `ai.hernani.grokd`; Clementine/Linux user-crontab `* * * * * grokd ensure` | Dateien/`--link-local` ok; **`--load` braucht Freigabe** |
-| **hernanid** | **Ansatz / Stub:** laufend Tip für Profil `hernani` (`admin-logs/local/*`, `buerokratie-enc`) | noch kein festes Bin — Muster wie grokd: `hernanid ensure` → `$HOME/git/pull.sh hernani` (+ unlock laut §2B) | Gleiches Host-Muster: magikoopa LaunchAgent `ai.hernani.hernanid`; Clementine crontab `hernanid ensure`. Bis es existiert: Agents/`pull.sh hernani` manuell bzw. Session-Start | Scheduler-Install / `--load` nur mit Freigabe |
-| **combo-git-sync** | Combo **Write-Trees** commit+push (OpenPGP+SSH), ≠ Tip-Pull | `$HOME/git/llm/llm-configs/bin/combo-git-sync.py` · LaunchAgent `ai.llm-configs.combo-git-sync-hourly` | `install-combo-git-sync-hourly.sh` (macOS LaunchAgent / Clem crontab stündlich). Quit-on-conflict → `--clear-quit` | Install/Load + jeder Push-Pfad nur mit Freigabe-Policy der Settings |
-
-### Agent-Regeln zu Daemons
-
-1. Vor Arbeit: wenn Controld/Statusline/Grok nötig → `llm-controld ensure` / `grokd ensure` (billig, Singleton/flock).
-2. Tip-Sync weiter über `pull.sh grok llm hernani` — Controld ersetzt das **nicht**.
-3. Keine neuen LaunchAgents/crontab-Zeilen ohne Freigabe; Soft-Park = Dateien + `ensure` on-demand.
-4. Clementine (sysvinit): **kein** systemctl — user crontab wie in den `install-*.sh`.
-5. `hernanid` fehlt noch als Binary: nicht erfinden; Ansatz oben dokumentieren / Human+Clem abstimmen; bis dahin Session-`pull.sh`.
-
---
-
-## 5. Agent-Pflicht (laufend)
-
-1. Vor Arbeit an diesen Bäumen: Tip prüfen (`pull.sh` oder `git status` + behind).
-2. Nach lokalen Commits: Human auf Push ansprechen; **kein** eigenmächtiger `git push`.
-3. Bei Ciphertext / fehlendem Unlock: SYNC.md §2B befolgen, nicht Inhalt erfinden.
-4. Neuer technischer Ordner in diesem Set: SYNC.md + AGENTS-Verweis auf SYNC.md mitziehen.
-5. Katalog/Index-Refresh und SSH-Mutationen: nur mit Freigabe.
-6. Dauerbetrieb: §4 — `ensure` nutzen; Scheduler nur mit Freigabe; `hernanid` als Ansatz bis Binary da ist.
-
---
-
-## 6. Verweise
-
- Profile: `$HOME/git/profiles/{grok,llm,combo,hernani}.repos`
- Session Must: `$HOME/.grok/AGENTS.md` (Freigabe, §7 Git)
- Hosts: `$HOME/git/llm/HOSTS.md`
- grokd docs: `$HOME/git/src/_hernani-private/grokd/docs/README.md`
- llm-controld / peel: host skill magikoopa · `llm-configs/bin/llm-controld` · `llm-control-data-peel.sh`
- Diese Datei: neben `AGENTS.md` in jedem technischen Ordner dieses Sets
--- a/configs/README.md
+++ b/configs/README.md
@ -9,13 +9,12 @@ Directories are named to match **live podman container names** where possible.
 | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
 | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
 | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
-| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, `koopa-decidim`, … | compose mirrors |
+| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors |
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |
 | `nym/` | **`koopa-nym`** (nym.com nym-node) | `localhost/koopa-nym:latest` (**non-root** uid 1000) |
-| `paivana/` | **`koopa-paivana`** + paywalls + upstream | `localhost/koopa-paivana:latest` (**non-root**); public **9025/9028–9030** |
-| `notes/` | **`koopa-silverbullet`** (SilverBullet) | `localhost/koopa-silverbullet:cachyos` (backend **127.0.0.1:19128**; paywall **9028**) |
+| `paivana/` | **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` (**non-root**); upstream unprivileged nginx |
 | `forgejo/` | **`koopa-forgejo`** | rootless image + `user: 1000` + `userns keep-id` |
 | `prime/` | jellyfin / qbittorrent | linuxserver **PUID/PGID=1000** |

--- a/configs/bank-landing/index.html
+++ b/configs/bank-landing/index.html
@ -1118,18 +1118,12 @@
  <script src="/intro/qrcode.min.js"></script>
 </head>
 <body data-shop-theme="bank">
-  <!-- stack-bar -->
-  <p class="stack-bar" role="note" title="Taler software on this bank service (goa-regio-ng vanilla)">
+  <p class="stack-bar" role="note" title="Taler software on this bank service (links → git.taler.net tags)">
    <strong>stack</strong><span class="sep">·</span>
-    <a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a>
+    <a href="https://git.taler.net/taler/libeufin/commit/ab00480dd9b3be50704fb449b750c764fd4c1de0.html" target="_blank" rel="noopener noreferrer" title="libeufin tag v1.6.6">libeufin-bank&nbsp;1.6.6</a>
    <span class="sep">·</span>
-    libeufin-bank&nbsp;1.6.10
-    <span class="sep">·</span>
-    libeufin-common&nbsp;1.6.10
-    <span class="sep">·</span>
-    libeufin-bank-webui&nbsp;1.6.38
+    <a href="https://git.taler.net/taler/libeufin/commit/ab00480dd9b3be50704fb449b750c764fd4c1de0.html" target="_blank" rel="noopener noreferrer" title="libeufin tag v1.6.6">libeufin-common&nbsp;1.6.6</a>
  </p>
-  <!-- /stack-bar -->
  <main>
    <header class="hero">
      <span class="badge">Intergalactic · GOA · no IBAN</span>
@ -1564,10 +1558,10 @@ tw run-until-done &amp;&amp; tw balance</pre>
        <a href="https://bank.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
      </p>
      <!-- landing-rev -->
-      <p class="landing-rev" data-landing-site="bank" data-landing-version="45" data-landing-commit="0d881cd">
-        Bank landing <strong>v45</strong>
-        · content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time>
-        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a>
+      <p class="landing-rev" data-landing-site="bank" data-landing-version="44" data-landing-commit="689ee59">
+        Bank landing <strong>v44</strong>
+        · content <time datetime="2026-07-17T18:31:49+02:00">2026-07-17 18:31 CEST</time>
+        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/689ee595e08f3880c1e4068aac8e972574e20d21" title="koopa-admin-log 689ee595e08f3880c1e4068aac8e972574e20d21">689ee59</a>
      </p>
      <!-- /landing-rev -->
    </footer>
--- a/configs/bank-landing/nginx-landing.conf
+++ b/configs/bank-landing/nginx-landing.conf
@ -49,16 +49,6 @@ server {
        add_header Cache-Control "no-store" always;
        add_header Access-Control-Allow-Origin * always;
    }
-    # FP pattern: GET Integration via demo-api (inject suggested/required_exchange)
-    # Caddy @wdGet → :9013 → here → :19096; POST/other Integration stays on :9012
-    location /taler-integration/withdrawal-operation/ {
-        proxy_pass http://127.0.0.1:19096;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_read_timeout 70s;
-        add_header Cache-Control "no-store" always;
-        add_header Access-Control-Allow-Origin * always;
-    }
    location /intro/ {
        alias /var/www/bank-landing/;
    }
--- a/configs/bbb/Containerfile
+++ b/configs/bbb/Containerfile
@ -1,36 +0,0 @@
-# koopa-bbb-front — BigBlueButton front (Ubuntu)
-# Exception to CachyOS policy: BBB packages and install scripts target Ubuntu.
-# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu
-#
-# Placeholder reverse-proxy target (nginx) until Greenlight and/or BBB core
-# (bbb-install on Ubuntu) is chosen. Not production BBB media.
-
-ARG UBUNTU_IMAGE=docker.io/library/ubuntu:24.04
-FROM ${UBUNTU_IMAGE}
-
-ENV DEBIAN_FRONTEND=noninteractive \
-    TZ=Europe/Zurich
-
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      ca-certificates curl nginx tini \
- && rm -rf /var/lib/apt/lists/*
-
-RUN printf '%s\n' \
-      'server {' \
-      '  listen 80 default_server;' \
-      '  root /var/www/html;' \
-      '  index index.html;' \
-      '  location = /health { access_log off; default_type text/plain; return 200 "ok\n"; }' \
-      '  location / { try_files $uri $uri/ =404; }' \
-      '}' > /etc/nginx/sites-available/default \
- && printf '%s\n' \
-      '<!doctype html><meta charset=utf-8><title>bbb.hacktivism.ch</title>' \
-      '<p>BBB front stub (Ubuntu 24.04). Full BigBlueButton / Greenlight is a separate Ubuntu install step.</p>' \
-      > /var/www/html/index.html
-
-COPY entrypoint.sh /docker-entrypoint.sh
-RUN chmod 755 /docker-entrypoint.sh
-
-EXPOSE 80
-ENTRYPOINT ["/usr/bin/tini", "--", "/docker-entrypoint.sh"]
--- a/configs/bbb/README.md
+++ b/configs/bbb/README.md
@ -1,38 +0,0 @@
-# BBB (BigBlueButton) — Ubuntu container (koopa)
-
-CachyOS exception: BBB packages and `bbb-install` target **Ubuntu**. Front stub image is Ubuntu 24.04.
-
-| Item | Value |
-|------|--------|
-| Stack | BigBlueButton (front stub → core later) |
-| Image | `localhost/koopa-bbb-front:ubuntu` (`FROM docker.io/library/ubuntu:24.04`) |
-| Live dir | `/home/hernani/koopa-bbb/` |
-| Container | `koopa-bbb-front` |
-| Host port | **9032** |
-| Public site | `bbb.hacktivism.ch` |
-
-## Phases
-
-1. **Front stub (this tree)** — nginx placeholder on `:9032` so Caddy + DNS can land.
-2. **Greenlight (optional)** — Rails UI talking to a real BBB API; still Ubuntu-based images.
-3. **BBB core** — FreeSWITCH / mediasoup / akka-apps. Prefer official Ubuntu install (`bbb-install.sh`) on a dedicated Ubuntu host/VM, or a known multi-container BBB compose. Not CachyOS.
-
-Media UDP/TCP and TURN are documented when core is chosen — not in this stub.
-
-## Build + up (koopa)
-
-```bash
-bash /path/to/koopa-admin-log/scripts/bbb/build.sh
-mkdir -p ~/koopa-bbb && cp -a /path/to/koopa-admin-log/configs/bbb/{compose.yml,Containerfile,entrypoint.sh} ~/koopa-bbb/
-cd ~/koopa-bbb && HOST_PORT=9032 podman-compose up -d
-```
-
-## Caddy
-
-```bash
-sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
-  --snippet /path/to/koopa-admin-log/configs/caddy/bbb.hacktivism.ch.caddy \
-  --site bbb.hacktivism.ch --port 9032 --label bbb
-```
-
-DNS + VeciGate for the hostname after apply Freigabe.
--- a/configs/bbb/compose.yml
+++ b/configs/bbb/compose.yml
@ -1,31 +0,0 @@
-# koopa-bbb — BigBlueButton front on Ubuntu (exception to CachyOS)
-# Live: /home/hernani/koopa-bbb/
-# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu
-#
-# HOST_PORT: 9032 → Caddy bbb.hacktivism.ch
-# Core BBB / Greenlight: separate follow-up (Ubuntu), not this stub.
-services:
-  bbb-front:
-    image: localhost/koopa-bbb-front:ubuntu
-    build:
-      context: .
-      dockerfile: Containerfile
-    container_name: koopa-bbb-front
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    ports:
-      - "${HOST_PORT:-9032}:80"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    labels:
-      org.hacktivism.service: bbb
-      org.hacktivism.host_port: "${HOST_PORT:-9032}"
-      org.hacktivism.site: bbb.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.port_status: allocated-9032
-      org.hacktivism.image_base: ubuntu
--- a/configs/bbb/entrypoint.sh
+++ b/configs/bbb/entrypoint.sh
@ -1,3 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-exec nginx -g 'daemon off;'
--- a/configs/bbb/vm/defaults.env
+++ b/configs/bbb/vm/defaults.env
@ -1,27 +0,0 @@
-# koopa BBB Ubuntu VM — lean defaults (host ~15 Gi / 4 cores)
-# Override before sourcing: RAM_MIB=4096 VCPUS=2 …
-
-VM_NAME=koopa-bbb
-# Official prod=16G; local-dev floor=8G. Koopa lean default=6G + guest swap.
-RAM_MIB=6144
-VCPUS=2
-DISK_GB=50
-# Ubuntu 22.04 LTS (bbb-install 3.0). 24.04 only if docs for your branch say so.
-OS_VARIANT=ubuntu22.04
-CLOUD_IMAGE_URL=https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-amd64.img
-HOSTNAME=bbb.hacktivism.ch
-# Bridged LAN (preferred for media DNAT). Set BRIDGE= after host-prep creates br0.
-BRIDGE=
-# Fallback: libvirt default NAT (media harder; ok for first boot/ssh)
-NETWORK_SOURCE=default
-# Guest swap (MiB) — important when RAM_MIB < 8192
-SWAP_MIB=4096
-# SSH pubkey injected via cloud-init (path on koopa host)
-SSH_PUBKEY_FILE=/home/hernani/.ssh/id_ed25519.pub
-# Disk pool
-POOL_DIR=/var/lib/libvirt/images
-# bbb-install branch + Greenlight
-BBB_INSTALL_BRANCH=v3.0.x-release
-BBB_INSTALL_EXTRA=-g
-# After VM has IP: Caddy may stay on :9032 stub until cutover, or point at VM:80
-CADDY_BACKEND_HINT=VM_HTTP_80_OR_DNAT
--- a/configs/caddy/Caddyfile
+++ b/configs/caddy/Caddyfile
@ -1,7 +1,7 @@
 # Internal only (not in the browser URL):
 # 9010 merchant API | 9011 exchange API | 9012 bank API
 # 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9028 silverbullet | 9200 forgejo-ssh
+# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh
 # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3

 {
@ -204,19 +204,6 @@ bank.hacktivism.ch {
        }
    }

-    # FP pattern (francpaysan-admin-log files/caddy/Caddyfile @wdGet):
-    # GET withdrawal-operation → landing :9013 → demo-api :19096
-    # (injects suggested_exchange / required_exchange for Android/iOS)
-    @wdGet {
-        method GET
-        path /taler-integration/withdrawal-operation/*
-    }
-    handle @wdGet {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
    reverse_proxy 127.0.0.1:9012 {
        import proxy_public
    }
@ -345,101 +332,7 @@ decidim.hacktivism.ch {
    }
 }

-# 9028 silverbullet / SilverBullet — allocated 2026-09-08
-# Merge into /etc/caddy/Caddyfile (sudo).
-# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list.
-silverbullet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9028 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9029 galene — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
-galene.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9029 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9030 cryptpad — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
-# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
-cryptpad.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9030 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9031 meet (Jitsi) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
-# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
-meet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9031 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9032 bbb (BigBlueButton) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
-# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
-bbb.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9032 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch {
+http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch {
    handle /.well-known/acme-challenge/* {
        root * /var/www/acme
        file_server
--- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954
+++ b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954
@ -1,343 +0,0 @@
-# Internal only (not in the browser URL):
-# 9010 merchant API | 9011 exchange API | 9012 bank API
-# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh
-# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
-
-{
-    email info+koopa@hacktivism.ch
-    http_port 9000
-    https_port 9001
-    auto_https disable_redirects
-    # Caddy listens on 9001 behind VeciGate/https-proxy :443.
-    # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
-    servers {
-        protocols h1 h2
-    }
-}
-
-(proxy_public) {
-    header_up Host {host}
-    header_up X-Forwarded-Host {host}
-    header_up X-Forwarded-Proto {scheme}
-    header_up X-Forwarded-Port 443
-    header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
-}
-
-taler.hacktivism.ch {
-    tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9015 {
-            import proxy_public
-        }
-    }
-
-    # surface + aptdeploy HTML (taler.hacktivism.ch only)
-    handle /taler-monitoring-surface_err {
-        redir /taler-monitoring-surface_err/ 302
-    }
-    handle /taler-monitoring-surface_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-surface {
-        redir /taler-monitoring-surface/ 302
-    }
-    handle /taler-monitoring-surface* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy_err {
-        redir /taler-monitoring-aptdeploy_err/ 302
-    }
-    handle /taler-monitoring-aptdeploy_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy {
-        redir /taler-monitoring-aptdeploy/ 302
-    }
-    handle /taler-monitoring-aptdeploy* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mattermost_err {
-        redir /taler-monitoring-mattermost_err/ 302
-    }
-    handle /taler-monitoring-mattermost_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mattermost {
-        redir /taler-monitoring-mattermost/ 302
-    }
-    handle /taler-monitoring-mattermost* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mail_err {
-        redir /taler-monitoring-mail_err/ 302
-    }
-    handle /taler-monitoring-mail_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mail {
-        redir /taler-monitoring-mail/ 302
-    }
-    handle /taler-monitoring-mail* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-
-
-
-    # SPA: /webui → /webui/
-    redir /webui /webui/ 302
-
-    # Merchant API + WebUI (nginx :9010 → unix socket)
-    reverse_proxy https://127.0.0.1:9010 {
-        transport http {
-            tls_insecure_skip_verify
-        }
-        import proxy_public
-    }
-}
-
-exchange.hacktivism.ch {
-    tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9014 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-
-
-    reverse_proxy 127.0.0.1:9011 {
-        import proxy_public
-    }
-}
-
-bank.hacktivism.ch {
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-
-
-    # Static terms/privacy on landing nginx :9013
-    handle /terms* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-    handle /privacy* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    reverse_proxy 127.0.0.1:9012 {
-        import proxy_public
-    }
-}
-
-castopod.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9020 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-bonfire.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9021 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-prime.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9022 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-bt.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9023 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
-git.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9024 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-
-# Taler Operations design previews (static nginx)
-tops.ng1.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9090 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng2.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9091 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng3.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9092 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-
-# 9025 paivana-httpd (GOA paywall)
-paivana.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9025 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-    }
-}
-
-# 9026 lemmy (+ ui/pictrs via internal nginx)
-lemmy.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9026 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-# 9027 decidim (rails)
-decidim.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9027 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch {
-    handle /.well-known/acme-challenge/* {
-        root * /var/www/acme
-        file_server
-    }
-    handle {
-        redir https://{host}{uri} permanent
-    }
-}
--- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955
+++ b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955
@ -1,399 +0,0 @@
-# Internal only (not in the browser URL):
-# 9010 merchant API | 9011 exchange API | 9012 bank API
-# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9200 forgejo-ssh
-# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
-
-{
-    email info+koopa@hacktivism.ch
-    http_port 9000
-    https_port 9001
-    auto_https disable_redirects
-    # Caddy listens on 9001 behind VeciGate/https-proxy :443.
-    # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
-    servers {
-        protocols h1 h2
-    }
-}
-
-(proxy_public) {
-    header_up Host {host}
-    header_up X-Forwarded-Host {host}
-    header_up X-Forwarded-Proto {scheme}
-    header_up X-Forwarded-Port 443
-    header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
-}
-
-taler.hacktivism.ch {
-    tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9015 {
-            import proxy_public
-        }
-    }
-
-    # surface + aptdeploy HTML (taler.hacktivism.ch only)
-    handle /taler-monitoring-surface_err {
-        redir /taler-monitoring-surface_err/ 302
-    }
-    handle /taler-monitoring-surface_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-surface {
-        redir /taler-monitoring-surface/ 302
-    }
-    handle /taler-monitoring-surface* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy_err {
-        redir /taler-monitoring-aptdeploy_err/ 302
-    }
-    handle /taler-monitoring-aptdeploy_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy {
-        redir /taler-monitoring-aptdeploy/ 302
-    }
-    handle /taler-monitoring-aptdeploy* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mattermost_err {
-        redir /taler-monitoring-mattermost_err/ 302
-    }
-    handle /taler-monitoring-mattermost_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mattermost {
-        redir /taler-monitoring-mattermost/ 302
-    }
-    handle /taler-monitoring-mattermost* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mail_err {
-        redir /taler-monitoring-mail_err/ 302
-    }
-    handle /taler-monitoring-mail_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mail {
-        redir /taler-monitoring-mail/ 302
-    }
-    handle /taler-monitoring-mail* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-
-
-
-    # SPA: /webui → /webui/
-    redir /webui /webui/ 302
-
-    # Merchant API + WebUI (nginx :9010 → unix socket)
-    reverse_proxy https://127.0.0.1:9010 {
-        transport http {
-            tls_insecure_skip_verify
-        }
-        import proxy_public
-    }
-}
-
-exchange.hacktivism.ch {
-    tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9014 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-
-
-    reverse_proxy 127.0.0.1:9011 {
-        import proxy_public
-    }
-}
-
-bank.hacktivism.ch {
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-
-
-    # Static terms/privacy on landing nginx :9013
-    handle /terms* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-    handle /privacy* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    reverse_proxy 127.0.0.1:9012 {
-        import proxy_public
-    }
-}
-
-castopod.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9020 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-bonfire.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9021 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-prime.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9022 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-bt.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9023 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
-git.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9024 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-
-# Taler Operations design previews (static nginx)
-tops.ng1.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9090 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng2.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9091 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng3.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9092 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-
-# 9025 paivana-httpd (GOA paywall)
-paivana.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9025 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-    }
-}
-
-# 9026 lemmy (+ ui/pictrs via internal nginx)
-lemmy.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9026 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-# 9027 decidim (rails)
-decidim.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9027 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-# 9029 galene — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
-galene.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9029 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9030 cryptpad — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
-# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
-cryptpad.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9030 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9031 meet (Jitsi) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
-# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
-meet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9031 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch {
-    handle /.well-known/acme-challenge/* {
-        root * /var/www/acme
-        file_server
-    }
-    handle {
-        redir https://{host}{uri} permanent
-    }
-}
--- a/configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821
+++ b/configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821
@ -1,418 +0,0 @@
-# Internal only (not in the browser URL):
-# 9010 merchant API | 9011 exchange API | 9012 bank API
-# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9200 forgejo-ssh
-# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
-
-{
-    email info+koopa@hacktivism.ch
-    http_port 9000
-    https_port 9001
-    auto_https disable_redirects
-    # Caddy listens on 9001 behind VeciGate/https-proxy :443.
-    # Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
-    servers {
-        protocols h1 h2
-    }
-}
-
-(proxy_public) {
-    header_up Host {host}
-    header_up X-Forwarded-Host {host}
-    header_up X-Forwarded-Proto {scheme}
-    header_up X-Forwarded-Port 443
-    header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
-}
-
-taler.hacktivism.ch {
-    tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9015 {
-            import proxy_public
-        }
-    }
-
-    # surface + aptdeploy HTML (taler.hacktivism.ch only)
-    handle /taler-monitoring-surface_err {
-        redir /taler-monitoring-surface_err/ 302
-    }
-    handle /taler-monitoring-surface_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-surface {
-        redir /taler-monitoring-surface/ 302
-    }
-    handle /taler-monitoring-surface* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy_err {
-        redir /taler-monitoring-aptdeploy_err/ 302
-    }
-    handle /taler-monitoring-aptdeploy_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy {
-        redir /taler-monitoring-aptdeploy/ 302
-    }
-    handle /taler-monitoring-aptdeploy* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mattermost_err {
-        redir /taler-monitoring-mattermost_err/ 302
-    }
-    handle /taler-monitoring-mattermost_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mattermost {
-        redir /taler-monitoring-mattermost/ 302
-    }
-    handle /taler-monitoring-mattermost* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    handle /taler-monitoring-mail_err {
-        redir /taler-monitoring-mail_err/ 302
-    }
-    handle /taler-monitoring-mail_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-mail {
-        redir /taler-monitoring-mail/ 302
-    }
-    handle /taler-monitoring-mail* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-
-
-
-
-    # SPA: /webui → /webui/
-    redir /webui /webui/ 302
-
-    # Merchant API + WebUI (nginx :9010 → unix socket)
-    reverse_proxy https://127.0.0.1:9010 {
-        transport http {
-            tls_insecure_skip_verify
-        }
-        import proxy_public
-    }
-}
-
-exchange.hacktivism.ch {
-    tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9014 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/exchange.hacktivism.ch
-        file_server
-    }
-
-
-    reverse_proxy 127.0.0.1:9011 {
-        import proxy_public
-    }
-}
-
-bank.hacktivism.ch {
-    header Alt-Svc "clear"
-
-    # Public landing first
-    redir / /intro/ 302
-
-    handle /intro* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    # taler-monitoring console HTML (host static — not in app containers)
-    handle /monitoring_err {
-        redir /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-    handle /monitoring {
-        redir /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/bank.hacktivism.ch
-        file_server
-    }
-
-
-    # Static terms/privacy on landing nginx :9013
-    handle /terms* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-    handle /privacy* {
-        reverse_proxy 127.0.0.1:9013 {
-            import proxy_public
-        }
-    }
-
-    reverse_proxy 127.0.0.1:9012 {
-        import proxy_public
-    }
-}
-
-castopod.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9020 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-bonfire.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9021 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-prime.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9022 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        flush_interval -1
-    }
-}
-
-bt.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9023 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-    }
-}
-
-# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
-git.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9024 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-
-# Taler Operations design previews (static nginx)
-tops.ng1.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9090 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng2.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9091 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-tops.ng3.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9092 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-}
-
-
-# 9025 paivana-httpd (GOA paywall)
-paivana.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9025 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-    }
-}
-
-# 9026 lemmy (+ ui/pictrs via internal nginx)
-lemmy.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9026 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Proto {scheme}
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-# 9027 decidim (rails)
-decidim.hacktivism.ch {
-    header Alt-Svc "clear"
-    reverse_proxy 127.0.0.1:9027 {
-        header_up Host {host}
-        header_up X-Forwarded-For {remote_host}
-        header_up X-Forwarded-Host {host}
-        header_up X-Forwarded-Proto {scheme}
-        header_up X-Forwarded-Port 443
-        flush_interval -1
-        transport http {
-            read_timeout 3600s
-            write_timeout 3600s
-        }
-    }
-}
-
-# 9029 galene — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
-galene.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9029 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9030 cryptpad — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
-# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
-cryptpad.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9030 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9031 meet (Jitsi) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
-# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
-meet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9031 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-# 9032 bbb (BigBlueButton) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
-# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
-bbb.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9032 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
-
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch {
-    handle /.well-known/acme-challenge/* {
-        root * /var/www/acme
-        file_server
-    }
-    handle {
-        redir https://{host}{uri} permanent
-    }
-}
--- a/configs/caddy/README.md
+++ b/configs/caddy/README.md
@ -4,7 +4,6 @@
 |------|------|
 | **`Caddyfile`** | Multi-vhost config mirror (`/etc/caddy/Caddyfile` on host) |
 | `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo |
-| `silverbullet.hacktivism.ch.caddy` | Site-block snippet for SilverBullet |
 | `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy |

 Also: `host/caddy/Caddyfile` (same as `Caddyfile` here).
--- a/configs/caddy/bbb.hacktivism.ch.caddy
+++ b/configs/caddy/bbb.hacktivism.ch.caddy
@ -1,18 +0,0 @@
-# 9032 bbb (BigBlueButton) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
-# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
-bbb.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9032 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/caddy/cryptpad.hacktivism.ch.caddy
+++ b/configs/caddy/cryptpad.hacktivism.ch.caddy
@ -1,18 +0,0 @@
-# 9030 cryptpad — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
-# Backend is koopa-cryptpad-edge (HTTP+WS). Sandbox subdomain (cryptpad-ui) — wire after first boot.
-cryptpad.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9030 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/caddy/decidim.hacktivism.ch.caddy
+++ b/configs/caddy/decidim.hacktivism.ch.caddy
@ -1,17 +0,0 @@
-# 9027 decidim (rails)
-# Live: merged into /etc/caddy/Caddyfile
-decidim.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9027 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/caddy/galene.hacktivism.ch.caddy
+++ b/configs/caddy/galene.hacktivism.ch.caddy
@ -1,17 +0,0 @@
-# 9029 galene — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
-galene.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9029 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/caddy/meet.hacktivism.ch.caddy
+++ b/configs/caddy/meet.hacktivism.ch.caddy
@ -1,18 +0,0 @@
-# 9031 meet (Jitsi) — allocated 2026-09-08
-# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
-# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
-meet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9031 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/caddy/silverbullet.hacktivism.ch.caddy
+++ b/configs/caddy/silverbullet.hacktivism.ch.caddy
@ -1,18 +0,0 @@
-# 9028 silverbullet / SilverBullet — allocated 2026-09-08
-# Merge into /etc/caddy/Caddyfile (sudo).
-# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list.
-silverbullet.hacktivism.ch {
-	header Alt-Svc "clear"
-	reverse_proxy 127.0.0.1:9028 {
-		header_up Host {host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Port 443
-		flush_interval -1
-		transport http {
-			read_timeout 3600s
-			write_timeout 3600s
-		}
-	}
-}
--- a/configs/cryptpad/Containerfile
+++ b/configs/cryptpad/Containerfile
@ -1,47 +0,0 @@
-# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman
-# Build on koopa (x86_64):
-#   bash ~/koopa-admin-log/scripts/cryptpad/build.sh
-#   → localhost/koopa-cryptpad:cachyos
-#
-# App tree from upstream release tarball (not the official Debian-ish image).
-
-ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
-FROM ${CACHYOS_IMAGE}
-
-ARG CRYPTPAD_VERSION=2025.9.0
-ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz
-
-ENV TZ=Europe/Zurich \
-    PATH=/usr/local/bin:$PATH \
-    CRYPTPAD_HOME=/cryptpad
-
-RUN pacman -Syu --noconfirm --needed \
-      bash curl ca-certificates catatonit tar git \
-      nodejs npm \
- && pacman -Scc --noconfirm \
- && rm -rf /var/cache/pacman/pkg/* /tmp/*
-
-# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs.
-RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \
- && mkdir -p /cryptpad \
- && tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \
- && rm -f /tmp/cryptpad.tgz \
- && cd /cryptpad \
- && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \
- && git config --global url."https://github.com/".insteadOf "git@github.com:" \
- && git config --global url."https://".insteadOf "git://" \
- && printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \
- && (npm ci --omit=dev --allow-git=all --allow-remote=all \
-     || npm install --omit=dev --allow-git=all --allow-remote=all) \
- && (npm run install:components || true) \
- && rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/*
-
-COPY entrypoint.sh /docker-entrypoint.sh
-RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \
-             /cryptpad/blobstage /cryptpad/data/logs
-COPY config.example.js /cryptpad/config/config.js
-RUN chmod 755 /docker-entrypoint.sh
-
-EXPOSE 3000
-WORKDIR /cryptpad
-ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]
--- a/configs/cryptpad/README.md
+++ b/configs/cryptpad/README.md
@ -1,32 +0,0 @@
-# CryptPad — on CachyOS (koopa)
-
-| Item | Value |
-|------|--------|
-| Stack | [CryptPad](https://cryptpad.org/) |
-| Image | `localhost/koopa-cryptpad:cachyos` |
-| Live dir | `/home/hernani/koopa-cryptpad/` |
-| Host port | **9030** = Paivana paywall; nginx edge backend **172.17.0.1:19130** → app (pasta host IP; Paivana DEST) |
-| App ports (internal) | **3000** HTTP, **3003** websocket |
-| Public site | `cryptpad.hacktivism.ch` |
-
-`websocketPort` must differ from `httpPort` (upstream default 3003). Compose runs `koopa-cryptpad-edge` (nginx) so Caddy still only targets **9030**.  
-Upstream wants a separate **safe/sandbox** origin for some builds — add a second vhost after first boot if the admin UI requires it.
-
-## Build + up
-
-```bash
-bash /path/to/koopa-admin-log/scripts/cryptpad/build.sh
-mkdir -p ~/koopa-cryptpad
-cp -a /path/to/koopa-admin-log/configs/cryptpad/{compose.yml,config.example.js} ~/koopa-cryptpad/
-cp ~/koopa-cryptpad/config.example.js ~/koopa-cryptpad/config.js
-# edit httpUnsafeOrigin / httpSafeOrigin in config.js
-cd ~/koopa-cryptpad && podman-compose up -d
-```
-
-## Caddy
-
-```bash
-sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
-  --snippet …/configs/caddy/cryptpad.hacktivism.ch.caddy \
-  --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
-```
--- a/configs/cryptpad/compose.yml
+++ b/configs/cryptpad/compose.yml
@ -1,53 +0,0 @@
-# koopa-cryptpad — CryptPad on CachyOS + nginx edge (HTTP+WS on :9030)
-# Live: /home/hernani/koopa-cryptpad/
-# Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos
-#
-# Public :9030 = koopa-paivana-cryptpad (shared paivana image).
-# Edge on pasta host IP — Paivana DEST → 172.17.0.1:19130 (not LAN 0.0.0.0)
-# App listens 3000 (http) + 3003 (websocket) inside the net.
-services:
-  cryptpad:
-    image: localhost/koopa-cryptpad:cachyos
-    build:
-      context: .
-      dockerfile: Containerfile
-      args:
-        CRYPTPAD_VERSION: "${CRYPTPAD_VERSION:-2025.9.0}"
-    container_name: koopa-cryptpad
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    volumes:
-      - ./data:/cryptpad/data
-      - ./datastore:/cryptpad/datastore
-      - ./block:/cryptpad/block
-      - ./blob:/cryptpad/blob
-      - ./config.js:/cryptpad/config/config.js:ro
-    expose:
-      - "3000"
-      - "3003"
-    labels:
-      org.hacktivism.service: cryptpad
-      org.hacktivism.host_port: "9030"
-      org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
-      org.hacktivism.site: cryptpad.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.port_status: backend-19130-paywall-9030
-      org.hacktivism.image_base: cachyos
-
-  edge:
-    image: docker.io/library/nginx:alpine
-    container_name: koopa-cryptpad-edge
-    restart: unless-stopped
-    depends_on:
-      - cryptpad
-    volumes:
-      - ./edge.conf:/etc/nginx/conf.d/default.conf:ro
-    ports:
-      - "172.17.0.1:${BACKEND_PORT:-19130}:80"
-    labels:
-      org.hacktivism.service: cryptpad-edge
-      org.hacktivism.host_port: "9030"
-      org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
-      org.hacktivism.site: cryptpad.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
--- a/configs/cryptpad/config.example.js
+++ b/configs/cryptpad/config.example.js
@ -1,13 +0,0 @@
-/* CryptPad config — http on 3000, websockets on 3003 (must differ).
- * Live: mount ./config.js over /cryptpad/config/config.js
- * Edge nginx in compose merges both onto host :9030 (Caddy unchanged).
- */
-module.exports = {
-    httpUnsafeOrigin: 'https://cryptpad.hacktivism.ch',
-    httpSafeOrigin: 'https://cryptpad.hacktivism.ch',
-    httpAddress: '0.0.0.0',
-    httpPort: 3000,
-    websocketPort: 3003,
-    logToStdout: true,
-    maxWorkers: 2,
-};
--- a/configs/cryptpad/edge.conf
+++ b/configs/cryptpad/edge.conf
@ -1,37 +0,0 @@
-# Front for koopa-cryptpad: HTTP :3000 + /cryptpad_websocket → :3003
-upstream cryptpad_http {
-    server cryptpad:3000;
-}
-upstream cryptpad_ws {
-    server cryptpad:3003;
-}
-
-server {
-    listen 80 default_server;
-    server_name _;
-    client_max_body_size 150m;
-
-    location /cryptpad_websocket {
-        proxy_pass http://cryptpad_ws;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-    }
-
-    location / {
-        proxy_pass http://cryptpad_http;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-    }
-}
--- a/configs/cryptpad/entrypoint.sh
+++ b/configs/cryptpad/entrypoint.sh
@ -1,5 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-cd /cryptpad
-# Expect config.js already present (compose mounts or image default).
-exec node server.js "$@"
--- a/configs/decidim/.env.example
+++ b/configs/decidim/.env.example
@ -11,3 +11,7 @@ SMTP_USERNAME=unused
 SMTP_PASSWORD=unused
 SMTP_PORT=25
 QUEUE_ADAPTER=sidekiq
+DECIDIM_ISOC_EMAIL=isoc@hacktivism.ch
+DECIDIM_ISOC_PASSWORD=@inline-secret@
+DECIDIM_ISOC_NAME=isoc
+DECIDIM_ISOC_NICKNAME=isoc
--- a/configs/decidim/README.md
+++ b/configs/decidim/README.md
@ -10,14 +10,19 @@

 Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo.

-Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Bonfire/Castopod). Analog stack: `configs/castopod/`.
+Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Lemmy/Bonfire). Analog stack: `configs/lemmy/`.
+
+Privacy: no third-party trackers. Stock GDPR banner is hidden (`#dc-dialog-wrapper`); `theme/hacktivism-consent.js` sets essential-only `decidim-consent`.

 ```bash
 cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d
-~/koopa-decidim/bin/install-systemd.sh
-~/koopa-decidim/bin/apply-branding.sh
+scripts/decidim/install-systemd.sh
+scripts/decidim/apply-branding.sh
+scripts/decidim/seed-example.sh   # public process /processes/example + optional isoc user
 ```

-Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (vhost `decidim.hacktivism.ch` → `127.0.0.1:9027`).
+Public example (no account): `https://decidim.hacktivism.ch/processes/example`

-This tree documents **this** instance only. Secrets stay in `koopa-admin-secrets` / host `~/koopa-decidim/{.env,users.env}`.
+Caddy: `sudo /home/hernani/koopa-caddy/apply.sh`
+
+Daylog: `2026/2026-08-17--decidim.md`.
--- a/configs/decidim/assets/img/isoc-gold.png
+++ b/configs/decidim/assets/img/isoc-gold.png
--- a/configs/decidim/bin/apply-branding.sh
+++ b/configs/decidim/bin/apply-branding.sh
@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-# Apply hacktivism colors + header CSS on the live organization.
-set -euo pipefail
-cd "${HOME}/koopa-decidim"
-set -a
-# shellcheck disable=SC1091
-source .env
-# shellcheck disable=SC1091
-source users.env
-set +a
-podman exec \
-  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
-  -e DECIDIM_SYSTEM_EMAIL \
-  -e DECIDIM_SYSTEM_PASSWORD \
-  -e DECIDIM_ADMIN_EMAIL \
-  -e DECIDIM_ADMIN_PASSWORD \
-  -e DECIDIM_ADMIN_NAME \
-  -e DECIDIM_APPLICATION_NAME \
-  -e DECIDIM_DEFAULT_LOCALE \
-  -e DECIDIM_AVAILABLE_LOCALES \
-  koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb
-echo "branding applied. public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/bin/install-systemd.sh
+++ b/configs/decidim/bin/install-systemd.sh
@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Install Decidim user systemd units on koopa (boot via linger).
-set -euo pipefail
-HERE="$(cd "$(dirname "$0")" && pwd)"
-LIVE="${HOME}/koopa-decidim"
-# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin
-if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then
-  UNIT_SRC="${HERE}/../../configs/decidim"
-elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then
-  UNIT_SRC="${LIVE}"
-else
-  echo "ERROR: decidim unit files not found" >&2
-  exit 1
-fi
-UNIT_DIR="${HOME}/.config/systemd/user"
-
-mkdir -p "${UNIT_DIR}"
-cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/"
-cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/"
-
-systemctl --user daemon-reload
-systemctl --user enable \
-  container-koopa-decidim-db.service \
-  container-koopa-decidim.service
-
-if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then
-  (cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d)
-fi
-
-systemctl --user start \
-  container-koopa-decidim-db.service \
-  container-koopa-decidim.service
-
-systemctl --user --no-pager --lines=0 status \
-  container-koopa-decidim-db.service \
-  container-koopa-decidim.service || true
-
-echo "OK. Public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/bin/seed-example.sh
+++ b/configs/decidim/bin/seed-example.sh
@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-# Publish public example process/meeting + optional isoc user from users.env.
-set -euo pipefail
-cd "${HOME}/koopa-decidim"
-set -a
-# shellcheck disable=SC1091
-source .env
-# shellcheck disable=SC1091
-source users.env
-set +a
-
-src=""
-if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then
-  src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb"
-elif [ -f ./seed_example.rb ]; then
-  src="./seed_example.rb"
-else
-  echo "ERROR: seed_example.rb not found" >&2
-  exit 1
-fi
-podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb
-
-avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}"
-avatar_ctr=""
-if [ -f "${avatar_host}" ]; then
-  avatar_ctr="/tmp/isoc-gold.png"
-  podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}"
-fi
-
-podman exec \
-  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
-  -e DECIDIM_ADMIN_EMAIL \
-  -e DECIDIM_ISOC_EMAIL \
-  -e DECIDIM_ISOC_PASSWORD \
-  -e DECIDIM_ISOC_NAME \
-  -e DECIDIM_ISOC_NICKNAME \
-  -e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \
-  koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb
-echo "seed done. public: https://decidim.hacktivism.ch/processes/example"
--- a/configs/decidim/bin/up.sh
+++ b/configs/decidim/bin/up.sh
@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-DIR="${HOME}/koopa-decidim"
-cd "${DIR}"
-set -a
-# shellcheck disable=SC1091
-source .env
-set +a
-podman-compose up -d
-echo "== wait for :9027 =="
-ok=0
-for i in $(seq 1 80); do
-  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true)
-  echo "try $i: $code"
-  case "$code" in
-    2*|3*) ok=1; break ;;
-  esac
-  sleep 5
-done
-[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; }
-echo "local ok. public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/compose.yml
+++ b/configs/decidim/compose.yml
@ -42,7 +42,9 @@ services:
      - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
      - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
      - ./theme/hacktivism.css:/code/public/hacktivism.css:ro
+      - ./theme/hacktivism-consent.js:/code/public/hacktivism-consent.js:ro
      - ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro
+      - ./seed_example.rb:/code/lib/koopa_seed_example.rb:ro
      - ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro
      - ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro
      - decidim-storage:/code/storage
--- a/configs/exchange-landing/index.html
+++ b/configs/exchange-landing/index.html
@ -289,22 +289,18 @@
 </style>
 </head>
 <body>
-  <!-- stack-bar -->
-  <p class="stack-bar" role="note" title="Taler software on this exchange service (goa-regio-ng vanilla)">
+  <p class="stack-bar" role="note" title="Taler software on this exchange service (links → git.taler.net tags)">
    <strong>stack</strong><span class="sep">·</span>
-    <a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a>
+    <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange&nbsp;1.6.6</a>
    <span class="sep">·</span>
-    taler-exchange&nbsp;1.6.15
+    <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">libtalerexchange&nbsp;1.6.6</a>
    <span class="sep">·</span>
-    libtalerexchange&nbsp;1.6.15
+    <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange-database&nbsp;1.6.6</a>
    <span class="sep">·</span>
-    taler-exchange-database&nbsp;1.6.15
+    <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange-offline&nbsp;1.6.6</a>
    <span class="sep">·</span>
-    taler-exchange-offline&nbsp;1.6.15
-    <span class="sep">·</span>
-    taler-terms-generator&nbsp;1.6.15
+    <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-terms-generator&nbsp;1.6.6</a>
  </p>
-  <!-- /stack-bar -->
  <main>
    <header class="hero">
      <span class="badge">GOA · Exchange</span>
@ -504,10 +500,10 @@ sudo apt-get install -y taler-wallet-cli</pre>
        <a href="https://exchange.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
      </p>
      <!-- landing-rev -->
-      <p class="landing-rev" data-landing-site="exchange" data-landing-version="44" data-landing-commit="0d881cd">
-        Exchange landing <strong>v44</strong>
-        · content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time>
-        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a>
+      <p class="landing-rev" data-landing-site="exchange" data-landing-version="43" data-landing-commit="d0594cb">
+        Exchange landing <strong>v43</strong>
+        · content <time datetime="2026-07-17T18:33:13+02:00">2026-07-17 18:33 CEST</time>
+        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/d0594cb44ffb1bec2e009f6812167cbbf216eda9" title="koopa-admin-log d0594cb44ffb1bec2e009f6812167cbbf216eda9">d0594cb</a>
      </p>
      <!-- /landing-rev -->
    </footer>
--- a/configs/firewalld/public-ports.md
+++ b/configs/firewalld/public-ports.md
@ -18,7 +18,6 @@ sudo firewall-cmd --list-ports
 | 8080/tcp | Tor OR | — |
 | 23235/tcp | (legacy list; host SSH is :22, WAN via VeciGate 23235→22) | — |
 | **9200/tcp** | **Forgejo git-SSH** (podman rootlessport) | **OK** after add+reload |
-| **6881/tcp+udp** | qBittorrent BT listen (`koopa-prime-qbittorrent`) | apply: `scripts/prime/apply-qbittorrent-bt-net.sh` |

 ### Not opened on purpose

@ -62,7 +61,6 @@ Forgejo advertises `SSH_PORT=9200`. Traffic hits **host:9200** (not Caddy). With
 |------|--------|
 | 2026-07-09 | 443/tcp re-added for IPv6 |
 | 2026-07-10 | **9200/tcp** for Forgejo git-SSH (verified LAN + hairpin + SSH auth) |
-| 2026-09-25 | **6881/tcp+udp** for qBittorrent BT (`scripts/prime/apply-qbittorrent-bt-net.sh`); VeciGate wan+hairpin DNAT live; WAN/LAN `nc` OK |

 ## Nym (`koopa-nym`, nym.com)

--- a/configs/forgejo/README.md
+++ b/configs/forgejo/README.md
@ -58,7 +58,3 @@ Or: Profile → Appearance → theme **hacktivism**, then hard-reload.
 ### Registration

 Public signup is disabled (`DISABLE_REGISTRATION`, no registration button).
-
-### pre-receive: gitleaks + *enc.git gate (TODO320, 2026-09-11)
-
-Live hooks under `~/koopa-forgejo/data/custom/hooks/pre-receive.d/` (gitleaks skip `*enc.git`; `git-crypt-enforce` Klartext-Sperre). Binary `data/custom/bin/gitleaks` v8.21.2. Installer + smoke: laptop `llm-configs/bin/forgejo-hooks/`. Ops note: `2026/2026-09-11--forgejo-gitleaks-enc-gate.md`. New repos → re-run `install-hooks-ht.sh`.
--- a/configs/galene/Containerfile
+++ b/configs/galene/Containerfile
@ -1,41 +0,0 @@
-# koopa-galene — Galene SFU on CachyOS base
-# Build on koopa (x86_64):
-#   bash ~/koopa-admin-log/scripts/galene/build.sh
-#   → localhost/koopa-galene:cachyos
-#
-# Upstream no longer ships release tarballs; build from git tag/branch.
-
-ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
-FROM ${CACHYOS_IMAGE}
-
-ARG GALENE_REF=galene-0.96.3
-ARG GALENE_REPO=https://github.com/jech/galene.git
-
-ENV TZ=Europe/Zurich \
-    PATH=/usr/local/bin:$PATH \
-    GALENE_DATA=/data \
-    GOPATH=/tmp/go \
-    GOTOOLCHAIN=auto
-
-RUN pacman -Syu --noconfirm --needed \
-      bash curl ca-certificates catatonit tar git go \
- && pacman -Scc --noconfirm \
- && rm -rf /var/cache/pacman/pkg/* /tmp/*
-
-RUN set -eux \
- && git clone --depth 1 --branch "$GALENE_REF" "$GALENE_REPO" /src/galene \
- && cd /src/galene \
- && CGO_ENABLED=0 go build -ldflags='-s -w' -o /usr/local/bin/galene . \
- && test -x /usr/local/bin/galene \
- && mkdir -p /opt/galene \
- && cp -a /src/galene/static /opt/galene/static \
- && rm -rf /src/galene /tmp/go /root/go /var/cache/pacman/pkg/*
-
-COPY entrypoint.sh /docker-entrypoint.sh
-RUN chmod 755 /docker-entrypoint.sh \
- && mkdir -p /data/groups /data/recordings /data/data \
- && ln -sfn /opt/galene/static /data/static
-
-EXPOSE 8443
-WORKDIR /data
-ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]
--- a/configs/galene/README.md
+++ b/configs/galene/README.md
@ -1,36 +0,0 @@
-# Galene — SFU on CachyOS (koopa)
-
-| Item | Value |
-|------|--------|
-| Stack | [Galene](https://galene.org/) |
-| Image | `localhost/koopa-galene:cachyos` (`FROM docker.io/cachyos/cachyos`) |
-| Build | Go from git tag `GALENE_REF` (default `galene-0.96.3`; no release tarballs) |
-| Live dir | `/home/hernani/koopa-galene/` |
-| Container | `koopa-galene` |
-| Host port | **9029** = Paivana paywall; Galene HTTP backend **127.0.0.1:19129** (`-insecure`) |
-| Public site | `galene.hacktivism.ch` |
-
-## Build + up (koopa)
-
-```bash
-bash /path/to/koopa-admin-log/scripts/galene/build.sh
-mkdir -p ~/koopa-galene && cp -a /path/to/koopa-admin-log/configs/galene/compose.yml ~/koopa-galene/
-cd ~/koopa-galene && podman-compose up -d
-```
-
-## Caddy
-
-```bash
-sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
-  --snippet /path/to/koopa-admin-log/configs/caddy/galene.hacktivism.ch.caddy \
-  --site galene.hacktivism.ch --port 9029 --label galene
-```
-
-DNS + VeciGate for the hostname; WebRTC UDP ports documented when first room is live.
-
-## Notes
-
- Volume `./data` must not hide UI assets; entrypoint passes `-static /opt/galene/static`.
- Example group: copy `groups/hacktivism.json.example` → `~/koopa-galene/data/groups/hacktivism.json` (change op password).
- WebRTC UDP: compose publishes **10000–10099/udp**; set the same range in VeciGate DNAT → koopa. Entrypoint uses `-udp-range` (`GALENE_UDP_RANGE`).
- Built-in TURN (`-turn auto`) logs `no public addresses` until the host has a reachable public/mapped address; fix UDP/NAT first, then re-check logs.
--- a/configs/galene/compose.yml
+++ b/configs/galene/compose.yml
@ -1,30 +0,0 @@
-# koopa-galene — Galene on CachyOS
-# Live: /home/hernani/koopa-galene/
-# Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos
-#
-# Public :9029 = koopa-paivana-galene (shared paivana image).
-# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19129 (HTTP -insecure; not LAN 0.0.0.0).
-# WebRTC UDP: still published (see README / ports.md)
-services:
-  galene:
-    image: localhost/koopa-galene:cachyos
-    container_name: koopa-galene
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-      - GALENE_UDP_RANGE=${GALENE_UDP_RANGE:-10000-10099}
-    volumes:
-      - ./data:/data
-      - ./entrypoint.sh:/docker-entrypoint.sh:ro
-    ports:
-      - "172.17.0.1:${BACKEND_PORT:-19129}:8443"
-      - "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp"
-    labels:
-      org.hacktivism.service: galene
-      org.hacktivism.host_port: "9029"
-      org.hacktivism.backend_port: "${BACKEND_PORT:-19129}"
-      org.hacktivism.site: galene.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.port_status: backend-19129-paywall-9029
-      org.hacktivism.image_base: cachyos
-
--- a/configs/galene/entrypoint.sh
+++ b/configs/galene/entrypoint.sh
@ -1,21 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443
-# with -insecure (TLS terminated at Caddy).
-# Static assets stay in the image (/opt/galene/static); the ./data volume must
-# not shadow them — pass -static explicitly.
-DATA="${GALENE_DATA:-/data}"
-STATIC="${GALENE_STATIC:-/opt/galene/static}"
-# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md).
-UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}"
-mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data"
-cd "$DATA"
-exec /usr/local/bin/galene \
-  -http "0.0.0.0:8443" \
-  -insecure \
-  -static "$STATIC" \
-  -udp-range "$UDP_RANGE" \
-  -data "$DATA/data" \
-  -groups "$DATA/groups" \
-  -recordings "$DATA/recordings" \
-  "$@"
--- a/configs/galene/groups/hacktivism.json.example
+++ b/configs/galene/groups/hacktivism.json.example
@ -1,7 +0,0 @@
-{
-  "displayName": "hacktivism",
-  "public": true,
-  "op": [{"username": "op", "password": "changeme"}],
-  "presenter": [{}],
-  "other": []
-}
--- a/configs/goa-backups/README.md
+++ b/configs/goa-backups/README.md
@ -1,5 +0,0 @@
-# GOA backup pointers
-
-Canonical dumps: **`~/backups/goa/`** on koopa and magikoopa (not in this git tree).
-
-See `2026/2026-09-04--goa-backup-regio-ng.md`.
--- a/configs/lab-local/README.md
+++ b/configs/lab-local/README.md
@ -1,51 +0,0 @@
-# Lab local on koopa (parallel to live)
-
-Does **not** touch live GOA (`taler-hacktivism*`, **9010–9015**) or **9080** (`koopa-nym`).
-
-| Lab | Container | Host binds (loopback only) |
-|-----|-----------|----------------------------|
-| **goa-regio-ng** | `goa-regio-ng` | `127.0.0.1:9180→80`, `127.0.0.1:9322→22` |
-| **mytops-local** | `mytops-local` | `127.0.0.1:8288→80` |
-
-## goa-regio-ng
-
- Tree on laptop/koopa: `~/src/regio-local/`
- Inventory (canonical copy here): [`goa-regio-ng-koopa.yml`](./goa-regio-ng-koopa.yml)
- Ansible from magikoopa: ProxyCommand → `hernani@koopa` → `127.0.0.1:9322`
- Master: `koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv`
-
-```bash
-rsync -az ~/src/regio-local/ hernani@koopa:src/regio-local/
-ssh hernani@koopa 'cd ~/src/regio-local && REGIO_HTTP_PORT=9180 REGIO_SSH_PORT=9322 REGIO_BIND=127.0.0.1 ./scripts/01-build-run.sh'
-REGIO_PODMAN_SSH=hernani@koopa REGIO_INVENTORY=$HOME/git/admin-logs/koopa-admin-log/configs/lab-local/goa-regio-ng-koopa.yml \
-  ~/src/regio-local/scripts/03-deploy.sh
-REGIO_HTTP_PORT=9180 REGIO_PROBE_SSH=hernani@koopa ~/src/regio-local/scripts/04-probe.sh
-```
-
-Never `REGIO_PUBLISH_KOOPA_PORTS=1` on koopa next to live GOA.
-
-## mytops-local
-
- **Verified 2026-09-04:** koopa `127.0.0.1:8288/config` → **200**; laptop same stack on **8088** → **200**. Daylog: `2026/2026-09-04--mytops-local-podman.md`. FIND: [`../koopa-setup`](../koopa-setup) · ports: [`../ports.md`](../ports.md).
- Tree: `mytops-admin-log` **`master`** (`mytops-local/wip:…`; rsync to `~/src/mytops-admin-log` on koopa; `.git` optional). Stage live-restore on betel still TODO.
- Config snippet: [`mytops-local.toml`](./mytops-local.toml) — port **8288** on koopa
- Orchestrator: `MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh`
- If `taler-merchant-dbconfig` fails (no postgres socket): `systemctl enable --now postgresql` inside the container, then dbconfig + `taler-merchant.target` again
-
-```bash
-# on koopa: image + container (repo bind)
-podman build -t localhost/mytops-debian-systemd:trixie -f Containerfile.mytops-local .
-podman rm -f mytops-local 2>/dev/null || true
-podman run -d --name mytops-local --hostname mytops-local \
-  --systemd=always --cap-add SYS_ADMIN --security-opt label=disable \
-  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
-  -p 127.0.0.1:8288:80 \
-  -v "$HOME/src/mytops-admin-log:/root/mytops-admin-log:ro" \
-  localhost/mytops-debian-systemd:trixie /sbin/init
-# apply koopa URL then setup (needs RW copy of config or run apply on host tree)
-podman exec mytops-local bash -lc \
-  'cd /root/mytops-admin-log && MYTOPS_LOCAL_HTTP_PORT=8288 ./scripts/taler-merchant/setup-local.sh'
-curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8288/config   # expect 200
-```
-
-Laptop default remains **8088**; koopa lab uses **8288** so both can coexist with regio **9180**.
--- a/configs/lab-local/goa-regio-ng-koopa.yml
+++ b/configs/lab-local/goa-regio-ng-koopa.yml
@ -1,59 +0,0 @@
-# goa-regio-ng on koopa — parallel lab; does NOT use live 9010–9015 or 9080 (nym).
-# Host binds on koopa: 127.0.0.1:9180→80, 127.0.0.1:9322→22.
-# Ansible from magikoopa via ProxyCommand into koopa loopback.
-#
-# Live GOA (untouched): taler-hacktivism{,-bank,-exchange-ansible} on 9010–9015.
-
-regional_currency:
-  hosts:
-    goa-regio-ng:
-      ansible_host: 127.0.0.1
-      ansible_port: 9322
-      ansible_user: root
-      ansible_ssh_private_key_file: "{{ lookup('ansible.builtin.env', 'HOME') }}/src/regio-local/ssh/regio_local_ed25519"
-      ansible_ssh_common_args: >-
-        -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
-        -o ProxyCommand="ssh -W 127.0.0.1:%p -o StrictHostKeyChecking=no hernani@koopa"
-      ansible_python_interpreter: /usr/bin/python3
-
-      regional_currency_currency: GOA
-      regional_currency_currency_name: "GOA exploration currency"
-      regional_currency_domain: goa.local
-      regional_currency_bank_name: "GOA Exploration Bank"
-      regional_currency_bank_admin_password: "change-me"
-      regional_currency_bank_port: 8080
-      regional_currency_bank_bind: "127.0.0.1"
-      regional_currency_enable_tls: false
-      regional_currency_enable_conversion: false
-      regional_currency_testing_deployment: true
-      regional_currency_enable_exchange_terms: false
-      regional_currency_enable_exchange_privacy: false
-      regional_currency_podman_systemd_relax: true
-
-      # Dual merchant (CHF package + regional GOA); regio-style BASE_URLs (no :9180).
-      regional_currency_merchant_currency: CHF
-      regional_currency_merchant_regional_exchange_section: goa
-      regional_currency_merchant_disable_exchanges:
-        - kudos
-      regional_currency_merchant_disable_currencies:
-        - KUDOS
-      regional_currency_disable_currencies:
-        - kudos
-        - testkudos
-        - euro
-        - swiss-francs
-        - netzbon
-
-      regional_currency_round_unit: "GOA:0.00000001"
-      regional_currency_tiny_amount: "GOA:0.00000001"
-      regional_currency_fractional_input_digits: 8
-      regional_currency_fractional_normal_digits: 0
-      regional_currency_fractional_trailing_zero_digits: 0
-      regional_currency_alt_unit_names: '{"24":"Yotta-GOA","21":"Zetta-GOA","18":"Exa-GOA","15":"Peta-GOA","12":"Tera-GOA","9":"Giga-GOA","6":"Mega-GOA","3":"Kilo-GOA","0":"GOA","-1":"Deci-GOA","-2":"Centi-GOA","-3":"Milli-GOA","-6":"Micro-GOA","-7":"Deci-Micro-GOA","-8":"Atomic-GOA"}'
-      regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000"
-      regional_currency_static_coins_file: goa-exchange-coins.conf
-      regional_currency_coin_withdraw_duration: 7 days
-      regional_currency_default_debt_limit: "GOA:4503599627370496"
-
-      regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10"
-      regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv"
--- a/configs/lab-local/lab-hosts.yml
+++ b/configs/lab-local/lab-hosts.yml
@ -1,19 +0,0 @@
---
-# lab-only: pin *.goa.local → 127.0.0.1 inside goa-regio-ng
-# ephemeral on container recreate — re-run after recreate / before site.yml wait-on-bank
-# inventory: goa-regio-ng-koopa.yml (same SSH ProxyCommand)
-#
-#   ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
-
- name: lab hosts goa.local
-  hosts: regional_currency
-  gather_facts: false
-  tasks:
-    - name: /etc/hosts *.goa.local → 127.0.0.1
-      ansible.builtin.blockinfile:
-        path: /etc/hosts
-        marker: "# {mark} ANSIBLE LAB goa.local"
-        # podman systemd: /etc/hosts often EBUSY on atomic rename
-        unsafe_writes: true
-        block: |
-          127.0.0.1 bank.goa.local exchange.goa.local backend.goa.local goa.local
--- a/configs/lab-local/mytops-local.toml
+++ b/configs/lab-local/mytops-local.toml
@ -1,6 +0,0 @@
-# Drop-in values for mytops-admin-log config.toml [mytops-local] when running on koopa.
-# Laptop lab keeps 8088; koopa lab uses 8288 (avoid 901x live GOA, 9080 nym, 9180 goa-regio-ng).
-
-[mytops-local]
-base_url = "http://127.0.0.1:8288/"
-forwarded_host = "127.0.0.1:8288"
--- a/configs/meet/Containerfile
+++ b/configs/meet/Containerfile
@ -1,55 +0,0 @@
-# koopa-meet-web — Jitsi Meet web assets on CachyOS
-# Build: bash ~/koopa-admin-log/scripts/meet/build.sh → localhost/koopa-meet-web:cachyos
-#
-# Full Meet needs prosody + jicofo + jvb (see compose.yml). This image serves
-# the static web UI via nginx from Arch/CachyOS packages + upstream meet tarball.
-# Signaling/media containers are separate services in the same compose.
-
-ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
-FROM ${CACHYOS_IMAGE}
-
-ARG JITSI_MEET_VERSION=stable
-ARG JITSI_MEET_URL=https://download.jitsi.org/jitsi-meet/src/jitsi-meet-1.0.0.tar.bz2
-
-ENV TZ=Europe/Zurich
-
-RUN pacman -Syu --noconfirm --needed \
-      bash curl ca-certificates catatonit tar nginx \
- && pacman -Scc --noconfirm \
- && rm -rf /var/cache/pacman/pkg/* /tmp/*
-
-# CachyOS/Arch nginx.conf embeds a default server and does NOT include http.d/.
-# Replace it with a minimal conf that serves the branded landing.
-RUN mkdir -p /usr/share/jitsi-meet /etc/nginx/http.d \
- && printf '%s\n' \
-      'worker_processes 1;' \
-      'events { worker_connections 1024; }' \
-      'http {' \
-      '  include mime.types;' \
-      '  default_type application/octet-stream;' \
-      '  sendfile on;' \
-      '  keepalive_timeout 65;' \
-      '  server {' \
-      '    listen 80 default_server;' \
-      '    server_name _;' \
-      '    root /usr/share/jitsi-meet;' \
-      '    index index.html;' \
-      '    location / { try_files $uri $uri/ /index.html; }' \
-      '  }' \
-      '}' > /etc/nginx/nginx.conf \
- && printf '%s\n' \
-      '<!doctype html><html lang=en><meta charset=utf-8>' \
-      '<meta name=viewport content="width=device-width,initial-scale=1">' \
-      '<title>meet.hacktivism.ch</title>' \
-      '<style>body{font-family:system-ui,sans-serif;max-width:40rem;margin:3rem auto;padding:0 1rem;line-height:1.5}' \
-      'code{background:#f2f2f2;padding:.1rem .35rem;border-radius:4px}</style>' \
-      '<h1>meet.hacktivism.ch</h1>' \
-      '<p>Jitsi Meet <strong>web</strong> (CachyOS). Signaling/media (prosody / jicofo / jvb) is Phase&nbsp;2 — see compose + README.</p>' \
-      '<p>HTTP OK on host port <code>9031</code>. Full rooms need UDP/JVB after Phase&nbsp;2.</p>' \
-      > /usr/share/jitsi-meet/index.html
-
-COPY entrypoint.sh /docker-entrypoint.sh
-RUN chmod 755 /docker-entrypoint.sh
-
-EXPOSE 80
-ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]
--- a/configs/meet/README.md
+++ b/configs/meet/README.md
@ -1,23 +0,0 @@
-# Meet (Jitsi) — CachyOS web stub (koopa)
-
-| Item | Value |
-|------|--------|
-| Public site | `meet.hacktivism.ch` |
-| Public port | **9031** (`koopa-paivana-meet`) |
-| Backend | `127.0.0.1:19131` (`koopa-meet-web`) |
-| Image (web) | `localhost/koopa-meet-web:cachyos` |
-| Live dir | `/home/hernani/koopa-meet/` |
-
-Phase 1 = Caddy vhost + branded nginx landing on CachyOS (`koopa-meet-web`) behind Paivana (GOA:42).  
-Phase 2 = prosody + jicofo + jvb — scaffold in `compose.phase2.yml` (`profiles: [phase2]`); images under `configs/meet/phase2/` still TODO. Not `docker-jitsi-meet` Debian by default.  
-UDP/JVB and TURN need VeciGate once rooms work (range TBD in `ports.md`).
-
-## Caddy
-
-Caddy stays on `127.0.0.1:9031` (paywall). App bind is loopback `19131` only.
-
-```bash
-sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
-  --snippet …/configs/caddy/meet.hacktivism.ch.caddy \
-  --site meet.hacktivism.ch --port 9031 --label meet
-```
--- a/configs/meet/compose.phase2.yml
+++ b/configs/meet/compose.phase2.yml
@ -1,49 +0,0 @@
-# Phase-2 stubs — NOT started by default.
-# Usage (after images exist):
-#   cd ~/koopa-meet && podman-compose -f compose.yml -f compose.phase2.yml up -d
-#
-# Do not pull official docker-jitsi-meet Debian images as the default base.
-# Build CachyOS (or pinned binary) images under configs/meet/phase2/ when ready.
-
-services:
-  prosody:
-    profiles: ["phase2"]
-    image: localhost/koopa-meet-prosody:cachyos
-    container_name: koopa-meet-prosody
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    # ports / volumes: fill when Containerfile exists
-    labels:
-      org.hacktivism.service: meet-prosody
-      org.hacktivism.site: meet.hacktivism.ch
-      org.hacktivism.phase: "2"
-
-  jicofo:
-    profiles: ["phase2"]
-    image: localhost/koopa-meet-jicofo:cachyos
-    container_name: koopa-meet-jicofo
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    depends_on:
-      - prosody
-    labels:
-      org.hacktivism.service: meet-jicofo
-      org.hacktivism.site: meet.hacktivism.ch
-      org.hacktivism.phase: "2"
-
-  jvb:
-    profiles: ["phase2"]
-    image: localhost/koopa-meet-jvb:cachyos
-    container_name: koopa-meet-jvb
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    # UDP host publish TBD in ports.md when allocated
-    depends_on:
-      - prosody
-    labels:
-      org.hacktivism.service: meet-jvb
-      org.hacktivism.site: meet.hacktivism.ch
-      org.hacktivism.phase: "2"
--- a/configs/meet/compose.yml
+++ b/configs/meet/compose.yml
@ -1,26 +0,0 @@
-# koopa-meet — Jitsi Meet (CachyOS web stub + follow-up signaling/media)
-# Live: /home/hernani/koopa-meet/
-# Public :9031 = koopa-paivana-meet (shared paivana image).
-# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19131 (not LAN 0.0.0.0)
-#
-# Next: add prosody / jicofo / jvb services (CachyOS images or pinned binaries).
-# Official docker-jitsi-meet is Debian-based — do not pull those as default here.
-services:
-  meet-web:
-    image: localhost/koopa-meet-web:cachyos
-    build:
-      context: .
-      dockerfile: Containerfile
-    container_name: koopa-meet-web
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Zurich
-    ports:
-      - "172.17.0.1:${BACKEND_PORT:-19131}:80"
-    labels:
-      org.hacktivism.service: meet
-      org.hacktivism.backend_port: "${BACKEND_PORT:-19131}"
-      org.hacktivism.site: meet.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.port_status: backend-19131-paywall-9031
-      org.hacktivism.image_base: cachyos
--- a/configs/meet/entrypoint.sh
+++ b/configs/meet/entrypoint.sh
@ -1,3 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-exec nginx -g 'daemon off;'
--- a/configs/merchant-landing/index.html
+++ b/configs/merchant-landing/index.html
@ -530,22 +530,18 @@
 </style>
 </head>
 <body>
-  <!-- stack-bar -->
-  <p class="stack-bar" role="note" title="Taler software on this merchant service (goa-regio-ng vanilla)">
+  <p class="stack-bar" role="note" title="Taler software on this merchant service (links → git.taler.net tags)">
    <strong>stack</strong><span class="sep">·</span>
-    <a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a>
+    <a href="https://git.taler.net/taler/merchant/commit/b5af1c99052f4c5053070cd5c6cc39b68eca2a20.html" target="_blank" rel="noopener noreferrer" title="merchant tag v1.6.9">taler-merchant&nbsp;1.6.9</a>
    <span class="sep">·</span>
-    taler-merchant&nbsp;1.6.23
+    <a href="https://git.taler.net/taler/taler-typescript-core/commit/d7ab425239226b798a95dbf6742fe4b4a2e30e47.html" target="_blank" rel="noopener noreferrer" title="taler-typescript-core tag v1.6.8-dev.6">taler-merchant-webui&nbsp;1.6.8~dev6</a>
    <span class="sep">·</span>
-    taler-merchant-webui&nbsp;1.6.38
+    <a href="https://git.taler.net/taler/merchant/commit/b5af1c99052f4c5053070cd5c6cc39b68eca2a20.html" target="_blank" rel="noopener noreferrer" title="merchant tag v1.6.9">libtalermerchant&nbsp;1.6.9</a>
    <span class="sep">·</span>
-    libtalermerchant&nbsp;1.6.23
+    <a href="https://git.taler.net/taler/exchange/commit/fed7d0e782ea4d36b2d2e337d93bfd2723c6ed64.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.7-dev.2">libtalerexchange&nbsp;1.6.7~dev2</a>
    <span class="sep">·</span>
-    libtalerexchange&nbsp;1.6.15
-    <span class="sep">·</span>
-    taler-terms-generator&nbsp;1.6.15
+    <a href="https://git.taler.net/taler/exchange/commit/fed7d0e782ea4d36b2d2e337d93bfd2723c6ed64.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.7-dev.2">taler-terms-generator&nbsp;1.6.7~dev2</a>
  </p>
-  <!-- /stack-bar -->
  <main>
    <header class="hero">
      <span class="badge">Merchant · dual currency</span>
@ -837,10 +833,10 @@ sudo apt-get install -y taler-wallet-cli</pre>
        <a href="https://taler.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
      </p>
      <!-- landing-rev -->
-      <p class="landing-rev" data-landing-site="merchant" data-landing-version="43" data-landing-commit="0d881cd">
-        Merchant landing <strong>v43</strong>
-        · content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time>
-        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a>
+      <p class="landing-rev" data-landing-site="merchant" data-landing-version="42" data-landing-commit="37ea4bb">
+        Merchant landing <strong>v42</strong>
+        · content <time datetime="2026-07-17T18:27:48+02:00">2026-07-17 18:27 CEST</time>
+        · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/37ea4bb8396691e3ea69ae61374e6623bf6c5ea7" title="koopa-admin-log 37ea4bb8396691e3ea69ae61374e6623bf6c5ea7">37ea4bb</a>
      </p>
      <!-- /landing-rev -->
    </footer>
--- a/configs/notes/.env.example
+++ b/configs/notes/.env.example
@ -1,5 +0,0 @@
-# Live on koopa: ~/koopa-silverbullet/.env (not git)
-# Allocate HOST_PORT only after live `ss` + Freigabe + ports.md update.
-HOST_PORT=9028
-# Optional SilverBullet app auth (prefer Caddy basicauth):
-# SB_USER=hernani:changeme
--- a/configs/notes/Containerfile
+++ b/configs/notes/Containerfile
@ -1,44 +0,0 @@
-# koopa-silverbullet — SilverBullet on CachyOS base + server binary
-# Build on koopa (x86_64):
-#   bash ~/koopa-admin-log/scripts/notes/build.sh
-#   → localhost/koopa-silverbullet:cachyos
-#
-# Base: docker.io/cachyos/cachyos (Arch-derived). App binary from upstream
-# silverbullet-server-linux-x86_64 release (not the Alpine ghcr image).
-
-ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
-FROM ${CACHYOS_IMAGE}
-
-ARG SB_VERSION=2.10.0
-ARG SB_ZIP_URL=https://github.com/silverbulletmd/silverbullet/releases/download/${SB_VERSION}/silverbullet-server-linux-x86_64.zip
-
-ENV SB_HOSTNAME=0.0.0.0 \
-    SB_FOLDER=/space \
-    SB_PORT=3000 \
-    SB_NAME=SilverBullet \
-    TZ=Europe/Zurich \
-    PATH=/usr/local/bin:$PATH
-
-# catatonit = Arch/CachyOS container init (tini not in repos)
-RUN pacman -Syu --noconfirm --needed \
-      bash curl git openssh catatonit unzip \
- && pacman -Scc --noconfirm \
- && rm -rf /var/cache/pacman/pkg/* /tmp/*
-
-# Fetch + install server binary (build-time; no Deno in image)
-RUN curl -fsSL "$SB_ZIP_URL" -o /tmp/sb.zip \
- && unzip -o /tmp/sb.zip -d /tmp \
- && install -m 755 /tmp/silverbullet /silverbullet \
- && /silverbullet --version || true \
- && rm -rf /tmp/sb.zip /tmp/silverbullet
-
-COPY entrypoint.sh /docker-entrypoint.sh
-RUN chmod 755 /docker-entrypoint.sh \
- && mkdir -p /space
-
-EXPOSE 3000
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-  CMD curl -fsS "http://127.0.0.1:${SB_PORT}/.instance" || exit 1
-
-WORKDIR /space
-ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]
--- a/configs/notes/README.md
+++ b/configs/notes/README.md
@ -1,65 +0,0 @@
-# SilverBullet — SilverBullet on CachyOS (koopa)
-
-Cross-host markdown notes (magikoopa + clementine). Stack name **SilverBullet** (parked web UI). Product **FreeNotes** = separate native enc notes (not this stack).
-
-| Item | Value |
-|------|--------|
-| Stack | [SilverBullet](https://silverbullet.md/) server binary |
-| Image | `localhost/koopa-silverbullet:cachyos` (`FROM docker.io/cachyos/cachyos`) |
-| Live dir | `/home/hernani/koopa-silverbullet/` |
-| Container | `koopa-silverbullet` |
-| Host port | **9028** = Paivana paywall; app backend **127.0.0.1:19128** |
-| Public site | `silverbullet.hacktivism.ch` |
-| Auth | Paivana (GOA:42); no Caddy basic_auth |
-| Forgejo space backup | private `hernani/freenotes` (historical name; SB space only) |
-
-## Cutover freenotes → silverbullet (koopa)
-
-Live still may be `~/koopa-freenotes` / CT `koopa-freenotes`. Scripts default dry-run; `--apply` needs Freigabe.
-
-```bash
-bash /path/to/koopa-admin-log/scripts/notes/status.sh
-bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh
-# Freigabe:
-bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh --apply
-```
-
-See `scripts/notes/README.md` for seed + Caddy order. DNS: `silverbullet.hacktivism.ch`.
-
-## Build + recreate (koopa)
-
-```bash
-# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
-bash /path/to/koopa-admin-log/scripts/notes/build.sh
-cd ~/koopa-silverbullet
-podman-compose down
-podman-compose up -d
-bash /path/to/koopa-admin-log/scripts/notes/up.sh
-```
-
-## Caddy apply (sudo on koopa)
-
-```bash
-sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
-# seed from secrets-enc SoT so apply does not rotate PASS
-sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
-  bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
-```
-
-Runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only). Never recreate `~/koopa-secrets`.
-
-## Space SoT (Forgejo)
-
-Private `hernani/freenotes` — live tree `~/koopa-silverbullet/space/` (git). On-koopa push uses oneshot HTTP token (no hernani SSH key in `~/.ssh`); laptop push via `git@git.hacktivism.ch:hernani/freenotes.git` (ProxyJump).
-
-## Client apps (hosts)
-
-Notes-like **system apps** (standalone Brave/Chrome `--app=` window + own profile): `configs/notes/client-apps/`.
-
- magikoopa: `~/Applications/SilverBullet.app` — `bash client-apps/install-magikoopa.sh`
- clementine (on-box): `silverbullet.desktop` — `bash client-apps/install-clementine.sh`
- optional: browser **Install app** (PWA) for Dock identity
-
-## Plugs (SB)
-
-`space/_plug/`: `treeview.plug.js`, `silversearch.plug.js` — see `PLUGS.md`.
--- a/configs/notes/client-apps/README.md
+++ b/configs/notes/client-apps/README.md
@ -1,23 +0,0 @@
-# SilverBullet — system Notes apps (hosts)
-
-Goal: **like Apple Notes** — a real system app window on each laptop, not a browser bookmark and not SilverBullet plugs.
-
-| Host | App | Behavior |
-|------|-----|----------|
-| magikoopa | `SilverBullet.app` → `~/Applications/` | Brave/Chrome **`--app=`** + own profile (`SilverBullet-BraveProfile`) — no tab bar |
-| clementine | `silverbullet.desktop` | same `--app=` via Brave/Chromium + `~/.local/share/SilverBullet-browser` |
-| both (optional) | Browser **Install app** / PWA | even closer to native Dock/menu identity |
-
-**Not this:** `space/_plug/` (TreeView/SilverSearch) — those are in-editor extensions.
-
-Install:
-
-```bash
-# magikoopa
-bash configs/notes/client-apps/install-magikoopa.sh
-
-# clementine (on-box)
-bash configs/notes/client-apps/install-clementine.sh
-```
-
-First launch: log in once (Caddy basicauth); credentials stay in the app profile.
--- a/configs/notes/client-apps/SilverBullet.app/Contents/Info.plist
+++ b/configs/notes/client-apps/SilverBullet.app/Contents/Info.plist
@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleName</key><string>SilverBullet</string>
-  <key>CFBundleDisplayName</key><string>SilverBullet</string>
-  <key>CFBundleIdentifier</key><string>ch.hacktivism.silverbullet</string>
-  <key>CFBundleVersion</key><string>1</string>
-  <key>CFBundleShortVersionString</key><string>1.0</string>
-  <key>CFBundleExecutable</key><string>SilverBullet</string>
-  <key>CFBundlePackageType</key><string>APPL</string>
-  <key>LSMinimumSystemVersion</key><string>12.0</string>
-  <key>CFBundleIconFile</key><string>AppIcon</string>
-</dict>
-</plist>
--- a/configs/notes/client-apps/SilverBullet.app/Contents/MacOS/SilverBullet
+++ b/configs/notes/client-apps/SilverBullet.app/Contents/MacOS/SilverBullet
@ -1,31 +0,0 @@
-#!/bin/bash
-# SilverBullet — Notes-like system app (standalone window, not a browser tab)
-URL="https://silverbullet.hacktivism.ch/"
-USER_DATA="${HOME}/Library/Application Support/SilverBullet-BraveProfile"
-mkdir -p "$USER_DATA"
-
-BRAVE="/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"
-CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
-
-# Dedicated Chromium profile so this feels like its own app (Dock, cookies, no tab chrome)
-if [[ -x "$BRAVE" ]]; then
-  exec "$BRAVE" \
-    --user-data-dir="$USER_DATA" \
-    --class=SilverBullet \
-    --app="$URL" \
-    --name=SilverBullet
-elif [[ -x "$CHROME" ]]; then
-  exec "$CHROME" \
-    --user-data-dir="$USER_DATA" \
-    --class=SilverBullet \
-    --app="$URL" \
-    --name=SilverBullet
-else
-  # last resort: Safari has no --app; open dedicated window via osascript
-  exec osascript <<'OSA'
-tell application "Safari"
-  activate
-  make new document with properties {URL:"https://silverbullet.hacktivism.ch/"}
-end tell
-OSA
-fi
--- a/configs/notes/client-apps/install-clementine.sh
+++ b/configs/notes/client-apps/install-clementine.sh
@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-# Install SilverBullet XFCE launcher on clementine (on-box). No Freigabe (user home).
-set -euo pipefail
-SRC="$(cd "$(dirname "$0")" && pwd)/silverbullet.desktop"
-APPDIR="${HOME}/.local/share/applications"
-DESK="${HOME}/Desktop"
-mkdir -p "$APPDIR" "$DESK"
-install -m 0644 "$SRC" "$APPDIR/silverbullet.desktop"
-install -m 0644 "$SRC" "$DESK/silverbullet.desktop"
-# refresh menu cache if available
-command -v update-desktop-database >/dev/null && update-desktop-database "$APPDIR" || true
-echo "STATUS=ok DESKTOP=$APPDIR/silverbullet.desktop SHORTCUT=$DESK/silverbullet.desktop"
-echo "TIP=open https://silverbullet.hacktivism.ch then browser Install app for PWA"
--- a/configs/notes/client-apps/install-magikoopa.sh
+++ b/configs/notes/client-apps/install-magikoopa.sh
@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Install SilverBullet.app into ~/Applications (magikoopa). No Freigabe (user home).
-set -euo pipefail
-SRC="$(cd "$(dirname "$0")" && pwd)/SilverBullet.app"
-DEST="${HOME}/Applications/SilverBullet.app"
-URL="${HOME}/Desktop/SilverBullet.url"
-mkdir -p "${HOME}/Applications" "${HOME}/Desktop"
-if [[ -d "$SRC" ]]; then
-  rm -rf "$DEST"
-  cp -R "$SRC" "$DEST"
-else
-  # bootstrap minimal app if scaffold app tree missing
-  mkdir -p "$DEST/Contents/MacOS" "$DEST/Contents/Resources"
-  cat >"$DEST/Contents/Info.plist" <<'PLIST'
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleName</key><string>SilverBullet</string>
-  <key>CFBundleDisplayName</key><string>SilverBullet</string>
-  <key>CFBundleIdentifier</key><string>ch.hacktivism.silverbullet</string>
-  <key>CFBundleVersion</key><string>1</string>
-  <key>CFBundleShortVersionString</key><string>1.0</string>
-  <key>CFBundleExecutable</key><string>SilverBullet</string>
-  <key>CFBundlePackageType</key><string>APPL</string>
-  <key>LSMinimumSystemVersion</key><string>12.0</string>
-</dict>
-</plist>
-PLIST
-  printf '%s\n' '#!/bin/bash' 'open "https://silverbullet.hacktivism.ch/"' >"$DEST/Contents/MacOS/SilverBullet"
-  chmod +x "$DEST/Contents/MacOS/SilverBullet"
-fi
-printf '%s\n' '[InternetShortcut]' 'URL=https://silverbullet.hacktivism.ch/' >"$URL"
-echo "STATUS=ok APP=$DEST URL=$URL"
--- a/configs/notes/client-apps/silverbullet.desktop
+++ b/configs/notes/client-apps/silverbullet.desktop
@ -1,12 +0,0 @@
-[Desktop Entry]
-Version=1.0
-Type=Application
-Name=SilverBullet
-Comment=Notes-like SilverBullet on koopa — standalone window
-TryExec=brave-browser
-Exec=sh -c 'B=""; for c in brave-browser brave chromium chromium-browser google-chrome; do command -v "$c" >/dev/null && B="$c" && break; done; if [ -n "$B" ]; then exec "$B" --user-data-dir="$HOME/.local/share/SilverBullet-browser" --class=SilverBullet --app=https://silverbullet.hacktivism.ch/; else exec xdg-open https://silverbullet.hacktivism.ch/; fi'
-Terminal=false
-Categories=Office;Network;
-Keywords=notes;todo;silverbullet;
-StartupWMClass=SilverBullet
-StartupNotify=true
--- a/configs/notes/compose.yml
+++ b/configs/notes/compose.yml
@ -1,38 +0,0 @@
-# koopa-silverbullet — SilverBullet on CachyOS base (parked; FreeNotes = native enc)
-# Live: /home/hernani/koopa-silverbullet/
-# Build: bash ~/koopa-admin-log/scripts/notes/build.sh → localhost/koopa-silverbullet:cachyos
-#
-# Public :9028 = koopa-paivana-silverbullet (shared paivana image).
-# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19128 (not LAN 0.0.0.0)
-services:
-  notes:
-    image: localhost/koopa-silverbullet:cachyos
-    build:
-      context: .
-      dockerfile: Containerfile
-      args:
-        SB_VERSION: "${SB_VERSION:-2.10.0}"
-    container_name: koopa-silverbullet
-    restart: unless-stopped
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Europe/Zurich
-      - SB_INDEX_PAGE=index
-      - SB_NAME=SilverBullet
-      - SB_SHELL_BACKEND=off
-      # Optional app-layer auth (prefer Caddy basicauth; leave empty in .env to skip):
-      # - SB_USER=${SB_USER}
-    volumes:
-      - ./space:/space
-    ports:
-      - "172.17.0.1:${BACKEND_PORT:-19128}:3000"
-    labels:
-      org.hacktivism.service: silverbullet
-      org.hacktivism.host_port: "9028"
-      org.hacktivism.backend_port: "${BACKEND_PORT:-19128}"
-      org.hacktivism.site: silverbullet.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.port_status: backend-19128-paywall-9028
-      org.hacktivism.image_base: cachyos
-
--- a/configs/notes/container-koopa-silverbullet.service
+++ b/configs/notes/container-koopa-silverbullet.service
@ -1,28 +0,0 @@
-# container-koopa-silverbullet.service
-# Install on koopa as hernani (after compose create):
-#   mkdir -p ~/.config/systemd/user
-#   cp configs/notes/container-koopa-silverbullet.service ~/.config/systemd/user/
-#   systemctl --user daemon-reload
-#   systemctl --user enable --now container-koopa-silverbullet.service
-# Requires: loginctl enable-linger hernani (root, once)
-#
-# Container must already exist (podman-compose up -d once).
-
-[Unit]
-Description=Podman container-koopa-silverbullet.service (SilverBullet)
-Documentation=https://silverbullet.md/
-Wants=network-online.target
-After=network-online.target
-RequiresMountsFor=/run/user/1000/containers
-
-[Service]
-Environment=PODMAN_SYSTEMD_UNIT=%n
-Restart=always
-TimeoutStopSec=90
-ExecStart=/usr/bin/podman start koopa-silverbullet
-ExecStop=/usr/bin/podman stop -t 20 koopa-silverbullet
-ExecStopPost=/usr/bin/podman stop -t 20 koopa-silverbullet
-Type=forking
-
-[Install]
-WantedBy=default.target
--- a/configs/notes/entrypoint.sh
+++ b/configs/notes/entrypoint.sh
@ -1,36 +0,0 @@
-#!/bin/bash
-# SilverBullet entrypoint (CachyOS/Arch user tools).
-# Adapted from upstream docker-entrypoint.sh (busybox → shadow useradd).
-set -euo pipefail
-
-if [[ -f /space/CONTAINER_BOOT.md ]]; then
-  echo "Executing CONTAINER_BOOT.md script"
-  bash /space/CONTAINER_BOOT.md &
-fi
-
-SB_FOLDER="${SB_FOLDER:-/space}"
-
-if [[ -z "${PUID:-}" && "$(id -u)" == "0" ]]; then
-  PUID=$(stat -c "%u" "$SB_FOLDER")
-  echo "Will run SilverBullet with UID $PUID (from owner of $SB_FOLDER)"
-fi
-if [[ -z "${PGID:-}" ]]; then
-  PGID=$(stat -c "%g" "$SB_FOLDER")
-fi
-
-if [[ "${PUID:-0}" == "0" || "$(id -u)" != "0" ]]; then
-  exec /silverbullet "$@"
-fi
-
-echo "Creating silverbullet user UID=$PUID GID=$PGID"
-getent group silverbullet >/dev/null 2>&1 || groupadd -g "$PGID" silverbullet || groupadd -o -g "$PGID" silverbullet
-getent passwd silverbullet >/dev/null 2>&1 || useradd -M -N -g silverbullet -u "$PUID" -d "$SB_FOLDER" -s /bin/bash silverbullet \
-  || useradd -o -M -N -g silverbullet -u "$PUID" -d "$SB_FOLDER" -s /bin/bash silverbullet
-
-echo "Running SilverBullet as PUID=$PUID PGID=$PGID"
-# quote-safe: pass args via "$@" under su -c is awkward; use runuser when present
-if command -v runuser >/dev/null 2>&1; then
-  exec runuser -u silverbullet -- /silverbullet "$@"
-fi
-args=$(printf '%q ' "$@")
-exec su silverbullet -s /bin/bash -c "/silverbullet $args"
--- a/configs/notes/space/PLUGS.md
+++ b/configs/notes/space/PLUGS.md
@ -1,12 +0,0 @@
-# Plugs (apps)
-
-Third-party SilverBullet plugs in  (loaded automatically).
-
-| Plug | Role |
-|------|------|
-| treeview.plug.js | Folder sidebar (Apple Notes-like) |
-| silversearch.plug.js | Full-text search |
-
-Install/update: drop  into , reload SilverBullet.
-
-Builtin SB plugs stay in the image; only extras live here.
--- a/configs/notes/space/TODO.md
+++ b/configs/notes/space/TODO.md
@ -1,31 +0,0 @@
-# TODO
-
-Canonical ADHD todo (SilverBullet space SoT; FreeNotes = separate native enc).
-
-## Now (max 3) — active quest board
- [x] magikoopa SilverBullet.app (`~/Applications`) + Desktop SilverBullet.url
- [ ] Install silverbullet.desktop on clementine (on-box: client-apps/install-clementine.sh)
- [ ] One-shot migrate: Apple Notes export + Dokumente/TODO.md → here (or FreeNotes later)
- [ ] Human sudo: confirm `sudo ls -la /etc/caddy/secrets/silverbullet-basicauth.txt`
- [ ] Live cutover Freigabe: dir/container → koopa-silverbullet; Caddy → silverbullet.hacktivism.ch; DNS
-
-## Next
- [x] Private Forgejo backup remote for space/ (hernani/freenotes — historical name)
- [x] Seed notes space on koopa
- [x] Caddy merge + basicauth scripts (live cutover pending Freigabe)
- [ ] DNS / public hostname silverbullet.hacktivism.ch (human)
- [x] Update productivity-adhd-notes 02 / 02b → single SoT pointing here
- [x] Wire magikoopa SSH push to hernani/freenotes (ProxyJump) — clone ~/git/freenotes
-
-## Someday / amnesty
- [ ] PWA install both laptops (browser Install app)
- [ ] Second-layer SB_USER if basicauth alone is not enough
- [ ] TreeView / SilverSearch UX polish after first week
-
-## Stats (gamification — agent updates)
- Session streak: 1
- Quests finished today: 6
- XP today: 60
- Last win: rename stack freenotes → silverbullet
- Boss: silverbullet cutover
- Boss HP: 70%
--- a/configs/notes/space/_plug/silversearch.plug.js
+++ b/configs/notes/space/_plug/silversearch.plug.js
--- a/configs/notes/space/_plug/treeview.plug.js
+++ b/configs/notes/space/_plug/treeview.plug.js
--- a/configs/notes/space/inbox.md
+++ b/configs/notes/space/inbox.md
@ -1,13 +0,0 @@
-# Inbox
-
-Apple **Quick Note** analogue. Dump here first; triage into [[TODO]] (Now / Next / Waiting / Someday) or a dedicated page.
-
-Rules:
-
- Empty capture OK — fill the next `- [ ]` line and save.
- Do not create a new folder just to capture.
- After triage, clear or check off lines so Inbox stays short.
-
-## Capture
-
- [ ] 
--- a/configs/notes/space/index.md
+++ b/configs/notes/space/index.md
@ -1,46 +0,0 @@
---
-# SilverBullet index page (SB_INDEX_PAGE=index)
-# Apple-Notes-like home: pins + capture path + search
---
-
-# Notes
-
-Cross-host notes (magikoopa + clementine) via koopa SilverBullet.
-Mental model = Apple Notes: **folders/pages · list · editor**, pin primary TODO, Quick Note → triage.
-
-| Page | Apple analogue | Role |
-|------|----------------|------|
-| [[TODO]] | Pinned primary note | ADHD SoT: Now≤3 / Next / Waiting / Someday / Stats |
-| [[inbox]] | Quick Note | Capture before triage |
-
-## Pins
-
- [[TODO]]
- [[inbox]]
-
-## How to use (Apple habits → here)
-
-1. **Capture** into [[inbox]] (or SB quick-note if enabled) — do not invent folders first.
-2. **Triage** into [[TODO]] sections (Now max 3). Same rules as former Apple Notes guide.
-3. **Find** with Page Picker / search (**Cmd/Ctrl-K**).
-4. **New page** when a topic is not a todo (meetings, dumps) — link from TODO by title, do not dump transcripts into TODO.
-5. Optional later: TreeView plug (folder sidebar), Space Lua query page = “smart folder” for `#tag` open tasks.
-
-## Shortcuts (target)
-
-| Action | Typical SB |
-|--------|------------|
-| Open page / filter | Cmd/Ctrl-K (Page Picker) |
-| Quick note | Ctrl-q (if client supports) → prefer landing in [[inbox]] |
-| Search body | built-in search / SilverSearch plug |
-
-## Hygiene (from Apple Notes ADHD pack)
-
- One primary [[TODO]] — no competing systems.
- Capture first; tags (`#taler` …) optional and light.
- On “I’m back”: re-read **Now** only.
- No passwords/tokens in notes.
-
-## Apps
-
- [[PLUGS]] — TreeView + SilverSearch
--- a/configs/paivana/README.md
+++ b/configs/paivana/README.md
@ -2,32 +2,27 @@

 GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.

-One process = one `BASE_URL` + one `DESTINATION_BASE_URL` + one `MERCHANT_BACKEND_URL`.
-Shared **image / secrets / entrypoint / conf template**; per-service env sets
-`PAIVANA_BASE_URL` + `PAIVANA_DESTINATION_BASE_URL`. Portal on **9025**; app
-paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only
-(`19128` SilverBullet, `19129` Galene HTTP, `19130` CryptPad edge, `19131` Meet).
-
 | Item | Value |
 |------|--------|
 | Live | `/home/hernani/koopa-paivana/` |
-| Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` |
+| Containers | `koopa-paivana`, `koopa-paivana-upstream` |
 | Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
-| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via pasta host IP `172.17.0.1:19128–19131` (compose publish, not `127.0.0.1`) |
-| Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy |
-| Currency | **multi** via goa-shop template `paivana` choices (CHF / FLOODS / GOA / TESTPAYSAN); wallet still filters by held coins |
+| Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
+| Host port | **9025** → Caddy `paivana.hacktivism.ch` |
+| Currency | **GOA** |
 | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
-| Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) |
-| Access | **`-g`** site-wide: pay once → that hostname free to browse |
+| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
+| Access | **`-g`** site-wide: pay once → example upstream free to browse |
+| Upstream | example site in `upstream/` (compose service) |

 ## Layout

 | Path | Role |
 |------|------|
 | `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
-| `compose.yml` | portal + 4 app paywalls + nginx upstream (YAML anchor `x-paivana-common`) |
-| `conf/paivana.conf.template` | Shared conf; `@BASE_URL@` / `@DESTINATION_BASE_URL@` / secrets at start |
-| `entrypoint.sh` | Env + secrets → run `paivana-httpd -g -f` |
+| `compose.yml` | `koopa-paivana` + nginx upstream |
+| `conf/paivana.conf.template` | Config; secrets substituted at start |
+| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
 | `secrets/` | **not in git** — live only |
 | `upstream/` | Protected demo content |
 | `container-koopa-paivana.service` | systemd --user oneshot compose up |
@ -95,10 +90,9 @@ extra_hosts:
 | Check | Expect |
 |-------|--------|
 | `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` |
-| `curl -si http://127.0.0.1:902{8,9,0}/` | **302** same template path (per-host BASE_URL) |
-| `https://{paivana,silverbullet,galene,cryptpad,meet}.hacktivism.ch/` | unpaid → **302** `…/templates/paivana#…` (or paywall HTML) |
+| `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` |
 | monitoring `urls` | `www.paivana` OK |
-| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:42** (wenn `E2E_PAIVANA=1`) |
+| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:4200** (wenn `E2E_PAIVANA=1`) |

 ---

@ -143,26 +137,22 @@ Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).

 ## Merchant template

-Create (or replace via PATCH / DELETE+POST — see live merchant API):
-
 ```bash
 curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
  -H "Authorization: Bearer secret-token:…" \
  -H 'Content-Type: application/json' \
  -d '{
    "template_id": "paivana",
-    "template_description": "Paivana paywall portal (GOA)",
+    "template_description": "Paivana paywall (GOA)",
    "template_contract": {
      "template_type": "paivana",
-      "summary": "Access to paivana.hacktivism.ch portal",
+      "summary": "Access to paivana.hacktivism.ch",
      "website_regex": ".*",
-      "choices": [{ "amount": "GOA:42", "description": "Unlock portal (cryptpad / galene / silverbullet links)" }]
+      "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
    }
  }'
 ```

-goa-shop template `paivana` exposes multi-currency **choices**. Wallet/UI still only offers currencies the wallet holds. Live conf must use `instances/goa-shop/` + matching merchant token (not `goa-demo-*`).
-
 ## Docs

 - https://docs.taler.net/taler-paivana-manual.html
--- a/configs/paivana/compose.yml
+++ b/configs/paivana/compose.yml
@ -1,21 +1,21 @@
-# koopa-paivana — shared image/secrets/entrypoint for portal + app paywalls
+# koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
 # Live: /home/hernani/koopa-paivana/
-#
-# Public Caddy targets (unchanged):
-#   9025 → portal (paivana.hacktivism.ch)
-#   9028 → paywall silverbullet
-#   9029 → paywall galene
-#   9030 → paywall cryptpad
-#   9031 → paywall meet (Jitsi web)
-# App backends on pasta host IP (see app compose; not LAN 0.0.0.0):
-#   172.17.0.1:19128 / 19129 / 19130 / 19131
-
-x-paivana-common: &paivana-common
+services:
+  paivana:
+    build:
+      context: .
+      dockerfile: Containerfile
    image: localhost/koopa-paivana:latest
+    container_name: koopa-paivana
    restart: unless-stopped
+    # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
    user: "1000:1000"
    userns_mode: keep-id
+    ports:
+      - "9025:9967"
    extra_hosts:
+      # pasta publishes merchant on host :9010. Prefer fixed IPv4 — host-gateway
+      # alone still loses to public AAAA and times out from the container.
      - "taler.hacktivism.ch:172.17.0.1"
      - "bank.hacktivism.ch:172.17.0.1"
      - "exchange.hacktivism.ch:172.17.0.1"
@ -24,22 +24,6 @@ x-paivana-common: &paivana-common
      - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
      - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
      - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
-  labels:
-    org.hacktivism.managed_by: koopa-admin
-    org.hacktivism.currency: multi
-
-services:
-  paivana:
-    <<: *paivana-common
-    build:
-      context: .
-      dockerfile: Containerfile
-    container_name: koopa-paivana
-    ports:
-      - "9025:9967"
-    environment:
-      PAIVANA_BASE_URL: https://paivana.hacktivism.ch/
-      PAIVANA_DESTINATION_BASE_URL: http://upstream:8080/
    depends_on:
      - upstream
    labels:
@ -47,70 +31,10 @@ services:
      org.hacktivism.host_port: "9025"
      org.hacktivism.site: paivana.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: multi
-
-  # App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031.
-  paivana-silverbullet:
-    <<: *paivana-common
-    container_name: koopa-paivana-silverbullet
-    ports:
-      - "9028:9967"
-    environment:
-      PAIVANA_BASE_URL: https://silverbullet.hacktivism.ch/
-      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19128/
-    labels:
-      org.hacktivism.service: paivana-silverbullet
-      org.hacktivism.host_port: "9028"
-      org.hacktivism.site: silverbullet.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: multi
-
-  paivana-galene:
-    <<: *paivana-common
-    container_name: koopa-paivana-galene
-    ports:
-      - "9029:9967"
-    environment:
-      PAIVANA_BASE_URL: https://galene.hacktivism.ch/
-      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19129/
-    labels:
-      org.hacktivism.service: paivana-galene
-      org.hacktivism.host_port: "9029"
-      org.hacktivism.site: galene.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: multi
-
-  paivana-cryptpad:
-    <<: *paivana-common
-    container_name: koopa-paivana-cryptpad
-    ports:
-      - "9030:9967"
-    environment:
-      PAIVANA_BASE_URL: https://cryptpad.hacktivism.ch/
-      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19130/
-    labels:
-      org.hacktivism.service: paivana-cryptpad
-      org.hacktivism.host_port: "9030"
-      org.hacktivism.site: cryptpad.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: multi
-
-  paivana-meet:
-    <<: *paivana-common
-    container_name: koopa-paivana-meet
-    ports:
-      - "9031:9967"
-    environment:
-      PAIVANA_BASE_URL: https://meet.hacktivism.ch/
-      PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19131/
-    labels:
-      org.hacktivism.service: paivana-meet
-      org.hacktivism.host_port: "9031"
-      org.hacktivism.site: meet.hacktivism.ch
-      org.hacktivism.managed_by: koopa-admin
-      org.hacktivism.currency: multi
+      org.hacktivism.currency: GOA

  upstream:
+    # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
    image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
    container_name: koopa-paivana-upstream
    restart: unless-stopped
--- a/configs/paivana/conf/paivana.conf.template
+++ b/configs/paivana/conf/paivana.conf.template
@ -1,14 +1,14 @@
-# Shared paivana-httpd conf — BASE/DEST injected by entrypoint (env).
-# Secrets injected from /run/secrets/
+# paivana.hacktivism.ch — paywall reverse proxy
+# Secrets injected by entrypoint from /run/secrets/

 [paivana]
 SERVE = tcp
 PORT = 9967
 BIND_TO = 0.0.0.0

-BASE_URL = @BASE_URL@
+BASE_URL = https://paivana.hacktivism.ch/

-DESTINATION_BASE_URL = @DESTINATION_BASE_URL@
+DESTINATION_BASE_URL = http://upstream:8080/

 MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/
 MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@
--- a/configs/paivana/entrypoint.sh
+++ b/configs/paivana/entrypoint.sh
@ -5,10 +5,6 @@ SECRET_FILE="${PAIVANA_SECRET_FILE:-/run/secrets/paivana-secret}"
 TEMPLATE="${PAIVANA_CONF_TEMPLATE:-/etc/paivana/paivana.conf.template}"
 OUT="${PAIVANA_CONF:-/tmp/paivana.conf}"

-# Per-instance (portal + app paywalls share this entrypoint/image).
-BASE_URL="${PAIVANA_BASE_URL:-https://paivana.hacktivism.ch/}"
-DEST_URL="${PAIVANA_DESTINATION_BASE_URL:-http://upstream:8080/}"
-
 if [ ! -r "$TOKEN_FILE" ]; then
  echo "missing merchant token: $TOKEN_FILE" >&2
  exit 1
@ -21,12 +17,10 @@ fi
 TOKEN=$(tr -d '\n\r' < "$TOKEN_FILE")
 SECRET=$(tr -d '\n\r' < "$SECRET_FILE")

-awk -v t="$TOKEN" -v s="$SECRET" -v b="$BASE_URL" -v d="$DEST_URL" '
+awk -v t="$TOKEN" -v s="$SECRET" '
 {
  gsub(/@MERCHANT_ACCESS_TOKEN@/, t)
  gsub(/@PAIVANA_SECRET@/, s)
-  gsub(/@BASE_URL@/, b)
-  gsub(/@DESTINATION_BASE_URL@/, d)
  print
 }
 ' "$TEMPLATE" > "$OUT"
--- a/configs/paivana/upstream/index.html
+++ b/configs/paivana/upstream/index.html
@ -3,7 +3,7 @@
 <head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
-  <title>hacktivism tools — unlocked</title>
+  <title>Example site — free after GOA:4200</title>
  <style>
    :root { color-scheme: light dark; }
    body {
@ -26,41 +26,29 @@
    .price { font-variant-numeric: tabular-nums; }
    code { background: color-mix(in srgb, CanvasText 12%, transparent); padding: 0.1em 0.35em; border-radius: 3px; }
    .card {
-      margin-top: 1.25rem;
+      margin-top: 1.5rem;
      padding: 1rem 1.1rem;
      border: 1px solid color-mix(in srgb, CanvasText 18%, transparent);
      border-radius: 10px;
    }
    ul { padding-left: 1.2rem; }
-    a { color: inherit; }
-    .sites a {
-      display: block;
-      margin: 0.45rem 0;
-      font-weight: 600;
-    }
  </style>
 </head>
 <body>
  <span class="badge">unlocked</span>
-  <h1>hacktivism tools</h1>
+  <h1>Example site</h1>
  <p>
-    You paid once via GNU Taler / Paivana
-    (template <code>paivana</code> on <code>goa-shop</code>: CHF / FLOODS / GOA / TESTPAYSAN choices).
-    Site-wide access cookie is set for <code>paivana.hacktivism.ch</code>.
+    You paid <strong class="price">GOA:4200</strong> once via GNU Taler / Paivana.
+    This whole example site is now free for you to browse (site-wide access cookie).
  </p>
-  <div class="card sites">
-    <p><strong>Sites</strong></p>
-    <a href="https://cryptpad.hacktivism.ch/">cryptpad.hacktivism.ch</a>
-    <a href="https://galene.hacktivism.ch/">galene.hacktivism.ch</a>
-    <a href="https://silverbullet.hacktivism.ch/">silverbullet.hacktivism.ch</a>
-  </div>
  <div class="card">
-    <p><strong>Notes</strong></p>
+    <p><strong>What this demonstrates</strong></p>
    <ul>
-      <li>One Paivana process = one <code>DESTINATION_BASE_URL</code> → this portal is the gated upstream.</li>
-      <li>Merchant: <code>goa-shop</code> · template <code>paivana</code> (multi-currency choices).</li>
-      <li>Host: <code>https://paivana.hacktivism.ch/</code></li>
+      <li>Paywall: <code>paivana-httpd</code> in front of a normal upstream HTTP site</li>
+      <li>Currency: exploration money <code>GOA</code> on exchange.hacktivism.ch</li>
+      <li>After payment: no further charge for pages behind this proxy</li>
    </ul>
+    <p style="margin-bottom:0">Host: <code>https://paivana.hacktivism.ch/</code></p>
  </div>
 </body>
 </html>
--- a/configs/ports.md
+++ b/configs/ports.md
@ -1,4 +1,4 @@
-# Port map (koopa)
+# Port map (see also host/overview/services.md)

 | Port | Role |
 |------|------|
@ -7,44 +7,29 @@
 | 443 | systemd `https-proxy.socket` → Caddy **9001** |
 | 9000 | Caddy HTTP + ACME webroot |
 | 9001 | Caddy HTTPS (vhosts) |
-| **9010** | `goa-regio-ng` merchant API (HTTPS in CTR) |
-| **9011** | `goa-regio-ng` exchange |
-| **9012** | `goa-regio-ng` libeufin-bank |
-| **9013–9015** | bank / exchange / merchant public landings (host nginx) |
-| 9020 | `koopa-castopod` → `castopod.hacktivism.ch` |
-| 9021 | `koopa-bonfire` → `bonfire.hacktivism.ch` |
-| 9022 | `koopa-prime` (Jellyfin) → `prime.hacktivism.ch` |
-| 9023 | qBittorrent WebUI → `bt.hacktivism.ch` |
-| **6881** | qBittorrent BT listen (tcp+udp; firewalld + VeciGate DNAT) |
-| **9024** | `koopa-forgejo` (HTTP) → **`git.hacktivism.ch`** |
-| **9025** | `koopa-paivana` → `paivana.hacktivism.ch` |
-| **9026** | `koopa-lemmy-proxy` → `lemmy.hacktivism.ch` |
-| **9027** | `koopa-decidim` → `decidim.hacktivism.ch` |
-| **9028** | `koopa-paivana-silverbullet` → `silverbullet.hacktivism.ch` |
-| **9029** | `koopa-paivana-galene` → `galene.hacktivism.ch` |
-| **9030** | `koopa-paivana-cryptpad` → `cryptpad.hacktivism.ch` |
-| **9031** | `koopa-paivana-meet` → `meet.hacktivism.ch` |
-| **9032** | `koopa-bbb-front` → `bbb.hacktivism.ch` |
-| **9200** | Forgejo git-SSH (host-direct; not Caddy) |
-| 9090–9092 | `koopa-tops-ng1`…`ng3` → `tops.ng{1,2,3}.hacktivism.ch` |
-| **8080** | host `tor.service` ORPort |
-| **9051** | host Tor ControlPort (loopback) |
+| 9010 | podman `taler-hacktivism` (merchant) |
+| 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) |
+| 9012 | podman `taler-hacktivism-bank` (libeufin-bank) |
+| 9013–9015 | bank / exchange / merchant public landings |
+| 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` |
+| 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |
+| 9022 | podman `koopa-prime` (Jellyfin) → Caddy `prime.hacktivism.ch` |
+| 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
+| **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
+| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
+| **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
+| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
+| **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
+| 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
+| 8080 | Tor ORPort |

 VeciGate: WAN **80→9000**, WAN **443→9001**.  
-Public apps: Caddy on **9001** → 127.0.0.1:{9010–9015, 9020–9032, 9090–9092}.  
-Git SSH needs **9200/tcp** if exposed to WAN.
+Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.  
+Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.

-| UDP range | Role |
-|-----------|------|
-| **10000–10099/udp** | Galene WebRTC |
+| **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
+| **1790** | podman **`koopa-nym`** verloc |
+| **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) |
+| **19000** | optional nym entry WS (gateway mode) |
+| **51822/udp** | optional nym WireGuard (dVPN path) |

-| Extra | Role |
-|-------|------|
-| **1789** | `koopa-nym` mixnet |
-| **1790** | `koopa-nym` verloc |
-| **9080** | `koopa-nym` HTTP API |
-| **9180** | lab `goa-regio-ng` HTTP (loopback; `configs/lab-local/`) |
-| **9322** | lab `goa-regio-ng` SSH/ansible (loopback) |
-| **8288** | lab `mytops-local` HTTP (loopback) |
-
-login-health inventory: `scripts/login-health/koopa-login-health.sh`.
--- a/configs/prime/README.md
+++ b/configs/prime/README.md
@ -6,7 +6,6 @@
 | Compose | `compose.yml` (this dir; **no secret values**) |
 | Jellyfin | **9022** → Caddy `prime.hacktivism.ch` |
 | qBittorrent | **9023** → Caddy `bt.hacktivism.ch` |
-| BT listen | **6881** tcp+udp (firewalld + VeciGate DNAT); apply `scripts/prime/apply-qbittorrent-bt-net.sh` |
 | Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` |

 `WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in  
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
Hernâni Marques	50fc9a35c0	koopa: hernani user ollama loopback + host-power sampling	2026-09-05 03:57:08 +02:00
Hernâni Marques	6a99f7d6bb	decidim: public-commons process text + isoc avatar hook	2026-08-17 15:55:23 +02:00
Hernâni Marques	03e5c0d3ad	decidim: public example process + isoc participant seed	2026-08-17 15:38:43 +02:00
Hernâni Marques	609056615e	decidim: decidim.hacktivism.ch behind Caddy :9027	2026-08-17 15:31:10 +02:00