paivana — `paivana.hacktivism.ch`

GNU Taler paivana-httpd reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.

Item	Value
Live	`/home/hernani/koopa-paivana/`
Containers	`koopa-paivana`, `koopa-paivana-upstream`
Image	`localhost/koopa-paivana:latest` (built from `Containerfile`)
Host port	9025 → Caddy `paivana.hacktivism.ch`
Currency	GOA
Merchant	`https://taler.hacktivism.ch/instances/goa-shop/`
Template	`paivana` (`template_type: paivana`, amount `GOA:4200`, `website_regex: .*`)
Access	`-g` site-wide: pay once → example upstream free to browse
Upstream	example site in `upstream/` (compose service)

Layout

Path	Role
`Containerfile`	Multi-stage: build paivana-httpd from `git.taler.net/paivana` + Taler libs
`compose.yml`	`koopa-paivana` + nginx upstream
`conf/paivana.conf.template`	Config; secrets substituted at start
`entrypoint.sh`	Inject secrets → run `paivana-httpd -g -f`
`secrets/`	not in git — live only
`upstream/`	Protected demo content
`container-koopa-paivana.service`	systemd --user oneshot compose up
`taler-systems.gpg`	Deb signing key (build context)

Secrets (live)

File	Role
`~/koopa-paivana/secrets/merchant-access-token`	`secret-token:…` for goa-shop
`~/koopa-paivana/secrets/paivana-secret`	cookie MAC secret (stable across restarts)

Mirror notes: koopa-admin-secrets → koopa/home-hernani/koopa-paivana/secrets/ (paths only / examples).

Ops

# as hernani on koopa
cd ~/koopa-paivana
podman compose build
podman compose up -d
podman logs -f koopa-paivana
curl -si http://127.0.0.1:9025/ | head   # 302 → /.well-known/paivana/templates/paivana#…

Autostart:

mkdir -p ~/.config/systemd/user
cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/
systemctl --user daemon-reload
systemctl --user enable --now container-koopa-paivana.service

Network notes

Rootless pasta cannot hairpin public DNS for the merchant. Compose sets:

extra_hosts:
  - "taler.hacktivism.ch:host-gateway"

so paivana-httpd can load templates from the merchant API.

Caddy

Vhost → 127.0.0.1:9025 (see configs/caddy/Caddyfile).
Flags -g (site-wide payment) and -f (X-Forwarded-For).

Merchant template

curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
  -H "Authorization: Bearer secret-token:…" \
  -H 'Content-Type: application/json' \
  -d '{
    "template_id": "paivana",
    "template_description": "Paivana paywall (GOA)",
    "template_contract": {
      "template_type": "paivana",
      "summary": "Access to paivana.hacktivism.ch",
      "website_regex": ".*",
      "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
    }
  }'

3.1 KiB Raw Blame History

paivana — paivana.hacktivism.ch