koopa-admin-log/configs/paivana

paivana — paivana.hacktivism.ch

GNU Taler paivana-httpd reverse-proxy paywall (DD 95 / DD 76 style), GOA payments.

Item	Value
Live	/home/hernani/koopa-paivana/
Containers	koopa-paivana, koopa-paivana-upstream
Image	localhost/koopa-paivana:latest (built from Containerfile); process uid 1000 paivana-httpd
Upstream	nginxinc/nginx-unprivileged on :8080 (not root nginx:80)
Host port	9025 → Caddy paivana.hacktivism.ch
Currency	GOA
Merchant	https://taler.hacktivism.ch/instances/goa-shop/
Template	paivana (template_type: paivana, amount GOA:4200, website_regex: .*)
Access	-g site-wide: pay once → example upstream free to browse
Upstream	example site in upstream/ (compose service)

Layout

Path	Role
Containerfile	Multi-stage: build paivana-httpd from git.taler.net/paivana + Taler libs
compose.yml	koopa-paivana + nginx upstream
conf/paivana.conf.template	Config; secrets substituted at start
entrypoint.sh	Inject secrets → run paivana-httpd -g -f
secrets/	not in git — live only
upstream/	Protected demo content
container-koopa-paivana.service	systemd --user oneshot compose up
taler-systems.gpg	Deb signing key (build context)

Secrets (live)

File	Role
~/koopa-paivana/secrets/merchant-access-token	secret-token:… for goa-shop
~/koopa-paivana/secrets/paivana-secret	cookie MAC secret (stable across restarts)

Mirror notes: koopa-admin-secrets → koopa/home-hernani/koopa-paivana/secrets/ (paths only / examples).

Ops

# as hernani on koopa
cd ~/koopa-paivana
podman compose build
podman compose up -d
podman logs -f koopa-paivana
curl -si http://127.0.0.1:9025/ | head   # 302 → /.well-known/paivana/templates/paivana#…

Autostart (only the compose unit — starts both koopa-paivana and koopa-paivana-upstream):

mkdir -p ~/.config/systemd/user
cp ~/koopa-paivana/container-koopa-paivana.service ~/.config/systemd/user/
# optional: After= merchant (configs/systemd/user/container-koopa-paivana.service.d/)
systemctl --user daemon-reload
systemctl --user enable --now container-koopa-paivana.service

Do not enable a separate container-koopa-paivana-upstream.service that only runs podman start koopa-paivana-upstream. At boot that unit races compose (container not created yet → exit 125 → start-limit-hit). Compose already starts the upstream. If such a unit exists:
systemctl --user disable --now container-koopa-paivana-upstream.service.

Healthy smoke:

Check	Expect
curl -si http://127.0.0.1:9025/	302 → /.well-known/paivana/templates/paivana#…
template URL / public https://paivana.hacktivism.ch/	402 paywall HTML + paivana: taler://pay-template/…
monitoring	./scripts/taler-monitoring/taler-monitoring.sh -d hacktivism.ch urls → www.paivana OK

Network notes

Rootless pasta cannot hairpin public DNS for the merchant. Compose sets:

extra_hosts:
  - "taler.hacktivism.ch:host-gateway"

so paivana-httpd can load templates from the merchant API.

Caddy

Vhost → 127.0.0.1:9025 (see configs/caddy/Caddyfile).
Flags -g (site-wide payment) and -f (X-Forwarded-For).

Merchant template

curl -X POST 'https://taler.hacktivism.ch/instances/goa-shop/private/templates' \
  -H "Authorization: Bearer secret-token:…" \
  -H 'Content-Type: application/json' \
  -d '{
    "template_id": "paivana",
    "template_description": "Paivana paywall (GOA)",
    "template_contract": {
      "template_type": "paivana",
      "summary": "Access to paivana.hacktivism.ch",
      "website_regex": ".*",
      "choices": [{ "amount": "GOA:4200", "description": "Unlock example site (then free to browse)" }]
    }
  }'

Docs

• https://docs.taler.net/taler-paivana-manual.html
• https://docs.taler.net/design-documents/095-captcha-100.html
• https://docs.taler.net/design-documents/076-paywall-proxy.html
• https://docs.taler.net/manpages/paivana.conf.5.html