koopa-admin-log/configs/taler-merchant

taler-merchant (container taler-hacktivism)

Image: localhost/taler-hacktivism-live:9010
Publish: 9010/tcp only
Labels: org.hacktivism.service=taler-merchant, host_port=9010, site=taler.hacktivism.ch

Config layout (same pattern as exchange)

Path in container	Mirror in this dir
taler-merchant.conf	includes documented in taler-merchant.conf.includes.txt
overrides.conf	tooling — do not edit (not mirrored)
merchant-overrides.conf	merchant-overrides.conf
conf.d/merchant.conf	conf.d-merchant.conf
nginx sites-available/taler-merchant	nginx-taler-merchant.conf

Secrets (secrets/*.secret.conf, SMTP password) are not mirrored.

Manual start (merchant model)

Path	User	Role
/root/start_base_services_for_taler.sh	root	logs, SMS env, postgres → shell as taler-merchant-httpd
/usr/local/bin/start_merchant.sh	taler-merchant-httpd	start / --restart httpd + helpers
/usr/local/bin/check_merchant-health.sh	any	health (socket + nginx)

Also under /usr/local/bin/: email/SMS helpers, stats--merchant-payments.sh.
Certbot loop: /root/scripts/certbot_renew.sh (started from base script).

Git scripts: scripts/taler-merchant/.

Site settings (overrides)

• Default currency: CHF ([taler] / [merchant])
• Exchanges (multi-currency):
  • CHF → exchange.taler-ops.ch (package default [merchant-exchange-chf] in tops.conf — do not redeclare as merchant-exchange-tops)
  • GOA → exchange.hacktivism.ch ([merchant-exchange-goa] in merchant-overrides.conf)
• SERVE: unix socket → nginx :9010 SSL → Caddy :9001
• Self-provisioning: YES; no mandatory TAN (SMS off)
• Terms: TERMS_ETAG = merchant-tos-dual-v0 — short dual-currency notice (GOA explorational + CHF real). Sources in terms-src/; install with scripts/taler-merchant/install_dual_terms.sh inside the container, then restart taler-merchant-httpd. Public: https://taler.hacktivism.ch/terms

Wire status is per account × exchange: an x-taler-bank GOA payto shows ready for hacktivism and unsupported for taler-ops (expected). CHF/IBAN accounts use taler-ops.

Container → public exchange (pasta)

Inside pasta, exchange.hacktivism.ch must not resolve to 127.0.0.1 (merchant nginx self-signed). Pin public A in container /etc/hosts:

212.51.151.254 exchange.hacktivism.ch bank.hacktivism.ch taler.hacktivism.ch

After conf/hosts changes: taler-merchant-exchangekeyupdate -t and taler-merchant-kyccheck -t.## Ports

Port	Role
9010	nginx TLS in container (podman)
unix sock	taler-merchant-httpd

Demo instance (2026-07-09)

Self-provisioned shop goa-demo-cp4zqk, bank account same username, payto linked, seed GOA:5000.

Details + credential paths: demo-instance-goa-demo-cp4zqk.md.