# 2026-09-04 — GOA backup (pre regio-ng)

## Live (koopa)

| Container | Ports | Site |
|-----------|-------|------|
| `taler-hacktivism-exchange-ansible` | 9011/9014 | exchange.hacktivism.ch |
| `taler-hacktivism-bank` | 9012/9013 | bank.hacktivism.ch |
| `taler-hacktivism` | 9010/9015 | taler.hacktivism.ch |
| `koopa-paivana` | 9025 | paivana.hacktivism.ch |

Currency **GOA**. Master pub (public): `TW6K5FXF81VYCAH0YWYX0SX98KBBSJ42VX27WAX01FTFH400QG10`.

Probes 2026-09-04: exchange/bank/taler `/config` **200**. Monitoring user units mostly failed (apps/ladder) — separate.

**Risk:** exchange/bank/merchant data sit in container **overlay** (no named volumes). Offline key: `/var/lib/taler-exchange/offline/master.priv` inside exchange container.

## Backup location (ERPNext-style `backups/` + stamp + `current`)

| Host | Path |
|------|------|
| koopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
| magikoopa | `~/backups/goa/<stamp>/` · `~/backups/goa/current` |
| **secrets** (keys + `*.secret.conf` + host_vars/paivana) | `koopa-admin-secrets/backups/goa/<stamp>/` · `…/current` |

Stamp taken: **`20260904T1238Z`**.

### Non-secret dumps (`~/backups/goa/`)

`exchange/` `bank/` `merchant/` TGZs (PG + etc), `meta/`, optional `images/` (~2.2G).

### Secrets (`koopa-admin-secrets/backups/goa/current/`)

| Path | Content |
|------|---------|
| `exchange-offline/master.priv` | offline master (pub TW6K5…) |
| `exchange-offline/secm_tofus.pub` | secmod TOFU |
| `exchange/secrets/*.secret.conf` | DB + wire account creds |
| `merchant/secrets/merchant-db.secret.conf` | merchant DB |
| `ansible/host_vars/` | public.yml + secrets.yml |
| `paivana/secrets/` | merchant-access-token, paivana-secret |

Never Forgejo push for `koopa-admin-secrets`. Magikoopa: `~/git/admin-logs/koopa-admin-secrets` (symlink `~/src/koopa/koopa-admin-secrets`).

## Local reproduce (magikoopa) — **one** container, few unprivileged ports

Not the three `goa-local-*` snapshot containers. Use **`regio-local`** only:

| Bind | Role |
|------|------|
| `127.0.0.1:9080` | nginx HTTP (`Host: *.goa.local`) |
| `127.0.0.1:9222` | SSH ansible |

Optional: `REGIO_PUBLISH_KOOPA_PORTS=1` also binds `9010–9012` (still unprivileged).

Tree: `~/src/regio-local/` — see `RESTORE.md`, `README.md`.

### koopa lab ports (2026-09-04)

Same stack **on koopa** without touching live **9010–9015** or **9080** (nym):

| Bind | Role |
|------|------|
| `127.0.0.1:9180` | `goa-regio-ng` HTTP |
| `127.0.0.1:9322` | `goa-regio-ng` SSH |
| `127.0.0.1:8288` | `mytops-local` HTTP |

Canonical config: **`configs/lab-local/`** (`goa-regio-ng-koopa.yml`, `mytops-local.toml`, README).

### `taler-deployment` branches

```
dev/hernani/regio-ng-apt-refresh
  └─ dev/hernani/regio-ng-ensure-postgresql
       └─ regio-goa-explorational-currency   # GOA profile + master pin/import + TCP 901x
```

Example inventory: `regional-currency-ng/examples/goa-explorational.yml`  
(imports `master.priv` from admin-secrets; refuses greenfield when pub pinned).

### Restore flow

```bash
podman stop goa-local-exchange goa-local-bank goa-local-merchant   # free 901x; leave koopa live alone
cd ~/src/regio-local
./scripts/01-build-run.sh
./scripts/02-inventory.sh
./scripts/03-deploy.sh          # ansible; master from admin-secrets
./scripts/05-restore-data.sh    # optional PG dumps from ~/backups/goa/current
./scripts/04-probe.sh           # expect 200 on :9010 :9011 :9012
```

## Push

`koopa-admin-log` Push nötig — nur mit Freigabe / User-Push.  
`taler-deployment` branch `regio-goa-explorational-currency` likewise Freigabe.  
Live wipe: **no**.