koopa-admin-log/scripts/taler-bank

taler-bank scripts

Container: goa-regio-ng (libeufin-bank, GOA, no IBAN; legacy name taler-hacktivism-bank).

File	Container path	User
start_base_services_for_taler_bank.sh	/root/	root
start_bank.sh	/usr/local/bin/	libeufin-bank
check_bank-health.sh	/usr/local/bin/	libeufin-bank / any
landing-stats.sh	/usr/local/bin/	root (in container) — writes /var/www/bank-landing/stats.json
landing-stats-install.sh	host only	root/podman — copies + runs + optional cron
demo-withdraw-api.py	/usr/local/bin/	root — loopback :19096
install-demo-withdraw-api.sh	host only	installs API + nginx + auto-confirm
maintenance/raise-debit-limits.sh	host or bank ctr	raise all accounts’ debit_threshold (dry-run; --no-dry)
auto-confirm-withdrawals.sh	/usr/local/bin/	root — explorer-only confirm loop
refresh-demo-withdraw.sh	/usr/local/bin/	refresh static withdraw.uri
credit-account.sh	host/ops	admin → user credit

Usage

# root in container
./start_base_services_for_taler_bank.sh
# then as libeufin-bank in /usr/local/bin:
./start_bank.sh --restart

Landing stats (inside container)

# on koopa host — copy + run (writes /var/www/bank-landing/stats.json)
./landing-stats-install.sh
./landing-stats-install.sh --cron     # every minute inside container (* * * * *)
./landing-stats-install.sh --run-only

Details + JSON schema: configs/bank-landing/README.md.

Demo withdraw + auto-account API

FP reference SoT: $HOME/git/admin-logs/taler/francpaysan-admin-log (files/testpaysan/demo-withdraw-api.py, files/caddy/Caddyfile @wdGet). GOA ports that pattern: mint amount+exchange_url, and GET Integration injects suggested_exchange / required_exchange (Android/iOS).

demo-withdraw-api.py listens on 127.0.0.1:19096 (in bank CTR; nginx on :9013):

Path	Behaviour
GET /demo-withdraw.json	Mint one-shot withdraw from shared explorer pool; write withdraw.uri + watch ids
GET /auto-account.json	Public POST /accounts with generated goa-account-<random> user + password containing pleasechangeme; balance GOA:0; return credentials once
GET /taler-integration/withdrawal-operation/*	Proxy libeufin + inject suggested_exchange/required_exchange

Public path (Android): Caddy @wdGet (GET only) → landing :9013 → nginx → :19096. POST / other Integration stays Caddy → :9012 (raw libeufin). FP stage proxies @wdGet straight to host :19096; GOA keeps 19096 CTR-only and routes via published 9013 instead.

Install / restart (host, podman → taler-hacktivism-bank):

./install-demo-withdraw-api.sh
# Public checks:
curl -sS https://bank.hacktivism.ch/intro/demo-withdraw.json | head
curl -sS https://bank.hacktivism.ch/intro/auto-account.json | head   # creates a real account
# After Caddy @wdGet + nginx Integration are live:
WID=…  # from demo-withdraw.json
curl -sS "https://bank.hacktivism.ch/taler-integration/withdrawal-operation/$WID" \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("suggested_exchange"), d.get("required_exchange"))'

Requires python3 in the bank container. Env: BANK_URL, BANK_USER/BANK_PASS (or /root/bank-explorer-password.txt), AMOUNT (default GOA:10), EXCHANGE_URL (default https://exchange.hacktivism.ch/).

Caddy (root on koopa — you apply): insert @wdGet before the bank catch-all reverse_proxy 127.0.0.1:9012 in ~/koopa-caddy/Caddyfile (SoT: configs/caddy/Caddyfile / host/caddy/Caddyfile; paste-ready snippet: scripts/caddy/wdGet-bank-snippet.caddy, also copied live as ~/koopa-caddy/wdGet-bank-snippet.caddy), then sudo ~/bin/caddy-apply. Caddy alone is not enough — demo-api + nginx Integration must be installed via ./install-demo-withdraw-api.sh first.

Auto-confirm (explorer only)

# preferred: systemd inside CTR (Restart=always)
systemctl status goa-auto-confirm-withdrawals.service
# manual loop — refuses non-explorer unless ALLOW_NON_EXPLORER=1
auto-confirm-withdrawals.sh --loop 2

Only confirms withdrawals owned by explorer when status is selected (community demo path). Does not confirm arbitrary customer withdraws. Skips amounts above explorer debt headroom (otherwise libeufin returns HTTP 409).

Stable ops (via koopa-external if LAN koopa is down):

• Unit: goa-auto-confirm-withdrawals.service (install script enables it)
• One process only (flock on /var/run/auto-confirm-withdrawals.lock)
• QUIET=1 + summary tick checked=… selected=… each loop
• Watch list capped (WATCH_MAX=80, prune of bloated withdraw-watch.ids)
• Status via taler-integration/withdrawal-operation/{id}
• Reinstall: BANK_CONTAINER=goa-regio-ng ./install-demo-withdraw-api.sh

Config

See configs/taler-hacktivism-bank/ and configs/bank-landing/.