# taler-bank (container `taler-bank-hacktivism`)

Image: `docker.io/library/debian:trixie` + package `libeufin-bank`  
Publish: **9012/tcp only**  
Labels: `org.hacktivism.service=taler-bank`, `host_port=9012`, `site=bank.hacktivism.ch`, `currency=GOA`

## Role

Regional **GOA Exploration Bank** for GNU Taler:

- **No IBAN**, no libeufin-nexus, no fiat conversion (`ALLOW_CONVERSION = no`)
- **`WIRE_TYPE = x-taler-bank`** (payto://x-taler-bank/bank.hacktivism.ch/…)
- Wallet default exchange: `https://exchange.hacktivism.ch/`
- Mobile withdraw: Bank SPA → login → **Withdraw** → Taler Wallet (QR / deeplink)

## Config layout (merchant/exchange pattern)

| Path in container | Mirror |
|-------------------|--------|
| `libeufin-bank.conf` | includes: `libeufin-bank.conf.includes.txt` |
| **`bank-overrides.conf`** | **`bank-overrides.conf`** |

## Manual start

| Path | User | Role |
|------|------|------|
| `/root/start_base_services_for_taler_bank.sh` | **root** | logs, postgres, DB ensure → shell as `libeufin-bank` |
| `/usr/local/bin/start_bank.sh` | **libeufin-bank** | start / `--restart` `libeufin-bank serve` |
| `/usr/local/bin/check_bank-health.sh` | any | health |

## Ports / Caddy

| Port | Role |
|------|------|
| 9012 | libeufin-bank HTTP (podman pasta) |
| 9001 | Caddy HTTPS `bank.hacktivism.ch` → 127.0.0.1:9012 |

**DNS:** A/AAAA for `bank.hacktivism.ch` → koopa public IP (required for TLS/ACME and phones).

## Accounts (typical)

| Login | Purpose |
|-------|---------|
| `admin` | bank admin (password on host `/root/bank-admin-password.txt`) |
| `exchange` | Taler exchange wire account (`is_taler_exchange`) |
| `explorer` | demo user for phone withdraw (`debit_threshold` for regional GOA) |

## Mobile withdraw (GOA)

1. Install **GNU Taler Wallet** (Android / iOS / browser).
2. Open **https://bank.hacktivism.ch/** (after DNS + cert work).
3. Login as `explorer` (or registered user with debt headroom).
4. **Withdraw** → amount in GOA → open / scan with wallet.
5. Wallet uses `DEFAULT_EXCHANGE` = exchange.hacktivism.ch.

Exchange must have wire account pointing at this bank (payto + wire gateway credentials) and offline **enable-account** for `/keys` withdraw to fully work.

**Details (diagram `/keys` ↔ Wire ↔ Account):**  
`configs/taler-exchange/README.md` → Abschnitt **„/keys, Wire und Account“**.

## Public landing (withdraw QR)

English intro + QR: **`https://bank.hacktivism.ch/`** → `/intro/`  
Details: `configs/bank-landing/`. Refresh demo URI: `scripts/taler-bank/make-demo-withdraw-qr.sh`.

### Wallet says “transfer money” — auto-confirm

Normal Taler bank flow after the wallet selects the exchange:

1. Withdrawal status → **`selected`**
2. Bank must **`POST …/withdrawals/$ID/confirm`** → wires GOA user → exchange
3. Exchange **wirewatch** sees credit → wallet can finish withdraw

For the demo QR (`explorer`), automate step 2:

```bash
# once
/root/auto-confirm-withdrawals.sh
# loop (e.g. every 4s)
nohup /root/auto-confirm-withdrawals.sh --loop 4 >>/var/log/auto-confirm-withdrawals.log 2>&1 &
```

Script: `scripts/taler-bank/auto-confirm-withdrawals.sh`  
Watches IDs in `/var/www/bank-landing/withdraw.uri` and `withdraw-watch.ids`.