koopa-admin-log/scripts/taler-bank

taler-bank scripts

Container: taler-hacktivism-bank (libeufin-bank, GOA, no IBAN).

File	Container path	User
start_base_services_for_taler_bank.sh	/root/	root
start_bank.sh	/usr/local/bin/	libeufin-bank
check_bank-health.sh	/usr/local/bin/	libeufin-bank / any
landing-stats.sh	/usr/local/bin/	root (in container) — writes /var/www/bank-landing/stats.json
landing-stats-install.sh	host only	root/podman — copies + runs + optional cron
demo-withdraw-api.py	/usr/local/bin/	root — loopback :19096
install-demo-withdraw-api.sh	host only	installs API + nginx + auto-confirm
maintenance/raise-debit-limits.sh	host or bank ctr	raise all accounts’ debit_threshold (dry-run; --no-dry)
auto-confirm-withdrawals.sh	/usr/local/bin/	root — explorer-only confirm loop
refresh-demo-withdraw.sh	/usr/local/bin/	refresh static withdraw.uri
credit-account.sh	host/ops	admin → user credit

Usage

# root in container
./start_base_services_for_taler_bank.sh
# then as libeufin-bank in /usr/local/bin:
./start_bank.sh --restart

Landing stats (inside container)

# on koopa host — copy + run (writes /var/www/bank-landing/stats.json)
./landing-stats-install.sh
./landing-stats-install.sh --cron     # every minute inside container (* * * * *)
./landing-stats-install.sh --run-only

Details + JSON schema: configs/bank-landing/README.md.

Demo withdraw + auto-account API

FP reference SoT: $HOME/git/admin-logs/taler/francpaysan-admin-log (files/testpaysan/demo-withdraw-api.py, files/caddy/Caddyfile @wdGet). GOA ports that pattern: mint amount+exchange_url, and GET Integration injects suggested_exchange / required_exchange (Android/iOS).

demo-withdraw-api.py listens on 127.0.0.1:19096 (in bank CTR; nginx on :9013):

Path	Behaviour
GET /demo-withdraw.json	Mint one-shot withdraw from shared explorer pool; write withdraw.uri + watch ids
GET /auto-account.json	Public POST /accounts with generated goa-account-<random> user + password containing pleasechangeme; balance GOA:0; return credentials once
GET /taler-integration/withdrawal-operation/*	Proxy libeufin + inject suggested_exchange/required_exchange

Public path (Android): Caddy @wdGet (GET only) → landing :9013 → nginx → :19096. POST / other Integration stays Caddy → :9012 (raw libeufin). FP stage proxies @wdGet straight to host :19096; GOA keeps 19096 CTR-only and routes via published 9013 instead.

Install / restart (host, podman → taler-hacktivism-bank):

./install-demo-withdraw-api.sh
# Public checks:
curl -sS https://bank.hacktivism.ch/intro/demo-withdraw.json | head
curl -sS https://bank.hacktivism.ch/intro/auto-account.json | head   # creates a real account
# After Caddy @wdGet + nginx Integration are live:
WID=…  # from demo-withdraw.json
curl -sS "https://bank.hacktivism.ch/taler-integration/withdrawal-operation/$WID" \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("suggested_exchange"), d.get("required_exchange"))'

Requires python3 in the bank container. Env: BANK_URL, BANK_USER/BANK_PASS (or /root/bank-explorer-password.txt), AMOUNT (default GOA:10), EXCHANGE_URL (default https://exchange.hacktivism.ch/).

Caddy (root on koopa — you apply): insert @wdGet before the bank catch-all reverse_proxy 127.0.0.1:9012 in ~/koopa-caddy/Caddyfile (SoT: configs/caddy/Caddyfile / host/caddy/Caddyfile; paste-ready snippet: scripts/caddy/wdGet-bank-snippet.caddy, also copied live as ~/koopa-caddy/wdGet-bank-snippet.caddy), then sudo ~/bin/caddy-apply. Caddy alone is not enough — demo-api + nginx Integration must be installed via ./install-demo-withdraw-api.sh first.

Auto-confirm (explorer only)

# loop inside container — refuses non-explorer unless ALLOW_NON_EXPLORER=1
auto-confirm-withdrawals.sh --loop 2

Only confirms withdrawals owned by explorer when status is selected (community demo path). Does not confirm arbitrary customer withdraws.

Stable ops (via koopa-external if LAN koopa is down):

• One process only (flock on /var/run/auto-confirm-withdrawals.lock)
• QUIET=1 + summary tick checked=… selected=… each loop
• Watch list capped (WATCH_MAX=80, prune of bloated withdraw-watch.ids)
• Status via taler-integration/withdrawal-operation/{id}
• Reinstall: ./install-demo-withdraw-api.sh on host with podman access to taler-hacktivism-bank

Config

See configs/taler-hacktivism-bank/ and configs/bank-landing/.