# taler-bank scripts

Container: **`taler-hacktivism-bank`** (libeufin-bank, GOA, **no IBAN**).

| File | Container path | User |
|------|----------------|------|
| `start_base_services_for_taler_bank.sh` | `/root/` | **root** |
| `start_bank.sh` | `/usr/local/bin/` | **libeufin-bank** |
| `check_bank-health.sh` | `/usr/local/bin/` | libeufin-bank / any |
| `landing-stats.sh` | `/usr/local/bin/` | root (in container) — writes `/var/www/bank-landing/stats.json` |
| `landing-stats-install.sh` | host only | root/podman — copies + runs + optional cron |
| `demo-withdraw-api.py` | `/usr/local/bin/` | root — loopback **:19096** |
| `install-demo-withdraw-api.sh` | host only | installs API + nginx + auto-confirm |
| `maintenance/raise-debit-limits.sh` | host or bank ctr | raise all accounts’ `debit_threshold` (dry-run; `--no-dry`) |
| `auto-confirm-withdrawals.sh` | `/usr/local/bin/` | root — **explorer-only** confirm loop |
| `refresh-demo-withdraw.sh` | `/usr/local/bin/` | refresh static `withdraw.uri` |
| `credit-account.sh` | host/ops | admin → user credit |

## Usage

```bash
# root in container
./start_base_services_for_taler_bank.sh
# then as libeufin-bank in /usr/local/bin:
./start_bank.sh --restart
```

## Landing stats (inside container)

```bash
# on koopa host — copy + run (writes /var/www/bank-landing/stats.json)
./landing-stats-install.sh
./landing-stats-install.sh --cron     # every minute inside container (* * * * *)
./landing-stats-install.sh --run-only
```

Details + JSON schema: `configs/bank-landing/README.md`.

## Demo withdraw + auto-account API

**FP reference SoT:** `$HOME/git/admin-logs/taler/francpaysan-admin-log`
(`files/testpaysan/demo-withdraw-api.py`, `files/caddy/Caddyfile` `@wdGet`).
GOA ports that pattern: mint `amount`+`exchange_url`, and GET Integration
injects `suggested_exchange` / `required_exchange` (Android/iOS).

`demo-withdraw-api.py` listens on **127.0.0.1:19096** (in bank CTR; nginx on :9013):

| Path | Behaviour |
|------|-----------|
| `GET /demo-withdraw.json` | Mint one-shot withdraw from shared **`explorer`** pool; write `withdraw.uri` + watch ids |
| `GET /auto-account.json` | Public `POST /accounts` with generated **`goa-account-<random>`** user + password containing **pleasechangeme**; **balance GOA:0**; return credentials once |
| `GET /taler-integration/withdrawal-operation/*` | Proxy libeufin + inject `suggested_exchange`/`required_exchange` |

**Public path (Android):** Caddy `@wdGet` (GET only) → landing **:9013** → nginx → **:19096**.
POST / other Integration stays Caddy → **:9012** (raw libeufin).
FP stage proxies `@wdGet` straight to host `:19096`; GOA keeps 19096 CTR-only
and routes via published 9013 instead.

Install / restart (host, podman → `taler-hacktivism-bank`):

```bash
./install-demo-withdraw-api.sh
# Public checks:
curl -sS https://bank.hacktivism.ch/intro/demo-withdraw.json | head
curl -sS https://bank.hacktivism.ch/intro/auto-account.json | head   # creates a real account
# After Caddy @wdGet + nginx Integration are live:
WID=…  # from demo-withdraw.json
curl -sS "https://bank.hacktivism.ch/taler-integration/withdrawal-operation/$WID" \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("suggested_exchange"), d.get("required_exchange"))'
```

Requires **python3** in the bank container. Env: `BANK_URL`, `BANK_USER`/`BANK_PASS`
(or `/root/bank-explorer-password.txt`), `AMOUNT` (default `GOA:10`),
`EXCHANGE_URL` (default `https://exchange.hacktivism.ch/`).

**Caddy (root on koopa — you apply):** insert `@wdGet` before the bank catch-all
`reverse_proxy 127.0.0.1:9012` in `~/koopa-caddy/Caddyfile` (SoT:
`configs/caddy/Caddyfile` / `host/caddy/Caddyfile`; paste-ready snippet:
`scripts/caddy/wdGet-bank-snippet.caddy`, also copied live as
`~/koopa-caddy/wdGet-bank-snippet.caddy`), then `sudo ~/bin/caddy-apply`.
Caddy alone is not enough — demo-api + nginx Integration must be installed
via `./install-demo-withdraw-api.sh` first.

### Auto-confirm (explorer only)

```bash
# loop inside container — refuses non-explorer unless ALLOW_NON_EXPLORER=1
auto-confirm-withdrawals.sh --loop 2
```

Only confirms withdrawals owned by **`explorer`** when status is `selected`
(community demo path). Does not confirm arbitrary customer withdraws.

**Stable ops (via `koopa-external` if LAN `koopa` is down):**

- One process only (`flock` on `/var/run/auto-confirm-withdrawals.lock`)
- `QUIET=1` + summary `tick checked=… selected=…` each loop
- Watch list capped (`WATCH_MAX=80`, prune of bloated `withdraw-watch.ids`)
- Status via `taler-integration/withdrawal-operation/{id}`
- Reinstall: `./install-demo-withdraw-api.sh` on host with podman access to `taler-hacktivism-bank`

## Config

See `configs/taler-hacktivism-bank/` and `configs/bank-landing/`.