hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: hernani:master
Branches Tags
hernani:master
hernani:chore/forgejo-host-ro-users
hernani:clementine-20261031-park-koopa-admin-log
hernani:magikoopa-vs-clementine
hernani:clementine
..
compare: hernani:magikoopa-vs-clementine
Branches Tags
hernani:master
hernani:chore/forgejo-host-ro-users
hernani:clementine-20261031-park-koopa-admin-log
hernani:magikoopa-vs-clementine
hernani:clementine

3 commits
master ... magikoopa-

Author SHA1 Message Date
Hernâni Marques
56460c6bd7
koopa: update caddy scripts and docs 2026-09-07 16:55:57 +02:00
Hernâni Marques
f6691c6de0
goa: lower default debt_limit under 2^52 for libeufin 2026-09-05 13:17:03 +02:00
Hernâni Marques
bb62ebea36
koopa: apt-src ubuntu noble container (Freigabe) 2026-09-05 12:46:19 +02:00
209 changed files with 1344 additions and 12666 deletions
Download patch file Download diff file Expand all files Collapse all files

5
2026/2026-07-19.md
View file

@ -3,8 +3,3 @@
- **Caddy mon bare paths:** `redir /path/ 302` inside `handle` → Location `302` → merchant code 21; fix `redir * /path/ 302` - **Caddy mon bare paths:** `redir /path/ 302` inside `handle` → Location `302` → merchant code 21; fix `redir * /path/ 302`
- **apply-monitoring-live.sh:** smoke for-loop syntax (missing `\`); use absolute `/home/hernani/koopa-caddy/…` (root `~` = `/root`) - **apply-monitoring-live.sh:** smoke for-loop syntax (missing `\`); use absolute `/home/hernani/koopa-caddy/…` (root `~` = `/root`)
- Re-apply: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh` - Re-apply: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh`
- **clementine-magikoopa-share** (`~/clementine-magikoopa-share/`): openssl AES-256-CBC + PBKDF2 iter 600000; `lock.sh`/`unlock.sh` + `ANLEITUNG.md` (usage). Inventory only after decrypt: `EXPECTED-REPOS.md` (includes vecigate-admin-log/secrets expected from magikoopa). Usage mirror in `koopa-admin-secrets/docs/clementine-magikoopa-share.md`.
- **Share payload = all local-only / never-pushed repos:** canonical list in `koopa-admin-secrets/docs/share-payload-dirs.txt` (+ `local-only-share-repos.md`). On clementine archived: `taler-monitoring-env`, `llm`, `grok-work-log`, **`koopa-admin-secrets`**, **`francpaysan-secrets`**, **`dot-grok`** (`~/.grok` full profile); still MISSING until magikoopa locks them: `vecigate-admin-log`, `vecigate-admin-secrets`.
- **Share README:** other machine must treat `dot-grok` / profile rules **system-wide** (install to `~/.grok`, same operator rules on clementine and magikoopa).
- **secret-languages:** extracted from local branches `local/merchant-secret-ui` / `local/secret-ui-scrub` into standalone local-only repo `~/src/koopa/secret-languages` (never push). Those branches deleted on this clone. Pack via clementine-magikoopa-share.

43
2026/2026-08-17--decidim.md
View file

@ -1,43 +0,0 @@
# Decidim — decidim.hacktivism.ch (2026-08-17)
Site: **https://decidim.hacktivism.ch/**
Port **9027** → Caddy. Stack: `koopa-decidim` + `koopa-decidim-sidekiq` + `koopa-decidim-db` + `koopa-decidim-redis`. Image `decidim/decidim:0.30.8`.
Live: `~/koopa-decidim/` (compose mirror `configs/decidim/`). Secrets only on host (`.env`, `users.env`).
Instance name **hacktivism**. Theme: exchange-dark (gold `#e8a838`, bg `#1a1410`) via `theme/hacktivism.css`. Analog: `configs/lemmy/`.
Admin users are on the host (`~/koopa-decidim/users.env`), not in this repo.
Caddy: `sudo /home/hernani/koopa-caddy/apply.sh`
Boot: `scripts/decidim/install-systemd.sh` (linger already yes on koopa).
## Cookie / privacy
Stock Decidim still emits `#dc-dialog-wrapper` (Accept all / essential / Settings). This instance has no third-party trackers; privacy is default.
- CSS: `#dc-dialog-wrapper, .cookies__container { display: none !important; }`
- JS: `/hacktivism-consent.js` sets `decidim-consent={"essential":true}` if missing
- Live 2026-08-17: HTML 200, CSS/JS 200, hide rules in public `/hacktivism.css`
## Reboot (checked 2026-08-17)
| Item | Value |
|------|--------|
| linger `hernani` | yes |
| `container-koopa-decidim-db` | enabled + active |
| `container-koopa-decidim` | enabled + active |
| `container-koopa-lemmy-db` / `container-koopa-lemmy` | enabled + active |
| listen | `:9027` `:9026` |
login-health: probes + containers + linger + these units enabled. Loopback HTTP on :9027 is **301** (app wants HTTPS; TLS is Caddy). Probe allows 301. After reboot: login-health only unless asked.
## Public example + isoc
- Process **example** (published, not private): `https://decidim.hacktivism.ch/processes/example`
— title **Öffentliche digitale Allmende** (public-by-default reading).
- Published meeting **Offene Runde: Lesen ohne Konto** + one public proposal + background page.
- Homepage block `highlighted_processes` published.
- Participant `isoc` on the host (`users.env`); password not in this repo.
- Avatar: gold ISOC globe (same crop as Bonfire `@isoc`); host file `~/koopa-decidim/assets/img/isoc-gold.png`, not in this repo.
- Seed: `scripts/decidim/seed-example.sh` / `configs/decidim/seed_example.rb`.

16
2026/2026-09-05--hernani-ollama-user+power.md
View file

@ -1,16 +0,0 @@
# koopa: hernani user Ollama + power sampling (2026-09-05)
Freigabe: operator — install Ollama under hernani (no root package); loopback only; laptop tunnels.
## Ollama
- Binary: `~hernani/.local/bin/ollama` (v0.33.3 from GitHub `ollama-linux-amd64.tar.zst`)
- Unit: `~/.config/systemd/user/ollama.service` · `OLLAMA_HOST=127.0.0.1:11434` · enabled
- Access: SSH as **hernani** from clementine/magikoopa → LocalForward (helper `koopa-ollama-tunnel` → laptop `:11438`)
- Models: small + exotic pulls (see pull log `/tmp/ollama-koopa-pull-20260905.log`) — prefer ≤3B
## Power / energy
- Deployed `host-power.py` to `~hernani/.local/bin/host-power`
- Laptop: `remote-power koopa` / `koopa-power` → JSON watts; combo derives Wh
- RAPL `energy_uj` root-only → quality **estimated** until Freigabe for `enable-host-power-access.sh --apply`

6
2026/2026-09-07--git-meta-origin-forgejo.md
View file

@ -7,7 +7,7 @@
| Host | **Forgejo rootless** `https://git.hacktivism.ch/` | | Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
| Repo | **hernani/git** (meta-repo: non-secret globals only) | | Repo | **hernani/git** (meta-repo: non-secret globals only) |
| Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) | | Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) |
| Default branch | `master` (forgejo/ht SoT — never `main`) | | Default branch | `main` |
| SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` | | SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` |
| SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` | | SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` |
| Local tree | `$HOME/git/` (`PATH[git-root]`) | | Local tree | `$HOME/git/` (`PATH[git-root]`) |
@ -19,7 +19,7 @@ Unauth HTTPS browse of a private repo → **404** (expected).
```bash ```bash
cd "$HOME/git" cd "$HOME/git"
git remote add origin git@git.hacktivism.ch:hernani/git.git git remote add origin git@git.hacktivism.ch:hernani/git.git
git push -u origin master git push -u origin main
``` ```
SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`. SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`.
@ -40,7 +40,7 @@ podman exec koopa-forgejo gitea admin user generate-access-token \
curl -sS -X POST \ curl -sS -X POST \
-H "Authorization: token ${TOKEN}" \ -H "Authorization: token ${TOKEN}" \
-H "Content-Type: application/json" \ -H "Content-Type: application/json" \
-d '{"name":"git","private":true,"auto_init":false,"default_branch":"master"}' \ -d '{"name":"git","private":true,"auto_init":false,"default_branch":"main"}' \
http://127.0.0.1:9024/api/v1/admin/users/hernani/repos http://127.0.0.1:9024/api/v1/admin/users/hernani/repos
# expect HTTP 201, full_name=hernani/git # expect HTTP 201, full_name=hernani/git
``` ```

31
2026/2026-09-09--forgejo-tip-master-only.md
View file

@ -1,31 +0,0 @@
# Forgejo HT tip = `master` only (2026-09-09)
## Rule
On `git.hacktivism.ch` every hernani tip is **`master` only** — no dual `main`+`master`, no tip named `main`.
- Instance: `[repository] DEFAULT_BRANCH = master` in Forgejo `app.ini` (live after container restart).
- Sync/clone/push defaults: `origin/master`.
- Docs: `llm-configs` → `git-skills.md`, `ESYNC-RULE.md`, `REPOS-INDEX.md`, `forgejo-llm-config.md`.
## Unify (done)
Authenticated inventory: 32 hernani repos. Mutated 15 NEED → verify **OK 32 / BAD 0**.
Notable:
| Case | Repos |
|------|--------|
| MAIN_ONLY → master + drop main | `_grok_sync`, admin-logs, `elelmon` (kept `main-legacy`), `silverbucket` (ex-`freenotes` space), `grok-work-log`, `llm-work-output-enc`, `openkknd-ng`, `taler-monitoring`, `taler-wallets-enc`, `vecirex-www`, … |
| EMPTY | `vecigate-admin-log` (PATCH default only) |
| DUAL_DIFF (stale master dropped; tip from former main) | `git`, `llm-configs` |
Feature branches left in place where present (`koopa-admin-log`, `taler-monitoring`, …).
## Rename (same day)
Forgejo space repo **`hernani/freenotes` → `hernani/silverbucket`** (tip `master`). Local clone: `~/git/freenotes-space` → origin `silverbucket`. **Not** the FreeNotes tool/apps tree (`~/git/freenotes`).
## Local clones
Retarget checkout/tracking to `origin/master` on magikoopa trees that had `origin`.

55
2026/2026-09-11--forgejo-gitleaks-enc-gate.md
View file

@ -1,55 +0,0 @@
# 2026-09-11 — Forgejo/ht gitleaks + *enc.git Klartext-Sperre (TODO320)
**Status:** live on koopa Forgejo (`koopa-forgejo` / `git.hacktivism.ch`)
**Freigabe:** Auftrag `TODO=320` this session (host mutation ht)
**Analog:** firefly/taler `admin-log/firefly/28-gitolite-enc-gitleaks.md` + `hooks/common/pre-receive.d-gitleaks`
**Tip:** k stays **319** (no tip-advance)
## What
1. **gitleaks** pre-receive on non-`*enc.git` — reject pushes with detected secrets.
2. **Skip** `*enc.git` for gitleaks (ciphertext / FP).
3. **`git-crypt-enforce`** on `*enc.git` — require `.gitattributes` + `.git-crypt/`; reject blobs under `filter=git-crypt` missing `\0GITCRYPT` (9-byte header).
## Live paths (koopa)
| Item | Path |
|------|------|
| Data root | `~/koopa-forgejo/data` → container `/var/lib/gitea` |
| Binary | `data/custom/bin/gitleaks` (v8.21.2 linux_x64) |
| Shared hooks | `data/custom/hooks/pre-receive.d/{gitleaks,git-crypt-enforce}` |
| Smoke | `data/custom/bin/smoke-todo320.sh` (run **inside** container) |
| Per-repo | `data/git/repositories/*/*.git/hooks/pre-receive.d/` → symlinks to shared hooks (container paths) |
| Staging / installer SoT | laptop `PATH[llm-configs]/bin/forgejo-hooks/` + koopa `~/koopa-forgejo/hooks-staging/` |
Installer: `install-hooks-ht.sh` (idempotent; podman; does not restart container).
After install: **~32** repos linked. **New repos:** re-run installer (custom/hooks alone not relied on for auto-sync into every bare repo).
## Smoke (Done-when a/b/c) — PASSED 2026-09-11
```bash
podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
# ALL SMOKES PASSED
# (a) secret push denied — private-key fixture (not AWS EXAMPLE keys)
# (b) enc ciphertext allowed
# (c) enc plaintext denied
```
Fixes needed during smoke: park incoming objects on `refs/tmp/*` (not `refs/heads/*`, else `rev-list tip --not --branches` is empty); magic check `head -c 9` for `\0GITCRYPT`.
## Rollback
```bash
# Per repo or all: remove custom hooks from pre-receive.d (keep Forgejo `gitea` hook)
rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/gitleaks
rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/git-crypt-enforce
# Optional: remove shared copies under data/custom/hooks/pre-receive.d/
```
## Ops notes
- Use **podman** (not docker sock) for `koopa-forgejo`.
- Symlink targets must be **container** paths (`/var/lib/gitea/custom/...`).
- Hook logs redact via gitleaks `--redact`; do not echo secrets.
- Laptop SSH: `Host git.hacktivism.ch` ProxyJump koopa, Port 9200, User git.
- Local SoT scripts: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`.

60
2026/2026-09-12--enc-inventur-rewrite-hooks.md
View file

@ -1,60 +0,0 @@
# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY)
**Status:** report only — **no** admin-log / firefly / Taler push this stretch
**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only
**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`)
**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0%
**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt`
## Priority table (tip)
| Priority | Repo | Outcome |
|----------|------|---------|
| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). |
| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). |
| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. |
| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. |
| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. |
| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. |
## Wrong origin (cleared)
Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`.
## Hooks (TODO320) — reinstall + smoke 2026-09-12
Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`
Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh`
```
OK gitleaks=8.21.2 repos_linked=32
podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
ALL SMOKES PASSED
(a) secret push denied
(b) enc ciphertext allowed
(c) enc plaintext denied
```
`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks.
Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING).
**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext).
Inventur STATUS close block appended same turn.
## GPG recipients (credit + control)
- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep)
- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa)
## Blocked / needs next Freigabe
1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks.
2. Optional: commit/push work-output dirty overlay (2090) after review.
3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy.
4. Admin-log **push** of this file (report-only until Freigabe).
## HALT (unchanged)
- No ladder restart `@START_N=333`
- No admin-log / firefly / Taler push without Freigabe
- No force-push to `hernani/git.git`

124
2026/2026-09-15--goa-ansible-merchant-first.md
View file

@ -1,124 +0,0 @@
# 2026-09-15 — GOA Ansible Merchant-first
**Freigabe:** Live-Stop / Caddy = nein bis Chat-OK.
**Feed:** `taler-deployment` `origin/dev/hernani/regio-goa-explorational-currency`
**Work branch:** `dev/hernani/goa-regio-ng-vanilla`
## Naming
| | |
|--|--|
| **vanilla** | Ansible Vollkomposition (Merchant+Exchange+Bank+nginx/pg); GOA-Ersatz-Kandidat |
| **local** | Lab only: loopback / `goa.local` |
`configs/lab-local/goa-regio-ng` = **vanilla** @ **local**. Nie `REGIO_PUBLISH_KOOPA_PORTS=1` neben Live.
## Ist (lab green)
```bash
ssh hernani@koopa 'podman ps --format "{{.Names}} {{.Status}} {{.Ports}}" | grep -E "goa-regio|taler-hacktivism"'
# taler-hacktivism* Up 9010–9015
# goa-regio-ng Up 127.0.0.1:9180→80, 127.0.0.1:9322→22
ssh hernani@koopa "podman exec goa-regio-ng sh -c '
for u in nginx postgresql libeufin-bank taler-merchant-httpd taler-exchange-httpd taler-merchant.target; do
printf \"%s=\"; systemctl is-active \$u
done'"
# all=active
ssh hernani@koopa 'for h in bank.goa.local exchange.goa.local backend.goa.local; do
curl -sS -o /dev/null -w "$h %{http_code}\n" -H "Host: $h" http://127.0.0.1:9180/config
done'
# all 200
ssh hernani@koopa 'curl -sS -H "Host: exchange.goa.local" http://127.0.0.1:9180/keys' \
| python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["master_public_key"],d["currency"],len(d.get("denominations",[])))'
# TW6K5… GOA 27
```
| Piece | Live | Lab vanilla@local |
|-------|------|-------------------|
| Merchant | :9010 | **active** · instance `default` |
| Exchange | :9011 | **active** · master TW6K5 · 27 denoms |
| Bank | :9012 | libeufin-bank OK |
| MASTER | TW6K5… | sha256 match enc `current/exchange-offline/master.priv` |
Playbook: `ok=92 changed=20 failed=0` after `/etc/hosts` pin (bank.goa.local NXDOMAIN once).
## Lab hosts (ephemeral)
Container recreate drops hosts. Re-pin:
```bash
cd $HOME/git/admin-logs/local/koopa-admin-log/configs/lab-local
ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
# unsafe_writes — /etc/hosts EBUSY on atomic rename inside podman
```
## Merchant token (lab)
SoT: `koopa-admin-secrets-enc/backups/goa/lab-local/merchant/secrets/merchant-default-access-token`
passwd = PLAIN; Bearer = file value as-is (`secret-token:…`). `/instances/default/private/products` **200**.
`/config` `"currency":"CHF"` = tip dual-merchant; GOA under `currencies.GOA`.
## t2 — wire + order + withdraw + pay (lab) **done**
Bank acct `lab-merchant` via `libeufin-bank create-account`; secrets under `…/lab-local/merchant/secrets/`. Wire `x-taler-bank`.
```bash
# POST /instances/default/private/accounts → 200 salt/h_wire
# POST orders GOA:1 → 200 unpaid
# create-token labwallet; POST withdrawals; wallet-cli withdraw; POST confirm → 204
# handle-uri --yes "$taler_pay_uri"
```
| | |
|--|--|
| WID | `1eab9b0d-a3a8-41a8-b070-d7645b25ab25` |
| withdraw | `txn:withdrawal:2EBFWF7GK415A151KP56MWCVK2CYMDHMR55Q9BG11VT6NR55YC80` final |
| pay | `txn:payment:D4H75B5YDNJ52G8T6ADBDCXVWXCVZBG5HVSGE7G4S0XBQ6K8H3Y0` done |
| order | `2026.257-6E75WGDBR32M4` **paid** |
| wallet | GOA:9 (GOA:10 − GOA:1); CLI 1.6.43 **inside** `goa-regio-ng` |
## Zielbild
Ansible = SoT. Zwei Formen, gleiche Playbooks: **Full-stack Podman** · **Recreate-Fabrik**.
Branch: **master = stage**; anderer = **prod**. Kein `STAGE_ENV`.
**Reihenfolge:** **1 GOA** → **2 FP/Stage** (zwei Stacks) → **3 mytops-***. Merchant-Probleme → mytops vorziehen.
Gate: elelmon moderate → purse/withdraw → lab harden → Live-Merchant cutover nur wenn 1–3 grün → restore-back. Greenfield `*.2.*` PARK.
## APPLY 20260915T0013Z
BACKUP+APT+COMMIT OK. APPLY_SMOKE_FAIL was `sm=$(smoke)` capture; driver now `if smoke; then` → **APPLY_OK**. Smoke endpoints 200. Live bank/exchange/merchant Up; lab `goa-regio-ng` Up. Images retagged `:live` / `:landing`.
## Arbeit 1 — live confirm overflow (2026-09-16) **FAIL**
Smoke: `$HOME/git/llm/llm-work-input/goa-confirm-smoke.sh` (fresh scratch wallet; WCLI `$HOME/.local/bin/taler-wallet-cli.mjs`).
| | |
|--|--|
| user | `cfm18923` 2026-09-16T00:35:23Z |
| max_debt | acct#1=1e12 · **#2=1e8** · #3=1e12 |
| credit | GOA:4798.5 **200** |
| TOS | `exchanges add` + `update` + `accept-tos` **OK** |
| GOA:20 WID | `062e3112-e235-4fea-95d1-644773100224` |
| create | body `amount` + `exchange_url` → **200** |
| force-select | rpub + epayto from `/keys` → **200** `selected` |
| confirm | POST `/accounts/{user}/withdrawals/{wid}/confirm` → **500** code **5110** P0001 `amount value overflowed` |
| GOA:4200 | same scratch rpub → **409** code **5114** Reserve pub already used (script; skip until GOA:20 green) |
`CONFIRM_SMOKE_FAIL`. Select+TOS+RPUB green for GOA:20; overflow still at confirm. Next: dump `make_incoming` / `bank_wire_transfer` for that WID; lower remaining 1e12 if dump confirms.
## Pointers
| | |
|--|--|
| inventory | `configs/lab-local/goa-regio-ng-koopa.yml` |
| lab hosts | `configs/lab-local/lab-hosts.yml` |
| Lab README | `configs/lab-local/README.md` |
| backup daylog | `2026/2026-09-04--goa-backup-regio-ng.md` |
| APPLY driver | `scripts/taler-shared/goa-live-backup-upgrade.sh` |
| dumps | koopa `~/backups/goa/current` → `20260904T1238Z` |
| Caddy | taler→9010 · exchange→9011 · bank→9012 |
Leave-off: t1+t2 lab green. Live confirm **5110**. No Live-Stop / no Caddy.

39
2026/2026-09-18--amanita-external-probe.md
View file

@ -1,39 +0,0 @@
# 2026-09-18 — koopa as external amanita probe logger
## Why
Amanita hard hangs leave no panic; internal heartbeat stops with the box.
External ICMP+SSH from **koopa** records last-alive independently so hang vs
power/PSU can be separated after the next freeze.
## Live (hernani@koopa)
| Piece | Detail |
|-------|--------|
| Key | `~/.ssh/id_ed25519_amanita_probe` — fingerprint `SHA256:R2i2nZfI1svR6Ts3DaSw5eZj2fvnGgm1R9PoMFS4Jj0` |
| SSH Host | `amanita-probe` → `vx@192.168.100.6`, IdentityFile that key only |
| Script | `~/.local/bin/koopa-amanita-probe` (SoT: `scripts/amanita-probe/`) |
| Timer | user `koopa-amanita-probe.timer` ~15 s, linger yes |
| Log | `~/.local/state/amanita-probe/amanita-probe.{log,last,meta}` — owned by hernani, mode 644 |
## amanita vx (only)
Restricted `authorized_keys` line (not on root):
```text
from="192.168.100.95",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,command="/bin/cat /var/lib/amanita/heartbeat.last" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeMenvp0D9EarfAEUtu49Q7bCbGhw+R/E1nJPQSSmZc koopa-amanita-probe@hernani-koopa
```
Forced command only cats the world-readable HB mirror. No shell, no agent/X11/port forward.
## Verify (2026-09-18 ~15:09 CEST)
- `systemctl --user is-active koopa-amanita-probe.timer` → active
- `ssh amanita-probe` → EXIT 0, one HB line
- meta: `icmp=ok ssh=ok gap_s≈15`
- hernani can read the probe log dir on koopa (owner)
## Docs / install
`scripts/amanita-probe/README.md` + `install-amanita-probe.sh`.
Do **not** put this key on root AK; do **not** bare `modprobe ramoops`.

46
2026/2026-09-19--goa-regio-ng-login-health+monitoring.md
View file

@ -1,46 +0,0 @@
# 2026-09-19 — GOA single-CTR: login-health + monitoring
## Why
`koopa-login-health` FAIL×3 on dead `taler-hacktivism*` + WARN `koopa-tor-relay`.
Live stack is **`goa-regio-ng`** (pasta 9010–9015) + host **`tor.service`** (ORPort 8080).
## Live SoT (hernani@koopa)
| Piece | Detail |
|-------|--------|
| GOA CTR | `goa-regio-ng` — image `localhost/goa-regio-ng:empty-current` |
| Scripts | `~/scripts/taler-shared/goa-regio-ng/` · `goa-all-in-one.sh` |
| Bak | `~/backups/goa/current` |
| Landings | host `/var/www/*-landing/` + `~/goa-landing-deploy` · Caddy outside CTR |
| Tor | host `tor.service` — **not** container `koopa-tor-relay` |
| Forgejo | `:9024/:9200` · edge Caddy `:9000/:9001` |
## Repo changes (magikoopa, no push yet)
**koopa-admin-log**
- `scripts/login-health/`: CRITICAL/EXPECT → `goa-regio-ng` (+ forgejo); drop legacy + tor-relay; host `tor.service` check; probes 9010–9012
- delete `host/overview/{LIVE,services}.*` · delete `configs/tor/*`
- rewrite `host/tor/README.md` · shorten README / ports / koopa-setup / login-health README
- ISSUES I-07 → host Tor SoT
**elelmon + taler-monitoring** (EQ scripts mirrored)
- BANK=EX=MER=`goa-regio-ng`; drop nginx-in-bank; host stats.json fallback
- `check_{server,inside,urls,versions,e2e,sanity}.sh` · `metrics.sh` · `lib.sh` · docs
## Verify (after deploy on koopa — Freigabe)
```bash
koopa-login-health show -v
# expect: goa-regio-ng OK · no taler-hacktivism* · tor.service OK|WARN
```
STATE dir name `taler-hacktivism-monitoring` kept (host-agent path, not CTR).
## Follow-up (same day) — elelmon-only SoT
- Forgejo `hernani/taler-monitoring` **archived**; push fails. Do not maintain twin.
- Parity leftover (mail-deliverability) → **elelmon** only (`check_mail_deliverability.sh`,
`mail_deliv_probe.py`, host-agent timer, wrapper phase `mail-deliverability|maildeliv`).
- Canonical clone/install path: `~/src/elelmon` — see `scripts/taler-monitoring/README.md`.
- Modular Python rewrite scaffold under elelmon package `elelmon/` (not flat TM `check_*.sh` layout).

32
2026/2026-09-23--goa-merchant-terms-privacy+mon.md
View file

@ -1,32 +0,0 @@
# 2026-09-23 — GOA merchant /terms+/privacy + mon green
## Why
Public merchant `taler.hacktivism.ch` lacked `/terms` + `/privacy` (501).
elelmon still assumed legacy multi-CTR `taler-hacktivism*`; live SoT is single
CTR **`goa-regio-ng`** (pasta 9010–9015).
## Live (hernani@koopa)
| Piece | Detail |
|-------|--------|
| CTR | `goa-regio-ng` · BANK=EX=MER same |
| Terms | `TERMS_ETAG=merchant-tos-dual-v2` · en under `/var/lib/taler-merchant/terms/` |
| Privacy | `PRIVACY_ETAG=merchant-pp-swiss-v0` |
| Drop-in | `/etc/taler-merchant/conf.d/terms-privacy.conf` · httpd restart |
| Public | `https://taler.hacktivism.ch/{terms,privacy}` → **200** |
| Mon stamp | `20260923T075931Z` · LOG `~/.local/state/elelmon-runs/hacktivism-full-….log` |
| Mon result | EXIT=0 · 182 OK · 0 ERROR · 21 WARN · 21 INFO |
| Public mon | staging → `/var/www/monitoring-sites/{host}/monitoring/` |
## Repo SoT (magikoopa)
**koopa-admin-log** — profile/scripts already had ETAGs + install helpers;
runtime apply on CTR today. Caddyfile dossiers `try_files` → `{path} {path}/ {path}/index.html`
(separate commit).
**elelmon** — laptop tip goa-aware (clean); koopa WT may still need SSH pull.
## Hold
Cutover locked. No `taler-deployment` master push. Next: T3 vanilla Ansible lokal → T2 APT (Freigabe).

39
2026/2026-09-25--qbittorrent-bt-net.md
View file

@ -1,39 +0,0 @@
# 2026-09-25 — qBittorrent BT net (flame / firewalled)
## Goal
Inbound BT listen **6881** tcp+udp reachable so WebUI connection status leaves the firewalled (flame) state.
## Live on koopa
- CTR `koopa-prime-qbittorrent` (linuxserver): host **6881** tcp+udp, WebUI **9023**→8080 → `bt.hacktivism.ch`
- Conf: `Session\Port=6881`, `PortForwardingEnabled=true`, `Connection\UPnP=true`
- Temp: `/downloads/incomplete/` (abc / host uid 100999)
- Durable apply: `scripts/prime/apply-qbittorrent-bt-net.sh` (+ wrapper `koopa-bt-fix.sh`)
- Clone on host: `~/koopa-admin-log/scripts/prime/`
## firewalld
- Doc: `configs/firewalld/public-ports.md` — **6881/tcp+udp**
- Agent cannot list without sudo/polkit; human opens with:
```bash
sudo firewall-cmd --permanent --add-port=6881/tcp
sudo firewall-cmd --permanent --add-port=6881/udp
sudo firewall-cmd --reload
```
- WAN probe success (below) implies the path through host firewall is open.
## VeciGate (2026-09-25)
- wan `dstnat` tcp+udp **6881** → `192.168.100.95:6881`
- hairpin LAN `192.168.100.0/24` and LAN2 `192.168.88.0/24` → `212.51.151.254:6881` tcp+udp
- Comments: `koopa: qBittorrent BT …` / `hairpin: LAN[2] qBittorrent BT …`
- Detail: vecigate-admin-log `2026/2026-09-25--qbittorrent-bt-dnat.md`
## Verify (2026-09-25, from magikoopa)
| Probe | Result |
|-------|--------|
| `nc -vz 192.168.100.95 6881` | LAN_TCP_OK |
| `nc -vz 212.51.151.254 6881` | WAN_TCP_OK |
| `nc -zu 212.51.151.254 6881` | WAN_UDP_OK |
WebUI API (`/api/v2/…`) still auth-gated from agent — human glance at connection icon on `bt.hacktivism.ch`.
## Freigabe
Session Freigabe covered podman conf/restart + VeciGate NAT. No git push of admin-log unless asked.

51
2026/2026-09-28--tech-dossier-freeze-cascade.md
View file

@ -1,51 +0,0 @@
# tech-dossier Freeze cascade — 2026-09-28
Repo: `$HOME/git/src/ngi/tech-dossier-project-data`
Ladder (each tip autonomously `make html`; each depends on the previous):
| # | Branch | Tip | Local serve | Live ht root |
|---|--------|-----|-------------|--------------|
| 1 | `main` | `d2fbd79` | http://127.0.0.1:8101/ | — |
| 2 | `feat/sm-content` | `089ef1f` | http://127.0.0.1:8102/ | `dossiers.3.ngi.hacktivism.ch` (optional) |
| 3 | `feat/website-features` | `53a3176` | http://127.0.0.1:8103/ | `dossiers.2.ngi.hacktivism.ch` (optional) |
| 4 | `feat/website-design` | `2e26c80` | http://127.0.0.1:8104/ | — (no public host after views deploy) |
| 5 | `feat/website-views` | `bbafc38` (origin tip; local soft-reset dropped bad `1b2fcf7`/`7aca0e8`) | http://127.0.0.1:8105/ | path roots under blank landing (see Live) |
Caddy roots (SoT `scripts/caddy/Caddyfile.koopa-live-wdGet`):
- `/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch`
- `/var/www/monitoring-sites/dossiers.2.ngi.hacktivism.ch`
- `/var/www/monitoring-sites/dossiers.3.ngi.hacktivism.ch`
basic_auth: `scripts/caddy/apply-dossiers-ngi-basicauth.sh`
## Local cascade links
- [main](http://127.0.0.1:8101/)
- [feat/sm-content](http://127.0.0.1:8102/)
- [feat/website-features](http://127.0.0.1:8103/)
- [feat/website-design](http://127.0.0.1:8104/)
- [feat/website-views](http://127.0.0.1:8105/)
## Live
- [dossiers.ngi](https://dossiers.ngi.hacktivism.ch/) ← **blank cascade landing** (kal `sites/dossiers.ngi.hacktivism.ch/`; EN + ASCII ladder; views tip cite `bbafc38`)
- Path editions: `/main/`, `/feat-sm-content/`, `/feat-website-features/`, `/feat-website-design/`, `/feat-website-views/`
- Hourly branch-status builder: **kal** `scripts/dossiers-ngi/branch-status-hourly.py` → `sites/…/branch-status.json` (+ user timer); **not** inside tdpd
- tdpd `feat/website-views` local HEAD = origin = `bbafc38` (NO_PUSH; bad tips discarded locally)
- [dossiers.2.ngi](https://dossiers.2.ngi.hacktivism.ch/) ← website-features (optional)
- [dossiers.3.ngi](https://dossiers.3.ngi.hacktivism.ch/) ← sm-content (optional)
## Deploy (Freigabe 2026-09-28 design; Freigabe 2026-09-29 views; Freigabe blank landing same day)
Earlier primary: rsync `website/build/` from tip `feat/website-views` →
`hernani@koopa:/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/`
(`--delete`, exclude `.DS_Store`).
**Result 2026-09-28 ~22:25+02 (design @ `2e26c80`):** `RSYNC_OK` — ~2698 files / ~27M; live `dossier/sm/index.html` 41693 bytes.
**Result 2026-09-29 ~04:30+02 (views-era freeze):** `RSYNC_OK` — live `/` HTTP 200. Local tdpd later briefly carried wrong tips `1b2fcf7` → `7aca0e8` (ladder rewrite + hourly in tdpd); those were **dropped** locally back to `bbafc38` (TODO=430). Never push those tips.
**Result 2026-09-29 (blank landing kal @ `56ee97a`):** `RSYNC_OK` — live `/` HTTP 200 SIZE=3505 title `cascade landing`; path-root editions owned by koopa-admin-log `sites/dossiers.ngi.hacktivism.ch/`; NO_PUSH.
**TODO=430 follow-up (local, NO_PUSH):** kal landing EN/ASCII + tip cite `bbafc38`; hourly builder + systemd under kal; daylog tip table corrected. Deploy landing / enable timer on koopa needs Freigabe.

57
2026/2026-10-20--forgejo-host-ro-users.md
View file

@ -1,57 +0,0 @@
# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)
Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).
## Users
| Username | ID | Email | Flags |
|----------|----|-------|-------|
| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |
## Repo access
- Collaborator **read** on `hernani/waldpfad` (all three).
- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.
## Secrets (enc only)
Laptop SoT (git-crypt):
`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`
Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.
## Create recipe (idempotent)
On koopa as `hernani`, Forgejo HTTP **9024**:
```bash
podman exec koopa-forgejo gitea admin user create \
--username USER --email USER@hosts.hacktivism.ch \
--random-password --must-change-password=false --restricted
```
SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:
- `POST /admin/users/USER/keys` with `{"title","key"}`
- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`
Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.
## Clone pattern (on target host)
```bash
GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
git clone --depth 1 --single-branch --branch master \
ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
```
Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).
## Related
- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`

13
2026/2026-10-21--castopod-php-stay-off.md
View file

@ -1,13 +0,0 @@
# Castopod stays off
Rechecked 2026-10-21 after the stop note. Web unit container-koopa-castopod.service is disabled, inactive, dead. Container koopa-castopod is exited, finished 2026-10-21 22:48:06 +0200. Nothing listens on :9020. MariaDB and Redis user units stay loaded and active. No second stop. Caddy vhost unchanged.
Log review found no sign of a successful remote code execution. Overlay file /tmp/fw-cp.php (1448 bytes, mode 600, sha256 7bb279bffa12dbb81787183108a2641b78a6657b069cbef7967950d80e13b5bc, mtime 2026-09-07 03:25:59 +0200) is a local database script for cp_users, outside the docroot, not a web shell. /tmp/os-dry.out is an apt dry-run. Five theme files differ by one branding line from 2026-07-13. Media volume has no scripts. Access logs run 2026-10-17 through the stop and show no 2xx on a non-index script. Critical lines on 2026-09-07 match other days.
Limits: access logs start 2026-10-17, so HTTP from 2026-09-07 is absent. A memory-only or already rotated request is not ruled out. Whether the local script ran is not in the logs. MariaDB was not opened.
Stays down until an image ships PHP newer than 8.4.18. Hub tag :1 from 2026-02-24 is not that image. Parent 537, slug castopod-restart-after-php-fix.
Restore only then:
systemctl --user enable --now container-koopa-castopod.service

23
2026/2026-10-21--castopod-php-stop.md
View file

@ -1,23 +0,0 @@
# Castopod PHP stopped
Checked 2026-10-21. Host has no php-fpm and no php package. The only PHP process was Castopod FrankenPHP in container koopa-castopod.
| Item | Value |
|------|--------|
| image | docker.io/castopod/castopod:1 |
| repo digest | sha256:4e4f0440520f45257bfeac7be4347defd20048b4efef8f53d73ec9ed3a4f7966 |
| amd64 digest | sha256:757f3c2a96b31b81753c23bc092dfcf05039d9df4d13cc12c428bb752fce882b |
| image created | 2026-02-24 |
| hub tags 1 / latest / 1.15.5 | same digest, pushed 2026-02-24 |
| PHP | 8.4.18 (12 Feb 2026) |
| FrankenPHP | v2.10.2 |
| listen | 0.0.0.0:9020 -> 8080 |
| public | https://castopod.hacktivism.ch/ |
Stable Hub tags have not moved since 2026-02-24. develop last push 2026-06-05 and is not a stable security update. php.net lists 8.4.26 (24 Sep 2026) and 8.4.27 (22 Oct 2026) after 8.4.18, with a banner to update for critical remote code execution. Pulling :1 repeats the same image. FrankenPHP ships its own PHP binary.
Stopped and disabled user unit container-koopa-castopod.service. ExecStop is `podman stop -t 30 koopa-castopod`. Container status after stop: Exited (0). :9020 not listening. MariaDB and Redis units left running. Caddy vhost unchanged.
Bring the web container back only when a newer image exists:
systemctl --user enable --now container-koopa-castopod.service

41
2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
View file

@ -1,41 +0,0 @@
# TODO=704 Tor CachyOS CTR + CookieAuth (koopa)
Relay was down (stale PIDFile / start-timeout on forking unit), keys intact. Recreated **same identity** on CachyOS container; CookieAuth for ControlPort; host tor disabled.
## Stand after APPLY (2026-10-24 ~21:47–21:51 Europe/Zurich)
| Item | Value |
|------|--------|
| CTR | `koopa-tor-relay` Up, image `localhost/koopa-tor-relay:latest` (=`:cachyos`) |
| Tor | 0.4.9.14 (CachyOS/Arch extra) |
| Unit | `container-koopa-tor-relay.service` Type=simple, active |
| Host tor | `tor.service` disabled + failed/inactive |
| FP | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` (keys mtime 2024-11-14) |
| ORPort | 8080 |
| ControlPort | 127.0.0.1:9051 CookieAuthentication=1, CookieAuthFile=/var/lib/tor/control_auth_cookie |
| Bootstrap | PROGRESS=100 done; status/circuit-established=1 |
| Unauth ControlPort | 514 Authentication required |
| Cookie AUTH | 250 OK |
## Steps
1. Dry-run `/tmp/tor.sh` on koopa → STATUS=dry-run-ok; NEXT=`sudo APPLY=1 /tmp/tor.sh` (host tor was still enabled).
2. Human: `systemctl disable --now tor.service`, then `sudo APPLY=1 /tmp/tor.sh`.
3. APPLY: wrote CachyOS Containerfile, pulled `docker.io/cachyos/cachyos:latest`, build (cache hit), `podman create --replace --network host --user 1000:1000 --userns keep-id`, torrc bak `torrc.bak-cookie-20261024-214720`, CookieAuth on.
4. First APPLY hit dbus fail under sudo (`$DBUS_SESSION_BUS_ADDRESS` / `$XDG_RUNTIME_DIR` unset). Unit rewrite + enable finished with XDG/DBUS set; script path re-exec as SUDO_USER for later runs.
5. Verify from magikoopa SSH: unit active, CTR Up, FP match, circuit-established=1, unauth 514.
## Live paths
- `~/koopa-tor-relay/{torrc,data,log,build/Containerfile}`
- `~/.config/systemd/user/container-koopa-tor-relay.service`
- Driver: `/tmp/tor.sh` (TARGET=koopa); upgrade later: `~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay`
## Akte mirrors
- `configs/tor/torrc`
- `configs/tor/build/Containerfile`
- `configs/systemd/user/container-koopa-tor-relay.service`
- `host/tor/README.md` updated (was stale host `tor.service`)
Sibling: firecuda brew tor CookieAuth same day (FP `52BB94DDC1292F950CF728708AC48523E018A718`, MyFamily both ways). Parent TODO=704.

5
AGENTS.md
View file

@ -1,5 +0,0 @@
# AGENTS.md
Session Must / Must not: `$HOME/.grok/AGENTS.md` only — do not duplicate.
**Sync (must-sync trees / wenn Git allein nicht reicht):** siehe [SYNC.md](SYNC.md).

24
ISSUES.md
View file

@ -12,7 +12,7 @@ Stand **2026-07-18** (koopa, live). Keine Secrets.
| [I-04](#i-2026-07-16-04) | low | open | Stray `kind_taussig` | | [I-04](#i-2026-07-16-04) | low | open | Stray `kind_taussig` |
| [I-05](#i-2026-07-16-05) | low | open | Alte exited Podman-Container | | [I-05](#i-2026-07-16-05) | low | open | Alte exited Podman-Container |
| [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` | | [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` |
| [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor = host `tor.service` (not container) | | [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` |
| [I-08](#i-2026-07-17-08) | medium | open | Landing-stats → standalone `taler-landing-stats` | | [I-08](#i-2026-07-17-08) | medium | open | Landing-stats → standalone `taler-landing-stats` |
| [I-09](#i-2026-07-18-09) | high | open | Monitoring-HTML öffentlich: Caddy/www (code 21) | | [I-09](#i-2026-07-18-09) | high | open | Monitoring-HTML öffentlich: Caddy/www (code 21) |
@ -36,7 +36,7 @@ sudo ~/koopa-caddy/apply-monitoring-live.sh
``` ```
Details: `2026/2026-07-18--monitoring-public-caddy.md` Details: `2026/2026-07-18--monitoring-public-caddy.md`
Suite: https://git.hacktivism.ch/hernani/elelmon (`taler-monitoring.sh`; archived twin not SoT) Suite: https://git.hacktivism.ch/hernani/taler-monitoring (v1.7.1+)
### I-2026-07-16-01 ### I-2026-07-16-01
@ -134,18 +134,24 @@ Hinweis: `nym-node` startet intern mit `--http-bind-address [::]:8080` (Containe
### I-2026-07-16-07 ### I-2026-07-16-07
**Tor = host `tor.service` (ORPort 8080)** **`koopa-tor-relay` vs host `tor.service` (Port-Clash)**
Severity: medium · Host: koopa · Status: **fixed** (SoT 2026-09) Severity: medium · Host: koopa · Status: **fixed** 2026-07-16
**Live:** host **`tor.service`** · ORPort **8080** · ControlPort **9051** · non-exit. **War:** Nach Reboot crash-loopte `koopa-tor-relay` — Host-`tor.service` hielt **8080**/**9051**.
Legacy CTR `koopa-tor-relay` / `configs/tor/` removed from inventory (git history keeps them). **Soll:** nur Container (`KoopaRelay`, ORPort **8080**, VeciGate WAN→koopa:8080).
**Fix:** Host-Tor gestoppt/disabled; ggf. hängenden Prozess gekillt; User-Unit:
```bash ```bash
systemctl status tor sudo systemctl disable --now tor
sudo systemctl mask tor # optional
systemctl --user enable --now container-koopa-tor-relay.service
ss -lntp | grep -E '8080|9051' ss -lntp | grep -E '8080|9051'
# login-health: WARN if tor.service not active podman ps --filter name=koopa-tor-relay
``` ```
**Live (nach Fix):** Host-`tor` inactive/disabled; `koopa-tor-relay` Up; 8080 + 127.0.0.1:9051 vom Relay-Prozess.
--- ---
### I-2026-07-17-08 ### I-2026-07-17-08
@ -171,4 +177,4 @@ Severity: medium · Host: koopa · Status: open · **TODO (noch nicht umsetzen a
- Prod-Container mit Boot-Autostart: Up - Prod-Container mit Boot-Autostart: Up
- Taler-Ports 9010–9015 antworten (401/302 OK) - Taler-Ports 9010–9015 antworten (401/302 OK)
- Linger=yes, container-*-Units enabled - Linger=yes, container-*-Units enabled
- Tor-OR: host `tor.service` (I-07) - Tor-OR: Container-Pfad (I-07 fixed)

78
README.md
View file

@ -8,7 +8,8 @@ Ops log and config mirror for host **koopa** (openSUSE Tumbleweed).
## FIND / setup entry ## FIND / setup entry
Plain file **`koopa-setup`** — lab + host pointers (goa-regio-ng, ports, daylogs). Start there. Plain file **`koopa-setup`** — lab + host pointers (mytops-local, regio-ng,
ports, daylogs). Start there before hunting under `configs/` / `2026/`.
## Open issues ## Open issues
@ -27,32 +28,69 @@ Hosted on **Forgejo rootless** (this host). See `2026/2026-07-10--admin-log-orig
## Layout ## Layout
``` ```
koopa-setup # FIND: lab/host setup pointers host/ # openSUSE host-level config + overview
host/ # openSUSE host-level (caddy, tor, systemd, …) overview/services.md # graphical service map
configs/ # mirrored app configs (caddy, forgejo, …) systemd/ firewalld/ caddy/ network/
scripts/ # login-health, GOA helpers, … configs/ # mirrored app configs (caddy, taler, forgejo, …)
login-health/ # SSH login snapshot taler-hacktivism/ # merchant container taler-hacktivism
taler-shared/goa-regio-ng/ # live GOA SoT taler-hacktivism-bank/ # bank container (image …-banking)
taler-exchange/ # exchange conf (inside ansible container)
taler-exchange-ansible/ # container taler-hacktivism-exchange-ansible
forgejo/ # rootless git.hacktivism.ch
castopod/ bonfire/ lemmy/ prime/ # compose mirrors (no secret values)
tops/ # koopa-tops-ng1…ng3 + autostart unit
tor/ # KoopaRelay ORPort 8080
scripts/ # merchant, exchange, monitoring helpers
taler-merchant/ # merchant-model start scripts
taler-exchange/ # same model; archive/ = greenfield bootstrap
2026/ # day logs + dated topic notes 2026/ # day logs + dated topic notes
``` ```
## Live GOA + public stack ## Live containers (podman)
| Name | Role | Host ports | **Authoritative snapshot of host koopa:** [`host/overview/LIVE.md`](host/overview/LIVE.md) (refreshed from live).
|------|------|------------|
| **`goa-regio-ng`** | bank + exchange + merchant (one CTR, pasta) | **9010–9012** APIs · **9013–9015** landings (host nginx) | | Name (podman) | Role | Host port |
|---------------|------|-----------|
| `taler-hacktivism` | merchant | **9010** (+ landing **9015**) |
| **`taler-hacktivism-exchange-ansible`** | exchange (Ansible/systemd) | **9011** (+ landing **9014**) |
| `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) |
| `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** |
| `koopa-bonfire` (+ postgres) | Bonfire | **9021** |
| `koopa-lemmy-proxy` (+ lemmy/ui/pictrs/db) | Lemmy | **9026** |
| `koopa-prime-jellyfin` | Jellyfin | **9022** |
| `koopa-prime-qbittorrent` | qBittorrent | **9023** |
| `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** | | `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** |
| `koopa-castopod` / bonfire / lemmy / decidim / … | optional apps | **9020+** | | `koopa-tops-ng1` … `ng3` | static nginx | **9090**–**9092** |
| `koopa-tops-ng1`…`ng3` | static nginx | **9090–9092** |
| host **`tor.service`** | Tor relay | ORPort **8080** · ControlPort **9051** |
Start GOA: `scripts/taler-shared/goa-regio-ng/` · bak `~/backups/goa/current` · landings `~/goa-landing-deploy`. Start model (Taler merchant/bank): **root** `start_base_services_*` → `/usr/local/bin/start_*.sh`.
Edge: Caddy **9000/9001** → 127.0.0.1 backends. Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh` + `deploy-hacktivism-goa.sh`.
Login snapshot: `scripts/login-health/` (`koopa-login-health`). Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.
Start model (tops): user unit `container-koopa-tops.service` (linger).
Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `lemmy.` / `tops.ng1`–`ng3`.hacktivism.ch
(Caddy → 9010–9015 / 9020–**9026** / **9090–9092**; git-SSH host **9200** direct).
Service **details**: `configs/taler-hacktivism*`, `configs/taler-exchange*`, `configs/forgejo/`, `configs/tops/`, `scripts/*`.
Host-wide picture: **`host/overview/services.md`**.
Port table: **`configs/ports.md`**. Port table: **`configs/ports.md`**.
Tor: **`host/tor/README.md`**.
Router: **`../vecigate-admin-log`**. Router: **`../vecigate-admin-log`**.
**Benchmarks:** `benchmarks/` **Benchmarks** (drive from the local machine, measure on koopa): **`benchmarks/`**
**Forgejo:** `2026/2026-07-10--forgejo-rootless.md` → https://git.hacktivism.ch/ → amount ladder: `benchmarks/amount-ladder/`.
**Exchange snapshot/restore (GOA, local images only):**
→ `2026/2026-07-09--exchange-snapshot-and-restore.md`
**Exchange `/keys` + Wire + bank account (diagram):**
`configs/taler-exchange/README.md` (section “/keys, Wire and Account”).
**Castopod (stack/accounts/boot — not podcast content):**
`2026/2026-07-09--castopod-content.md` → https://castopod.hacktivism.ch/
**Bonfire FEDERATE + guest public (2026-07-10):**
`2026/2026-07-10--bonfire-federate.md` → https://bonfire.hacktivism.ch/
(ground zero: `2026/2026-07-09--bonfire-ground-zero.md`)
**Forgejo rootless (git.hacktivism.ch, no free registration, SSH :9200):**
`2026/2026-07-10--forgejo-rootless.md` → https://git.hacktivism.ch/

8
SECRETS.md
View file

@ -1,12 +1,12 @@
# Secrets — not stored in this repo # Secrets — not stored in this repo
Live passwords/keys live in sibling **`koopa-admin-secrets-enc-enc`**. Live passwords/keys live in sibling **`koopa-admin-secrets`**.
## Map ## Map
### Taler — host `/root` ### Taler — host `/root`
| What | Mirror (`koopa-admin-secrets-enc/…`) | Live | | What | Mirror (`koopa-admin-secrets/…`) | Live |
|------|----------------------------------|------| |------|----------------------------------|------|
| Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` | | Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
| Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` | | Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
@ -28,8 +28,8 @@ Live passwords/keys live in sibling **`koopa-admin-secrets-enc-enc`**.
## Rules ## Rules
- **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material. - **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
- Pull/deploy: `koopa-admin-secrets-enc/scripts/{pull,deploy}-from-koopa.sh` - Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
- Full inventory: `koopa-admin-secrets-enc/MAP.md` - Full inventory: `koopa-admin-secrets/MAP.md`
## Public (OK here) ## Public (OK here)

146
SYNC.md
View file

@ -1,146 +0,0 @@
# SYNC.md — must-sync (pull.sh / push.sh)
**SoT:** Git tip auf ht/Forgejo (`hernani/*`), nicht grok-all-Pack, nicht ASC-only.
**Dieses Set:** Profile `grok` + `llm` (=`combo`) + `hernani`.
**Nicht in diesem Set:** `taler` / `admin-logs/taler/` (eigenes Profil).
**Parties (local crossover):** magikoopa · clementine · koopatroopa (plus weitere Hosts unter `admin-logs/local/`).
**Meta-Skripte:** `$HOME/git/pull.sh` · `$HOME/git/push.sh` · `$HOME/git/profiles/*.repos`
Agents sollen diese Bäume **laufend** auf dem gleichen Tip halten (pull oft; push nur mit Freigabe).
---
## 1. Schnell: was Agents tun
| Wann | Aktion | Freigabe? |
|------|--------|-----------|
| Session-Start / Host-Wechsel / „sync“ | `$HOME/git/pull.sh grok llm hernani` | nein (read/ff) |
| Repo fehlt auf Disk | gleiches `pull.sh` (cloned + unlock) | nein |
| Nur Status / Dry-Run | `$HOME/git/pull.sh --list grok llm hernani` bzw. `--dry-run …` | nein |
| Commits hoch | `$HOME/git/push.sh grok llm hernani` (oder `--dry-run`) | **ja** Push-Freigabe |
| Dirty tree committen | `/g` bzw. git-worker — **kein** Push aus Worker | Commit-Freigabe ≠ Push |
`combo` ≡ `llm` (Alias). Nie `$HOME/git/dot-grok-enc` anlegen — Live-SoT ist flat `$HOME/.grok`.
---
## 2. Wenn Git allein nicht reicht
Reines `git pull` / `git clone` reicht oft **nicht**, weil: Profile-DEST, git-crypt, ff-only-Policy, ACCESS_DENIED, retired grok-all.
### A) Clone / Update über Profile (bevorzugt)
```bash
$HOME/git/pull.sh grok llm hernani
# optional:
$HOME/git/pull.sh --dry-run grok llm hernani
$HOME/git/pull.sh --list grok llm hernani # zeigt u.a. ACCESS_DENIED
```
- Existierendes Repo: fetch + **ff-only** pull (kein stilles Merge).
- `--force`: fetch + `reset --hard` auf Remote (tracked überschreiben; untracked bleiben). **Nur mit Absicht / Freigabe**, nie blind auf dirty Work.
- Kein `.git`: init + fetch + reset, dann Unlock.
### B) git-crypt (*-enc und `$HOME/.grok`)
Nach erfolgreichem Git-Stand kann der Tree noch **Ciphertext** sein:
```bash
cd "$DEST" && git-crypt unlock
# oder: git-crypt status -e # noch encrypted?
```
| Symptom | Ursache | Fix |
|---------|---------|-----|
| Dateien sind Blob/binär / `git-crypt status` zeigt encrypted | Key fehlt / nie unlocked | `git-crypt unlock` mit GPG-Key der Collaborators |
| Unlock schlägt fehl, Tree dirty | Unlock überspringt dirty+already-unlocked Policy in pull.sh | erst commit/stash/clean klären, dann unlock |
| Agent liest Müll / leere Secrets | Unlock vergessen | unlock, dann erneut lesen — nicht raten |
| „Permission denied“ SSH ht | Key/ACL | SSH-Agent laden; ACL auf Forgejo — nicht Pfade erfinden |
### C) Push / Divergenz
```bash
$HOME/git/push.sh --dry-run grok llm hernani
$HOME/git/push.sh grok llm hernani # nur mit Freigabe
```
| Farbe/Lage (push.sh) | Bedeutung | Agent |
|----------------------|-----------|-------|
| GREEN | synced / push ok | weiter |
| YELLOW | behind / mergeable | erst `pull.sh` (ff); diverged → Human |
| RED | conflict / diverged hard | **HALT** — kein force ohne Freigabe |
| INFO blue | Repo fehlt auf Disk | `pull.sh` clone |
### D) Explizit verboten / retired
- **grok-all / pack-push / passphrase-Pack** — retired. `magikoopa-unlock-enc.sh unlock` → exit 2.
- ASC-Board (`SYNC-TODO.md.asc`) optional; Sync läuft über Git-Tip + diese SYNC.md.
- `taler`-Profile hier **nicht** mitziehen (außer Human sagt explizit taler).
- Keine Secrets in Klartext-Chat; *enc nur nach unlock lesen.
---
## 3. DEST-Übersicht (dieses Set)
### Profile `grok`
| DEST | Remote (kurz) |
|------|----------------|
| `$HOME/.grok` | `hernani/dot-grok-enc` |
| `$HOME/git/src/_hernani-private/grokd` | `hernani/grokd` |
### Profile `llm` (= `combo`)
Alles unter `$HOME/git/llm/…` laut `profiles/llm.repos` (configs, knowledge-mirror, work-*-enc, input, control-data-enc, work-logs).
### Profile `hernani` (local crossover — **nicht** taler)
| DEST-Bereich | Inhalt |
|--------------|--------|
| `$HOME/git/admin-logs/local/*` | Host admin-logs + `*-secrets-enc` (amanita, clementine, firecuda, koopa, koopatroopa, magikoopa, vecigate, …) + `hernani-common-secrets-enc` |
| `$HOME/git/buerokratie-enc` | Bürokratie *enc |
firefly-Vault-Pfad laut HOSTS: unter shared secrets (`admin-secrets-enc/firefly/` bzw. common) — **nicht** Clem-only Blob; Host-Zeile in `$HOME/git/llm/HOSTS.md`. SSH Host+Key für firefly braucht Freigabe / ACL, nicht nur Sync-Datei.
---
## 4. Dauerbetrieb — Ansätze (llm-controld · grokd · hernanid · …)
Agents halten Tips **laufend**; dafür gibt es (bzw. sollen) Host-Daemons/`ensure`-Hooks geben. **Nicht verwechseln:** Git-Tip-Sync (`pull.sh`) ≠ Controld-Snapshots ≠ Statusline-Keepalive ≠ Combo-Write-Push.
| Name | Rolle | SoT / Bin | Start-Ansatz | Freigabe? |
|------|--------|-----------|--------------|-----------|
| **llm-controld** | Fleet/Letter-Probes → `status.json` (Statusline-Daten) | `$HOME/git/llm/llm-configs/bin/llm-controld` · DATA `llm-control-data-enc` | **Mit Tunnel**, nicht Boot: Tunnel-Skripte → `llm-controld ensure`. Nach Unlock ggf. `llm-control-data-peel.sh` (Doppel-*enc*). Stats: `$HOME/.local/state/llm-controld/` | `ensure` ok; dauerhafte Boot-Units nur mit Freigabe |
| **grokd** | Grok-Statusline keep-alive (`ensure-statusline.sh`) | `$HOME/git/src/_hernani-private/grokd` (Profil `grok`) | `grokd ensure` (auch via `ensure-statusline`). Optional Scheduler: `install-grokd.sh --load` — macOS LaunchAgent `ai.hernani.grokd`; Clementine/Linux user-crontab `* * * * * grokd ensure` | Dateien/`--link-local` ok; **`--load` braucht Freigabe** |
| **hernanid** | **Ansatz / Stub:** laufend Tip für Profil `hernani` (`admin-logs/local/*`, `buerokratie-enc`) | noch kein festes Bin — Muster wie grokd: `hernanid ensure` → `$HOME/git/pull.sh hernani` (+ unlock laut §2B) | Gleiches Host-Muster: magikoopa LaunchAgent `ai.hernani.hernanid`; Clementine crontab `hernanid ensure`. Bis es existiert: Agents/`pull.sh hernani` manuell bzw. Session-Start | Scheduler-Install / `--load` nur mit Freigabe |
| **combo-git-sync** | Combo **Write-Trees** commit+push (OpenPGP+SSH), ≠ Tip-Pull | `$HOME/git/llm/llm-configs/bin/combo-git-sync.py` · LaunchAgent `ai.llm-configs.combo-git-sync-hourly` | `install-combo-git-sync-hourly.sh` (macOS LaunchAgent / Clem crontab stündlich). Quit-on-conflict → `--clear-quit` | Install/Load + jeder Push-Pfad nur mit Freigabe-Policy der Settings |
### Agent-Regeln zu Daemons
1. Vor Arbeit: wenn Controld/Statusline/Grok nötig → `llm-controld ensure` / `grokd ensure` (billig, Singleton/flock).
2. Tip-Sync weiter über `pull.sh grok llm hernani` — Controld ersetzt das **nicht**.
3. Keine neuen LaunchAgents/crontab-Zeilen ohne Freigabe; Soft-Park = Dateien + `ensure` on-demand.
4. Clementine (sysvinit): **kein** systemctl — user crontab wie in den `install-*.sh`.
5. `hernanid` fehlt noch als Binary: nicht erfinden; Ansatz oben dokumentieren / Human+Clem abstimmen; bis dahin Session-`pull.sh`.
---
## 5. Agent-Pflicht (laufend)
1. Vor Arbeit an diesen Bäumen: Tip prüfen (`pull.sh` oder `git status` + behind).
2. Nach lokalen Commits: Human auf Push ansprechen; **kein** eigenmächtiger `git push`.
3. Bei Ciphertext / fehlendem Unlock: SYNC.md §2B befolgen, nicht Inhalt erfinden.
4. Neuer technischer Ordner in diesem Set: SYNC.md + AGENTS-Verweis auf SYNC.md mitziehen.
5. Katalog/Index-Refresh und SSH-Mutationen: nur mit Freigabe.
6. Dauerbetrieb: §4 — `ensure` nutzen; Scheduler nur mit Freigabe; `hernanid` als Ansatz bis Binary da ist.
---
## 6. Verweise
- Profile: `$HOME/git/profiles/{grok,llm,combo,hernani}.repos`
- Session Must: `$HOME/.grok/AGENTS.md` (Freigabe, §7 Git)
- Hosts: `$HOME/git/llm/HOSTS.md`
- grokd docs: `$HOME/git/src/_hernani-private/grokd/docs/README.md`
- llm-controld / peel: host skill magikoopa · `llm-configs/bin/llm-controld` · `llm-control-data-peel.sh`
- Diese Datei: neben `AGENTS.md` in jedem technischen Ordner dieses Sets

3
configs/README.md
View file

@ -14,8 +14,7 @@ Directories are named to match **live podman container names** where possible.
| `caddy/` `firewalld/` `systemd/` | host services | | | `caddy/` `firewalld/` `systemd/` | host services | |
| `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) | | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |
| `nym/` | **`koopa-nym`** (nym.com nym-node) | `localhost/koopa-nym:latest` (**non-root** uid 1000) | | `nym/` | **`koopa-nym`** (nym.com nym-node) | `localhost/koopa-nym:latest` (**non-root** uid 1000) |
| `paivana/` | **`koopa-paivana`** + paywalls + upstream | `localhost/koopa-paivana:latest` (**non-root**); public **9025/9028–9030** | | `paivana/` | **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` (**non-root**); upstream unprivileged nginx |
| `notes/` | **`koopa-silverbullet`** (SilverBullet) | `localhost/koopa-silverbullet:cachyos` (backend **127.0.0.1:19128**; paywall **9028**) |
| `forgejo/` | **`koopa-forgejo`** | rootless image + `user: 1000` + `userns keep-id` | | `forgejo/` | **`koopa-forgejo`** | rootless image + `user: 1000` + `userns keep-id` |
| `prime/` | jellyfin / qbittorrent | linuxserver **PUID/PGID=1000** | | `prime/` | jellyfin / qbittorrent | linuxserver **PUID/PGID=1000** |

20
configs/bank-landing/index.html
View file

@ -1118,18 +1118,12 @@
<script src="/intro/qrcode.min.js"></script> <script src="/intro/qrcode.min.js"></script>
</head> </head>
<body data-shop-theme="bank"> <body data-shop-theme="bank">
<!-- stack-bar --> <p class="stack-bar" role="note" title="Taler software on this bank service (links → git.taler.net tags)">
<p class="stack-bar" role="note" title="Taler software on this bank service (goa-regio-ng vanilla)">
<strong>stack</strong><span class="sep">·</span> <strong>stack</strong><span class="sep">·</span>
<a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a> <a href="https://git.taler.net/taler/libeufin/commit/ab00480dd9b3be50704fb449b750c764fd4c1de0.html" target="_blank" rel="noopener noreferrer" title="libeufin tag v1.6.6">libeufin-bank&nbsp;1.6.6</a>
<span class="sep">·</span> <span class="sep">·</span>
libeufin-bank&nbsp;1.6.10 <a href="https://git.taler.net/taler/libeufin/commit/ab00480dd9b3be50704fb449b750c764fd4c1de0.html" target="_blank" rel="noopener noreferrer" title="libeufin tag v1.6.6">libeufin-common&nbsp;1.6.6</a>
<span class="sep">·</span>
libeufin-common&nbsp;1.6.10
<span class="sep">·</span>
libeufin-bank-webui&nbsp;1.6.38
</p> </p>
<!-- /stack-bar -->
<main> <main>
<header class="hero"> <header class="hero">
<span class="badge">Intergalactic · GOA · no IBAN</span> <span class="badge">Intergalactic · GOA · no IBAN</span>
@ -1564,10 +1558,10 @@ tw run-until-done &amp;&amp; tw balance</pre>
<a href="https://bank.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>. <a href="https://bank.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
</p> </p>
<!-- landing-rev --> <!-- landing-rev -->
<p class="landing-rev" data-landing-site="bank" data-landing-version="45" data-landing-commit="0d881cd"> <p class="landing-rev" data-landing-site="bank" data-landing-version="44" data-landing-commit="689ee59">
Bank landing <strong>v45</strong> Bank landing <strong>v44</strong>
· content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time> · content <time datetime="2026-07-17T18:31:49+02:00">2026-07-17 18:31 CEST</time>
· <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a> · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/689ee595e08f3880c1e4068aac8e972574e20d21" title="koopa-admin-log 689ee595e08f3880c1e4068aac8e972574e20d21">689ee59</a>
</p> </p>
<!-- /landing-rev --> <!-- /landing-rev -->
</footer> </footer>

10
configs/bank-landing/nginx-landing.conf
View file

@ -49,16 +49,6 @@ server {
add_header Cache-Control "no-store" always; add_header Cache-Control "no-store" always;
add_header Access-Control-Allow-Origin * always; add_header Access-Control-Allow-Origin * always;
} }
# FP pattern: GET Integration via demo-api (inject suggested/required_exchange)
# Caddy @wdGet → :9013 → here → :19096; POST/other Integration stays on :9012
location /taler-integration/withdrawal-operation/ {
proxy_pass http://127.0.0.1:19096;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_read_timeout 70s;
add_header Cache-Control "no-store" always;
add_header Access-Control-Allow-Origin * always;
}
location /intro/ { location /intro/ {
alias /var/www/bank-landing/; alias /var/www/bank-landing/;
} }

36
configs/bbb/Containerfile
View file

@ -1,36 +0,0 @@
# koopa-bbb-front — BigBlueButton front (Ubuntu)
# Exception to CachyOS policy: BBB packages and install scripts target Ubuntu.
# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu
#
# Placeholder reverse-proxy target (nginx) until Greenlight and/or BBB core
# (bbb-install on Ubuntu) is chosen. Not production BBB media.
ARG UBUNTU_IMAGE=docker.io/library/ubuntu:24.04
FROM ${UBUNTU_IMAGE}
ENV DEBIAN_FRONTEND=noninteractive \
TZ=Europe/Zurich
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
ca-certificates curl nginx tini \
&& rm -rf /var/lib/apt/lists/*
RUN printf '%s\n' \
'server {' \
' listen 80 default_server;' \
' root /var/www/html;' \
' index index.html;' \
' location = /health { access_log off; default_type text/plain; return 200 "ok\n"; }' \
' location / { try_files $uri $uri/ =404; }' \
'}' > /etc/nginx/sites-available/default \
&& printf '%s\n' \
'<!doctype html><meta charset=utf-8><title>bbb.hacktivism.ch</title>' \
'<p>BBB front stub (Ubuntu 24.04). Full BigBlueButton / Greenlight is a separate Ubuntu install step.</p>' \
> /var/www/html/index.html
COPY entrypoint.sh /docker-entrypoint.sh
RUN chmod 755 /docker-entrypoint.sh
EXPOSE 80
ENTRYPOINT ["/usr/bin/tini", "--", "/docker-entrypoint.sh"]

38
configs/bbb/README.md
View file

@ -1,38 +0,0 @@
# BBB (BigBlueButton) — Ubuntu container (koopa)
CachyOS exception: BBB packages and `bbb-install` target **Ubuntu**. Front stub image is Ubuntu 24.04.
| Item | Value |
|------|--------|
| Stack | BigBlueButton (front stub → core later) |
| Image | `localhost/koopa-bbb-front:ubuntu` (`FROM docker.io/library/ubuntu:24.04`) |
| Live dir | `/home/hernani/koopa-bbb/` |
| Container | `koopa-bbb-front` |
| Host port | **9032** |
| Public site | `bbb.hacktivism.ch` |
## Phases
1. **Front stub (this tree)** — nginx placeholder on `:9032` so Caddy + DNS can land.
2. **Greenlight (optional)** — Rails UI talking to a real BBB API; still Ubuntu-based images.
3. **BBB core** — FreeSWITCH / mediasoup / akka-apps. Prefer official Ubuntu install (`bbb-install.sh`) on a dedicated Ubuntu host/VM, or a known multi-container BBB compose. Not CachyOS.
Media UDP/TCP and TURN are documented when core is chosen — not in this stub.
## Build + up (koopa)
```bash
bash /path/to/koopa-admin-log/scripts/bbb/build.sh
mkdir -p ~/koopa-bbb && cp -a /path/to/koopa-admin-log/configs/bbb/{compose.yml,Containerfile,entrypoint.sh} ~/koopa-bbb/
cd ~/koopa-bbb && HOST_PORT=9032 podman-compose up -d
```
## Caddy
```bash
sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
--snippet /path/to/koopa-admin-log/configs/caddy/bbb.hacktivism.ch.caddy \
--site bbb.hacktivism.ch --port 9032 --label bbb
```
DNS + VeciGate for the hostname after apply Freigabe.

31
configs/bbb/compose.yml
View file

@ -1,31 +0,0 @@
# koopa-bbb — BigBlueButton front on Ubuntu (exception to CachyOS)
# Live: /home/hernani/koopa-bbb/
# Build: bash ~/koopa-admin-log/scripts/bbb/build.sh → localhost/koopa-bbb-front:ubuntu
#
# HOST_PORT: 9032 → Caddy bbb.hacktivism.ch
# Core BBB / Greenlight: separate follow-up (Ubuntu), not this stub.
services:
bbb-front:
image: localhost/koopa-bbb-front:ubuntu
build:
context: .
dockerfile: Containerfile
container_name: koopa-bbb-front
restart: unless-stopped
environment:
- TZ=Europe/Zurich
ports:
- "${HOST_PORT:-9032}:80"
healthcheck:
test: ["CMD", "curl", "-fsS", "http://127.0.0.1/health"]
interval: 30s
timeout: 5s
retries: 3
start_period: 10s
labels:
org.hacktivism.service: bbb
org.hacktivism.host_port: "${HOST_PORT:-9032}"
org.hacktivism.site: bbb.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.port_status: allocated-9032
org.hacktivism.image_base: ubuntu

3
configs/bbb/entrypoint.sh
View file

@ -1,3 +0,0 @@
#!/bin/bash
set -euo pipefail
exec nginx -g 'daemon off;'

27
configs/bbb/vm/defaults.env
View file

@ -1,27 +0,0 @@
# koopa BBB Ubuntu VM — lean defaults (host ~15 Gi / 4 cores)
# Override before sourcing: RAM_MIB=4096 VCPUS=2 …
VM_NAME=koopa-bbb
# Official prod=16G; local-dev floor=8G. Koopa lean default=6G + guest swap.
RAM_MIB=6144
VCPUS=2
DISK_GB=50
# Ubuntu 22.04 LTS (bbb-install 3.0). 24.04 only if docs for your branch say so.
OS_VARIANT=ubuntu22.04
CLOUD_IMAGE_URL=https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-amd64.img
HOSTNAME=bbb.hacktivism.ch
# Bridged LAN (preferred for media DNAT). Set BRIDGE= after host-prep creates br0.
BRIDGE=
# Fallback: libvirt default NAT (media harder; ok for first boot/ssh)
NETWORK_SOURCE=default
# Guest swap (MiB) — important when RAM_MIB < 8192
SWAP_MIB=4096
# SSH pubkey injected via cloud-init (path on koopa host)
SSH_PUBKEY_FILE=/home/hernani/.ssh/id_ed25519.pub
# Disk pool
POOL_DIR=/var/lib/libvirt/images
# bbb-install branch + Greenlight
BBB_INSTALL_BRANCH=v3.0.x-release
BBB_INSTALL_EXTRA=-g
# After VM has IP: Caddy may stay on :9032 stub until cutover, or point at VM:80
CADDY_BACKEND_HINT=VM_HTTP_80_OR_DNAT

156
configs/caddy/Caddyfile
View file

@ -1,7 +1,7 @@
# Internal only (not in the browser URL): # Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API # 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing # 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9028 silverbullet | 9200 forgejo-ssh # 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3 # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{ {
@ -39,28 +39,28 @@ taler.hacktivism.ch {
# surface + aptdeploy HTML (taler.hacktivism.ch only) # surface + aptdeploy HTML (taler.hacktivism.ch only)
handle /taler-monitoring-surface_err { handle /taler-monitoring-surface_err {
redir /taler-monitoring-surface_err/ 302 redir * /taler-monitoring-surface_err/ 302
} }
handle /taler-monitoring-surface_err* { handle /taler-monitoring-surface_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /taler-monitoring-surface { handle /taler-monitoring-surface {
redir /taler-monitoring-surface/ 302 redir * /taler-monitoring-surface/ 302
} }
handle /taler-monitoring-surface* { handle /taler-monitoring-surface* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /taler-monitoring-aptdeploy_err { handle /taler-monitoring-aptdeploy_err {
redir /taler-monitoring-aptdeploy_err/ 302 redir * /taler-monitoring-aptdeploy_err/ 302
} }
handle /taler-monitoring-aptdeploy_err* { handle /taler-monitoring-aptdeploy_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /taler-monitoring-aptdeploy { handle /taler-monitoring-aptdeploy {
redir /taler-monitoring-aptdeploy/ 302 redir * /taler-monitoring-aptdeploy/ 302
} }
handle /taler-monitoring-aptdeploy* { handle /taler-monitoring-aptdeploy* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
@ -68,14 +68,14 @@ taler.hacktivism.ch {
} }
handle /taler-monitoring-mattermost_err { handle /taler-monitoring-mattermost_err {
redir /taler-monitoring-mattermost_err/ 302 redir * /taler-monitoring-mattermost_err/ 302
} }
handle /taler-monitoring-mattermost_err* { handle /taler-monitoring-mattermost_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /taler-monitoring-mattermost { handle /taler-monitoring-mattermost {
redir /taler-monitoring-mattermost/ 302 redir * /taler-monitoring-mattermost/ 302
} }
handle /taler-monitoring-mattermost* { handle /taler-monitoring-mattermost* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
@ -83,14 +83,14 @@ taler.hacktivism.ch {
} }
handle /taler-monitoring-mail_err { handle /taler-monitoring-mail_err {
redir /taler-monitoring-mail_err/ 302 redir * /taler-monitoring-mail_err/ 302
} }
handle /taler-monitoring-mail_err* { handle /taler-monitoring-mail_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /taler-monitoring-mail { handle /taler-monitoring-mail {
redir /taler-monitoring-mail/ 302 redir * /taler-monitoring-mail/ 302
} }
handle /taler-monitoring-mail* { handle /taler-monitoring-mail* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
@ -99,14 +99,14 @@ taler.hacktivism.ch {
# taler-monitoring console HTML (host static — not in app containers) # taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err { handle /monitoring_err {
redir /monitoring_err/ 302 redir * /monitoring_err/ 302
} }
handle /monitoring_err* { handle /monitoring_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server file_server
} }
handle /monitoring { handle /monitoring {
redir /monitoring/ 302 redir * /monitoring/ 302
} }
handle /monitoring* { handle /monitoring* {
root * /var/www/monitoring-sites/taler.hacktivism.ch root * /var/www/monitoring-sites/taler.hacktivism.ch
@ -143,14 +143,14 @@ exchange.hacktivism.ch {
# taler-monitoring console HTML (host static — not in app containers) # taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err { handle /monitoring_err {
redir /monitoring_err/ 302 redir * /monitoring_err/ 302
} }
handle /monitoring_err* { handle /monitoring_err* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server file_server
} }
handle /monitoring { handle /monitoring {
redir /monitoring/ 302 redir * /monitoring/ 302
} }
handle /monitoring* { handle /monitoring* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch root * /var/www/monitoring-sites/exchange.hacktivism.ch
@ -177,14 +177,14 @@ bank.hacktivism.ch {
# taler-monitoring console HTML (host static — not in app containers) # taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err { handle /monitoring_err {
redir /monitoring_err/ 302 redir * /monitoring_err/ 302
} }
handle /monitoring_err* { handle /monitoring_err* {
root * /var/www/monitoring-sites/bank.hacktivism.ch root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server file_server
} }
handle /monitoring { handle /monitoring {
redir /monitoring/ 302 redir * /monitoring/ 302
} }
handle /monitoring* { handle /monitoring* {
root * /var/www/monitoring-sites/bank.hacktivism.ch root * /var/www/monitoring-sites/bank.hacktivism.ch
@ -204,19 +204,6 @@ bank.hacktivism.ch {
} }
} }
# FP pattern (francpaysan-admin-log files/caddy/Caddyfile @wdGet):
# GET withdrawal-operation → landing :9013 → demo-api :19096
# (injects suggested_exchange / required_exchange for Android/iOS)
@wdGet {
method GET
path /taler-integration/withdrawal-operation/*
}
handle @wdGet {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
reverse_proxy 127.0.0.1:9012 { reverse_proxy 127.0.0.1:9012 {
import proxy_public import proxy_public
} }
@ -328,118 +315,7 @@ lemmy.hacktivism.ch {
} }
} }
# 9027 decidim (rails) http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch {
decidim.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9027 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9028 silverbullet / SilverBullet — allocated 2026-09-08
# Merge into /etc/caddy/Caddyfile (sudo).
# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list.
silverbullet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9028 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9029 galene — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
galene.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9029 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9030 cryptpad — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
cryptpad.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9030 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9031 meet (Jitsi) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
meet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9031 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9032 bbb (BigBlueButton) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
bbb.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9032 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch {
handle /.well-known/acme-challenge/* { handle /.well-known/acme-challenge/* {
root * /var/www/acme root * /var/www/acme
file_server file_server

343
configs/caddy/Caddyfile.bak-caddy-apply-20260908-090954
View file

@ -1,343 +0,0 @@
# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{
email info+koopa@hacktivism.ch
http_port 9000
https_port 9001
auto_https disable_redirects
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
servers {
protocols h1 h2
}
}
(proxy_public) {
header_up Host {host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
}
taler.hacktivism.ch {
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9015 {
import proxy_public
}
}
# surface + aptdeploy HTML (taler.hacktivism.ch only)
handle /taler-monitoring-surface_err {
redir /taler-monitoring-surface_err/ 302
}
handle /taler-monitoring-surface_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-surface {
redir /taler-monitoring-surface/ 302
}
handle /taler-monitoring-surface* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy_err {
redir /taler-monitoring-aptdeploy_err/ 302
}
handle /taler-monitoring-aptdeploy_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy {
redir /taler-monitoring-aptdeploy/ 302
}
handle /taler-monitoring-aptdeploy* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost_err {
redir /taler-monitoring-mattermost_err/ 302
}
handle /taler-monitoring-mattermost_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost {
redir /taler-monitoring-mattermost/ 302
}
handle /taler-monitoring-mattermost* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail_err {
redir /taler-monitoring-mail_err/ 302
}
handle /taler-monitoring-mail_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail {
redir /taler-monitoring-mail/ 302
}
handle /taler-monitoring-mail* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# SPA: /webui → /webui/
redir /webui /webui/ 302
# Merchant API + WebUI (nginx :9010 → unix socket)
reverse_proxy https://127.0.0.1:9010 {
transport http {
tls_insecure_skip_verify
}
import proxy_public
}
}
exchange.hacktivism.ch {
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9014 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
reverse_proxy 127.0.0.1:9011 {
import proxy_public
}
}
bank.hacktivism.ch {
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
# Static terms/privacy on landing nginx :9013
handle /terms* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
handle /privacy* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
reverse_proxy 127.0.0.1:9012 {
import proxy_public
}
}
castopod.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9020 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
bonfire.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9021 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
prime.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9022 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
bt.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9023 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
git.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9024 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# Taler Operations design previews (static nginx)
tops.ng1.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9090 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng2.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9091 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng3.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9092 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
# 9025 paivana-httpd (GOA paywall)
paivana.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9025 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
}
}
# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9026 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9027 decidim (rails)
decidim.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9027 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch {
handle /.well-known/acme-challenge/* {
root * /var/www/acme
file_server
}
handle {
redir https://{host}{uri} permanent
}
}

399
configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955
View file

@ -1,399 +0,0 @@
# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{
email info+koopa@hacktivism.ch
http_port 9000
https_port 9001
auto_https disable_redirects
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
servers {
protocols h1 h2
}
}
(proxy_public) {
header_up Host {host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
}
taler.hacktivism.ch {
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9015 {
import proxy_public
}
}
# surface + aptdeploy HTML (taler.hacktivism.ch only)
handle /taler-monitoring-surface_err {
redir /taler-monitoring-surface_err/ 302
}
handle /taler-monitoring-surface_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-surface {
redir /taler-monitoring-surface/ 302
}
handle /taler-monitoring-surface* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy_err {
redir /taler-monitoring-aptdeploy_err/ 302
}
handle /taler-monitoring-aptdeploy_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy {
redir /taler-monitoring-aptdeploy/ 302
}
handle /taler-monitoring-aptdeploy* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost_err {
redir /taler-monitoring-mattermost_err/ 302
}
handle /taler-monitoring-mattermost_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost {
redir /taler-monitoring-mattermost/ 302
}
handle /taler-monitoring-mattermost* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail_err {
redir /taler-monitoring-mail_err/ 302
}
handle /taler-monitoring-mail_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail {
redir /taler-monitoring-mail/ 302
}
handle /taler-monitoring-mail* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# SPA: /webui → /webui/
redir /webui /webui/ 302
# Merchant API + WebUI (nginx :9010 → unix socket)
reverse_proxy https://127.0.0.1:9010 {
transport http {
tls_insecure_skip_verify
}
import proxy_public
}
}
exchange.hacktivism.ch {
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9014 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
reverse_proxy 127.0.0.1:9011 {
import proxy_public
}
}
bank.hacktivism.ch {
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
# Static terms/privacy on landing nginx :9013
handle /terms* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
handle /privacy* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
reverse_proxy 127.0.0.1:9012 {
import proxy_public
}
}
castopod.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9020 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
bonfire.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9021 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
prime.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9022 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
bt.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9023 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
git.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9024 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# Taler Operations design previews (static nginx)
tops.ng1.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9090 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng2.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9091 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng3.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9092 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
# 9025 paivana-httpd (GOA paywall)
paivana.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9025 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
}
}
# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9026 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9027 decidim (rails)
decidim.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9027 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9029 galene — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
galene.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9029 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9030 cryptpad — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
cryptpad.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9030 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9031 meet (Jitsi) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
meet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9031 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch {
handle /.well-known/acme-challenge/* {
root * /var/www/acme
file_server
}
handle {
redir https://{host}{uri} permanent
}
}

418
configs/caddy/Caddyfile.bak-caddy-apply-20260908-143821
View file

@ -1,418 +0,0 @@
# Internal only (not in the browser URL):
# 9010 merchant API | 9011 exchange API | 9012 bank API
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9032 bbb | 9200 forgejo-ssh
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
{
email info+koopa@hacktivism.ch
http_port 9000
https_port 9001
auto_https disable_redirects
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
servers {
protocols h1 h2
}
}
(proxy_public) {
header_up Host {host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
}
taler.hacktivism.ch {
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9015 {
import proxy_public
}
}
# surface + aptdeploy HTML (taler.hacktivism.ch only)
handle /taler-monitoring-surface_err {
redir /taler-monitoring-surface_err/ 302
}
handle /taler-monitoring-surface_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-surface {
redir /taler-monitoring-surface/ 302
}
handle /taler-monitoring-surface* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy_err {
redir /taler-monitoring-aptdeploy_err/ 302
}
handle /taler-monitoring-aptdeploy_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-aptdeploy {
redir /taler-monitoring-aptdeploy/ 302
}
handle /taler-monitoring-aptdeploy* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost_err {
redir /taler-monitoring-mattermost_err/ 302
}
handle /taler-monitoring-mattermost_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mattermost {
redir /taler-monitoring-mattermost/ 302
}
handle /taler-monitoring-mattermost* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail_err {
redir /taler-monitoring-mail_err/ 302
}
handle /taler-monitoring-mail_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /taler-monitoring-mail {
redir /taler-monitoring-mail/ 302
}
handle /taler-monitoring-mail* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/taler.hacktivism.ch
file_server
}
# SPA: /webui → /webui/
redir /webui /webui/ 302
# Merchant API + WebUI (nginx :9010 → unix socket)
reverse_proxy https://127.0.0.1:9010 {
transport http {
tls_insecure_skip_verify
}
import proxy_public
}
}
exchange.hacktivism.ch {
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9014 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/exchange.hacktivism.ch
file_server
}
reverse_proxy 127.0.0.1:9011 {
import proxy_public
}
}
bank.hacktivism.ch {
header Alt-Svc "clear"
# Public landing first
redir / /intro/ 302
handle /intro* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
# taler-monitoring console HTML (host static — not in app containers)
handle /monitoring_err {
redir /monitoring_err/ 302
}
handle /monitoring_err* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
handle /monitoring {
redir /monitoring/ 302
}
handle /monitoring* {
root * /var/www/monitoring-sites/bank.hacktivism.ch
file_server
}
# Static terms/privacy on landing nginx :9013
handle /terms* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
handle /privacy* {
reverse_proxy 127.0.0.1:9013 {
import proxy_public
}
}
reverse_proxy 127.0.0.1:9012 {
import proxy_public
}
}
castopod.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9020 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
bonfire.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9021 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
prime.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9022 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
flush_interval -1
}
}
bt.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9023 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
}
}
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
git.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9024 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# Taler Operations design previews (static nginx)
tops.ng1.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9090 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng2.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9091 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
tops.ng3.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9092 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}
# 9025 paivana-httpd (GOA paywall)
paivana.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9025 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
}
}
# 9026 lemmy (+ ui/pictrs via internal nginx)
lemmy.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9026 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9027 decidim (rails)
decidim.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9027 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9029 galene — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
galene.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9029 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9030 cryptpad — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
cryptpad.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9030 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9031 meet (Jitsi) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
meet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9031 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
# 9032 bbb (BigBlueButton) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
bbb.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9032 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch, http://bbb.hacktivism.ch {
handle /.well-known/acme-challenge/* {
root * /var/www/acme
file_server
}
handle {
redir https://{host}{uri} permanent
}
}

1
configs/caddy/README.md
View file

@ -4,7 +4,6 @@
|------|------| |------|------|
| **`Caddyfile`** | Multi-vhost config mirror (`/etc/caddy/Caddyfile` on host) | | **`Caddyfile`** | Multi-vhost config mirror (`/etc/caddy/Caddyfile` on host) |
| `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo | | `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo |
| `silverbullet.hacktivism.ch.caddy` | Site-block snippet for SilverBullet |
| `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy | | `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy |
Also: `host/caddy/Caddyfile` (same as `Caddyfile` here). Also: `host/caddy/Caddyfile` (same as `Caddyfile` here).

18
configs/caddy/bbb.hacktivism.ch.caddy
View file

@ -1,18 +0,0 @@
# 9032 bbb (BigBlueButton) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site bbb.hacktivism.ch --port 9032 --label bbb
# Stack image base: Ubuntu (not CachyOS). Media/UDP ports TBD with install.
bbb.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9032 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}

18
configs/caddy/cryptpad.hacktivism.ch.caddy
View file

@ -1,18 +0,0 @@
# 9030 cryptpad — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
# Backend is koopa-cryptpad-edge (HTTP+WS). Sandbox subdomain (cryptpad-ui) — wire after first boot.
cryptpad.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9030 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}

17
configs/caddy/galene.hacktivism.ch.caddy
View file

@ -1,17 +0,0 @@
# 9029 galene — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
galene.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9029 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}

18
configs/caddy/meet.hacktivism.ch.caddy
View file

@ -1,18 +0,0 @@
# 9031 meet (Jitsi) — allocated 2026-09-08
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
meet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9031 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}

18
configs/caddy/silverbullet.hacktivism.ch.caddy
View file

@ -1,18 +0,0 @@
# 9028 silverbullet / SilverBullet — allocated 2026-09-08
# Merge into /etc/caddy/Caddyfile (sudo).
# Also add http://silverbullet.hacktivism.ch to the shared ACME/redirect list.
silverbullet.hacktivism.ch {
header Alt-Svc "clear"
reverse_proxy 127.0.0.1:9028 {
header_up Host {host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Host {host}
header_up X-Forwarded-Proto {scheme}
header_up X-Forwarded-Port 443
flush_interval -1
transport http {
read_timeout 3600s
write_timeout 3600s
}
}
}

47
configs/cryptpad/Containerfile
View file

@ -1,47 +0,0 @@
# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman
# Build on koopa (x86_64):
# bash ~/koopa-admin-log/scripts/cryptpad/build.sh
# → localhost/koopa-cryptpad:cachyos
#
# App tree from upstream release tarball (not the official Debian-ish image).
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}
ARG CRYPTPAD_VERSION=2025.9.0
ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz
ENV TZ=Europe/Zurich \
PATH=/usr/local/bin:$PATH \
CRYPTPAD_HOME=/cryptpad
RUN pacman -Syu --noconfirm --needed \
bash curl ca-certificates catatonit tar git \
nodejs npm \
&& pacman -Scc --noconfirm \
&& rm -rf /var/cache/pacman/pkg/* /tmp/*
# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs.
RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \
&& mkdir -p /cryptpad \
&& tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \
&& rm -f /tmp/cryptpad.tgz \
&& cd /cryptpad \
&& git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \
&& git config --global url."https://github.com/".insteadOf "git@github.com:" \
&& git config --global url."https://".insteadOf "git://" \
&& printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \
&& (npm ci --omit=dev --allow-git=all --allow-remote=all \
|| npm install --omit=dev --allow-git=all --allow-remote=all) \
&& (npm run install:components || true) \
&& rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/*
COPY entrypoint.sh /docker-entrypoint.sh
RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \
/cryptpad/blobstage /cryptpad/data/logs
COPY config.example.js /cryptpad/config/config.js
RUN chmod 755 /docker-entrypoint.sh
EXPOSE 3000
WORKDIR /cryptpad
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]

32
configs/cryptpad/README.md
View file

@ -1,32 +0,0 @@
# CryptPad — on CachyOS (koopa)
| Item | Value |
|------|--------|
| Stack | [CryptPad](https://cryptpad.org/) |
| Image | `localhost/koopa-cryptpad:cachyos` |
| Live dir | `/home/hernani/koopa-cryptpad/` |
| Host port | **9030** = Paivana paywall; nginx edge backend **172.17.0.1:19130** → app (pasta host IP; Paivana DEST) |
| App ports (internal) | **3000** HTTP, **3003** websocket |
| Public site | `cryptpad.hacktivism.ch` |
`websocketPort` must differ from `httpPort` (upstream default 3003). Compose runs `koopa-cryptpad-edge` (nginx) so Caddy still only targets **9030**.
Upstream wants a separate **safe/sandbox** origin for some builds — add a second vhost after first boot if the admin UI requires it.
## Build + up
```bash
bash /path/to/koopa-admin-log/scripts/cryptpad/build.sh
mkdir -p ~/koopa-cryptpad
cp -a /path/to/koopa-admin-log/configs/cryptpad/{compose.yml,config.example.js} ~/koopa-cryptpad/
cp ~/koopa-cryptpad/config.example.js ~/koopa-cryptpad/config.js
# edit httpUnsafeOrigin / httpSafeOrigin in config.js
cd ~/koopa-cryptpad && podman-compose up -d
```
## Caddy
```bash
sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
--snippet …/configs/caddy/cryptpad.hacktivism.ch.caddy \
--site cryptpad.hacktivism.ch --port 9030 --label cryptpad
```

53
configs/cryptpad/compose.yml
View file

@ -1,53 +0,0 @@
# koopa-cryptpad — CryptPad on CachyOS + nginx edge (HTTP+WS on :9030)
# Live: /home/hernani/koopa-cryptpad/
# Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos
#
# Public :9030 = koopa-paivana-cryptpad (shared paivana image).
# Edge on pasta host IP — Paivana DEST → 172.17.0.1:19130 (not LAN 0.0.0.0)
# App listens 3000 (http) + 3003 (websocket) inside the net.
services:
cryptpad:
image: localhost/koopa-cryptpad:cachyos
build:
context: .
dockerfile: Containerfile
args:
CRYPTPAD_VERSION: "${CRYPTPAD_VERSION:-2025.9.0}"
container_name: koopa-cryptpad
restart: unless-stopped
environment:
- TZ=Europe/Zurich
volumes:
- ./data:/cryptpad/data
- ./datastore:/cryptpad/datastore
- ./block:/cryptpad/block
- ./blob:/cryptpad/blob
- ./config.js:/cryptpad/config/config.js:ro
expose:
- "3000"
- "3003"
labels:
org.hacktivism.service: cryptpad
org.hacktivism.host_port: "9030"
org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
org.hacktivism.site: cryptpad.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.port_status: backend-19130-paywall-9030
org.hacktivism.image_base: cachyos
edge:
image: docker.io/library/nginx:alpine
container_name: koopa-cryptpad-edge
restart: unless-stopped
depends_on:
- cryptpad
volumes:
- ./edge.conf:/etc/nginx/conf.d/default.conf:ro
ports:
- "172.17.0.1:${BACKEND_PORT:-19130}:80"
labels:
org.hacktivism.service: cryptpad-edge
org.hacktivism.host_port: "9030"
org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
org.hacktivism.site: cryptpad.hacktivism.ch
org.hacktivism.managed_by: koopa-admin

13
configs/cryptpad/config.example.js
View file

@ -1,13 +0,0 @@
/* CryptPad config — http on 3000, websockets on 3003 (must differ).
* Live: mount ./config.js over /cryptpad/config/config.js
* Edge nginx in compose merges both onto host :9030 (Caddy unchanged).
*/
module.exports = {
httpUnsafeOrigin: 'https://cryptpad.hacktivism.ch',
httpSafeOrigin: 'https://cryptpad.hacktivism.ch',
httpAddress: '0.0.0.0',
httpPort: 3000,
websocketPort: 3003,
logToStdout: true,
maxWorkers: 2,
};

37
configs/cryptpad/edge.conf
View file

@ -1,37 +0,0 @@
# Front for koopa-cryptpad: HTTP :3000 + /cryptpad_websocket → :3003
upstream cryptpad_http {
server cryptpad:3000;
}
upstream cryptpad_ws {
server cryptpad:3003;
}
server {
listen 80 default_server;
server_name _;
client_max_body_size 150m;
location /cryptpad_websocket {
proxy_pass http://cryptpad_ws;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location / {
proxy_pass http://cryptpad_http;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}

5
configs/cryptpad/entrypoint.sh
View file

@ -1,5 +0,0 @@
#!/bin/bash
set -euo pipefail
cd /cryptpad
# Expect config.js already present (compose mounts or image default).
exec node server.js "$@"

24
configs/exchange-landing/index.html
View file

@ -289,22 +289,18 @@
</style> </style>
</head> </head>
<body> <body>
<!-- stack-bar --> <p class="stack-bar" role="note" title="Taler software on this exchange service (links → git.taler.net tags)">
<p class="stack-bar" role="note" title="Taler software on this exchange service (goa-regio-ng vanilla)">
<strong>stack</strong><span class="sep">·</span> <strong>stack</strong><span class="sep">·</span>
<a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a> <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange&nbsp;1.6.6</a>
<span class="sep">·</span> <span class="sep">·</span>
taler-exchange&nbsp;1.6.15 <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">libtalerexchange&nbsp;1.6.6</a>
<span class="sep">·</span> <span class="sep">·</span>
libtalerexchange&nbsp;1.6.15 <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange-database&nbsp;1.6.6</a>
<span class="sep">·</span> <span class="sep">·</span>
taler-exchange-database&nbsp;1.6.15 <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-exchange-offline&nbsp;1.6.6</a>
<span class="sep">·</span> <span class="sep">·</span>
taler-exchange-offline&nbsp;1.6.15 <a href="https://git.taler.net/taler/exchange/commit/6dbfa41e3fc6657eff28d11166d24301cdfa93ff.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.6">taler-terms-generator&nbsp;1.6.6</a>
<span class="sep">·</span>
taler-terms-generator&nbsp;1.6.15
</p> </p>
<!-- /stack-bar -->
<main> <main>
<header class="hero"> <header class="hero">
<span class="badge">GOA · Exchange</span> <span class="badge">GOA · Exchange</span>
@ -504,10 +500,10 @@ sudo apt-get install -y taler-wallet-cli</pre>
<a href="https://exchange.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>. <a href="https://exchange.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
</p> </p>
<!-- landing-rev --> <!-- landing-rev -->
<p class="landing-rev" data-landing-site="exchange" data-landing-version="44" data-landing-commit="0d881cd"> <p class="landing-rev" data-landing-site="exchange" data-landing-version="43" data-landing-commit="d0594cb">
Exchange landing <strong>v44</strong> Exchange landing <strong>v43</strong>
· content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time> · content <time datetime="2026-07-17T18:33:13+02:00">2026-07-17 18:33 CEST</time>
· <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a> · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/d0594cb44ffb1bec2e009f6812167cbbf216eda9" title="koopa-admin-log d0594cb44ffb1bec2e009f6812167cbbf216eda9">d0594cb</a>
</p> </p>
<!-- /landing-rev --> <!-- /landing-rev -->
</footer> </footer>

2
configs/firewalld/public-ports.md
View file

@ -18,7 +18,6 @@ sudo firewall-cmd --list-ports
| 8080/tcp | Tor OR | — | | 8080/tcp | Tor OR | — |
| 23235/tcp | (legacy list; host SSH is :22, WAN via VeciGate 23235→22) | — | | 23235/tcp | (legacy list; host SSH is :22, WAN via VeciGate 23235→22) | — |
| **9200/tcp** | **Forgejo git-SSH** (podman rootlessport) | **OK** after add+reload | | **9200/tcp** | **Forgejo git-SSH** (podman rootlessport) | **OK** after add+reload |
| **6881/tcp+udp** | qBittorrent BT listen (`koopa-prime-qbittorrent`) | apply: `scripts/prime/apply-qbittorrent-bt-net.sh` |
### Not opened on purpose ### Not opened on purpose
@ -62,7 +61,6 @@ Forgejo advertises `SSH_PORT=9200`. Traffic hits **host:9200** (not Caddy). With
|------|--------| |------|--------|
| 2026-07-09 | 443/tcp re-added for IPv6 | | 2026-07-09 | 443/tcp re-added for IPv6 |
| 2026-07-10 | **9200/tcp** for Forgejo git-SSH (verified LAN + hairpin + SSH auth) | | 2026-07-10 | **9200/tcp** for Forgejo git-SSH (verified LAN + hairpin + SSH auth) |
| 2026-09-25 | **6881/tcp+udp** for qBittorrent BT (`scripts/prime/apply-qbittorrent-bt-net.sh`); VeciGate wan+hairpin DNAT live; WAN/LAN `nc` OK |
## Nym (`koopa-nym`, nym.com) ## Nym (`koopa-nym`, nym.com)

4
configs/forgejo/README.md
View file

@ -58,7 +58,3 @@ Or: Profile → Appearance → theme **hacktivism**, then hard-reload.
### Registration ### Registration
Public signup is disabled (`DISABLE_REGISTRATION`, no registration button). Public signup is disabled (`DISABLE_REGISTRATION`, no registration button).
### pre-receive: gitleaks + *enc.git gate (TODO320, 2026-09-11)
Live hooks under `~/koopa-forgejo/data/custom/hooks/pre-receive.d/` (gitleaks skip `*enc.git`; `git-crypt-enforce` Klartext-Sperre). Binary `data/custom/bin/gitleaks` v8.21.2. Installer + smoke: laptop `llm-configs/bin/forgejo-hooks/`. Ops note: `2026/2026-09-11--forgejo-gitleaks-enc-gate.md`. New repos → re-run `install-hooks-ht.sh`.

41
configs/galene/Containerfile
View file

@ -1,41 +0,0 @@
# koopa-galene — Galene SFU on CachyOS base
# Build on koopa (x86_64):
# bash ~/koopa-admin-log/scripts/galene/build.sh
# → localhost/koopa-galene:cachyos
#
# Upstream no longer ships release tarballs; build from git tag/branch.
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}
ARG GALENE_REF=galene-0.96.3
ARG GALENE_REPO=https://github.com/jech/galene.git
ENV TZ=Europe/Zurich \
PATH=/usr/local/bin:$PATH \
GALENE_DATA=/data \
GOPATH=/tmp/go \
GOTOOLCHAIN=auto
RUN pacman -Syu --noconfirm --needed \
bash curl ca-certificates catatonit tar git go \
&& pacman -Scc --noconfirm \
&& rm -rf /var/cache/pacman/pkg/* /tmp/*
RUN set -eux \
&& git clone --depth 1 --branch "$GALENE_REF" "$GALENE_REPO" /src/galene \
&& cd /src/galene \
&& CGO_ENABLED=0 go build -ldflags='-s -w' -o /usr/local/bin/galene . \
&& test -x /usr/local/bin/galene \
&& mkdir -p /opt/galene \
&& cp -a /src/galene/static /opt/galene/static \
&& rm -rf /src/galene /tmp/go /root/go /var/cache/pacman/pkg/*
COPY entrypoint.sh /docker-entrypoint.sh
RUN chmod 755 /docker-entrypoint.sh \
&& mkdir -p /data/groups /data/recordings /data/data \
&& ln -sfn /opt/galene/static /data/static
EXPOSE 8443
WORKDIR /data
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]

36
configs/galene/README.md
View file

@ -1,36 +0,0 @@
# Galene — SFU on CachyOS (koopa)
| Item | Value |
|------|--------|
| Stack | [Galene](https://galene.org/) |
| Image | `localhost/koopa-galene:cachyos` (`FROM docker.io/cachyos/cachyos`) |
| Build | Go from git tag `GALENE_REF` (default `galene-0.96.3`; no release tarballs) |
| Live dir | `/home/hernani/koopa-galene/` |
| Container | `koopa-galene` |
| Host port | **9029** = Paivana paywall; Galene HTTP backend **127.0.0.1:19129** (`-insecure`) |
| Public site | `galene.hacktivism.ch` |
## Build + up (koopa)
```bash
bash /path/to/koopa-admin-log/scripts/galene/build.sh
mkdir -p ~/koopa-galene && cp -a /path/to/koopa-admin-log/configs/galene/compose.yml ~/koopa-galene/
cd ~/koopa-galene && podman-compose up -d
```
## Caddy
```bash
sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
--snippet /path/to/koopa-admin-log/configs/caddy/galene.hacktivism.ch.caddy \
--site galene.hacktivism.ch --port 9029 --label galene
```
DNS + VeciGate for the hostname; WebRTC UDP ports documented when first room is live.
## Notes
- Volume `./data` must not hide UI assets; entrypoint passes `-static /opt/galene/static`.
- Example group: copy `groups/hacktivism.json.example` → `~/koopa-galene/data/groups/hacktivism.json` (change op password).
- WebRTC UDP: compose publishes **10000–10099/udp**; set the same range in VeciGate DNAT → koopa. Entrypoint uses `-udp-range` (`GALENE_UDP_RANGE`).
- Built-in TURN (`-turn auto`) logs `no public addresses` until the host has a reachable public/mapped address; fix UDP/NAT first, then re-check logs.

30
configs/galene/compose.yml
View file

@ -1,30 +0,0 @@
# koopa-galene — Galene on CachyOS
# Live: /home/hernani/koopa-galene/
# Build: bash ~/koopa-admin-log/scripts/galene/build.sh → localhost/koopa-galene:cachyos
#
# Public :9029 = koopa-paivana-galene (shared paivana image).
# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19129 (HTTP -insecure; not LAN 0.0.0.0).
# WebRTC UDP: still published (see README / ports.md)
services:
galene:
image: localhost/koopa-galene:cachyos
container_name: koopa-galene
restart: unless-stopped
environment:
- TZ=Europe/Zurich
- GALENE_UDP_RANGE=${GALENE_UDP_RANGE:-10000-10099}
volumes:
- ./data:/data
- ./entrypoint.sh:/docker-entrypoint.sh:ro
ports:
- "172.17.0.1:${BACKEND_PORT:-19129}:8443"
- "${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}:${GALENE_UDP_LO:-10000}-${GALENE_UDP_HI:-10099}/udp"
labels:
org.hacktivism.service: galene
org.hacktivism.host_port: "9029"
org.hacktivism.backend_port: "${BACKEND_PORT:-19129}"
org.hacktivism.site: galene.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.port_status: backend-19129-paywall-9029
org.hacktivism.image_base: cachyos

21
configs/galene/entrypoint.sh
View file

@ -1,21 +0,0 @@
#!/bin/bash
set -euo pipefail
# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443
# with -insecure (TLS terminated at Caddy).
# Static assets stay in the image (/opt/galene/static); the ./data volume must
# not shadow them — pass -static explicitly.
DATA="${GALENE_DATA:-/data}"
STATIC="${GALENE_STATIC:-/opt/galene/static}"
# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md).
UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}"
mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data"
cd "$DATA"
exec /usr/local/bin/galene \
-http "0.0.0.0:8443" \
-insecure \
-static "$STATIC" \
-udp-range "$UDP_RANGE" \
-data "$DATA/data" \
-groups "$DATA/groups" \
-recordings "$DATA/recordings" \
"$@"

7
configs/galene/groups/hacktivism.json.example
View file

@ -1,7 +0,0 @@
{
"displayName": "hacktivism",
"public": true,
"op": [{"username": "op", "password": "changeme"}],
"presenter": [{}],
"other": []
}

3
configs/lab-local/goa-regio-ng-koopa.yml
View file

@ -53,7 +53,8 @@ regional_currency:
regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000" regional_currency_common_amounts: "GOA:10 GOA:20 GOA:50 GOA:100 GOA:200 GOA:1000"
regional_currency_static_coins_file: goa-exchange-coins.conf regional_currency_static_coins_file: goa-exchange-coins.conf
regional_currency_coin_withdraw_duration: 7 days regional_currency_coin_withdraw_duration: 7 days
regional_currency_default_debt_limit: "GOA:4503599627370496" # Must stay < 2^52 (libeufin amount overflow on withdraw confirm).
regional_currency_default_debt_limit: "GOA:1000000000000"
regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10" regional_currency_exchange_master_public_key_expected: "TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10"
regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv" regional_currency_exchange_master_priv_src: "{{ lookup('ansible.builtin.env', 'HOME') }}/git/admin-logs/koopa-admin-secrets/backups/goa/current/exchange-offline/master.priv"

19
configs/lab-local/lab-hosts.yml
View file

@ -1,19 +0,0 @@
---
# lab-only: pin *.goa.local → 127.0.0.1 inside goa-regio-ng
# ephemeral on container recreate — re-run after recreate / before site.yml wait-on-bank
# inventory: goa-regio-ng-koopa.yml (same SSH ProxyCommand)
#
# ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
- name: lab hosts goa.local
hosts: regional_currency
gather_facts: false
tasks:
- name: /etc/hosts *.goa.local → 127.0.0.1
ansible.builtin.blockinfile:
path: /etc/hosts
marker: "# {mark} ANSIBLE LAB goa.local"
# podman systemd: /etc/hosts often EBUSY on atomic rename
unsafe_writes: true
block: |
127.0.0.1 bank.goa.local exchange.goa.local backend.goa.local goa.local

55
configs/meet/Containerfile
View file

@ -1,55 +0,0 @@
# koopa-meet-web — Jitsi Meet web assets on CachyOS
# Build: bash ~/koopa-admin-log/scripts/meet/build.sh → localhost/koopa-meet-web:cachyos
#
# Full Meet needs prosody + jicofo + jvb (see compose.yml). This image serves
# the static web UI via nginx from Arch/CachyOS packages + upstream meet tarball.
# Signaling/media containers are separate services in the same compose.
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}
ARG JITSI_MEET_VERSION=stable
ARG JITSI_MEET_URL=https://download.jitsi.org/jitsi-meet/src/jitsi-meet-1.0.0.tar.bz2
ENV TZ=Europe/Zurich
RUN pacman -Syu --noconfirm --needed \
bash curl ca-certificates catatonit tar nginx \
&& pacman -Scc --noconfirm \
&& rm -rf /var/cache/pacman/pkg/* /tmp/*
# CachyOS/Arch nginx.conf embeds a default server and does NOT include http.d/.
# Replace it with a minimal conf that serves the branded landing.
RUN mkdir -p /usr/share/jitsi-meet /etc/nginx/http.d \
&& printf '%s\n' \
'worker_processes 1;' \
'events { worker_connections 1024; }' \
'http {' \
' include mime.types;' \
' default_type application/octet-stream;' \
' sendfile on;' \
' keepalive_timeout 65;' \
' server {' \
' listen 80 default_server;' \
' server_name _;' \
' root /usr/share/jitsi-meet;' \
' index index.html;' \
' location / { try_files $uri $uri/ /index.html; }' \
' }' \
'}' > /etc/nginx/nginx.conf \
&& printf '%s\n' \
'<!doctype html><html lang=en><meta charset=utf-8>' \
'<meta name=viewport content="width=device-width,initial-scale=1">' \
'<title>meet.hacktivism.ch</title>' \
'<style>body{font-family:system-ui,sans-serif;max-width:40rem;margin:3rem auto;padding:0 1rem;line-height:1.5}' \
'code{background:#f2f2f2;padding:.1rem .35rem;border-radius:4px}</style>' \
'<h1>meet.hacktivism.ch</h1>' \
'<p>Jitsi Meet <strong>web</strong> (CachyOS). Signaling/media (prosody / jicofo / jvb) is Phase&nbsp;2 — see compose + README.</p>' \
'<p>HTTP OK on host port <code>9031</code>. Full rooms need UDP/JVB after Phase&nbsp;2.</p>' \
> /usr/share/jitsi-meet/index.html
COPY entrypoint.sh /docker-entrypoint.sh
RUN chmod 755 /docker-entrypoint.sh
EXPOSE 80
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]

23
configs/meet/README.md
View file

@ -1,23 +0,0 @@
# Meet (Jitsi) — CachyOS web stub (koopa)
| Item | Value |
|------|--------|
| Public site | `meet.hacktivism.ch` |
| Public port | **9031** (`koopa-paivana-meet`) |
| Backend | `127.0.0.1:19131` (`koopa-meet-web`) |
| Image (web) | `localhost/koopa-meet-web:cachyos` |
| Live dir | `/home/hernani/koopa-meet/` |
Phase 1 = Caddy vhost + branded nginx landing on CachyOS (`koopa-meet-web`) behind Paivana (GOA:42).
Phase 2 = prosody + jicofo + jvb — scaffold in `compose.phase2.yml` (`profiles: [phase2]`); images under `configs/meet/phase2/` still TODO. Not `docker-jitsi-meet` Debian by default.
UDP/JVB and TURN need VeciGate once rooms work (range TBD in `ports.md`).
## Caddy
Caddy stays on `127.0.0.1:9031` (paywall). App bind is loopback `19131` only.
```bash
sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
--snippet …/configs/caddy/meet.hacktivism.ch.caddy \
--site meet.hacktivism.ch --port 9031 --label meet
```

49
configs/meet/compose.phase2.yml
View file

@ -1,49 +0,0 @@
# Phase-2 stubs — NOT started by default.
# Usage (after images exist):
# cd ~/koopa-meet && podman-compose -f compose.yml -f compose.phase2.yml up -d
#
# Do not pull official docker-jitsi-meet Debian images as the default base.
# Build CachyOS (or pinned binary) images under configs/meet/phase2/ when ready.
services:
prosody:
profiles: ["phase2"]
image: localhost/koopa-meet-prosody:cachyos
container_name: koopa-meet-prosody
restart: unless-stopped
environment:
- TZ=Europe/Zurich
# ports / volumes: fill when Containerfile exists
labels:
org.hacktivism.service: meet-prosody
org.hacktivism.site: meet.hacktivism.ch
org.hacktivism.phase: "2"
jicofo:
profiles: ["phase2"]
image: localhost/koopa-meet-jicofo:cachyos
container_name: koopa-meet-jicofo
restart: unless-stopped
environment:
- TZ=Europe/Zurich
depends_on:
- prosody
labels:
org.hacktivism.service: meet-jicofo
org.hacktivism.site: meet.hacktivism.ch
org.hacktivism.phase: "2"
jvb:
profiles: ["phase2"]
image: localhost/koopa-meet-jvb:cachyos
container_name: koopa-meet-jvb
restart: unless-stopped
environment:
- TZ=Europe/Zurich
# UDP host publish TBD in ports.md when allocated
depends_on:
- prosody
labels:
org.hacktivism.service: meet-jvb
org.hacktivism.site: meet.hacktivism.ch
org.hacktivism.phase: "2"

26
configs/meet/compose.yml
View file

@ -1,26 +0,0 @@
# koopa-meet — Jitsi Meet (CachyOS web stub + follow-up signaling/media)
# Live: /home/hernani/koopa-meet/
# Public :9031 = koopa-paivana-meet (shared paivana image).
# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19131 (not LAN 0.0.0.0)
#
# Next: add prosody / jicofo / jvb services (CachyOS images or pinned binaries).
# Official docker-jitsi-meet is Debian-based — do not pull those as default here.
services:
meet-web:
image: localhost/koopa-meet-web:cachyos
build:
context: .
dockerfile: Containerfile
container_name: koopa-meet-web
restart: unless-stopped
environment:
- TZ=Europe/Zurich
ports:
- "172.17.0.1:${BACKEND_PORT:-19131}:80"
labels:
org.hacktivism.service: meet
org.hacktivism.backend_port: "${BACKEND_PORT:-19131}"
org.hacktivism.site: meet.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.port_status: backend-19131-paywall-9031
org.hacktivism.image_base: cachyos

3
configs/meet/entrypoint.sh
View file

@ -1,3 +0,0 @@
#!/bin/bash
set -euo pipefail
exec nginx -g 'daemon off;'

24
configs/merchant-landing/index.html
View file

@ -530,22 +530,18 @@
</style> </style>
</head> </head>
<body> <body>
<!-- stack-bar --> <p class="stack-bar" role="note" title="Taler software on this merchant service (links → git.taler.net tags)">
<p class="stack-bar" role="note" title="Taler software on this merchant service (goa-regio-ng vanilla)">
<strong>stack</strong><span class="sep">·</span> <strong>stack</strong><span class="sep">·</span>
<a href="https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla" target="_blank" rel="noopener noreferrer" title="taler-deployment branch dev/hernani/goa-regio-ng-vanilla">vanilla</a> <a href="https://git.taler.net/taler/merchant/commit/b5af1c99052f4c5053070cd5c6cc39b68eca2a20.html" target="_blank" rel="noopener noreferrer" title="merchant tag v1.6.9">taler-merchant&nbsp;1.6.9</a>
<span class="sep">·</span> <span class="sep">·</span>
taler-merchant&nbsp;1.6.23 <a href="https://git.taler.net/taler/taler-typescript-core/commit/d7ab425239226b798a95dbf6742fe4b4a2e30e47.html" target="_blank" rel="noopener noreferrer" title="taler-typescript-core tag v1.6.8-dev.6">taler-merchant-webui&nbsp;1.6.8~dev6</a>
<span class="sep">·</span> <span class="sep">·</span>
taler-merchant-webui&nbsp;1.6.38 <a href="https://git.taler.net/taler/merchant/commit/b5af1c99052f4c5053070cd5c6cc39b68eca2a20.html" target="_blank" rel="noopener noreferrer" title="merchant tag v1.6.9">libtalermerchant&nbsp;1.6.9</a>
<span class="sep">·</span> <span class="sep">·</span>
libtalermerchant&nbsp;1.6.23 <a href="https://git.taler.net/taler/exchange/commit/fed7d0e782ea4d36b2d2e337d93bfd2723c6ed64.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.7-dev.2">libtalerexchange&nbsp;1.6.7~dev2</a>
<span class="sep">·</span> <span class="sep">·</span>
libtalerexchange&nbsp;1.6.15 <a href="https://git.taler.net/taler/exchange/commit/fed7d0e782ea4d36b2d2e337d93bfd2723c6ed64.html" target="_blank" rel="noopener noreferrer" title="exchange tag v1.6.7-dev.2">taler-terms-generator&nbsp;1.6.7~dev2</a>
<span class="sep">·</span>
taler-terms-generator&nbsp;1.6.15
</p> </p>
<!-- /stack-bar -->
<main> <main>
<header class="hero"> <header class="hero">
<span class="badge">Merchant · dual currency</span> <span class="badge">Merchant · dual currency</span>
@ -837,10 +833,10 @@ sudo apt-get install -y taler-wallet-cli</pre>
<a href="https://taler.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>. <a href="https://taler.hacktivism.ch/privacy" style="color:#5eead4">/privacy</a>.
</p> </p>
<!-- landing-rev --> <!-- landing-rev -->
<p class="landing-rev" data-landing-site="merchant" data-landing-version="43" data-landing-commit="0d881cd"> <p class="landing-rev" data-landing-site="merchant" data-landing-version="42" data-landing-commit="37ea4bb">
Merchant landing <strong>v43</strong> Merchant landing <strong>v42</strong>
· content <time datetime="2026-09-16T23:19:33+02:00">2026-09-16 23:19 CEST</time> · content <time datetime="2026-07-17T18:27:48+02:00">2026-07-17 18:27 CEST</time>
· <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" title="koopa-admin-log 0d881cd726da8d298c98114678253e3cbb7aa5e6">0d881cd</a> · <a href="https://git.hacktivism.ch/hernani/koopa-admin-log/commit/37ea4bb8396691e3ea69ae61374e6623bf6c5ea7" title="koopa-admin-log 37ea4bb8396691e3ea69ae61374e6623bf6c5ea7">37ea4bb</a>
</p> </p>
<!-- /landing-rev --> <!-- /landing-rev -->
</footer> </footer>

5
configs/notes/.env.example
View file

@ -1,5 +0,0 @@
# Live on koopa: ~/koopa-silverbullet/.env (not git)
# Allocate HOST_PORT only after live `ss` + Freigabe + ports.md update.
HOST_PORT=9028
# Optional SilverBullet app auth (prefer Caddy basicauth):
# SB_USER=hernani:changeme

44
configs/notes/Containerfile
View file

@ -1,44 +0,0 @@
# koopa-silverbullet — SilverBullet on CachyOS base + server binary
# Build on koopa (x86_64):
# bash ~/koopa-admin-log/scripts/notes/build.sh
# → localhost/koopa-silverbullet:cachyos
#
# Base: docker.io/cachyos/cachyos (Arch-derived). App binary from upstream
# silverbullet-server-linux-x86_64 release (not the Alpine ghcr image).
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
FROM ${CACHYOS_IMAGE}
ARG SB_VERSION=2.10.0
ARG SB_ZIP_URL=https://github.com/silverbulletmd/silverbullet/releases/download/${SB_VERSION}/silverbullet-server-linux-x86_64.zip
ENV SB_HOSTNAME=0.0.0.0 \
SB_FOLDER=/space \
SB_PORT=3000 \
SB_NAME=SilverBullet \
TZ=Europe/Zurich \
PATH=/usr/local/bin:$PATH
# catatonit = Arch/CachyOS container init (tini not in repos)
RUN pacman -Syu --noconfirm --needed \
bash curl git openssh catatonit unzip \
&& pacman -Scc --noconfirm \
&& rm -rf /var/cache/pacman/pkg/* /tmp/*
# Fetch + install server binary (build-time; no Deno in image)
RUN curl -fsSL "$SB_ZIP_URL" -o /tmp/sb.zip \
&& unzip -o /tmp/sb.zip -d /tmp \
&& install -m 755 /tmp/silverbullet /silverbullet \
&& /silverbullet --version || true \
&& rm -rf /tmp/sb.zip /tmp/silverbullet
COPY entrypoint.sh /docker-entrypoint.sh
RUN chmod 755 /docker-entrypoint.sh \
&& mkdir -p /space
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD curl -fsS "http://127.0.0.1:${SB_PORT}/.instance" || exit 1
WORKDIR /space
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]

65
configs/notes/README.md
View file

@ -1,65 +0,0 @@
# SilverBullet — SilverBullet on CachyOS (koopa)
Cross-host markdown notes (magikoopa + clementine). Stack name **SilverBullet** (parked web UI). Product **FreeNotes** = separate native enc notes (not this stack).
| Item | Value |
|------|--------|
| Stack | [SilverBullet](https://silverbullet.md/) server binary |
| Image | `localhost/koopa-silverbullet:cachyos` (`FROM docker.io/cachyos/cachyos`) |
| Live dir | `/home/hernani/koopa-silverbullet/` |
| Container | `koopa-silverbullet` |
| Host port | **9028** = Paivana paywall; app backend **127.0.0.1:19128** |
| Public site | `silverbullet.hacktivism.ch` |
| Auth | Paivana (GOA:42); no Caddy basic_auth |
| Forgejo space backup | private `hernani/freenotes` (historical name; SB space only) |
## Cutover freenotes → silverbullet (koopa)
Live still may be `~/koopa-freenotes` / CT `koopa-freenotes`. Scripts default dry-run; `--apply` needs Freigabe.
```bash
bash /path/to/koopa-admin-log/scripts/notes/status.sh
bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh
# Freigabe:
bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh --apply
```
See `scripts/notes/README.md` for seed + Caddy order. DNS: `silverbullet.hacktivism.ch`.
## Build + recreate (koopa)
```bash
# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
bash /path/to/koopa-admin-log/scripts/notes/build.sh
cd ~/koopa-silverbullet
podman-compose down
podman-compose up -d
bash /path/to/koopa-admin-log/scripts/notes/up.sh
```
## Caddy apply (sudo on koopa)
```bash
sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
# seed from secrets-enc SoT so apply does not rotate PASS
sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
```
Runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only). Never recreate `~/koopa-secrets`.
## Space SoT (Forgejo)
Private `hernani/freenotes` — live tree `~/koopa-silverbullet/space/` (git). On-koopa push uses oneshot HTTP token (no hernani SSH key in `~/.ssh`); laptop push via `git@git.hacktivism.ch:hernani/freenotes.git` (ProxyJump).
## Client apps (hosts)
Notes-like **system apps** (standalone Brave/Chrome `--app=` window + own profile): `configs/notes/client-apps/`.
- magikoopa: `~/Applications/SilverBullet.app` — `bash client-apps/install-magikoopa.sh`
- clementine (on-box): `silverbullet.desktop` — `bash client-apps/install-clementine.sh`
- optional: browser **Install app** (PWA) for Dock identity
## Plugs (SB)
`space/_plug/`: `treeview.plug.js`, `silversearch.plug.js` — see `PLUGS.md`.

23
configs/notes/client-apps/README.md
View file

@ -1,23 +0,0 @@
# SilverBullet — system Notes apps (hosts)
Goal: **like Apple Notes** — a real system app window on each laptop, not a browser bookmark and not SilverBullet plugs.
| Host | App | Behavior |
|------|-----|----------|
| magikoopa | `SilverBullet.app` → `~/Applications/` | Brave/Chrome **`--app=`** + own profile (`SilverBullet-BraveProfile`) — no tab bar |
| clementine | `silverbullet.desktop` | same `--app=` via Brave/Chromium + `~/.local/share/SilverBullet-browser` |
| both (optional) | Browser **Install app** / PWA | even closer to native Dock/menu identity |
**Not this:** `space/_plug/` (TreeView/SilverSearch) — those are in-editor extensions.
Install:
```bash
# magikoopa
bash configs/notes/client-apps/install-magikoopa.sh
# clementine (on-box)
bash configs/notes/client-apps/install-clementine.sh
```
First launch: log in once (Caddy basicauth); credentials stay in the app profile.

15
configs/notes/client-apps/SilverBullet.app/Contents/Info.plist
View file

@ -1,15 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleName</key><string>SilverBullet</string>
<key>CFBundleDisplayName</key><string>SilverBullet</string>
<key>CFBundleIdentifier</key><string>ch.hacktivism.silverbullet</string>
<key>CFBundleVersion</key><string>1</string>
<key>CFBundleShortVersionString</key><string>1.0</string>
<key>CFBundleExecutable</key><string>SilverBullet</string>
<key>CFBundlePackageType</key><string>APPL</string>
<key>LSMinimumSystemVersion</key><string>12.0</string>
<key>CFBundleIconFile</key><string>AppIcon</string>
</dict>
</plist>

31
configs/notes/client-apps/SilverBullet.app/Contents/MacOS/SilverBullet
View file

@ -1,31 +0,0 @@
#!/bin/bash
# SilverBullet — Notes-like system app (standalone window, not a browser tab)
URL="https://silverbullet.hacktivism.ch/"
USER_DATA="${HOME}/Library/Application Support/SilverBullet-BraveProfile"
mkdir -p "$USER_DATA"
BRAVE="/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"
CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
# Dedicated Chromium profile so this feels like its own app (Dock, cookies, no tab chrome)
if [[ -x "$BRAVE" ]]; then
exec "$BRAVE" \
--user-data-dir="$USER_DATA" \
--class=SilverBullet \
--app="$URL" \
--name=SilverBullet
elif [[ -x "$CHROME" ]]; then
exec "$CHROME" \
--user-data-dir="$USER_DATA" \
--class=SilverBullet \
--app="$URL" \
--name=SilverBullet
else
# last resort: Safari has no --app; open dedicated window via osascript
exec osascript <<'OSA'
tell application "Safari"
activate
make new document with properties {URL:"https://silverbullet.hacktivism.ch/"}
end tell
OSA
fi

13
configs/notes/client-apps/install-clementine.sh
View file

@ -1,13 +0,0 @@
#!/usr/bin/env bash
# Install SilverBullet XFCE launcher on clementine (on-box). No Freigabe (user home).
set -euo pipefail
SRC="$(cd "$(dirname "$0")" && pwd)/silverbullet.desktop"
APPDIR="${HOME}/.local/share/applications"
DESK="${HOME}/Desktop"
mkdir -p "$APPDIR" "$DESK"
install -m 0644 "$SRC" "$APPDIR/silverbullet.desktop"
install -m 0644 "$SRC" "$DESK/silverbullet.desktop"
# refresh menu cache if available
command -v update-desktop-database >/dev/null && update-desktop-database "$APPDIR" || true
echo "STATUS=ok DESKTOP=$APPDIR/silverbullet.desktop SHORTCUT=$DESK/silverbullet.desktop"
echo "TIP=open https://silverbullet.hacktivism.ch then browser Install app for PWA"

34
configs/notes/client-apps/install-magikoopa.sh
View file

@ -1,34 +0,0 @@
#!/usr/bin/env bash
# Install SilverBullet.app into ~/Applications (magikoopa). No Freigabe (user home).
set -euo pipefail
SRC="$(cd "$(dirname "$0")" && pwd)/SilverBullet.app"
DEST="${HOME}/Applications/SilverBullet.app"
URL="${HOME}/Desktop/SilverBullet.url"
mkdir -p "${HOME}/Applications" "${HOME}/Desktop"
if [[ -d "$SRC" ]]; then
rm -rf "$DEST"
cp -R "$SRC" "$DEST"
else
# bootstrap minimal app if scaffold app tree missing
mkdir -p "$DEST/Contents/MacOS" "$DEST/Contents/Resources"
cat >"$DEST/Contents/Info.plist" <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleName</key><string>SilverBullet</string>
<key>CFBundleDisplayName</key><string>SilverBullet</string>
<key>CFBundleIdentifier</key><string>ch.hacktivism.silverbullet</string>
<key>CFBundleVersion</key><string>1</string>
<key>CFBundleShortVersionString</key><string>1.0</string>
<key>CFBundleExecutable</key><string>SilverBullet</string>
<key>CFBundlePackageType</key><string>APPL</string>
<key>LSMinimumSystemVersion</key><string>12.0</string>
</dict>
</plist>
PLIST
printf '%s\n' '#!/bin/bash' 'open "https://silverbullet.hacktivism.ch/"' >"$DEST/Contents/MacOS/SilverBullet"
chmod +x "$DEST/Contents/MacOS/SilverBullet"
fi
printf '%s\n' '[InternetShortcut]' 'URL=https://silverbullet.hacktivism.ch/' >"$URL"
echo "STATUS=ok APP=$DEST URL=$URL"

12
configs/notes/client-apps/silverbullet.desktop
View file

@ -1,12 +0,0 @@
[Desktop Entry]
Version=1.0
Type=Application
Name=SilverBullet
Comment=Notes-like SilverBullet on koopa — standalone window
TryExec=brave-browser
Exec=sh -c 'B=""; for c in brave-browser brave chromium chromium-browser google-chrome; do command -v "$c" >/dev/null && B="$c" && break; done; if [ -n "$B" ]; then exec "$B" --user-data-dir="$HOME/.local/share/SilverBullet-browser" --class=SilverBullet --app=https://silverbullet.hacktivism.ch/; else exec xdg-open https://silverbullet.hacktivism.ch/; fi'
Terminal=false
Categories=Office;Network;
Keywords=notes;todo;silverbullet;
StartupWMClass=SilverBullet
StartupNotify=true

38
configs/notes/compose.yml
View file

@ -1,38 +0,0 @@
# koopa-silverbullet — SilverBullet on CachyOS base (parked; FreeNotes = native enc)
# Live: /home/hernani/koopa-silverbullet/
# Build: bash ~/koopa-admin-log/scripts/notes/build.sh → localhost/koopa-silverbullet:cachyos
#
# Public :9028 = koopa-paivana-silverbullet (shared paivana image).
# Backend on pasta host IP — Paivana DEST → 172.17.0.1:19128 (not LAN 0.0.0.0)
services:
notes:
image: localhost/koopa-silverbullet:cachyos
build:
context: .
dockerfile: Containerfile
args:
SB_VERSION: "${SB_VERSION:-2.10.0}"
container_name: koopa-silverbullet
restart: unless-stopped
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Zurich
- SB_INDEX_PAGE=index
- SB_NAME=SilverBullet
- SB_SHELL_BACKEND=off
# Optional app-layer auth (prefer Caddy basicauth; leave empty in .env to skip):
# - SB_USER=${SB_USER}
volumes:
- ./space:/space
ports:
- "172.17.0.1:${BACKEND_PORT:-19128}:3000"
labels:
org.hacktivism.service: silverbullet
org.hacktivism.host_port: "9028"
org.hacktivism.backend_port: "${BACKEND_PORT:-19128}"
org.hacktivism.site: silverbullet.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.port_status: backend-19128-paywall-9028
org.hacktivism.image_base: cachyos

28
configs/notes/container-koopa-silverbullet.service
View file

@ -1,28 +0,0 @@
# container-koopa-silverbullet.service
# Install on koopa as hernani (after compose create):
# mkdir -p ~/.config/systemd/user
# cp configs/notes/container-koopa-silverbullet.service ~/.config/systemd/user/
# systemctl --user daemon-reload
# systemctl --user enable --now container-koopa-silverbullet.service
# Requires: loginctl enable-linger hernani (root, once)
#
# Container must already exist (podman-compose up -d once).
[Unit]
Description=Podman container-koopa-silverbullet.service (SilverBullet)
Documentation=https://silverbullet.md/
Wants=network-online.target
After=network-online.target
RequiresMountsFor=/run/user/1000/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
TimeoutStopSec=90
ExecStart=/usr/bin/podman start koopa-silverbullet
ExecStop=/usr/bin/podman stop -t 20 koopa-silverbullet
ExecStopPost=/usr/bin/podman stop -t 20 koopa-silverbullet
Type=forking
[Install]
WantedBy=default.target

36
configs/notes/entrypoint.sh
View file

@ -1,36 +0,0 @@
#!/bin/bash
# SilverBullet entrypoint (CachyOS/Arch user tools).
# Adapted from upstream docker-entrypoint.sh (busybox → shadow useradd).
set -euo pipefail
if [[ -f /space/CONTAINER_BOOT.md ]]; then
echo "Executing CONTAINER_BOOT.md script"
bash /space/CONTAINER_BOOT.md &
fi
SB_FOLDER="${SB_FOLDER:-/space}"
if [[ -z "${PUID:-}" && "$(id -u)" == "0" ]]; then
PUID=$(stat -c "%u" "$SB_FOLDER")
echo "Will run SilverBullet with UID $PUID (from owner of $SB_FOLDER)"
fi
if [[ -z "${PGID:-}" ]]; then
PGID=$(stat -c "%g" "$SB_FOLDER")
fi
if [[ "${PUID:-0}" == "0" || "$(id -u)" != "0" ]]; then
exec /silverbullet "$@"
fi
echo "Creating silverbullet user UID=$PUID GID=$PGID"
getent group silverbullet >/dev/null 2>&1 || groupadd -g "$PGID" silverbullet || groupadd -o -g "$PGID" silverbullet
getent passwd silverbullet >/dev/null 2>&1 || useradd -M -N -g silverbullet -u "$PUID" -d "$SB_FOLDER" -s /bin/bash silverbullet \
|| useradd -o -M -N -g silverbullet -u "$PUID" -d "$SB_FOLDER" -s /bin/bash silverbullet
echo "Running SilverBullet as PUID=$PUID PGID=$PGID"
# quote-safe: pass args via "$@" under su -c is awkward; use runuser when present
if command -v runuser >/dev/null 2>&1; then
exec runuser -u silverbullet -- /silverbullet "$@"
fi
args=$(printf '%q ' "$@")
exec su silverbullet -s /bin/bash -c "/silverbullet $args"

12
configs/notes/space/PLUGS.md
View file

@ -1,12 +0,0 @@
# Plugs (apps)
Third-party SilverBullet plugs in (loaded automatically).
| Plug | Role |
|------|------|
| treeview.plug.js | Folder sidebar (Apple Notes-like) |
| silversearch.plug.js | Full-text search |
Install/update: drop into , reload SilverBullet.
Builtin SB plugs stay in the image; only extras live here.

31
configs/notes/space/TODO.md
View file

@ -1,31 +0,0 @@
# TODO
Canonical ADHD todo (SilverBullet space SoT; FreeNotes = separate native enc).
## Now (max 3) — active quest board
- [x] magikoopa SilverBullet.app (`~/Applications`) + Desktop SilverBullet.url
- [ ] Install silverbullet.desktop on clementine (on-box: client-apps/install-clementine.sh)
- [ ] One-shot migrate: Apple Notes export + Dokumente/TODO.md → here (or FreeNotes later)
- [ ] Human sudo: confirm `sudo ls -la /etc/caddy/secrets/silverbullet-basicauth.txt`
- [ ] Live cutover Freigabe: dir/container → koopa-silverbullet; Caddy → silverbullet.hacktivism.ch; DNS
## Next
- [x] Private Forgejo backup remote for space/ (hernani/freenotes — historical name)
- [x] Seed notes space on koopa
- [x] Caddy merge + basicauth scripts (live cutover pending Freigabe)
- [ ] DNS / public hostname silverbullet.hacktivism.ch (human)
- [x] Update productivity-adhd-notes 02 / 02b → single SoT pointing here
- [x] Wire magikoopa SSH push to hernani/freenotes (ProxyJump) — clone ~/git/freenotes
## Someday / amnesty
- [ ] PWA install both laptops (browser Install app)
- [ ] Second-layer SB_USER if basicauth alone is not enough
- [ ] TreeView / SilverSearch UX polish after first week
## Stats (gamification — agent updates)
- Session streak: 1
- Quests finished today: 6
- XP today: 60
- Last win: rename stack freenotes → silverbullet
- Boss: silverbullet cutover
- Boss HP: 70%

21
configs/notes/space/_plug/silversearch.plug.js
View file

File diff suppressed because one or more lines are too long

39
configs/notes/space/_plug/treeview.plug.js
View file

File diff suppressed because one or more lines are too long

13
configs/notes/space/inbox.md
View file

@ -1,13 +0,0 @@
# Inbox
Apple **Quick Note** analogue. Dump here first; triage into [[TODO]] (Now / Next / Waiting / Someday) or a dedicated page.
Rules:
- Empty capture OK — fill the next `- [ ]` line and save.
- Do not create a new folder just to capture.
- After triage, clear or check off lines so Inbox stays short.
## Capture
- [ ]

46
configs/notes/space/index.md
View file

@ -1,46 +0,0 @@
---
# SilverBullet index page (SB_INDEX_PAGE=index)
# Apple-Notes-like home: pins + capture path + search
---
# Notes
Cross-host notes (magikoopa + clementine) via koopa SilverBullet.
Mental model = Apple Notes: **folders/pages · list · editor**, pin primary TODO, Quick Note → triage.
| Page | Apple analogue | Role |
|------|----------------|------|
| [[TODO]] | Pinned primary note | ADHD SoT: Now≤3 / Next / Waiting / Someday / Stats |
| [[inbox]] | Quick Note | Capture before triage |
## Pins
- [[TODO]]
- [[inbox]]
## How to use (Apple habits → here)
1. **Capture** into [[inbox]] (or SB quick-note if enabled) — do not invent folders first.
2. **Triage** into [[TODO]] sections (Now max 3). Same rules as former Apple Notes guide.
3. **Find** with Page Picker / search (**Cmd/Ctrl-K**).
4. **New page** when a topic is not a todo (meetings, dumps) — link from TODO by title, do not dump transcripts into TODO.
5. Optional later: TreeView plug (folder sidebar), Space Lua query page = “smart folder” for `#tag` open tasks.
## Shortcuts (target)
| Action | Typical SB |
|--------|------------|
| Open page / filter | Cmd/Ctrl-K (Page Picker) |
| Quick note | Ctrl-q (if client supports) → prefer landing in [[inbox]] |
| Search body | built-in search / SilverSearch plug |
## Hygiene (from Apple Notes ADHD pack)
- One primary [[TODO]] — no competing systems.
- Capture first; tags (`#taler` …) optional and light.
- On “I’m back”: re-read **Now** only.
- No passwords/tokens in notes.
## Apps
- [[PLUGS]] — TreeView + SilverSearch

40
configs/paivana/README.md
View file

@ -2,32 +2,27 @@
GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments. GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.
One process = one `BASE_URL` + one `DESTINATION_BASE_URL` + one `MERCHANT_BACKEND_URL`.
Shared **image / secrets / entrypoint / conf template**; per-service env sets
`PAIVANA_BASE_URL` + `PAIVANA_DESTINATION_BASE_URL`. Portal on **9025**; app
paywalls on **9028–9031** (Caddy unchanged). App backends listen loopback only
(`19128` SilverBullet, `19129` Galene HTTP, `19130` CryptPad edge, `19131` Meet).
| Item | Value | | Item | Value |
|------|--------| |------|--------|
| Live | `/home/hernani/koopa-paivana/` | | Live | `/home/hernani/koopa-paivana/` |
| Containers | `koopa-paivana`, `koopa-paivana-{silverbullet,galene,cryptpad,meet}`, `koopa-paivana-upstream` | | Containers | `koopa-paivana`, `koopa-paivana-upstream` |
| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` | | Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
| Upstream | portal: `nginxinc/nginx-unprivileged` on **:8080**; apps via pasta host IP `172.17.0.1:19128–19131` (compose publish, not `127.0.0.1`) | | Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
| Host ports | **9025** portal; **9028/9029/9030/9031** app paywalls → Caddy | | Host port | **9025** → Caddy `paivana.hacktivism.ch` |
| Currency | **multi** via goa-shop template `paivana` choices (CHF / FLOODS / GOA / TESTPAYSAN); wallet still filters by held coins | | Currency | **GOA** |
| Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` | | Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
| Template | `paivana` (`template_type: paivana`, amount **`GOA:42`**, `website_regex: .*`) | | Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
| Access | **`-g`** site-wide: pay once → that hostname free to browse | | Access | **`-g`** site-wide: pay once → example upstream free to browse |
| Upstream | example site in `upstream/` (compose service) |
## Layout ## Layout
| Path | Role | | Path | Role |
|------|------| |------|------|
| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs | | `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
| `compose.yml` | portal + 4 app paywalls + nginx upstream (YAML anchor `x-paivana-common`) | | `compose.yml` | `koopa-paivana` + nginx upstream |
| `conf/paivana.conf.template` | Shared conf; `@BASE_URL@` / `@DESTINATION_BASE_URL@` / secrets at start | | `conf/paivana.conf.template` | Config; secrets substituted at start |
| `entrypoint.sh` | Env + secrets → run `paivana-httpd -g -f` | | `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
| `secrets/` | **not in git** — live only | | `secrets/` | **not in git** — live only |
| `upstream/` | Protected demo content | | `upstream/` | Protected demo content |
| `container-koopa-paivana.service` | systemd --user oneshot compose up | | `container-koopa-paivana.service` | systemd --user oneshot compose up |
@ -95,10 +90,9 @@ extra_hosts:
| Check | Expect | | Check | Expect |
|-------|--------| |-------|--------|
| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` | | `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` |
| `curl -si http://127.0.0.1:902{8,9,0}/` | **302** same template path (per-host BASE_URL) | | `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` |
| `https://{paivana,silverbullet,galene,cryptpad,meet}.hacktivism.ch/` | unpaid → **302** `…/templates/paivana#…` (or paywall HTML) |
| monitoring `urls` | `www.paivana` OK | | monitoring `urls` | `www.paivana` OK |
| e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:42** (wenn `E2E_PAIVANA=1`) | | e2e (GOA, lokal) | `e2e.paivana` Template-Pay **GOA:4200** (wenn `E2E_PAIVANA=1`) |
--- ---
@ -143,26 +137,22 @@ Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).
## Merchant template ## Merchant template
Create (or replace via PATCH / DELETE+POST — see live merchant API):
```bash ```bash
curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \ curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
-H "Authorization: Bearer secret-token:…" \ -H "Authorization: Bearer secret-token:…" \
-H 'Content-Type: application/json' \ -H 'Content-Type: application/json' \
-d '{ -d '{
"template_id": "paivana", "template_id": "paivana",
"template_description": "Paivana paywall portal (GOA)", "template_description": "Paivana paywall (GOA)",
"template_contract": { "template_contract": {
"template_type": "paivana", "template_type": "paivana",
"summary": "Access to paivana.hacktivism.ch portal", "summary": "Access to paivana.hacktivism.ch",
"website_regex": ".*", "website_regex": ".*",
"choices": [{ "amount": "GOA:42", "description": "Unlock portal (cryptpad / galene / silverbullet links)" }] "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
} }
}' }'
``` ```
goa-shop template `paivana` exposes multi-currency **choices**. Wallet/UI still only offers currencies the wallet holds. Live conf must use `instances/goa-shop/` + matching merchant token (not `goa-demo-*`).
## Docs ## Docs
- https://docs.taler.net/taler-paivana-manual.html - https://docs.taler.net/taler-paivana-manual.html

104
configs/paivana/compose.yml
View file

@ -1,21 +1,21 @@
# koopa-paivana — shared image/secrets/entrypoint for portal + app paywalls # koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
# Live: /home/hernani/koopa-paivana/ # Live: /home/hernani/koopa-paivana/
# services:
# Public Caddy targets (unchanged): paivana:
# 9025 → portal (paivana.hacktivism.ch) build:
# 9028 → paywall silverbullet context: .
# 9029 → paywall galene dockerfile: Containerfile
# 9030 → paywall cryptpad
# 9031 → paywall meet (Jitsi web)
# App backends on pasta host IP (see app compose; not LAN 0.0.0.0):
# 172.17.0.1:19128 / 19129 / 19130 / 19131
x-paivana-common: &paivana-common
image: localhost/koopa-paivana:latest image: localhost/koopa-paivana:latest
container_name: koopa-paivana
restart: unless-stopped restart: unless-stopped
# Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
user: "1000:1000" user: "1000:1000"
userns_mode: keep-id userns_mode: keep-id
ports:
- "9025:9967"
extra_hosts: extra_hosts:
# pasta publishes merchant on host :9010. Prefer fixed IPv4 — host-gateway
# alone still loses to public AAAA and times out from the container.
- "taler.hacktivism.ch:172.17.0.1" - "taler.hacktivism.ch:172.17.0.1"
- "bank.hacktivism.ch:172.17.0.1" - "bank.hacktivism.ch:172.17.0.1"
- "exchange.hacktivism.ch:172.17.0.1" - "exchange.hacktivism.ch:172.17.0.1"
@ -24,22 +24,6 @@ x-paivana-common: &paivana-common
- ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
- ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
- ./secrets/paivana-secret:/run/secrets/paivana-secret:ro - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
labels:
org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi
services:
paivana:
<<: *paivana-common
build:
context: .
dockerfile: Containerfile
container_name: koopa-paivana
ports:
- "9025:9967"
environment:
PAIVANA_BASE_URL: https://paivana.hacktivism.ch/
PAIVANA_DESTINATION_BASE_URL: http://upstream:8080/
depends_on: depends_on:
- upstream - upstream
labels: labels:
@ -47,70 +31,10 @@ services:
org.hacktivism.host_port: "9025" org.hacktivism.host_port: "9025"
org.hacktivism.site: paivana.hacktivism.ch org.hacktivism.site: paivana.hacktivism.ch
org.hacktivism.managed_by: koopa-admin org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi org.hacktivism.currency: GOA
# App paywalls: same image/secrets; BASE/DEST via env. Caddy still hits 9028–9031.
paivana-silverbullet:
<<: *paivana-common
container_name: koopa-paivana-silverbullet
ports:
- "9028:9967"
environment:
PAIVANA_BASE_URL: https://silverbullet.hacktivism.ch/
PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19128/
labels:
org.hacktivism.service: paivana-silverbullet
org.hacktivism.host_port: "9028"
org.hacktivism.site: silverbullet.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi
paivana-galene:
<<: *paivana-common
container_name: koopa-paivana-galene
ports:
- "9029:9967"
environment:
PAIVANA_BASE_URL: https://galene.hacktivism.ch/
PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19129/
labels:
org.hacktivism.service: paivana-galene
org.hacktivism.host_port: "9029"
org.hacktivism.site: galene.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi
paivana-cryptpad:
<<: *paivana-common
container_name: koopa-paivana-cryptpad
ports:
- "9030:9967"
environment:
PAIVANA_BASE_URL: https://cryptpad.hacktivism.ch/
PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19130/
labels:
org.hacktivism.service: paivana-cryptpad
org.hacktivism.host_port: "9030"
org.hacktivism.site: cryptpad.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi
paivana-meet:
<<: *paivana-common
container_name: koopa-paivana-meet
ports:
- "9031:9967"
environment:
PAIVANA_BASE_URL: https://meet.hacktivism.ch/
PAIVANA_DESTINATION_BASE_URL: http://172.17.0.1:19131/
labels:
org.hacktivism.service: paivana-meet
org.hacktivism.host_port: "9031"
org.hacktivism.site: meet.hacktivism.ch
org.hacktivism.managed_by: koopa-admin
org.hacktivism.currency: multi
upstream: upstream:
# Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
container_name: koopa-paivana-upstream container_name: koopa-paivana-upstream
restart: unless-stopped restart: unless-stopped

8
configs/paivana/conf/paivana.conf.template
View file

@ -1,14 +1,14 @@
# Shared paivana-httpd conf — BASE/DEST injected by entrypoint (env). # paivana.hacktivism.ch — paywall reverse proxy
# Secrets injected from /run/secrets/ # Secrets injected by entrypoint from /run/secrets/
[paivana] [paivana]
SERVE = tcp SERVE = tcp
PORT = 9967 PORT = 9967
BIND_TO = 0.0.0.0 BIND_TO = 0.0.0.0
BASE_URL = @BASE_URL@ BASE_URL = https://paivana.hacktivism.ch/
DESTINATION_BASE_URL = @DESTINATION_BASE_URL@ DESTINATION_BASE_URL = http://upstream:8080/
MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/ MERCHANT_BACKEND_URL = https://taler.hacktivism.ch/instances/goa-shop/
MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@ MERCHANT_ACCESS_TOKEN = @MERCHANT_ACCESS_TOKEN@

8
configs/paivana/entrypoint.sh
View file

@ -5,10 +5,6 @@ SECRET_FILE="${PAIVANA_SECRET_FILE:-/run/secrets/paivana-secret}"
TEMPLATE="${PAIVANA_CONF_TEMPLATE:-/etc/paivana/paivana.conf.template}" TEMPLATE="${PAIVANA_CONF_TEMPLATE:-/etc/paivana/paivana.conf.template}"
OUT="${PAIVANA_CONF:-/tmp/paivana.conf}" OUT="${PAIVANA_CONF:-/tmp/paivana.conf}"
# Per-instance (portal + app paywalls share this entrypoint/image).
BASE_URL="${PAIVANA_BASE_URL:-https://paivana.hacktivism.ch/}"
DEST_URL="${PAIVANA_DESTINATION_BASE_URL:-http://upstream:8080/}"
if [ ! -r "$TOKEN_FILE" ]; then if [ ! -r "$TOKEN_FILE" ]; then
echo "missing merchant token: $TOKEN_FILE" >&2 echo "missing merchant token: $TOKEN_FILE" >&2
exit 1 exit 1
@ -21,12 +17,10 @@ fi
TOKEN=$(tr -d '\n\r' < "$TOKEN_FILE") TOKEN=$(tr -d '\n\r' < "$TOKEN_FILE")
SECRET=$(tr -d '\n\r' < "$SECRET_FILE") SECRET=$(tr -d '\n\r' < "$SECRET_FILE")
awk -v t="$TOKEN" -v s="$SECRET" -v b="$BASE_URL" -v d="$DEST_URL" ' awk -v t="$TOKEN" -v s="$SECRET" '
{ {
gsub(/@MERCHANT_ACCESS_TOKEN@/, t) gsub(/@MERCHANT_ACCESS_TOKEN@/, t)
gsub(/@PAIVANA_SECRET@/, s) gsub(/@PAIVANA_SECRET@/, s)
gsub(/@BASE_URL@/, b)
gsub(/@DESTINATION_BASE_URL@/, d)
print print
} }
' "$TEMPLATE" > "$OUT" ' "$TEMPLATE" > "$OUT"

32
configs/paivana/upstream/index.html
View file

@ -3,7 +3,7 @@
<head> <head>
<meta charset="utf-8"/> <meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/> <meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>hacktivism tools — unlocked</title> <title>Example site — free after GOA:4200</title>
<style> <style>
:root { color-scheme: light dark; } :root { color-scheme: light dark; }
body { body {
@ -26,41 +26,29 @@
.price { font-variant-numeric: tabular-nums; } .price { font-variant-numeric: tabular-nums; }
code { background: color-mix(in srgb, CanvasText 12%, transparent); padding: 0.1em 0.35em; border-radius: 3px; } code { background: color-mix(in srgb, CanvasText 12%, transparent); padding: 0.1em 0.35em; border-radius: 3px; }
.card { .card {
margin-top: 1.25rem; margin-top: 1.5rem;
padding: 1rem 1.1rem; padding: 1rem 1.1rem;
border: 1px solid color-mix(in srgb, CanvasText 18%, transparent); border: 1px solid color-mix(in srgb, CanvasText 18%, transparent);
border-radius: 10px; border-radius: 10px;
} }
ul { padding-left: 1.2rem; } ul { padding-left: 1.2rem; }
a { color: inherit; }
.sites a {
display: block;
margin: 0.45rem 0;
font-weight: 600;
}
</style> </style>
</head> </head>
<body> <body>
<span class="badge">unlocked</span> <span class="badge">unlocked</span>
<h1>hacktivism tools</h1> <h1>Example site</h1>
<p> <p>
You paid once via GNU Taler / Paivana You paid <strong class="price">GOA:4200</strong> once via GNU Taler / Paivana.
(template <code>paivana</code> on <code>goa-shop</code>: CHF / FLOODS / GOA / TESTPAYSAN choices). This whole example site is now free for you to browse (site-wide access cookie).
Site-wide access cookie is set for <code>paivana.hacktivism.ch</code>.
</p> </p>
<div class="card sites">
<p><strong>Sites</strong></p>
<a href="https://cryptpad.hacktivism.ch/">cryptpad.hacktivism.ch</a>
<a href="https://galene.hacktivism.ch/">galene.hacktivism.ch</a>
<a href="https://silverbullet.hacktivism.ch/">silverbullet.hacktivism.ch</a>
</div>
<div class="card"> <div class="card">
<p><strong>Notes</strong></p> <p><strong>What this demonstrates</strong></p>
<ul> <ul>
<li>One Paivana process = one <code>DESTINATION_BASE_URL</code> → this portal is the gated upstream.</li> <li>Paywall: <code>paivana-httpd</code> in front of a normal upstream HTTP site</li>
<li>Merchant: <code>goa-shop</code> · template <code>paivana</code> (multi-currency choices).</li> <li>Currency: exploration money <code>GOA</code> on exchange.hacktivism.ch</li>
<li>Host: <code>https://paivana.hacktivism.ch/</code></li> <li>After payment: no further charge for pages behind this proxy</li>
</ul> </ul>
<p style="margin-bottom:0">Host: <code>https://paivana.hacktivism.ch/</code></p>
</div> </div>
</body> </body>
</html> </html>

65
configs/ports.md
View file

@ -1,4 +1,4 @@
# Port map (koopa) # Port map (see also host/overview/services.md)
| Port | Role | | Port | Role |
|------|------| |------|------|
@ -7,44 +7,31 @@
| 443 | systemd `https-proxy.socket` → Caddy **9001** | | 443 | systemd `https-proxy.socket` → Caddy **9001** |
| 9000 | Caddy HTTP + ACME webroot | | 9000 | Caddy HTTP + ACME webroot |
| 9001 | Caddy HTTPS (vhosts) | | 9001 | Caddy HTTPS (vhosts) |
| **9010** | `goa-regio-ng` merchant API (HTTPS in CTR) | | 9010 | podman `taler-hacktivism` (merchant) |
| **9011** | `goa-regio-ng` exchange | | 9011 | podman **`taler-hacktivism-exchange-ansible`** (exchange) |
| **9012** | `goa-regio-ng` libeufin-bank | | 9012 | podman `taler-hacktivism-bank` (libeufin-bank) |
| **9013–9015** | bank / exchange / merchant public landings (host nginx) | | 9013–9015 | bank / exchange / merchant public landings |
| 9020 | `koopa-castopod` → `castopod.hacktivism.ch` | | 9020 | podman `koopa-castopod` → Caddy `castopod.hacktivism.ch` |
| 9021 | `koopa-bonfire` → `bonfire.hacktivism.ch` | | 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |
| 9022 | `koopa-prime` (Jellyfin) → `prime.hacktivism.ch` | | 9022 | podman `koopa-prime` (Jellyfin) → Caddy `prime.hacktivism.ch` |
| 9023 | qBittorrent WebUI → `bt.hacktivism.ch` | | 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
| **6881** | qBittorrent BT listen (tcp+udp; firewalld + VeciGate DNAT) | | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
| **9024** | `koopa-forgejo` (HTTP) → **`git.hacktivism.ch`** | | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
| **9025** | `koopa-paivana` → `paivana.hacktivism.ch` | | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
| **9026** | `koopa-lemmy-proxy` → `lemmy.hacktivism.ch` | | **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
| **9027** | `koopa-decidim` → `decidim.hacktivism.ch` | | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
| **9028** | `koopa-paivana-silverbullet` → `silverbullet.hacktivism.ch` | | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
| **9029** | `koopa-paivana-galene` → `galene.hacktivism.ch` | | 8080 | Tor ORPort |
| **9030** | `koopa-paivana-cryptpad` → `cryptpad.hacktivism.ch` |
| **9031** | `koopa-paivana-meet` → `meet.hacktivism.ch` |
| **9032** | `koopa-bbb-front` → `bbb.hacktivism.ch` |
| **9200** | Forgejo git-SSH (host-direct; not Caddy) |
| 9090–9092 | `koopa-tops-ng1`…`ng3` → `tops.ng{1,2,3}.hacktivism.ch` |
| **8080** | host `tor.service` ORPort |
| **9051** | host Tor ControlPort (loopback) |
VeciGate: WAN **80→9000**, WAN **443→9001**. VeciGate: WAN **80→9000**, WAN **443→9001**.
Public apps: Caddy on **9001** → 127.0.0.1:{9010–9015, 9020–9032, 9090–9092}. Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.
Git SSH needs **9200/tcp** if exposed to WAN. Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
| UDP range | Role | | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
|-----------|------| | **1790** | podman **`koopa-nym`** verloc |
| **10000–10099/udp** | Galene WebRTC | | **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) |
| **19000** | optional nym entry WS (gateway mode) |
| Extra | Role | | **51822/udp** | optional nym WireGuard (dVPN path) |
|-------|------| | **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) |
| **1789** | `koopa-nym` mixnet | | **9322** | lab **`goa-regio-ng`** SSH/ansible (loopback only) |
| **1790** | `koopa-nym` verloc | | **8288** | lab **`mytops-local`** HTTP (loopback only) |
| **9080** | `koopa-nym` HTTP API |
| **9180** | lab `goa-regio-ng` HTTP (loopback; `configs/lab-local/`) |
| **9322** | lab `goa-regio-ng` SSH/ansible (loopback) |
| **8288** | lab `mytops-local` HTTP (loopback) |
login-health inventory: `scripts/login-health/koopa-login-health.sh`.

1
configs/prime/README.md
View file

@ -6,7 +6,6 @@
| Compose | `compose.yml` (this dir; **no secret values**) | | Compose | `compose.yml` (this dir; **no secret values**) |
| Jellyfin | **9022** → Caddy `prime.hacktivism.ch` | | Jellyfin | **9022** → Caddy `prime.hacktivism.ch` |
| qBittorrent | **9023** → Caddy `bt.hacktivism.ch` | | qBittorrent | **9023** → Caddy `bt.hacktivism.ch` |
| BT listen | **6881** tcp+udp (firewalld + VeciGate DNAT); apply `scripts/prime/apply-qbittorrent-bt-net.sh` |
| Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` | | Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` |
`WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in `WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in

79
configs/shared/landing-stack-versions.json
View file

@ -1,79 +0,0 @@
{
"updated_iso": "2026-09-16T23:19:33+02:00",
"updated_human": "2026-09-16 23:19 CEST",
"ctr": "goa-regio-ng",
"ssh": "hernani@192.168.100.95",
"packages": {
"libeufin-bank": {
"dpkg": "1.6.10-0+trixie",
"display": "1.6.10"
},
"libeufin-bank-webui": {
"dpkg": "1.6.38-0+trixie",
"display": "1.6.38"
},
"libeufin-common": {
"dpkg": "1.6.10-0+trixie",
"display": "1.6.10"
},
"libtalerexchange": {
"dpkg": "1.6.15-0+trixie",
"display": "1.6.15"
},
"libtalermerchant": {
"dpkg": "1.6.23-0+trixie",
"display": "1.6.23"
},
"taler-exchange": {
"dpkg": "1.6.15-0+trixie",
"display": "1.6.15"
},
"taler-exchange-database": {
"dpkg": "1.6.15-0+trixie",
"display": "1.6.15"
},
"taler-exchange-offline": {
"dpkg": "1.6.15-0+trixie",
"display": "1.6.15"
},
"taler-merchant": {
"dpkg": "1.6.23-0+trixie",
"display": "1.6.23"
},
"taler-merchant-webui": {
"dpkg": "1.6.38-0+trixie",
"display": "1.6.38"
},
"taler-terms-generator": {
"dpkg": "1.6.15-0+trixie",
"display": "1.6.15"
}
},
"sites": {
"bank": {
"packages": {
"libeufin-bank": "1.6.10",
"libeufin-common": "1.6.10",
"libeufin-bank-webui": "1.6.38"
}
},
"exchange": {
"packages": {
"taler-exchange": "1.6.15",
"libtalerexchange": "1.6.15",
"taler-exchange-database": "1.6.15",
"taler-exchange-offline": "1.6.15",
"taler-terms-generator": "1.6.15"
}
},
"merchant": {
"packages": {
"taler-merchant": "1.6.23",
"taler-merchant-webui": "1.6.38",
"libtalermerchant": "1.6.23",
"libtalerexchange": "1.6.15",
"taler-terms-generator": "1.6.15"
}
}
}
}

35
configs/shared/landing-stack.json
View file

@ -1,35 +0,0 @@
{
"note": "Stack-bar package lists per landing. Versions filled by scripts/taler-landing/stamp-landing-stack.sh from live CTR dpkg. Only hard link = vanilla branch.",
"vanilla_href": "https://git.taler.net/taler-deployment.git/tree/?h=dev/hernani/goa-regio-ng-vanilla",
"vanilla_title": "taler-deployment branch dev/hernani/goa-regio-ng-vanilla",
"sites": {
"bank": {
"title": "Taler software on this bank service (goa-regio-ng vanilla)",
"packages": [
"libeufin-bank",
"libeufin-common",
"libeufin-bank-webui"
]
},
"exchange": {
"title": "Taler software on this exchange service (goa-regio-ng vanilla)",
"packages": [
"taler-exchange",
"libtalerexchange",
"taler-exchange-database",
"taler-exchange-offline",
"taler-terms-generator"
]
},
"merchant": {
"title": "Taler software on this merchant service (goa-regio-ng vanilla)",
"packages": [
"taler-merchant",
"taler-merchant-webui",
"libtalermerchant",
"libtalerexchange",
"taler-terms-generator"
]
}
}
}

36
configs/shared/landing-version.json
View file

@ -2,34 +2,34 @@
"note": "Per-site landing content versions (start 42). Bump: scripts/taler-landing/stamp-landing-version.sh --bump bank|exchange|merchant", "note": "Per-site landing content versions (start 42). Bump: scripts/taler-landing/stamp-landing-version.sh --bump bank|exchange|merchant",
"sites": { "sites": {
"bank": { "bank": {
"version": 45, "version": 44,
"label": "Bank landing", "label": "Bank landing",
"path": "configs/bank-landing", "path": "configs/bank-landing",
"updated_iso": "2026-09-16T23:19:33+02:00", "updated_iso": "2026-07-17T18:31:49+02:00",
"updated_human": "2026-09-16 23:19 CEST", "updated_human": "2026-07-17 18:31 CEST",
"commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6", "commit": "689ee595e08f3880c1e4068aac8e972574e20d21",
"commit_short": "0d881cd", "commit_short": "689ee59",
"repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/689ee595e08f3880c1e4068aac8e972574e20d21"
}, },
"exchange": { "exchange": {
"version": 44, "version": 43,
"label": "Exchange landing", "label": "Exchange landing",
"path": "configs/exchange-landing", "path": "configs/exchange-landing",
"updated_iso": "2026-09-16T23:19:33+02:00", "updated_iso": "2026-07-17T18:33:13+02:00",
"updated_human": "2026-09-16 23:19 CEST", "updated_human": "2026-07-17 18:33 CEST",
"commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6", "commit": "d0594cb44ffb1bec2e009f6812167cbbf216eda9",
"commit_short": "0d881cd", "commit_short": "d0594cb",
"repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/d0594cb44ffb1bec2e009f6812167cbbf216eda9"
}, },
"merchant": { "merchant": {
"version": 43, "version": 42,
"label": "Merchant landing", "label": "Merchant landing",
"path": "configs/merchant-landing", "path": "configs/merchant-landing",
"updated_iso": "2026-09-16T23:19:33+02:00", "updated_iso": "2026-07-17T18:27:48+02:00",
"updated_human": "2026-09-16 23:19 CEST", "updated_human": "2026-07-17 18:27 CEST",
"commit": "0d881cd726da8d298c98114678253e3cbb7aa5e6", "commit": "37ea4bb8396691e3ea69ae61374e6623bf6c5ea7",
"commit_short": "0d881cd", "commit_short": "37ea4bb",
"repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/0d881cd726da8d298c98114678253e3cbb7aa5e6" "repo_commit_url": "https://git.hacktivism.ch/hernani/koopa-admin-log/commit/37ea4bb8396691e3ea69ae61374e6623bf6c5ea7"
} }
} }
} }

2
configs/systemd/user/container-koopa-paivana.service.d/order.conf
View file

@ -1,4 +1,4 @@
[Unit] [Unit]
# Paivana needs merchant private API — start after merchant apps, not only container shell # Paivana needs merchant private API — start after merchant apps, not only container shell
After=taler-merchant-apps.service goa-regio-ng.service After=taler-merchant-apps.service container-taler-hacktivism.service
Wants=taler-merchant-apps.service Wants=taler-merchant-apps.service

21
configs/systemd/user/container-koopa-tor-relay.service
View file

@ -1,21 +0,0 @@
# container-koopa-tor-relay.service — regenerated by tor.sh 2026-10-24T21:47:24+02:00
# Prefer simple over podman-generate-systemd forking+PIDFile (stale CID storm).
[Unit]
Description=Podman koopa-tor-relay
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=always
RestartSec=5
TimeoutStartSec=120
TimeoutStopSec=70
ExecStart=/usr/bin/podman start --attach koopa-tor-relay
ExecStop=/usr/bin/podman stop -t 10 koopa-tor-relay
Type=simple
[Install]
WantedBy=default.target

25
configs/systemd/user/dossiers-ngi-branch-status.service
View file

@ -1,25 +0,0 @@
[Unit]
Description=dossiers.ngi branch-status JSON + on-demand edition rebuild
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/README.md
After=default.target
[Service]
Type=oneshot
Nice=10
RemainAfterExit=no
# Full freezes per changed tip can take a while; skip overlap via flock
TimeoutStartSec=1h
Environment=TZ=Europe/Zurich
Environment=ADMIN_LOG=%h/src/koopa/koopa-admin-log
Environment=TDPD_ROOT=%h/git/src/ngi/tech-dossier-project-data
Environment=OUT=/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/branch-status.json
Environment=EDITIONS_ROOT=/var/www/monitoring-sites/dossiers.ngi.hacktivism.ch/editions
# Rebuild only when current tip freeze_ok is not already true (never force from timer)
Environment=REBUILD=1
EnvironmentFile=-%h/.config/dossiers-ngi/branch-status.env
# flock -n: second fire while busy exits 0 without stacking garbage
ExecStart=/usr/bin/flock -n %t/dossiers-ngi-branch-status.lock /usr/bin/python3 %h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/branch-status-hourly.py --rebuild
SuccessExitStatus=0 1
[Install]
WantedBy=default.target

14
configs/systemd/user/dossiers-ngi-branch-status.timer
View file

@ -1,14 +0,0 @@
[Unit]
Description=Timer · dossiers.ngi branch-status JSON (every 10 min)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/dossiers-ngi/README.md
[Timer]
OnBootSec=3min
OnUnitActiveSec=10min
AccuracySec=1min
RandomizedDelaySec=30
Persistent=true
Unit=dossiers-ngi-branch-status.service
[Install]
WantedBy=timers.target

15
configs/systemd/user/goa-regio-ng.service
View file

@ -1,15 +0,0 @@
[Unit]
Description=goa-regio-ng Taler AIO container (vanilla live 9010-9015)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/taler-shared/goa-regio-ng/README.md
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutStartSec=120
ExecStart=/usr/bin/podman start goa-regio-ng
ExecStop=/usr/bin/podman stop -t 20 goa-regio-ng
[Install]
WantedBy=default.target

4
configs/systemd/user/goa-regio-ng.service.d/apps.conf
View file

@ -1,4 +0,0 @@
[Unit]
# Pull in in-container bank/merchant apps after the AIO shell is up
Wants=taler-bank-apps.service taler-merchant-apps.service
Before=taler-bank-apps.service taler-merchant-apps.service

16
configs/systemd/user/koopa-amanita-probe.service
View file

@ -1,16 +0,0 @@
[Unit]
Description=External amanita freeze probe (ICMP+SSH last-alive)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/amanita-probe/README.md
After=default.target
[Service]
Type=oneshot
ExecStart=%h/.local/bin/koopa-amanita-probe once
# Probe outcomes are data in the log; never fail the timer
SuccessExitStatus=0 1
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
[Install]
WantedBy=default.target

13
configs/systemd/user/koopa-amanita-probe.timer
View file

@ -1,13 +0,0 @@
[Unit]
Description=Timer · external amanita probe (~15s)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/amanita-probe/README.md
[Timer]
OnBootSec=30s
OnUnitActiveSec=15s
AccuracySec=5s
Persistent=false
Unit=koopa-amanita-probe.service
[Install]
WantedBy=timers.target

16
configs/systemd/user/koopa-firecuda-probe.service
View file

@ -1,16 +0,0 @@
[Unit]
Description=External firecuda crash probe (ICMP+SSH last-alive)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/firecuda-probe/README.md
After=default.target
[Service]
Type=oneshot
ExecStart=%h/.local/bin/koopa-firecuda-probe once
# Probe outcomes are data in the log; never fail the timer
SuccessExitStatus=0 1
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
[Install]
WantedBy=default.target

13
configs/systemd/user/koopa-firecuda-probe.timer
View file

@ -1,13 +0,0 @@
[Unit]
Description=Timer · external firecuda probe (~15s)
Documentation=file:%h/src/koopa/koopa-admin-log/scripts/firecuda-probe/README.md
[Timer]
OnBootSec=30s
OnUnitActiveSec=15s
AccuracySec=5s
Persistent=false
Unit=koopa-firecuda-probe.service
[Install]
WantedBy=timers.target

Some files were not shown because too many files have changed in this diff Show more