# 2026-09-15 — GOA Ansible Merchant-first

**Freigabe:** Live-Stop / Caddy = nein bis Chat-OK.  
**Feed:** `taler-deployment` `origin/dev/hernani/regio-goa-explorational-currency`  
**Work branch:** `dev/hernani/goa-regio-ng-vanilla`

## Naming

| | |
|--|--|
| **vanilla** | Ansible Vollkomposition (Merchant+Exchange+Bank+nginx/pg); GOA-Ersatz-Kandidat |
| **local** | Lab only: loopback / `goa.local` |

`configs/lab-local/goa-regio-ng` = **vanilla** @ **local**. Nie `REGIO_PUBLISH_KOOPA_PORTS=1` neben Live.

## Ist (lab green)

```bash
ssh hernani@koopa 'podman ps --format "{{.Names}} {{.Status}} {{.Ports}}" | grep -E "goa-regio|taler-hacktivism"'
# taler-hacktivism* Up  9010–9015
# goa-regio-ng      Up  127.0.0.1:9180→80, 127.0.0.1:9322→22

ssh hernani@koopa "podman exec goa-regio-ng sh -c '
  for u in nginx postgresql libeufin-bank taler-merchant-httpd taler-exchange-httpd taler-merchant.target; do
    printf \"%s=\"; systemctl is-active \$u
  done'"
# all=active

ssh hernani@koopa 'for h in bank.goa.local exchange.goa.local backend.goa.local; do
  curl -sS -o /dev/null -w "$h %{http_code}\n" -H "Host: $h" http://127.0.0.1:9180/config
done'
# all 200

ssh hernani@koopa 'curl -sS -H "Host: exchange.goa.local" http://127.0.0.1:9180/keys' \
  | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["master_public_key"],d["currency"],len(d.get("denominations",[])))'
# TW6K5… GOA 27
```

| Piece | Live | Lab vanilla@local |
|-------|------|-------------------|
| Merchant | :9010 | **active** · instance `default` |
| Exchange | :9011 | **active** · master TW6K5 · 27 denoms |
| Bank | :9012 | libeufin-bank OK |
| MASTER | TW6K5… | sha256 match enc `current/exchange-offline/master.priv` |

Playbook: `ok=92 changed=20 failed=0` after `/etc/hosts` pin (bank.goa.local NXDOMAIN once).

## Lab hosts (ephemeral)

Container recreate drops hosts. Re-pin:

```bash
cd $HOME/git/admin-logs/local/koopa-admin-log/configs/lab-local
ansible-playbook -i goa-regio-ng-koopa.yml lab-hosts.yml
# unsafe_writes — /etc/hosts EBUSY on atomic rename inside podman
```

## Merchant token (lab)

SoT: `koopa-admin-secrets-enc/backups/goa/lab-local/merchant/secrets/merchant-default-access-token`  
passwd = PLAIN; Bearer = file value as-is (`secret-token:…`). `/instances/default/private/products` **200**.  
`/config` `"currency":"CHF"` = tip dual-merchant; GOA under `currencies.GOA`.

## t2 — wire + order + withdraw + pay (lab) **done**

Bank acct `lab-merchant` via `libeufin-bank create-account`; secrets under `…/lab-local/merchant/secrets/`. Wire `x-taler-bank`.

```bash
# POST /instances/default/private/accounts → 200 salt/h_wire
# POST orders GOA:1 → 200 unpaid
# create-token labwallet; POST withdrawals; wallet-cli withdraw; POST confirm → 204
# handle-uri --yes "$taler_pay_uri"
```

| | |
|--|--|
| WID | `1eab9b0d-a3a8-41a8-b070-d7645b25ab25` |
| withdraw | `txn:withdrawal:2EBFWF7GK415A151KP56MWCVK2CYMDHMR55Q9BG11VT6NR55YC80` final |
| pay | `txn:payment:D4H75B5YDNJ52G8T6ADBDCXVWXCVZBG5HVSGE7G4S0XBQ6K8H3Y0` done |
| order | `2026.257-6E75WGDBR32M4` **paid** |
| wallet | GOA:9 (GOA:10 − GOA:1); CLI 1.6.43 **inside** `goa-regio-ng` |

## Zielbild

Ansible = SoT. Zwei Formen, gleiche Playbooks: **Full-stack Podman** · **Recreate-Fabrik**.  
Branch: **master = stage**; anderer = **prod**. Kein `STAGE_ENV`.  
**Reihenfolge:** **1 GOA** → **2 FP/Stage** (zwei Stacks) → **3 mytops-***. Merchant-Probleme → mytops vorziehen.  
Gate: elelmon moderate → purse/withdraw → lab harden → Live-Merchant cutover nur wenn 1–3 grün → restore-back. Greenfield `*.2.*` PARK.

## APPLY 20260915T0013Z

BACKUP+APT+COMMIT OK. APPLY_SMOKE_FAIL was `sm=$(smoke)` capture; driver now `if smoke; then` → **APPLY_OK**. Smoke endpoints 200. Live bank/exchange/merchant Up; lab `goa-regio-ng` Up. Images retagged `:live` / `:landing`.

## Arbeit 1 — live confirm overflow (2026-09-16) **FAIL**

Smoke: `$HOME/git/llm/llm-work-input/goa-confirm-smoke.sh` (fresh scratch wallet; WCLI `$HOME/.local/bin/taler-wallet-cli.mjs`).

| | |
|--|--|
| user | `cfm18923` 2026-09-16T00:35:23Z |
| max_debt | acct#1=1e12 · **#2=1e8** · #3=1e12 |
| credit | GOA:4798.5 **200** |
| TOS | `exchanges add` + `update` + `accept-tos` **OK** |
| GOA:20 WID | `062e3112-e235-4fea-95d1-644773100224` |
| create | body `amount` + `exchange_url` → **200** |
| force-select | rpub + epayto from `/keys` → **200** `selected` |
| confirm | POST `/accounts/{user}/withdrawals/{wid}/confirm` → **500** code **5110** P0001 `amount value overflowed` |
| GOA:4200 | same scratch rpub → **409** code **5114** Reserve pub already used (script; skip until GOA:20 green) |

`CONFIRM_SMOKE_FAIL`. Select+TOS+RPUB green for GOA:20; overflow still at confirm. Next: dump `make_incoming` / `bank_wire_transfer` for that WID; lower remaining 1e12 if dump confirms.

## Pointers

| | |
|--|--|
| inventory | `configs/lab-local/goa-regio-ng-koopa.yml` |
| lab hosts | `configs/lab-local/lab-hosts.yml` |
| Lab README | `configs/lab-local/README.md` |
| backup daylog | `2026/2026-09-04--goa-backup-regio-ng.md` |
| APPLY driver | `scripts/taler-shared/goa-live-backup-upgrade.sh` |
| dumps | koopa `~/backups/goa/current` → `20260904T1238Z` |
| Caddy | taler→9010 · exchange→9011 · bank→9012 |

Leave-off: t1+t2 lab green. Live confirm **5110**. No Live-Stop / no Caddy.