koopa-admin-log/scripts

Scripts

Dir	Source on koopa
taler-merchant/	podman taler-hacktivism: /root, /usr/local/bin
taler-exchange/	podman taler-exchange-hacktivism: /root, /usr/local/bin
taler-bank/	podman taler-bank-hacktivism: /root, /usr/local/bin
taler-sanity/	host root checks (stack, settlement, helpers)
taler-monitoring/	outside-in public URL walk (/config → keys/terms/integration/webui)
ops/	host hygiene (cleanup-root-scratch.sh)
monitoring/	host /home/hernani/scripts (tor relay stats)
taler-wallet-cli/	thin wrappers; benchmarks live in ../benchmarks/
castopod/	host hernani podman-compose ~/koopa-castopod — see castopod/README.md

Scratch: one-off probes live in local koopa-admin-log/.tmp/ (gitignored). See ops/ROOT_HYGIENE.md.

Secrets: never in this tree — sibling ../koopa-admin-secrets (koopa/host-root/<service>/ ↔ /root/ on host; containers/…/secrets/ for in-container).

Manual start model (all three)

1. root runs /root/start_base_services_for_taler_*.sh
   → Debian-style postgres perms + start (pg_ctlcluster / init.d)
   → (+ exchange: secmods/helpers; merchant: nginx)
   → interactive shell as service user
   → automation: add --no-shell then run step 2 via runuser
2. service user runs /usr/local/bin/start_*.sh [ --restart ]
   → application process only

Postgres ownership (Debian defaults, if cluster was root-owned after bad ops):

chown -R root:postgres /etc/postgresql
chmod confs 640 / dirs 755
chown -R postgres:postgres /var/lib/postgresql /var/log/postgresql /var/run/postgresql
# only remove postmaster.pid / socket locks when pg_isready fails and no live postgres
pg_ctlcluster 17 main start

Container	Root base	App start	App user
taler-hacktivism	start_base_services_for_taler.sh	start_merchant.sh	taler-merchant-httpd
taler-exchange-hacktivism	start_base_services_for_taler_exchange.sh	start_exchange.sh	taler-exchange-httpd

Exchange one-shots (root, offline / wire):
taler-exchange/wire-enable-and-upload.sh, offline-sign-upload-keys.sh, start_wire_helpers.sh | taler-bank-hacktivism | start_base_services_for_taler_bank.sh | start_bank.sh | libeufin-bank |

runuser -u USER -- bash (never -u with -s on util-linux).

SMS helper symlinks into /var/taler-src/... are not copied (merchant only).