koopa-admin-log/configs/paivana

paivana — paivana.hacktivism.ch

GNU Taler paivana-httpd reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.

Item	Value
Live	/home/hernani/koopa-paivana/
Containers	koopa-paivana, koopa-paivana-upstream
Image	localhost/koopa-paivana:latest (built from Containerfile)
Host port	9025 → Caddy paivana.hacktivism.ch
Currency	GOA
Merchant	https://taler.hacktivism.ch/instances/goa-shop/
Template	paivana (template_type: paivana, amount GOA:4200, website_regex: .*)
Access	-g site-wide: pay once → example upstream free to browse
Upstream	example site in upstream/ (compose service)

Layout

Path	Role
Containerfile	Multi-stage: build paivana-httpd from git.taler.net/paivana + Taler libs
compose.yml	koopa-paivana + nginx upstream
conf/paivana.conf.template	Config; secrets substituted at start
entrypoint.sh	Inject secrets → run paivana-httpd -g -f
secrets/	not in git — live only
upstream/	Protected demo content
container-koopa-paivana.service	systemd --user oneshot compose up
taler-systems.gpg	Deb signing key (build context)

Secrets (live)

File	Role
~/koopa-paivana/secrets/merchant-access-token	secret-token:… for goa-shop
~/koopa-paivana/secrets/paivana-secret	cookie MAC secret (stable across restarts)

Mirror notes: koopa-admin-secrets → koopa/home-hernani/koopa-paivana/secrets/ (paths only / examples).

Ops

# as hernani on koopa
cd ~/koopa-paivana
podman compose build
podman compose up -d
podman logs -f koopa-paivana
curl -si http://127.0.0.1:9025/ | head   # 302 → /.well-known/paivana/templates/paivana#…

Autostart:

mkdir -p ~/.config/systemd/user
cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/
systemctl --user daemon-reload
systemctl --user enable --now container-koopa-paivana.service

Network notes

Rootless pasta cannot hairpin public DNS for the merchant. Compose sets:

extra_hosts:
  - "taler.hacktivism.ch:host-gateway"

so paivana-httpd can load templates from the merchant API.

Caddy

Vhost → 127.0.0.1:9025 (see configs/caddy/Caddyfile).
Flags -g (site-wide payment) and -f (X-Forwarded-For).

Merchant template

curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
  -H "Authorization: Bearer secret-token:…" \
  -H 'Content-Type: application/json' \
  -d '{
    "template_id": "paivana",
    "template_description": "Paivana paywall (GOA)",
    "template_contract": {
      "template_type": "paivana",
      "summary": "Access to paivana.hacktivism.ch",
      "website_regex": ".*",
      "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
    }
  }'

Docs

• https://docs.taler.net/taler-paivana-manual.html
• https://docs.taler.net/design-documents/095-captcha-100.html
• https://docs.taler.net/design-documents/076-paywall-proxy.html
• https://docs.taler.net/manpages/paivana.conf.5.html