feat: EBICS bank detect, regio FLODOS, and check skips
This commit is contained in:
Hernâni Marques
parent
bc785f8466
commit
4e4e6a2925
8 changed files with 256 additions and 22 deletions
|
|
@ -41,6 +41,11 @@ load_monitoring_secrets_env 2>/dev/null || true
|
|||
# Area ladder.* — withdraw/pay amount ladder (any EXPECT_CURRENCY / stack)
|
||||
# Groups: ladder.plan / ladder.load / ladder.withdraw / ladder.pay / ladder.report
|
||||
set_area ladder
|
||||
if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
|
||||
set_group plan
|
||||
info "ladder" "skipped — backend=${TALER_BANK_BACKEND:-ebics} (needs public x-taler-bank)"
|
||||
exit 0
|
||||
fi
|
||||
set_group plan
|
||||
SECTION_T0=$(date +%s)
|
||||
now_ms() { python3 -c 'import time; print(int(time.time()*1000))'; }
|
||||
|
|
@ -128,6 +133,16 @@ INST="${MERCHANT_INSTANCE}"
|
|||
# Uses bank max_wire_transfer_amount and exchange min denom when still on GOA defaults.
|
||||
apply_ladder_stack_defaults() {
|
||||
[ "${LADDER_STACK_AUTO}" = "1" ] || return 0
|
||||
if [ "${CUR}" = "FLODOS" ] || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
|
||||
CUR="FLODOS"
|
||||
# demo bank: keep ladder inside a small funded pool (override with LADDER_MAX_AMOUNT=)
|
||||
if [ "${LADDER_MAX_AMOUNT}" = "4503599627370496" ] || [ "${LADDER_MAX_AMOUNT}" = "${GOA_LADDER_CEILING:-}" ]; then
|
||||
LADDER_MAX_AMOUNT="${REGIO_LADDER_MAX:-20}"
|
||||
fi
|
||||
LADDER_MIN_AMOUNT="${LADDER_MIN_AMOUNT:-0.02}"
|
||||
info "ladder stack" "FLODOS/regio · max=${CUR}:${LADDER_MAX_AMOUNT} min=${CUR}:${LADDER_MIN_AMOUNT}"
|
||||
return 0
|
||||
fi
|
||||
if [ "${CUR}" != "TESTPAYSAN" ]; then
|
||||
case "${TALER_DOMAIN:-}" in
|
||||
stage.lefrancpaysan.ch|stage.bank.lefrancpaysan.ch|stage.exchange.lefrancpaysan.ch|stage.monnaie.lefrancpaysan.ch)
|
||||
|
|
@ -259,6 +274,28 @@ resolve_explorer_pw() {
|
|||
return 0
|
||||
fi
|
||||
|
||||
# regio.taler.net (FLODOS) — dedicated pool user, not admin (override default EXP_USER=explorer)
|
||||
if [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ] \
|
||||
|| [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
|
||||
if [ -n "${REGIO_BANK_EXPLORER_USER_FILE:-}" ] && [ -f "${REGIO_BANK_EXPLORER_USER_FILE}" ]; then
|
||||
EXP_USER=$(tr -d '\n\r' <"${REGIO_BANK_EXPLORER_USER_FILE}")
|
||||
elif [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt" ]; then
|
||||
EXP_USER=$(tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt")
|
||||
else
|
||||
EXP_USER="${EXP_USER:-lena.v92}"
|
||||
[ "$EXP_USER" = "explorer" ] && EXP_USER=lena.v92
|
||||
fi
|
||||
export EXP_USER
|
||||
if [ -n "${REGIO_BANK_EXPLORER_SECRET:-}" ] && [ -f "${REGIO_BANK_EXPLORER_SECRET}" ]; then
|
||||
tr -d '\n\r' <"${REGIO_BANK_EXPLORER_SECRET}"
|
||||
return 0
|
||||
fi
|
||||
if [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-password.txt" ]; then
|
||||
tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-password.txt"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Stage TESTPAYSAN — never use GOA koopa-admin-secrets explorer pw first
|
||||
if [ "${CUR}" = "TESTPAYSAN" ] \
|
||||
|| [[ "${TALER_DOMAIN:-}" == stage.*lefrancpaysan* ]] \
|
||||
|
|
@ -532,6 +569,18 @@ metrics_report_load "$LOAD_BEFORE" "ladder-start" || true
|
|||
# Fresh wallet per rung — baseline empty (or last-rung DB if re-used later)
|
||||
metrics_report_coins "ladder-start" || true
|
||||
|
||||
# EXP_USER must be set in this shell (resolve_explorer_pw runs in $(…) subshell)
|
||||
if [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ] \
|
||||
|| [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
|
||||
if [ -n "${REGIO_BANK_EXPLORER_USER_FILE:-}" ] && [ -f "${REGIO_BANK_EXPLORER_USER_FILE}" ]; then
|
||||
EXP_USER=$(tr -d '\n\r' <"${REGIO_BANK_EXPLORER_USER_FILE}")
|
||||
elif [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt" ]; then
|
||||
EXP_USER=$(tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt")
|
||||
elif [ -z "${EXP_USER:-}" ] || [ "${EXP_USER}" = "explorer" ]; then
|
||||
EXP_USER=lena.v92
|
||||
fi
|
||||
export EXP_USER
|
||||
fi
|
||||
if ! EXP_PW=$(resolve_explorer_pw); then
|
||||
err bank "explorer password missing" \
|
||||
"set EXP_PW / EXP_PW_FILE or SECRETS_ROOT=…/koopa/host-root (taler-bank/bank-explorer-password.txt)${SECRETS_ROOT:+ · SECRETS_ROOT=${SECRETS_ROOT}}"
|
||||
|
|
@ -539,9 +588,9 @@ if ! EXP_PW=$(resolve_explorer_pw); then
|
|||
exit 1
|
||||
fi
|
||||
if [ -n "${SECRETS_ROOT:-}" ]; then
|
||||
info "explorer secret" "resolved (SECRETS_ROOT=${SECRETS_ROOT} · stage uses stagepaysan secret first when CUR=TESTPAYSAN)"
|
||||
info "explorer secret" "resolved user=${EXP_USER} (SECRETS_ROOT=${SECRETS_ROOT})"
|
||||
else
|
||||
info "explorer secret" "resolved via EXP_PW / EXP_PW_FILE / stage SSH / koopa"
|
||||
info "explorer secret" "resolved user=${EXP_USER} via EXP_PW / file / stage SSH / koopa"
|
||||
fi
|
||||
if [ -n "${CLI_JS:-}" ] && [ -f "${CLI_JS}" ]; then
|
||||
ok "wallet-cli" "$CLI_JS"
|
||||
|
|
@ -556,20 +605,66 @@ if ! wcli balance >"$SCRATCH/wcli-smoke.out" 2>&1; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
# --- auto-account ---
|
||||
# --- personal account (intro auto-account, else open registration) ---
|
||||
t0=$(now_ms)
|
||||
if ! curl -sS -m 30 -o "$SCRATCH/auto-account.json" "${BANK}/intro/auto-account.json"; then
|
||||
err bank "auto-account.json unreachable"
|
||||
exit 1
|
||||
_acct_ok=0
|
||||
if curl -sS -m 30 -o "$SCRATCH/auto-account.json" "${BANK}/intro/auto-account.json" \
|
||||
&& python3 -c 'import json; d=json.load(open("'"$SCRATCH"'/auto-account.json")); assert d.get("ok") or d.get("username")' 2>/dev/null; then
|
||||
_acct_ok=1
|
||||
elif [ "${CUR:-}" = "FLODOS" ] || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]]; then
|
||||
# regio has no /intro landings — register a discreet one-shot user (disposable mail list)
|
||||
_mail_file="${REGIO_DISPOSABLE_EMAILS:-${TALER_DEPLOYMENT_SECRETS:+$TALER_DEPLOYMENT_SECRETS/regio/disposable-emails.txt}}"
|
||||
_email=""
|
||||
if [ -n "${_mail_file:-}" ] && [ -f "$_mail_file" ]; then
|
||||
_email=$(awk -F'\t' '$2=="UNUSED" && $1 !~ /^#/ {print $1; exit}' "$_mail_file")
|
||||
fi
|
||||
: "${_email:=sofia.keller4@grr.la}"
|
||||
_user=$(printf '%s' "$_email" | python3 -c 'import sys; e=sys.stdin.read().strip().split("@")[0]; print((e.replace(".","")[:10])+str(abs(hash(e))%100))')
|
||||
_pw=$(openssl rand -base64 18 | tr -d '/+=' | head -c 20)
|
||||
_name=$(printf '%s' "$_email" | python3 -c 'import sys; e=sys.stdin.read().strip().split("@")[0].replace("."," ").title(); print(e)')
|
||||
_code=$(curl -sS -m 20 -o "$SCRATCH/auto-account.raw" -w '%{http_code}' -X POST \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"username\":\"${_user}\",\"password\":\"${_pw}\",\"name\":\"${_name}\",\"email\":\"${_email}\"}" \
|
||||
"${BANK}/accounts")
|
||||
if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
|
||||
python3 - "$_user" "$_pw" "$_name" "$_email" "$SCRATCH/auto-account.json" <<'PY'
|
||||
import json,sys
|
||||
u,p,n,e,out=sys.argv[1:6]
|
||||
json.dump({"ok":True,"created_for_you":True,"username":u,"password":p,"name":n,"email":e,"balance":"FLODOS:0"}, open(out,"w"))
|
||||
PY
|
||||
if [ -n "${_mail_file:-}" ] && [ -f "$_mail_file" ]; then
|
||||
python3 - "$_mail_file" "$_email" "$_user" <<'PY'
|
||||
from pathlib import Path
|
||||
import sys
|
||||
p,email,user=Path(sys.argv[1]),sys.argv[2],sys.argv[3]
|
||||
lines=[]
|
||||
for line in p.read_text().splitlines():
|
||||
if line.startswith(email+"\t") or line.startswith(email+" "):
|
||||
parts=line.split("\t")
|
||||
while len(parts)<3: parts.append("")
|
||||
parts[1]="USED"
|
||||
parts[2]=f"personal {user}"
|
||||
line="\t".join(parts)
|
||||
lines.append(line)
|
||||
p.write_text("\n".join(lines)+"\n")
|
||||
PY
|
||||
fi
|
||||
_acct_ok=1
|
||||
info "personal account" "open-register ${_user} (no /intro; disposable mail)"
|
||||
else
|
||||
err bank "open register failed HTTP ${_code}" "$(head -c 120 "$SCRATCH/auto-account.raw" | tr '\n' ' ')"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
ms_auto=$(elapsed_ms "$t0")
|
||||
if ! python3 -c 'import json; d=json.load(open("'"$SCRATCH"'/auto-account.json")); assert d.get("ok") or d.get("username")' 2>/dev/null; then
|
||||
err bank "auto-account create failed" "$(head -c 120 "$SCRATCH/auto-account.json" | tr '\n' ' ')"
|
||||
if [ "$_acct_ok" != "1" ]; then
|
||||
err bank "auto-account create failed" "$(head -c 120 "$SCRATCH/auto-account.json" 2>/dev/null | tr '\n' ' ')"
|
||||
exit 1
|
||||
fi
|
||||
ACCT_USER=$(python3 -c 'import json; print(json.load(open("'"$SCRATCH"'/auto-account.json"))["username"])')
|
||||
ok "auto-account ${ACCT_USER} (${ms_auto}ms) — personal ${CUR}:0; pool=explorer"
|
||||
ok "auto-account ${ACCT_USER} (${ms_auto}ms) — personal ${CUR}:0; pool=${EXP_USER:-explorer}"
|
||||
info "auto-account password" "(see $SCRATCH/auto-account.json — not logged)"
|
||||
unset _acct_ok _mail_file _email _user _pw _name _code
|
||||
|
||||
# --- explorer token ---
|
||||
t0=$(now_ms)
|
||||
|
|
|
|||
17
check_e2e.sh
17
check_e2e.sh
|
|
@ -489,6 +489,17 @@ if [ "$E2E_REMOTE" = "1" ]; then
|
|||
fi
|
||||
unset _fp_try _fp_host _remote_bank_sec
|
||||
fi
|
||||
# regio.taler.net (FLODOS): path from taler-deployment-secrets via env
|
||||
if [ -z "$ADMIN_PASS" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ]; then
|
||||
_regio_sec="${REGIO_BANK_ADMIN_SECRET:-}"
|
||||
[ -z "$_regio_sec" ] && [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && \
|
||||
_regio_sec="${TALER_DEPLOYMENT_SECRETS}/regio/bank-admin-password.txt"
|
||||
if [ -n "$_regio_sec" ] && [ -f "$_regio_sec" ]; then
|
||||
ADMIN_PASS=$(tr -d '\n\r' <"$_regio_sec")
|
||||
info "bank admin secret" "from $_regio_sec"
|
||||
fi
|
||||
unset _regio_sec
|
||||
fi
|
||||
# Stage merchant: public templates need no token; optional default-instance token
|
||||
if [ -z "$MPW" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
|
||||
if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
|
||||
|
|
@ -552,6 +563,12 @@ merchant_auth_header() {
|
|||
esac
|
||||
}
|
||||
|
||||
# EBICS / no public bank.* — withdraw path needs x-taler-bank (libeufin)
|
||||
if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
|
||||
info "e2e" "skipped — backend=${TALER_BANK_BACKEND:-ebics} (no public bank.* / x-taler-bank)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Public reachability gates (remote: soft-skip if bank/merchant absent)
|
||||
for pair in \
|
||||
"bank|$BANK_PUBLIC/config" \
|
||||
|
|
|
|||
|
|
@ -31,6 +31,9 @@ set_area sanity
|
|||
set_group bank
|
||||
section "sanity · bank"
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
|
||||
info "bank" "IBAN/EBICS (CHECK_BANK=${CHECK_BANK:-0} · backend=${TALER_BANK_BACKEND:-ebics} — no public bank.*)"
|
||||
else
|
||||
expect_code "bank public /config" 200 "$BANK_PUBLIC/config"
|
||||
expect_code "bank public /taler-integration/config" 200 "$BANK_PUBLIC/taler-integration/config"
|
||||
expect_code "bank public /webui/" 200 "$BANK_PUBLIC/webui/"
|
||||
|
|
@ -98,6 +101,7 @@ REMOTE
|
|||
else
|
||||
warn "bank server-side" "ssh ${KOOPA_SSH} unavailable"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
set_group exchange
|
||||
|
|
|
|||
27
domains.conf
27
domains.conf
|
|
@ -5,9 +5,13 @@
|
|||
#
|
||||
# - name: what -d / TALER_DOMAIN matches (aliases allowed as extra lines)
|
||||
# - bank / exchange / merchant: hostname or full https:// URL
|
||||
# bank may be "-" / ebics / none when the stack is IBAN/EBICS (no public
|
||||
# libeufin bank.*). monitord also auto-detects from exchange /keys payto://
|
||||
# (x-taler-bank → expect bank.*; iban-only → ebics_no_bank, blue).
|
||||
# - currency: GOA | KUDOS | CHF | … (empty or "-" = report only)
|
||||
# - local: 1 = koopa SSH/inside/e2e stack; 0 = public-only
|
||||
# - landing: 1 = check /intro landings + assets; 0 = skip (no GOA-style landings)
|
||||
# - landing: 1 = custom /intro landings (GOA + FrancPaysan/TESTPAYSAN stage only).
|
||||
# 0 = no /intro (demo/test/regio/TOPS — not the custom landing stack)
|
||||
# - lang: UI language for mon console/HTML (en|fr|de). Source of truth when
|
||||
# TALER_MON_LANG_SET≠1. Workstation TALER_MON_LANG=en does not override.
|
||||
# **de is supported but must not be used as a profile default** (no row
|
||||
|
|
@ -21,26 +25,37 @@
|
|||
# CLI: --lang en|fr|de · TALER_MON_LANG_SET=1 locks UI lang
|
||||
# Alternate file: TALER_DOMAINS_CONF=/path/to/domains.conf
|
||||
|
||||
# Local GOA (koopa) — landings matter · UI en · locale de-CH
|
||||
# Local GOA (koopa) — merchant host taler.hacktivism.ch · landings · UI en · locale de-CH
|
||||
# monitord includes local=1 by default (stack id hacktivism.ch).
|
||||
koopa bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch GOA 1 1 en de-CH hacktivism.ch
|
||||
hacktivism bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch GOA 1 1 en de-CH hacktivism.ch
|
||||
hacktivism.ch bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch GOA 1 1 en de-CH
|
||||
taler.hacktivism.ch bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch GOA 1 1 en de-CH hacktivism.ch
|
||||
|
||||
# Public demo (KUDOS)
|
||||
taler.net bank.demo.taler.net exchange.demo.taler.net backend.demo.taler.net KUDOS 0 1 en de-CH demo.taler.net
|
||||
demo.taler.net bank.demo.taler.net exchange.demo.taler.net backend.demo.taler.net KUDOS 0 1 en de-CH
|
||||
# Public demo (KUDOS) — no custom /intro landings
|
||||
taler.net bank.demo.taler.net exchange.demo.taler.net backend.demo.taler.net KUDOS 0 0 en de-CH demo.taler.net
|
||||
demo.taler.net bank.demo.taler.net exchange.demo.taler.net backend.demo.taler.net KUDOS 0 0 en de-CH
|
||||
|
||||
# Public test stack (TESTKUDOS)
|
||||
test.taler.net bank.test.taler.net exchange.test.taler.net backend.test.taler.net TESTKUDOS 0 0 en de-CH
|
||||
|
||||
# TOPS CHF
|
||||
# TOPS CHF — EBICS/IBAN wire (no public bank.*); monitord softens bank via /keys
|
||||
taler-ops.ch bank.taler-ops.ch exchange.taler-ops.ch my.taler-ops.ch CHF 0 0 en de-CH
|
||||
my.taler-ops.ch bank.taler-ops.ch exchange.taler-ops.ch my.taler-ops.ch CHF 0 0 en de-CH taler-ops.ch
|
||||
stage.taler-ops.ch bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0 0 en de-CH
|
||||
stage.my.taler-ops.ch bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0 0 en de-CH stage.taler-ops.ch
|
||||
my.stage.taler-ops.ch bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0 0 en de-CH stage.taler-ops.ch
|
||||
|
||||
# Public regional-currency demo (FLODOS) — taler-deployment / regio.taler.net
|
||||
regio.taler.net bank.regio.taler.net exchange.regio.taler.net backend.regio.taler.net FLODOS 0 0 en de-CH
|
||||
bank.regio.taler.net bank.regio.taler.net exchange.regio.taler.net backend.regio.taler.net FLODOS 0 0 en de-CH regio.taler.net
|
||||
exchange.regio.taler.net bank.regio.taler.net exchange.regio.taler.net backend.regio.taler.net FLODOS 0 0 en de-CH regio.taler.net
|
||||
backend.regio.taler.net bank.regio.taler.net exchange.regio.taler.net backend.regio.taler.net FLODOS 0 0 en de-CH regio.taler.net
|
||||
regio bank.regio.taler.net exchange.regio.taler.net backend.regio.taler.net FLODOS 0 0 en de-CH regio.taler.net
|
||||
|
||||
# Franc Paysan — UI fr · regional locale fr-CH (Suisse romande)
|
||||
# currency "-" = no Taler prod stack yet (static site only; monitord: static_pending).
|
||||
# Stage TESTPAYSAN below is the live Taler stack.
|
||||
lefrancpaysan.ch bank.lefrancpaysan.ch exchange.lefrancpaysan.ch monnaie.lefrancpaysan.ch - 0 0 fr fr-CH
|
||||
monnaie.lefrancpaysan.ch bank.lefrancpaysan.ch exchange.lefrancpaysan.ch monnaie.lefrancpaysan.ch - 0 0 fr fr-CH lefrancpaysan.ch
|
||||
bank.lefrancpaysan.ch bank.lefrancpaysan.ch exchange.lefrancpaysan.ch monnaie.lefrancpaysan.ch - 0 0 fr fr-CH lefrancpaysan.ch
|
||||
|
|
|
|||
2
host-agent/env/mytops-stage.env.example
vendored
2
host-agent/env/mytops-stage.env.example
vendored
|
|
@ -27,7 +27,9 @@ TALER_MON_LANG=en
|
|||
AGENT_LABEL=mytops-stage-host-agent
|
||||
STATE_NAME=taler-monitoring-mytops-stage
|
||||
SUITE_UPDATE_STRICT=1
|
||||
# EBICS/IBAN wire — no public bank.* (also auto-detected from exchange /keys)
|
||||
CHECK_BANK=0
|
||||
CHECK_BANK_SET=1
|
||||
MERCHANT_REQUIRED=1
|
||||
CHECK_LANDING=0
|
||||
# rusty devtesting (SSH Host taler-rusty-devtesting → devtesting@rusty.taler-ops.ch)
|
||||
|
|
|
|||
89
lib.sh
89
lib.sh
|
|
@ -79,6 +79,12 @@ fi
|
|||
: "${EXCHANGE_LOCAL:=http://127.0.0.1:9011}"
|
||||
: "${MERCHANT_LOCAL:=https://127.0.0.1:9010}"
|
||||
: "${LANDING_LOCAL:=http://127.0.0.1:9013}"
|
||||
# Public libeufin bank.* checks (urls/sanity/e2e). Auto 0 for EBICS/IBAN wire.
|
||||
: "${CHECK_BANK:=1}"
|
||||
: "${CHECK_BANK_SET:=0}"
|
||||
# x-taler-bank | ebics | unknown — filled by resolve_taler_bank_backend
|
||||
: "${TALER_BANK_BACKEND:=}"
|
||||
: "${TALER_BANK_BACKEND_SET:=0}"
|
||||
# Hostnames/paths: set via ~/.config/taler-monitoring/env (no hardcoded machine values).
|
||||
: "${KOOPA_SSH:=}"
|
||||
: "${KOOPA_SSH_FALLBACKS:=}"
|
||||
|
|
@ -149,16 +155,77 @@ MERCHANT_PUBLIC=${MERCHANT_PUBLIC%/}
|
|||
_MONITOR_LIB_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
||||
: "${TALER_DOMAINS_CONF:=${_MONITOR_LIB_DIR}/domains.conf}"
|
||||
|
||||
# host_or_url → https://… (no trailing slash)
|
||||
# host_or_url → https://… (no trailing slash). Empty for EBICS skip tokens.
|
||||
_to_https_base() {
|
||||
local x="${1%/}"
|
||||
case "$x" in
|
||||
case "$(printf '%s' "$x" | tr '[:upper:]' '[:lower:]')" in
|
||||
""|"-"|"."|"none"|"n/a"|"na"|"ebics"|"iban"|"skip"|"off")
|
||||
printf ''
|
||||
;;
|
||||
https://*|http://*) printf '%s' "$x" ;;
|
||||
"") printf '' ;;
|
||||
*) printf 'https://%s' "$x" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# True when domains.conf bank column means "no public bank.*"
|
||||
bank_host_configured() {
|
||||
local b
|
||||
b=$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')
|
||||
case "$b" in
|
||||
""|"-"|"."|"none"|"n/a"|"na"|"ebics"|"iban"|"skip"|"off") return 1 ;;
|
||||
*) return 0 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Fetch exchange /keys and classify → x-taler-bank|ebics|unknown
|
||||
# (python fetch avoids SIGPIPE/pipefail on huge /keys bodies)
|
||||
detect_taler_bank_backend_from_keys() {
|
||||
local ex="${EXCHANGE_PUBLIC%/}"
|
||||
[ -n "$ex" ] || { printf 'unknown'; return 0; }
|
||||
python3 -c '
|
||||
import re, ssl, sys, urllib.error, urllib.request
|
||||
ex = sys.argv[1].rstrip("/")
|
||||
ctx = ssl.create_default_context()
|
||||
ctx.check_hostname = False
|
||||
ctx.verify_mode = ssl.CERT_NONE
|
||||
req = urllib.request.Request(
|
||||
ex + "/keys",
|
||||
headers={"User-Agent": "taler-monitoring/bank-backend"},
|
||||
method="GET",
|
||||
)
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
|
||||
text = resp.read(600000).decode("utf-8", "replace")
|
||||
except Exception:
|
||||
print("unknown")
|
||||
raise SystemExit(0)
|
||||
methods = {m.lower() for m in re.findall(r"payto://([a-z0-9-]+)/", text, flags=re.I)}
|
||||
if "x-taler-bank" in methods:
|
||||
print("x-taler-bank")
|
||||
elif "iban" in methods:
|
||||
print("ebics")
|
||||
else:
|
||||
print("unknown")
|
||||
' "$ex" 2>/dev/null || printf 'unknown'
|
||||
}
|
||||
|
||||
# Set TALER_BANK_BACKEND + auto CHECK_BANK=0 for EBICS (unless CHECK_BANK_SET=1).
|
||||
resolve_taler_bank_backend() {
|
||||
local backend="${TALER_BANK_BACKEND:-}"
|
||||
if [ "${TALER_BANK_BACKEND_SET:-0}" = "1" ] && [ -n "$backend" ]; then
|
||||
:
|
||||
elif [ -z "${BANK_PUBLIC}" ]; then
|
||||
backend=ebics
|
||||
else
|
||||
backend=$(detect_taler_bank_backend_from_keys)
|
||||
fi
|
||||
TALER_BANK_BACKEND="$backend"
|
||||
if [ "$TALER_BANK_BACKEND" = "ebics" ] && [ "${CHECK_BANK_SET:-0}" != "1" ]; then
|
||||
CHECK_BANK=0
|
||||
fi
|
||||
export TALER_BANK_BACKEND CHECK_BANK CHECK_BANK_SET TALER_BANK_BACKEND_SET
|
||||
}
|
||||
|
||||
# 1 = check GOA-style /intro landing pages (assets, link crawl, demo-withdraw).
|
||||
# 0 = skip (e.g. taler-ops.ch / mytops — no public landings).
|
||||
: "${CHECK_LANDING:=1}"
|
||||
|
|
@ -166,12 +233,19 @@ _to_https_base() {
|
|||
# Declare bank + exchange + merchant (+ currency, local stack, landing, domain id).
|
||||
# Usage:
|
||||
# set_taler_stack BANK EXCHANGE MERCHANT [CURRENCY] [LOCAL 0|1] [LANDING 0|1] [TALER_DOMAIN]
|
||||
# BANK/EXCHANGE/MERCHANT: hostname or full URL
|
||||
# BANK/EXCHANGE/MERCHANT: hostname or full URL; bank may be "-" / ebics (no public bank.*)
|
||||
set_taler_stack() {
|
||||
local bank="${1:-}" exchange="${2:-}" merchant="${3:-}"
|
||||
local currency="${4:-}" local_stack="${5:-0}" landing="${6:-}" domain_id="${7:-}"
|
||||
|
||||
BANK_PUBLIC=$(_to_https_base "$bank")
|
||||
if bank_host_configured "$bank"; then
|
||||
BANK_PUBLIC=$(_to_https_base "$bank")
|
||||
else
|
||||
BANK_PUBLIC=""
|
||||
if [ "${TALER_BANK_BACKEND_SET:-0}" != "1" ]; then
|
||||
TALER_BANK_BACKEND=ebics
|
||||
fi
|
||||
fi
|
||||
EXCHANGE_PUBLIC=$(_to_https_base "$exchange")
|
||||
MERCHANT_PUBLIC=$(_to_https_base "$merchant")
|
||||
# currency "-" or empty → report-only (do not force GOA)
|
||||
|
|
@ -452,6 +526,11 @@ apply_taler_domain() {
|
|||
if [ "${LOCAL_STACK}" = "1" ]; then
|
||||
INSIDE_PROFILE="${INSIDE_PROFILE:-koopa}"
|
||||
fi
|
||||
|
||||
# EBICS/IBAN (TOPS) → no public bank.*; x-taler-bank → keep CHECK_BANK
|
||||
if [ "${TALER_SKIP_BANK_BACKEND_DETECT:-0}" != "1" ]; then
|
||||
resolve_taler_bank_backend
|
||||
fi
|
||||
}
|
||||
|
||||
# Apply TALER_DOMAIN from env once (CLI exports TALER_DOMAIN_APPLIED=1 after overrides).
|
||||
|
|
|
|||
|
|
@ -26,6 +26,14 @@
|
|||
# MERCHANT_TOKEN=
|
||||
# MERCHANT_INSTANCE_PASSWORD=
|
||||
|
||||
# --- regio.taler.net (FLODOS / taler-deployment) ---
|
||||
# Prefer path via taler-monitoring-env (no password here):
|
||||
# TALER_DEPLOYMENT_SECRETS=$HOME/src/taler-deployment-secrets
|
||||
# REGIO_BANK_ADMIN_USER=admin
|
||||
# REGIO_BANK_ADMIN_SECRET=$HOME/src/taler-deployment-secrets/regio/bank-admin-password.txt
|
||||
# One-shot override:
|
||||
# E2E_BANK_ADMIN_PASS=… # same as bank admin password
|
||||
|
||||
# --- FrancPaysan STAGE (TESTPAYSAN) e2e ---
|
||||
# Default phases for -d stage.lefrancpaysan.ch: urls + inside + versions + e2e
|
||||
# inside uses francpaysan-stage-user (stagepaysan); stats from public HTTPS.
|
||||
|
|
|
|||
|
|
@ -99,6 +99,7 @@ Phases:
|
|||
max-ladder max-search: highest withdrawable + highest payable (≤ available)
|
||||
goa-ladder alias of ladder (legacy phase name; same check_amount_ladder.sh)
|
||||
auth401 merchant Basic-auth / case matrix (HTTP 401 paths; may create throwaway instance)
|
||||
ansible-smoke taler-deployment site.yml syntax + optional podman tracks (TASK112)
|
||||
aptdeploy koopa podman apt-src smoke: taler-merchant in
|
||||
koopa-taler-deploy-test-apt-src-trixie{,-testing}
|
||||
surface REMOTE-ONLY public inventory (NOT in default/all/full):
|
||||
|
|
@ -283,7 +284,7 @@ while [ $# -gt 0 ]; do
|
|||
shift
|
||||
;;
|
||||
--no-probe) NO_PROBE=1; shift ;;
|
||||
urls|inside|versions|sanity|server|e2e|zero-pay|zeropay|sticker-pay|template-zero|ladder|goa-ladder|max-ladder|maxladder|auth401|aptdeploy|apt-deploy|apt_src|surface|ecosystem|mattermost|mail|monpages|pages|devtesting|franken|fake-franken|fake_franken|all|full) PHASES+=("$1"); shift ;;
|
||||
urls|inside|versions|sanity|server|e2e|zero-pay|zeropay|sticker-pay|template-zero|ladder|goa-ladder|max-ladder|maxladder|auth401|aptdeploy|apt-deploy|apt_src|ansible-smoke|ansible_smoke|surface|ecosystem|mattermost|mail|monpages|pages|devtesting|franken|fake-franken|fake_franken|all|full) PHASES+=("$1"); shift ;;
|
||||
*)
|
||||
# bare domain shorthand: ./taler-monitoring.sh taler.net
|
||||
if [[ "$1" == *.* && "$1" != *://* && "$1" != -* ]]; then
|
||||
|
|
@ -308,6 +309,11 @@ if [ -n "$BANK_OVERRIDE" ]; then BANK_PUBLIC="$BANK_OVERRIDE"; fi
|
|||
if [ -n "$EXCHANGE_OVERRIDE" ]; then EXCHANGE_PUBLIC="$EXCHANGE_OVERRIDE"; fi
|
||||
if [ -n "$MERCHANT_OVERRIDE" ]; then MERCHANT_PUBLIC="$MERCHANT_OVERRIDE"; fi
|
||||
|
||||
# Wire backend (x-taler-bank vs EBICS) after CLI overrides — sets CHECK_BANK for EBICS
|
||||
if [ "${TALER_SKIP_BANK_BACKEND_DETECT:-0}" != "1" ]; then
|
||||
resolve_taler_bank_backend
|
||||
fi
|
||||
|
||||
# Only koopa may use SSH. Remote domains: public + optional e2e (no SSH).
|
||||
if [ "${LOCAL_STACK:-1}" != "1" ]; then
|
||||
SKIP_SSH=1
|
||||
|
|
@ -324,6 +330,7 @@ fi
|
|||
# Export so check_*.sh (re-source lib) see the same targets via env
|
||||
export TALER_DOMAIN BANK_PUBLIC EXCHANGE_PUBLIC MERCHANT_PUBLIC
|
||||
export EXPECT_CURRENCY SKIP_SSH LOCAL_STACK TALER_DOMAIN_PROBE CHECK_LANDING
|
||||
export CHECK_BANK CHECK_BANK_SET TALER_BANK_BACKEND TALER_BANK_BACKEND_SET
|
||||
export TALER_DOMAIN_FROM_CLI="${TALER_DOMAIN_FROM_CLI:-0}"
|
||||
export DOMAIN_SET="${DOMAIN_SET:-0}"
|
||||
export WITHDRAW_AMT PAY_AMT CREDIT_AMT MERCHANT_INSTANCE
|
||||
|
|
@ -578,9 +585,15 @@ fi
|
|||
printf 'target domain=%s\n' "${TALER_DOMAIN}"
|
||||
printf ' ui_lang %s\n' "${TALER_MON_LANG:-en}"
|
||||
printf ' locale %s\n' "${TALER_MON_LOCALE:-${TALER_DOMAIN_LOCALE:-?}}"
|
||||
printf ' bank %s\n' "$BANK_PUBLIC"
|
||||
if [ "${TALER_BANK_BACKEND:-}" = "ebics" ] || [ -z "${BANK_PUBLIC:-}" ]; then
|
||||
printf ' bank IBAN (EBICS — no public bank.*)\n'
|
||||
else
|
||||
printf ' bank %s\n' "${BANK_PUBLIC}"
|
||||
fi
|
||||
printf ' exchange %s\n' "$EXCHANGE_PUBLIC"
|
||||
printf ' merchant %s\n' "$MERCHANT_PUBLIC"
|
||||
printf ' wire backend=%s CHECK_BANK=%s\n' \
|
||||
"${TALER_BANK_BACKEND:-?}" "${CHECK_BANK:-1}"
|
||||
printf ' currency expect=%s\n' "${EXPECT_CURRENCY:-any}"
|
||||
printf ' phases %s\n' "${PHASES[*]}"
|
||||
printf ' flags LOCAL_STACK=%s SKIP_SSH=%s INSIDE_PODMAN=%s INSIDE_MODE=%s\n' \
|
||||
|
|
@ -652,6 +665,7 @@ while [ "$_phase_idx" -lt "$_n_phases" ]; do
|
|||
;;
|
||||
auth401) run_phase auth401 "$ROOT/check_auth401.sh" || ec=1 ;;
|
||||
aptdeploy|apt-deploy|apt_src) run_phase aptdeploy "$ROOT/check_apt_deploy.sh" || ec=1 ;;
|
||||
ansible-smoke|ansible_smoke) run_phase ansible-smoke "$ROOT/check_ansible_smoke.sh" || ec=1 ;;
|
||||
surface|ecosystem) run_phase surface "$ROOT/check_surface.sh" || ec=1 ;;
|
||||
mattermost) run_phase mattermost "$ROOT/check_mattermost.sh" || ec=1 ;;
|
||||
mail) run_phase mail "$ROOT/check_mail.sh" || ec=1 ;;
|
||||
|
|
|
|||
Reference in a new issue