# Container DNS pins (hacktivism.ch)

Pasta networking often has **no usable DNS**. Wirewatch needs:

```text
https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/
```

## Bake into images (preferred)

On koopa:

```bash
# copy bake assets, then:
SRC_DIR=/tmp/taler-dns-bake ./bake-hosts-into-images.sh
```

This:

1. Installs `/usr/local/bin/pin-hacktivism-hosts` **inside** each container  
2. Hooks `start_base_services_for_taler*.sh` (bank + merchant)  
3. Enables systemd `pin-hacktivism-hosts.service` (exchange, before wirewatch)  
4. **Commits** images:
   - `localhost/taler-hacktivism-banking:live` (+ `:hosts-pinned`)
   - `localhost/taler-hacktivism-live:landing` (+ `:hosts-pinned`)
   - `localhost/taler-hacktivism-exchange-ansible:landing` (+ `:hosts-pinned`)

Pin IP default: `212.51.151.254` (`PIN_IP=` to override).

## One-shot without bake

```bash
./pin-container-hosts.sh          # apply now
./pin-container-hosts.sh --check  # report resolve + /config
```

## After recreate

If you start from an **old** image without the bake, run `pin-container-hosts.sh` once.  
If you use `:hosts-pinned` / updated `:live`/`:landing` images, start_base / systemd re-pin on boot.

Optional podman flags when recreating (extra safety):

```bash
--add-host=bank.hacktivism.ch:212.51.151.254 \
--add-host=exchange.hacktivism.ch:212.51.151.254 \
--add-host=taler.hacktivism.ch:212.51.151.254
```