17f25d41c9
Compose unit starts both containers; standalone upstream podman-start raced at boot (exit 125). Live stack already healthy on hacktivism.
115 lines
4.1 KiB
Markdown
115 lines
4.1 KiB
Markdown
# paivana — `paivana.hacktivism.ch`
|
|
|
|
GNU Taler **paivana-httpd** reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.
|
|
|
|
| Item | Value |
|
|
|------|--------|
|
|
| Live | `/home/hernani/koopa-paivana/` |
|
|
| Containers | `koopa-paivana`, `koopa-paivana-upstream` |
|
|
| Image | `localhost/koopa-paivana:latest` (built from `Containerfile`); process **uid 1000** `paivana-httpd` |
|
|
| Upstream | `nginxinc/nginx-unprivileged` on **:8080** (not root nginx:80) |
|
|
| Host port | **9025** → Caddy `paivana.hacktivism.ch` |
|
|
| Currency | **GOA** |
|
|
| Merchant | `https://taler.hacktivism.ch/instances/goa-shop/` |
|
|
| Template | `paivana` (`template_type: paivana`, amount **`GOA:4200`**, `website_regex: .*`) |
|
|
| Access | **`-g`** site-wide: pay once → example upstream free to browse |
|
|
| Upstream | example site in `upstream/` (compose service) |
|
|
|
|
## Layout
|
|
|
|
| Path | Role |
|
|
|------|------|
|
|
| `Containerfile` | Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs |
|
|
| `compose.yml` | `koopa-paivana` + nginx upstream |
|
|
| `conf/paivana.conf.template` | Config; secrets substituted at start |
|
|
| `entrypoint.sh` | Inject secrets → run `paivana-httpd -g -f` |
|
|
| `secrets/` | **not in git** — live only |
|
|
| `upstream/` | Protected demo content |
|
|
| `container-koopa-paivana.service` | systemd --user oneshot compose up |
|
|
| `taler-systems.gpg` | Deb signing key (build context) |
|
|
|
|
## Secrets (live)
|
|
|
|
| File | Role |
|
|
|------|------|
|
|
| `~/koopa-paivana/secrets/merchant-access-token` | `secret-token:…` for goa-shop |
|
|
| `~/koopa-paivana/secrets/paivana-secret` | cookie MAC secret (stable across restarts) |
|
|
|
|
Mirror notes: `koopa-admin-secrets` → `koopa/home-hernani/koopa-paivana/secrets/` (paths only / examples).
|
|
|
|
## Ops
|
|
|
|
```bash
|
|
# as hernani on koopa
|
|
cd ~/koopa-paivana
|
|
podman compose build
|
|
podman compose up -d
|
|
podman logs -f koopa-paivana
|
|
curl -si http://127.0.0.1:9025/ | head # 302 → /.well-known/paivana/templates/paivana#…
|
|
```
|
|
|
|
Autostart (**only** the compose unit — starts **both** `koopa-paivana` and
|
|
`koopa-paivana-upstream`):
|
|
|
|
```bash
|
|
mkdir -p ~/.config/systemd/user
|
|
cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/
|
|
# optional: After= merchant (configs/systemd/user/container-koopa-paivana.service.d/)
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable --now container-koopa-paivana.service
|
|
```
|
|
|
|
**Do not** enable a separate `container-koopa-paivana-upstream.service` that only
|
|
runs `podman start koopa-paivana-upstream`. At boot that unit races compose
|
|
(container not created yet → exit 125 → start-limit-hit). Compose already
|
|
starts the upstream. If such a unit exists:
|
|
`systemctl --user disable --now container-koopa-paivana-upstream.service`.
|
|
|
|
Healthy smoke:
|
|
|
|
| Check | Expect |
|
|
|-------|--------|
|
|
| `curl -si http://127.0.0.1:9025/` | **302** → `/.well-known/paivana/templates/paivana#…` |
|
|
| template URL / public `https://paivana.hacktivism.ch/` | **402** paywall HTML + `paivana: taler://pay-template/…` |
|
|
| monitoring | `./scripts/taler-monitoring/taler-monitoring.sh -d hacktivism.ch urls` → `www.paivana` OK |
|
|
|
|
## Network notes
|
|
|
|
Rootless pasta cannot hairpin public DNS for the merchant. Compose sets:
|
|
|
|
```yaml
|
|
extra_hosts:
|
|
- "taler.hacktivism.ch:host-gateway"
|
|
```
|
|
|
|
so `paivana-httpd` can load templates from the merchant API.
|
|
|
|
## Caddy
|
|
|
|
Vhost → `127.0.0.1:9025` (see `configs/caddy/Caddyfile`).
|
|
Flags `-g` (site-wide payment) and `-f` (X-Forwarded-For).
|
|
|
|
## Merchant template
|
|
|
|
```bash
|
|
curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
|
|
-H "Authorization: Bearer secret-token:…" \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{
|
|
"template_id": "paivana",
|
|
"template_description": "Paivana paywall (GOA)",
|
|
"template_contract": {
|
|
"template_type": "paivana",
|
|
"summary": "Access to paivana.hacktivism.ch",
|
|
"website_regex": ".*",
|
|
"choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
|
|
}
|
|
}'
|
|
```
|
|
|
|
## Docs
|
|
|
|
- https://docs.taler.net/taler-paivana-manual.html
|
|
- https://docs.taler.net/design-documents/095-captcha-100.html
|
|
- https://docs.taler.net/design-documents/076-paywall-proxy.html
|
|
- https://docs.taler.net/manpages/paivana.conf.5.html
|