# Scripts

| Dir | Source on koopa |
|-----|-----------------|
| `taler-merchant/` | podman `taler-hacktivism`: `/root`, `/usr/local/bin` |
| `taler-exchange/` | podman `taler-hacktivism-exchange-ansible`: `/root`, `/usr/local/bin` |
| `taler-hacktivism-bank/` | podman `taler-hacktivism-bank`: `/root`, `/usr/local/bin` |
| `taler-bank/` | bank host helpers + **`maintenance/`** (debit limits, dry-run) |
| `taler-shared/` | host **ensure-taler-apps** (post-container app start + auto-confirm) |
| `taler-sanity/` | host root checks (stack, settlement, helpers) |
| `taler-monitoring/` | **outside-in** public URL walk (`/config` → keys/terms/integration/webui) |
| `taler-landing/` | **hernani user systemd**: central landing `stats.json` (full bank scan + alt units) |
| `monitoring/` | host `/home/hernani/scripts` (tor relay stats) |
| `nym/` | **koopa-nym** build/up/status (nym.com nym-node) |
| `taler-wallet-cli/` | thin wrappers; **benchmarks live in** `../benchmarks/` |
| `castopod/` | host `hernani` podman-compose `~/koopa-castopod` — see `castopod/README.md` |

**Secrets:** never in this tree — sibling **`../koopa-admin-secrets`** (`koopa/host-root/<service>/` ↔ `/root/` on host; `containers/…/secrets/` for in-container).

## Boot automation (host user systemd)

Merchant/bank containers stay **`sleep infinity`**. After the container unit
starts, **`taler-merchant-apps.service`** / **`taler-bank-apps.service`** run
`~/.local/bin/ensure-taler-apps.sh` (install via
`taler-shared/install-ensure-taler-apps.sh`). That runs the in-container
`start_base` + `start_*.sh` (and bank auto-confirm **2 s**).

Landing **stats.json** (bank / exchange / merchant intros) is refreshed by
**`taler-landing-stats.timer`** as user **hernani** (install:
`taler-landing/install-landing-stats-host.sh`). Full bank ledger scan + GOA
alt-unit fields; see `taler-landing/README.md`.

## Manual start model (all three)

1. **root** runs `/root/start_base_services_for_taler_*.sh`  
   → Debian-style postgres perms + start (`pg_ctlcluster` / `init.d`)  
   → (+ exchange: secmods/helpers; merchant: nginx)  
   → interactive shell as service user  
   → automation: add **`--no-shell`** then run step 2 via `runuser`  
2. **service user** runs `/usr/local/bin/start_*.sh` [ `--restart` ]  
   → application process only  

Postgres ownership (Debian defaults, if cluster was root-owned after bad ops):

```text
chown -R root:postgres /etc/postgresql
chmod confs 640 / dirs 755
chown -R postgres:postgres /var/lib/postgresql /var/log/postgresql /var/run/postgresql
# only remove postmaster.pid / socket locks when pg_isready fails and no live postgres
pg_ctlcluster 17 main start
```

| Container | Root base | App start | App user |
|-----------|-----------|-----------|----------|
| `taler-hacktivism` | `start_base_services_for_taler.sh` | `start_merchant.sh` | `taler-merchant-httpd` |
| `taler-hacktivism-exchange-ansible` | `start_base_services_for_taler_exchange.sh` | `start_exchange.sh` | `taler-exchange-httpd` |

Exchange one-shots (root, offline / wire):  
`taler-exchange/wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh`
| `taler-hacktivism-bank` | `start_base_services_for_taler_bank.sh` | `start_bank.sh` | `libeufin-bank` |

`runuser -u USER -- bash` (never `-u` with `-s` on util-linux).

SMS helper symlinks into `/var/taler-src/...` are not copied (merchant only).