hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
koopa-admin-log/2026/2026-07-09--exchange-snapshot-and-restore.md
Hernâni Marques 54ebdb7d7a
configs: rename dirs to match live koopa containers 
Reflect host naming in git paths:
- configs/taler-hacktivism/ (was taler-merchant) → container taler-hacktivism
- configs/taler-hacktivism-bank/ (was taler-bank) → container …-bank,
  image taler-hacktivism-banking:live
- configs/taler-exchange-ansible/ already matches …-exchange-ansible
- configs/taler-exchange/ = conf inside that exchange container

Update LIVE.md, README, ports/refs. No secret values.
2026-07-10 16:02:52 +02:00

201 lines
6.9 KiB
Markdown
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Exchange snapshot + restore (GOA) — 2026-07-09
**Scope:** local on host **koopa** only. No registry, no upload, no public internet publish.
Container was **stopped** then **committed/saved**. Live name: `taler-hacktivism-exchange-ansible`.
---
## 1. What was stored (local files)
Directory (hernani on koopa):
```text
/home/hernani/images/taler-stack-20260709-snapshot/
```
| File | Role | Size (approx.) |
|------|------|----------------|
| `taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar` | full exchange image archive | **~1.6 G** |
| `taler-hacktivism-live-20260709-snapshot.tar` | merchant archive (partial earlier run) | ~2.4 G |
| `SHA256SUMS` | checksums for completed saves | |
**Podman images (local store only):**
| Image | Tag | Notes |
|-------|-----|--------|
| `localhost/taler-hacktivism-exchange-ansible-live` | `20260709-snapshot` | committed from stopped container |
| `localhost/taler-hacktivism-exchange-ansible-live` | `9011` | previous live tag (still present) |
| `localhost/taler-hacktivism-live` | `20260709-snapshot` | merchant (if commit kept) |
| `localhost/taler-bank-hacktivism-live` | `20260709-snapshot` | bank (if commit kept) |
Verify:
```bash
# as hernani@koopa
ls -lh /home/hernani/images/taler-stack-20260709-snapshot/
sha256sum -c /home/hernani/images/taler-stack-20260709-snapshot/SHA256SUMS
podman images | grep exchange
podman ps -a --filter name=taler-hacktivism-exchange-ansible
```
Expected container state after stop:
```text
taler-hacktivism-exchange-ansible Exited (…) localhost/taler-hacktivism-exchange-ansible-live:9011 0.0.0.0:9011->9011/tcp
```
---
## 2. How the snapshot was made
```bash
# as hernani@koopa — local only
podman stop taler-hacktivism-exchange-ansible
TAG=20260709-snapshot
OUT=/home/hernani/images/taler-stack-$TAG
mkdir -p "$OUT"
podman commit taler-hacktivism-exchange-ansible \
localhost/taler-hacktivism-exchange-ansible-live:$TAG
podman save -o "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" \
localhost/taler-hacktivism-exchange-ansible-live:$TAG
sha256sum "$OUT/taler-hacktivism-exchange-ansible-live-$TAG.tar" | tee -a "$OUT/SHA256SUMS"
```
`-p` on commit pauses the container if still running; after `stop` it is optional.
---
## 3. Restore from image (same host)
### A. From local image tag (fast)
```bash
podman rm -f taler-hacktivism-exchange-ansible # only if replacing dead/exited
podman run -d --name taler-hacktivism-exchange-ansible \
--network pasta \
-p 9011:9011 \
--label org.hacktivism.service=taler-exchange \
--label org.hacktivism.host_port=9011 \
--label org.hacktivism.site=exchange.hacktivism.ch \
--label org.hacktivism.currency=GOA \
--label org.hacktivism.managed_by=koopa-admin \
localhost/taler-hacktivism-exchange-ansible-live:20260709-snapshot \
sleep infinity
```
### B. From tar (if image store was wiped)
```bash
podman load -i /home/hernani/images/taler-stack-20260709-snapshot/taler-hacktivism-exchange-ansible-live-20260709-snapshot.tar
# then same podman run as above
```
### C. Start services (manual model, no systemd)
Inside container as **root**, then app user:
```bash
podman exec -u root -it taler-hacktivism-exchange-ansible bash
# 1) base: postgres, runtime dirs, secmods, wire helpers
/root/start_base_services_for_taler_exchange.sh --no-shell
# 2) httpd
runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
# 3) health
/usr/local/bin/check_exchange-health.sh
```
Host / public checks:
```bash
curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9011/config
curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/config
curl -sS -o /dev/null -w "%{http_code}\n" https://exchange.hacktivism.ch/keys
```
Caddy already proxies `exchange.hacktivism.ch` → host `:9011` (see `configs/caddy/`, `configs/ports.md`).
---
## 4. GOA configuration (authoritative tree)
**Do not** edit package `taler-exchange.conf` defaults by hand. Site config lives in overrides + coins (merchant pattern).
| In container | In admin-log repo |
|--------------|-------------------|
| `/etc/taler-exchange/exchange-overrides.conf` | `configs/taler-exchange/exchange-overrides.conf` |
| `/etc/taler-exchange/conf.d/exchange-coins.conf` | `configs/taler-exchange/conf.d-exchange-coins.conf` |
| secrets (wire gateway) | **not** in admin-log → `koopa-admin-secrets` |
| start scripts | `scripts/taler-exchange/` |
GOA essentials in overrides:
- `CURRENCY = GOA`, `BASE_URL = https://exchange.hacktivism.ch/`
- `SERVE = tcp`, `PORT = 9011`
- `[currency-goa]` ENABLED + unit names (Yotta…Atomic)
- `[exchange-account-1]` payto `x-taler-bank/bank.hacktivism.ch/exchange`
- Terms stubs: `TERMS_ETAG` / `PRIVACY_ETAG` = `no-terms-v0` / `no-privacy-v0`
Deploy overrides from the local machine (example):
```bash
# from laptop, secrets never committed to admin-log
scp configs/taler-exchange/exchange-overrides.conf \
hernani@koopa:/tmp/exchange-overrides.conf
scp configs/taler-exchange/conf.d-exchange-coins.conf \
hernani@koopa:/tmp/exchange-coins.conf
ssh hernani@koopa 'podman cp /tmp/exchange-overrides.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/exchange-overrides.conf
podman cp /tmp/exchange-coins.conf taler-hacktivism-exchange-ansible:/etc/taler-exchange/conf.d/exchange-coins.conf'
```
Greenfield (empty Debian + packages) only:
`scripts/taler-exchange/archive/exchange-bootstrap.sh` **as root inside** container — generates a **new** master key; not the same as restoring this snapshot.
After config change:
```bash
runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
# optional offline keys / wire:
# scripts/taler-exchange/wire-enable-and-upload.sh
# scripts/taler-exchange/offline-sign-upload-keys.sh
# /usr/local/bin/install_no_terms.sh
```
---
## 5. Ansible
There is **no** Ansible playbook in `koopa-admin-log` / this monorepo path for the exchange.
Operational model is: **podman** + **manual start scripts** + **GOA overrides** as above.
If an external Ansible tree is added later, it should only:
1. `podman load` / ensure image tag
2. `podman run` with pasta + `9011:9011` + labels above
3. copy GOA configs from `configs/taler-exchange/`
4. run `start_base` → `start_exchange`
5. never push images to a public registry without explicit request
---
## 6. Related docs
| Doc | Content |
|-----|---------|
| `configs/taler-exchange/README.md` | GOA site notes, terms, ports |
| `scripts/taler-exchange/archive/README.md` | bootstrap vs daily start |
| `configs/ports.md` | 9011 pasta |
| `ops/ROOT_HYGIENE.md` | secrets layout |
---
## 7. Session note (2026-07-09)
- Exchange **stopped** on request (`Exited 137`).
- Snapshot **local only** under `/home/hernani/images/…`.
- Known pre-stop issue: wirewatch had died after Postgres ownership/outage → bank confirms OK but wallet “Withdraw money from bank…” could hang until wirewatch imports credits. After restore, always verify **wirewatch** is live (`check_exchange-health.sh`).
Reference in a new issue View git blame Copy permalink