# Scripts

| Dir | Source on koopa |
|-----|-----------------|
| `taler-merchant/` | podman `taler-hacktivism`: `/root`, `/usr/local/bin` |
| `taler-exchange/` | podman `taler-hacktivism-exchange-ansible`: `/root`, `/usr/local/bin` |
| `taler-hacktivism-bank/` | podman `taler-hacktivism-bank`: `/root`, `/usr/local/bin` |
| `taler-sanity/` | host root checks (stack, settlement, helpers) |
| `taler-monitoring/` | **outside-in** public URL walk (`/config` → keys/terms/integration/webui) |
| `ops/` | host hygiene (`cleanup-root-scratch.sh`) |
| `monitoring/` | host `/home/hernani/scripts` (tor relay stats) |
| `taler-wallet-cli/` | thin wrappers; **benchmarks live in** `../benchmarks/` |
| `castopod/` | host `hernani` podman-compose `~/koopa-castopod` — see `castopod/README.md` |

**Scratch:** one-off probes live in **local** `koopa-admin-log/.tmp/` (gitignored). See `ops/ROOT_HYGIENE.md`.

**Secrets:** never in this tree — sibling **`../koopa-admin-secrets`** (`koopa/host-root/<service>/` ↔ `/root/` on host; `containers/…/secrets/` for in-container).

## Manual start model (all three)

1. **root** runs `/root/start_base_services_for_taler_*.sh`  
   → Debian-style postgres perms + start (`pg_ctlcluster` / `init.d`)  
   → (+ exchange: secmods/helpers; merchant: nginx)  
   → interactive shell as service user  
   → automation: add **`--no-shell`** then run step 2 via `runuser`  
2. **service user** runs `/usr/local/bin/start_*.sh` [ `--restart` ]  
   → application process only  

Postgres ownership (Debian defaults, if cluster was root-owned after bad ops):

```text
chown -R root:postgres /etc/postgresql
chmod confs 640 / dirs 755
chown -R postgres:postgres /var/lib/postgresql /var/log/postgresql /var/run/postgresql
# only remove postmaster.pid / socket locks when pg_isready fails and no live postgres
pg_ctlcluster 17 main start
```

| Container | Root base | App start | App user |
|-----------|-----------|-----------|----------|
| `taler-hacktivism` | `start_base_services_for_taler.sh` | `start_merchant.sh` | `taler-merchant-httpd` |
| `taler-hacktivism-exchange-ansible` | `start_base_services_for_taler_exchange.sh` | `start_exchange.sh` | `taler-exchange-httpd` |

Exchange one-shots (root, offline / wire):  
`taler-exchange/wire-enable-and-upload.sh`, `offline-sign-upload-keys.sh`, `start_wire_helpers.sh`
| `taler-hacktivism-bank` | `start_base_services_for_taler_bank.sh` | `start_bank.sh` | `libeufin-bank` |

`runuser -u USER -- bash` (never `-u` with `-s` on util-linux).

SMS helper symlinks into `/var/taler-src/...` are not copied (merchant only).