12 files changed, 785 insertions, 634 deletions
diff --git a/libeufin/bank-manual.rst b/libeufin/bank-manual.rst
index af977492..ab793b2b 100644
--- a/libeufin/bank-manual.rst
+++ b/libeufin/bank-manual.rst
@@ -1,21 +1,60 @@
+..
+  This file is part of GNU TALER.
+  Copyright (C) 2014-2024 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 2.1, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+
+  @author Florian Dold
+  @author Marcello Stanisci
+  @author Christian Grothoff
+
 .. target audience: operator, developer
 
+.. _libeufin-bank:
+
 Bank Setup Manual
 #################
 
-.. contents:: Table of Contents
-
-LibEuFin Bank implements a simple core banking system with
+libeufin-bank implements a simple core banking system with
 account and REST APIs, including REST APIs for a Web interface
 and REST APIs to interact with GNU Taler components.
 
 In this manual, we explain how to setup a bank.
 
+.. contents:: Table of Contents
+  :local:
+
+
 Installing LibEuFin Bank
 ========================
 
 The following section was tested on an *OpenJDK 17* environment.
 
+Installing the libeufin-bank binary packages on Debian
+------------------------------------------------------
+
+.. include:: ../frags/installing-debian.rst
+
+.. include:: ../frags/apt-install-libeufin-bank.rst
+
+
+Installing the libeufin-bank binary packages on Ubuntu
+------------------------------------------------------
+
+.. include:: ../frags/installing-ubuntu.rst
+
+.. include:: ../frags/apt-install-libeufin-bank.rst
+
+
 Building from source
 --------------------
 
@@ -38,8 +77,9 @@ Navigate into the *libeufin* local repository, and from top-level run:
 If the previous steps succeeded, the ``libeufin-bank`` command should
 be found in the $PATH.
 
-Setting up the LibEuFin Bank
-============================
+
+Minimal Configuration for LibEuFin Bank
+=======================================
 
 The following snippet shows the mandatory configuration values:
 
@@ -47,79 +87,119 @@ The following snippet shows the mandatory configuration values:
 
   [libeufin-bank]
   CURRENCY = KUDOS
-
-  # Server
-  SERVE = tcp
-  PORT = 8080
-
-  [libeufin-bankdb-postgres]
-  CONFIG = postgresql:///libeufinbank
+  
+  # Supported payment target type
+  WIRE_TYPE = iban or x-taler-bank
+  # If WIRE_TYPE = iban
+  IBAN_PAYTO_BIC = SANDBOXX
+  # If WIRE_TYPE = x-taler-bank
+  X_TALER_BANK_PAYTO_HOSTNAME = https://bank.taler.net
 
 .. note::
   Refer to the manpage ``libeufin-man.conf(5)``
   for the full array of configuration values.
 
-Assuming that the configuration file exists at ``$config_file``, the following
-command would define the database schema and create an admin account.
+.. _libeufin-mfa:
 
-.. code-block:: console
+Configuring multi-factor authentication
+---------------------------------------
+
+libeufin-bank supports two-factor authentication. libeufin-bank uses helper scripts to send challenge codes to addresses for multi-factor authentication. We provide two default helper scripts: ``libeufin-tan-email.sh`` to send e-mails and ``libeufin-tan-sms.sh`` to send SMS. To enable two-factor authentication you need to configure at least one TAN channel.
 
-  $ libeufin-bank dbinit -c $config_file
+SMS TAN channel
++++++++++++++++
 
-If you wish to authenticate as admin, you must change the account password with the following command.
+The default ``libeufin-tan-sms.sh`` script is based on the `Telesign <https://www.telesign.com>`_ SMS provider. It requires an additional ``AUTH_TOKEN`` environment variable for `Telesign Basic authentication <https://developer.telesign.com/enterprise/docs/authentication#basic-authentication>`_.
+
+To test your setup run:
 
 .. code-block:: console
 
-  $ libeufin-bank passwd -c $config_file admin $PASSWORD
+  $ AUTH_TOKEN=$TELESIGN_TOKEN
+  $ echo "Test 1234" | libeufin-tan-sms.sh $PHONE
 
-Then you can start the HTTP server.
+If you received an SMS containing "Test 1234" you can enable this channel in the config: 
 
-.. code-block:: console
+.. code-block:: ini
 
-  $ libeufin-bank serve -c $config_file
+  [libeufin-bank]
+  TAN_SMS = libeufin-tan-sms.sh
+  TAN_SMS_ENV = "AUTH_TOKEN=$TELESIGN_TOKEN"
 
+Mail TAN channel
+++++++++++++++++
 
-Using custom e-mail / SMS TAN scripts
--------------------------------------
+The default ``libeufin-tan-email.sh`` script is based on the ``mail`` Linux command. It requires a working local mail transfer agent.
 
-The guided setup installs the TAN scripts found in ``libeufin/contrib/``:
-``libeufin-tan-email.sh`` and ``libeufin-tan-sms.sh``, but should you want to
-use custom scripts to send the e-mail or SMS TAN, set the configuration like
-follows:
+To test your setup run:
 
-.. note::
+.. code-block:: console
 
-  The default SMS TAN script is based on the `Telesign <https://www.telesign.com>`_ provider.
+  $ echo "Test 1234" | libeufin-tan-email.sh $EMAIL
+
+If you received an email containing "Test 1234" you can enable this channel in the config: 
 
 .. code-block:: ini
 
   [libeufin-bank]
+  TAN_EMAIL = libeufin-tan-email.sh
+
+Custom TAN channel scripts
+++++++++++++++++++++++++++
+
+It is possible to replace these scripts with use custom scripts to send
+the e-mail or SMS TAN. Such alternative scripts must accept the phone number / e-mail address as the ``$1`` parameter and the message content to be transmitted in their standard input.  They should return 0 to indicate successful transmission of the challenge and non-zero on failure.
+
+To change the scripts used for multi-factor authentication, change the following
+options in the configuration file:
 
+.. code-block:: ini
+
+  [libeufin-bank]
   TAN_SMS = custom-tan-sms.sh
+  TAN_SMS_ENV = 
   TAN_EMAIL = custom-tan-email.sh
+  TAN_EMAIL_ENV = 
+
+Launching libeufin-bank
+=======================
+
+Assuming that the configuration file exists at ``$CONFIG_FILE``, the following
+command initializes (or upgrades) the database schema:
+
+.. code-block:: console
+
+  $ libeufin-bank-dbinit -c "$CONFIG_FILE"
+
+Once this is done, you can start the libeufin-bank HTTP server:
+
+.. code-block:: console
+
+  $ libeufin-bank serve -c "$CONFIG_FILE"
 
-The scripts TAN_SMS/EMAIL must accept the phone number / e-mail address as the
-``$1`` parameter and the message content to be transmitted in their standard
-input.
 
 
-Using the Bank Web Interface
+Using the bank Web interface
 ============================
 
-Before you can use the Web interface, you must set
-a password for the "admin" account. You can do this
-using:
+To be able to use the Web interface, you must set a password for the "admin"
+account.  You can set (or reset) the account password to ``$PASSWORD`` using
+the following command:
 
 .. code-block:: console
 
-  $ libeufin-bank passwd -c $config_file admin "$PASSWORD"
+  $ libeufin-bank passwd -c "$CONFIG_FILE admin "$PASSWORD"
+
+You can also use the same command to reset the passwords of other accounts by
+replacing "admin" with the respective login.
+
 
-Setting up Accounts
+Setting up accounts
 -------------------
 
-Using the above "$PASSWORD", log into the Web interface as "admin". Then
-search for the button "Create account" near the list of all existing bank
-accounts in the Web interface of libeufin-bank.
+Using the above "$PASSWORD", log into the Web interface as "admin". To setup
+regular accounts, search for the button "Create account" near the list of all
+existing bank accounts in the Web interface of libeufin-bank.
 
 You will be asked to specify:
 
@@ -147,27 +227,24 @@ XXX Cashout channel
 Is this account public?
   Public accounts can be viewed without access control, their balance and transaction history becomes public.
 
-After submitting the form, a randomly created password
-for the new account will be shown in a notification.
-The administrator can also change passwords for any
-account in the system using the "change password" link
-in the account list. To change other details about an
-account, select the "Username" in the account list.
+After submitting the form, a randomly created password for the new account
+will be shown in a notification.  The administrator can also change passwords
+for any account in the system using the "change password" link in the account
+list. To change other details about an account, select the "Username" in the
+account list.
 
 
-Account Introspection
+Account introspection
 ---------------------
 
-Users can see (and possibly change) the settings of
-their bank account and also their IBAN by clicking
-on the "Welcome, $USERNAME" text after logging into
-their bank account using their username and password.
+Users can see (and possibly change) the settings of their bank account and
+also their IBAN by clicking on the "Welcome, $USERNAME" text after logging
+into their bank account using their username and password.
 
-The IBAN field has a convenient "copy to clipboard"
-button next to it.
+The IBAN field has a convenient "copy to clipboard" button next to it.
 
 
-Making Transfers between Accounts
+Making transfers between accounts
 ---------------------------------
 
 First, you need to know the IBAN of the account to credit, and log in as the
@@ -179,12 +256,52 @@ be wired. After pressing "Send", you may have to pass a 2-FA check.
 Integration with the Taler Exchange
 ===================================
 
-Exchange Configuration
-----------------------
+.. note::
+
+  This step is fully automated if you use the :doc:`automated setup manual<regional-automated-manual>`.
+
+You must have an exchange account with username ``exchange`` for conversion to work.
+Assuming that the configuration file exists at ``$CONFIG_FILE``, the following
+command would create one:
+
+.. code-block:: console
+
+  $ libeufin-bank create-account '{"username":"exchange","password":"$EXCHANGE_PASSWORD","name":"Cashout Exchange","is_taler_exchange":true}' -c "$CONFIG_FILE"
+
+.. note::
+
+   You can also set up the exchange account as "admin" using the Web interface of libeufin-bank.
+
+Having done so, take note of two key pieces of information, namely the ``$EXCHANGE_PASSWORD`` and the "payto://"-URI of the exchange bank account.  This information must then be used to configure the exchange as described in
+:ref:`exchange bank account configuration <exchange-account-signing>`.  When using the libeufin-bank in the context
+of a regional currency with conversion, you must
+additionally specify a "conversion-url" when setting
+up the exchange account. See the section on :ref:`conversion setup <regional-conversion-setup>` in the regional currency setup chapter for details.
 
-TODO.
 
 Withdrawing e-cash to a Taler wallet
-------------------------------------
+====================================
+
+.. note::
+
+  This step is fully automated if you use the :doc:`automated setup manual<regional-automated-manual>`.
+
+Users can withdraw digital cash from their bank account starting from their
+online banking as implemented by the libeufin-bank. However, in this scenario,
+the Taler wallet may not already know about an exchange that works with the
+respective currency.  Thus, the protocol includes the possibility of the bank
+*recommending* an exchange service to the wallet, thus providing a sane
+default for the wallet to suggest to the user.  To do so, the base URL of the
+exchange API must be specified in the libeufin-bank configuration:
+
+.. code-block:: ini
+
+  [libeufin-bank]
+  DEFAULT_EXCHANGE=${PROTO}://exchange.${DOMAIN_NAME}
+
+After changing this value, the libeufin-bank service needs to be restarted
+to make the change effective.
+
+.. note::
 
-TODO.
+  The user may change the default exchange from within the wallet, assuming they know of an alternative exchanges for the currency.
diff --git a/libeufin/create_orders.png b/libeufin/create_orders.png
deleted file mode 100644
index 74814c72..00000000
--- a/libeufin/create_orders.png
+++ /dev/null
diff --git a/libeufin/enter_instance_details.png b/libeufin/enter_instance_details.png
deleted file mode 100644
index f2177091..00000000
--- a/libeufin/enter_instance_details.png
+++ /dev/null
diff --git a/libeufin/index.rst b/libeufin/index.rst
index 042388dc..c77255b0 100644
--- a/libeufin/index.rst
+++ b/libeufin/index.rst
@@ -1,3 +1,23 @@
+..
+  This file is part of GNU TALER.
+  Copyright (C) 2014-2023 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 2.1, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+
+  @author Florian Dold
+  @author Marcello Stanisci
+  @author Christian Grothoff
+
+
 LibEuFin
 ########
 
@@ -9,5 +29,6 @@ LibEuFin is a project providing free software tooling for European FinTech.
 
   nexus-manual
   bank-manual
-  regional-manual
+  regional-automated-manual
+  regional-custom-manual
   setup-ebics-at-postfinance
diff --git a/libeufin/instance_iban_config.png b/libeufin/instance_iban_config.png
deleted file mode 100644
index 03fa8f36..00000000
--- a/libeufin/instance_iban_config.png
+++ /dev/null
diff --git a/libeufin/merchant_first_login.png b/libeufin/merchant_first_login.png
deleted file mode 100644
index 0baa0801..00000000
--- a/libeufin/merchant_first_login.png
+++ /dev/null
diff --git a/libeufin/nexus-manual.rst b/libeufin/nexus-manual.rst
index bc4ca471..de2f4bae 100644
--- a/libeufin/nexus-manual.rst
+++ b/libeufin/nexus-manual.rst
@@ -1,23 +1,68 @@
+..
+  This file is part of GNU TALER.
+  Copyright (C) 2014-2024 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 2.1, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+
+  @author Florian Dold
+  @author Marcello Stanisci
+  @author Christian Grothoff
+
 .. target audience: operator, developer
 
+.. _libeufin-nexus:
+
 Nexus Manual
 ############
 
-.. contents:: Table of Contents
+LibEuFin Nexus is an EBICS facilitator.  It offers a command line interface to
+setup EBICS access, download banking records, and submit payments.  Today, the
+LibEuFin implementation supports EBICS 2.5 and 3.0 and has been tested with
+the Postfinance (CHF). Please note that banks tend to have their own dialects
+of finance messages and thus other retail banks may or may not work.  Contact
+us if you need support for another bank or core banking protocol.
 
-LibEuFin Nexus is an EBICS facilitator.  It offers a command line
-interface to setup EBICS access, download banking records, and submit payments.
-Future versions will offer a Web API to allow Taler Exchanges to talk to their
+Future versions will offer a Web API to allow Taler exchanges to talk to their
 banks.
 
 In this manual, we explain how to setup an EBICS subscriber.  We assume that
-the bank had already granted EBICS access to the subscriber.
+the bank has already granted EBICS access to the subscriber.
+
+.. contents:: Table of Contents
+  :local:
+
 
 Installing Nexus
 ================
 
 The following section was tested on an *OpenJDK 17* environment.
 
+
+Installing the libeufin-nexus binary packages on Debian
+-------------------------------------------------------
+
+.. include:: ../frags/installing-debian.rst
+
+.. include:: ../frags/apt-install-libeufin-nexus.rst
+
+
+Installing the libeufin-nexus binary packages on Ubuntu
+-------------------------------------------------------
+
+.. include:: ../frags/installing-ubuntu.rst
+
+.. include:: ../frags/apt-install-libeufin-nexus.rst
+
+
 Building from source
 --------------------
 
@@ -45,71 +90,79 @@ be found in the $PATH.
 Setting up the EBICS subscriber
 ===============================
 
-.. include:: ../frags/ebics-setup.rst
-
-Sending payments
-================
+.. include:: ../frags/nexus-ebics-setup.rst
 
-Sending payments must follow a successful `EBICS subscriber setup <ebics-setup>`_,
-where the bank obtained the subscriber keys, and the subscriber accepted the
-bank keys.  The responsible subcommand for sending payments is ``ebics-submit``,
-and its configuration is a **superset** of core-config_.  On top of that, it
-expects the database connection string, and *optionally* a frequency to check
-for submittable payments in the database.
+Database setup
+==============
 
-The connection string is specified as
+The configuration file must include a connection string that
+tells Nexus how it should connect to the database. The default
+is:
 
 .. code-block:: ini
 
   [nexus-postgres]
-
   config = postgres:///nexus
 
+You must make sure that this database exists and is accessible to the user
+running Nexus before continuing.  Then, the Nexus database schema must be
+created (or updated) to the current Nexus version using the following command:
+
+.. code-block:: console
+
+  $ libeufin-nexus-dbinit -c "$CONFIG_FILE"
+
+where ``$CONFIG_FILE`` is again the path to a configuration that contains at
+least the above ``[nexus-postgres]`` section.
+
+.. _sending-payments:
+
+Sending payments
+================
+
+Sending payments must follow a successful `EBICS subscriber setup
+<ebics-setup>`_, where the bank obtained the subscriber keys, and the
+subscriber accepted the bank keys. Furthermore, the database has to
+be set up. Right now, some other process must queue payments to be
+submitted to the database, so this section only discusses how such
+queued payments will be executed.
+
+The responsible subcommand for sending payments is ``ebics-submit``, and its
+configuration is a **superset** of core-config_.  On top of that, it expects
+the database connection string and *optionally* a frequency at which it will
+check for submittable payments in the database.
+
 The frequency **may** be specified as
 
 .. code-block:: ini
 
   [nexus-submit]
-  frequency = 5m
-  # Optional, but useful to check what Nexus sends to the bank
-  submissions_log_directory = $LIBEUFIN_DATA_HOME/uploads
+  FREQUENCY = 5m
 
 The supported time units are ``s`` (seconds), ``m`` (minutes), ``h`` (hours).
 
-Before delving into the following sections, the database schema must be
-created, therefore run the following command:
-
-.. code-block:: console
-
-  $ libeufin-nexus dbinit -c $config_file
-
-Where ``$config_file`` is the path to a configuration path that contains at
-least the ``[nexus-postgres]`` section.
 
 For testing
 -----------
 
 The ``ebics-submit`` subcommand is **not** suitable to send arbitrary
-payments, but rather to submit initiated payments that may be found
-in the database.
-
-Such initiated payments may be refunds of incoming payments with a subject
-that would be invalid for a Taler withdrawal, or from a Taler exchange in
-the attempt to pay a merchant.
+payments, but rather to submit initiated payments that are already queued for
+submission in the Nexus database.
 
-For testing purposes, however, it is possible to artificially initiate
-a payment into the database with the ``contrib/payment_initiation_debug.sh``
-script, found in the libeufin repository.  The script pays always one Swiss
-Franc to an IBAN and subject pair of choice.
+Such queued payments may originate from bounces of incoming payments with a
+subject that would be invalid for a Taler withdrawal, or from a Taler exchange
+that needs to send a payment to a merchant.
 
+For testing purposes it is possible to manually initiate a payment using the
+``initiate-payment`` subcommand.
 The following invocation pays 1 CHF to the CH987654321 with an "Hello, Nexus!"
-subject.
+subject:
 
 .. code-block:: console
 
-  $ ./payment_initiation_debug.sh $config_file CH987654321 "Hello, Nexus!"
+  $ libeufin-nexus initiate-payment -c "$CONFIG_FILE" --subject "Hello, Nexus!" "payto://iban/CH987654321?receiver-name=Name&amount=CHF:1"
 
-``$config_file`` is the path to Nexus' configuration file and it does not need
+``$CONFIG_FILE`` is the path to Nexus' configuration file and it does not need
 the FREQUENCY value.  If the previous command worked, now the database should
 contain a new row in the ``initiated_outgoing_transactions`` table, with an
 ``unsubmitted`` submission state.
@@ -120,13 +173,14 @@ send it to the bank.
 
 .. code-block:: console
 
-  $ libeufin-nexus ebics-submit -c $config_file --transient
+  $ libeufin-nexus ebics-submit -c "$CONFIG_FILE" --transient
 
 The ``--transient`` flag instructs the software to perform only one pass on
 the database, submit what is submittable, and return.
 
-Alternatively, the ``--debug`` flag makes ebics-submit accept data from STDIN,
-and submit it to the bank.
+The ``--debug-ebics $SAVEDIR`` flag will cause the files to be stored in
+``$SAVEDIR/$YYYY-MM-DD/submit`` where ``$YYYY-MM-DD`` represents the
+date when the upload took place. This is mostly useful for debugging.
 
 For production
 --------------
@@ -136,87 +190,88 @@ The ``ebics-submit`` subcommand can run in fixed frequency, or transient mode.
 The fixed frequency mode causes the command to check the database every time the
 frequency period expires.  To activate this mode, and -- for example -- set a frequency
 of five minutes, set the configuration value ``FREQUENCY`` to ``5m``.  Assuming that
-``$config_fixed_frequency`` is set as described above, the following invocation would
+``FREQUENCY`` is set as described above, the following invocation would
 make ``ebics-submit`` check the database every five minutes, and submit any initiated
 payment according to their submission state.
 
 .. code-block:: console
 
-  $ libeufin-nexus ebics-submit -c $config_fixed_frequency
-
+  $ libeufin-nexus ebics-submit -c "$CONFIG_FILE"
 
 Transient mode causes ``ebics-submit`` to check the database only once, submit any
 initiated payment according to their submission state, and return.
 
 .. code-block:: console
 
-  $ libeufin-nexus ebics-submit -c $config
+  $ libeufin-nexus ebics-submit -c "$CONFIG_FILE"
+
+
+.. _receive-transaction-data:
 
-Downloading records
-===================
+Downloading payment records
+===========================
 
-Downloading records must follow a successful `EBICS subscriber setup <ebics-setup>`_,
-where the bank obtained the subscriber keys, and the subscriber accepted the bank keys.
+Downloading payments must follow a successful `EBICS subscriber setup
+<ebics-setup>`_, where the bank obtained the subscriber keys, and the
+subscriber accepted the bank keys. Furthermore, the database has to
+be set up.
 
-The configuration file must contain all the ``[ebics-setup]`` sections, plus the following
-values to set the database connection and a log directory where any downloaded record would
-be stored.
+The responsible subcommand for sending payments is ``ebics-fetch``, and its
+configuration is a **superset** of core-config_.  On top of that, it expects
+the database connection string and *optionally* a frequency at which it will
+downloads any new EBICS files and ingest them in the database.
+
+The frequency **may** be specified as
 
 .. code-block:: ini
 
-  [nexus-postgres]
-  config = postgres:///nexus
   [nexus-fetch]
-  # Optional, but usefull against data loss.
-  statement_log_directory = $LIBEUFIN_DATA_HOME/downloads
+  FREQUENCY = 5m
 
-Assuming that ``$config_file`` contains any required option, the following command
-would download any unseen notifications (as camt.054 files).
+The supported time units are ``s`` (seconds), ``m`` (minutes), ``h`` (hours).
 
-.. code-block:: console
+Assuming that ``$CONFIG_FILE`` contains all required options, the following 
+command would download any unseen EBICS files:
 
-  $ libeufin-nexus ebics-fetch -c $config_file --transient
+.. code-block:: console
 
-The ``--transient`` flag makes the command to download only once and return.  If the
-bank returned any records, look in ``$LIBEUFIN_DATA_HOME/camt/YYYY-MM-DD`` to find them.
-YYYY-MM-DD is the date when the download took place.
+  $ libeufin-nexus ebics-fetch -c "$CONFIG_FILE" --transient
 
-To activate periodic downloads, add the following setting to the ``nexus-fetch``
-configuration section in ``$config_file``:
+The ``ebics-fetch`` subcommand will always cause libeufin-nexus to download
+then parse EBICS files and ingest their content statements into its local
+database.
 
-.. code-block:: ini
+The files type can be given as an argument to select what will be fetched. If no argument is given, all supported files are fetched. The following files are supported:
 
-   [nexus-fetch]
-   frequency = 5m
+* ``acknowledgement``: EBICS acknowledgement, retrieves the status of EBICS orders.
+* ``status``: Payment status, retrieves status of pending debits.
+* ``notification``: Debit & credit notifications, retrieves the history of confirmed debits and credits.
 
-The following invocation would then download records every five minutes, asking the bank
-to only return documents that are timestamped *from* (inclusive) the last incoming transaction.
+The ``--transient`` flag makes the command download and import EBICS files only 
+once and return immediately afterwards.  Without the flag, Nexus
+will download at the frequency specified in the configuration.
 
-.. code-block:: console
+The ``--debug-ebics $SAVEDIR`` flag will cause the files to be stored in
+``$SAVEDIR/$YYYY-MM-DD/fetch`` where ``$YYYY-MM-DD`` represents the
+date when the download took place. This is mostly useful for debugging.
 
-  $ libeufin-nexus ebics-fetch -c $config_file
 
-Testing
--------
+For Testing
+-----------
 
 If the bank account history has transactions that are useful for testing, it is
-possible to redownload them via the ``--pinned-start`` argument.  Note: if the Nexus
-database contains already the bank account history, you might need to **reset** it,
-in order to have the redownloaded transactions ingested.
+possible to re-download them via the ``--pinned-start`` argument.
 
-.. note::
-
-   Double-check the configuration: resetting the wrong database might cause DATA LOSS!
-
-For example, say that three back on the 2023-06-01 an handful of incoming transactions
-got booked at the bank account watched by Nexus.  After such day, the following command
-would redownload them (and ingest them, if the database doesn't have them):
+The following command redownloads transactions *from* the pinned start until
+the present:
 
 .. code-block:: console
 
-  $ libeufin-nexus ebics-fetch -c $config_file --pinned-start 2023-06-01
-
+  $ libeufin-nexus ebics-fetch -c "$CONFIG_FILE" --pinned-start 2023-11-01
 
 .. note::
 
-   The command redownloads transactions *from* the pinned start until the present.
+  If the Nexus database already contains the bank account history, you might need
+  to **reset** the database in order to have the re-downloaded transactions be
+  properly ingested. Be careful when resetting the database: resetting the wrong
+  database might cause DATA LOSS!
diff --git a/libeufin/no_default_account_yet.png b/libeufin/no_default_account_yet.png
deleted file mode 100644
index c97c231d..00000000
--- a/libeufin/no_default_account_yet.png
+++ /dev/null
diff --git a/libeufin/payment_links.png b/libeufin/payment_links.png
deleted file mode 100644
index 0c58b286..00000000
--- a/libeufin/payment_links.png
+++ /dev/null
diff --git a/libeufin/regional-automated-manual.rst b/libeufin/regional-automated-manual.rst
new file mode 100644
index 00000000..645e000f
--- /dev/null
+++ b/libeufin/regional-automated-manual.rst
@@ -0,0 +1,259 @@
+..
+  This file is part of GNU TALER.
+  Copyright (C) 2014-2024 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 2.1, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+
+  @author Florian Dold
+  @author Marcello Stanisci
+  @author Christian Grothoff
+
+
+.. target audience: operator
+
+Regional Currency Automated Setup Manual
+########################################
+
+This manual describes how to setup a regional currency using a script that largely automates the process. If you want to do a custom setup you can follow the :doc:`custom setup manual<regional-custom-manual>`.
+
+
+.. contents:: Table of Contents
+  :local:
+
+.. include:: ../frags/regional-manual-architecture.rst
+
+Guided Automated Setup
+======================
+
+Prerequisites
++++++++++++++
+
+For this manual, we assume that the system is deployed on a contemporary
+Debian GNU/Linux Bookworm or Ubuntu Mantic system using the binary packages provided.
+Furthermore, you should run the process on a system with one or more globally
+reachable IP address(es) *and* with various DNS names already pointing to
+these IPs.
+
+Preparing the required subdomain names
+++++++++++++++++++++++++++++++++++++++
+
+The GNU Taler program needs to have three subdomains pointing to your server IP address, in order to let NGINX to accommodate each component.
+These are "bank", "exchange" and "backend", this said, you need to have a registered top level domain name,
+where you can create type (A) entries, as subdomains pointing to your own server public IP address.
+A very good advice when creating these subdomains, and if your domain panel lets you specify the TTL (time to live) figure, is
+to specify a very low value (such as 300), so in case of future changes, its value (the IP address), will be propagated quickly.
+
+Once you have added the three required subdomains in your domain control panel, you have to make sure as well, these subdomains have
+propagated over the Internet correctly, and they are currently publicly available.
+
+You can check this from your terminal very easily with the "ping" command, as this:
+
+.. code-block:: console
+
+  $ ping -c1 bank.domainname.ltd
+  $ ping -c1 exchange.domainname.ltd
+  $ ping -c1 backend.domainname.ltd
+
+You can also use `this tool <https://toolbox.googleapps.com/apps/dig/>`_ for the same purpose, and to check the propagation status.
+
+.. warning::
+  Take into account some hosting providers providing virtualized servers (VPS or VDS) can enable by default the firewall program "UFW", blocking by default the port number 443. So you have to either disable this firewall program, or open to this 443 port number to allow https.
+
+Now you are ready to go with the next step.
+
+Obtaining the Scripts
++++++++++++++++++++++
+
+First, download the deployment scripts via Git:
+
+.. code-block:: console
+
+  # apt update && apt install git
+  $ git clone git://git.taler.net/deployment
+
+Running the Guided Configuration
+++++++++++++++++++++++++++++++++
+
+Navigate into the *regional-currency/* directory and run *main.sh* as **root**:
+
+.. code-block:: console
+
+  $ cd deployment/regional-currency/
+  # ./main.sh
+
+The script will start by installing the required packages and then asking you fundamental questions about the desired setup, in particular:
+
+#. The name of the regional currency. It must have 3 to 11 letters.
+#. Whether to setup the regional currency to be backed by a fiat currency. You'll need a bank account at a fiat currency bank offering an online banking protocol supported by LibEuFin Nexus. If you answer ``y``, you will also need to provide the following information:
+
+   #. The ISO code of the fiat currency. Use 'CHF' or 'EUR'.
+   #. The IBAN of the fiat bank account.
+   #. The BIC of the fiat bank account.
+   #. The legal name of the fiat bank account.
+
+#. The name of the regional currency bank. It will be shown to business users when they interact with the system.
+#. The DNS domain name of your setup (i.e: domain.tld). The installer will create by itself all the needed subdomains for your domain name, as (``bank.$DOMAIN_NAME``, ``exchange.$DOMAIN_NAME`` and ``backend.$DOMAIN_NAME``). But, these subdomain names as explained before, must have been added beforehand to your DNS domain control panel, and they must be pointing to the IP address of the server on which you are running the installation (before you execute the installer).
+#. Whether to use TLS or not. You should answer ``y`` in most cases.
+#. Whether to setup SMS two-factor authentication using `Telesign <https://www.telesign.com>`_, multi-factor authentication is strongly recommended, especially when regional currency can be converted to fiat currency. This requires `a Customer ID and an API Key <https://developer.telesign.com/enterprise/docs/authentication#basic-authentication>`_. You should answer ``y`` in most cases.
+#. The admin password for the bank. Be absolutely sure to enter a very, very long and high-entropy password, preferably using the autogenerated one.
+#. Whether to generate terms of service (ToS) for the exchange from default templates.
+#. Whether to generate a privacy policy for the exchange from default templates.
+
+The information you entered as well as the generated bank admin password will
+be stored in a file called ``config/user.conf``. If you run the script in
+the future again (for example, to upgrade the installation), you will not be asked
+these questions a second time.
+
+After answering all of the questions, the actual installation will start. The
+scripts will download and configure various packages, which may take some time.
+Grab a coffee.
+
+.. note::
+
+   At this point, the setup is NOT connected to any fiat bank account! The next
+   steps must always be done manually!
+
+Running the script again from scratch
++++++++++++++++++++++++++++++++++++++
+
+If for some reason your installation doesn't work because you have answered erroneously
+some of the interactive questions, or you just want to reset the current installation and to re-deploy
+the script again for having its latest changes, you will have to proceed as follows:
+
+In brief, you need to wipe completely the "content" of the file config/user.conf, this doesn't mean
+to remove the file itself, but only its content. Even though you can do this manually by editing the file manually
+with your preferred text editor, you can also do this in one single command.
+
+.. code-block:: console
+
+  # rm config/user.conf
+
+.. note::
+
+  In future versions of the program when executed for the second time, the program itself will
+  show an option to offer wiping the content of this config/user.conf file, automatically.
+
+Multi-factor authentication
++++++++++++++++++++++++++++
+
+The script allows you to configure multi-factor authentication via SMS using Telesign as a provider. You can also configure multi-factor authentication via email or use providers other than Telesign for SMS. You will need to configure these channels manually as described in :ref:`multi-factor authentication <libeufin-mfa>`.
+
+If you choose not to back your regional currency with a fiat currency, you can stop here.
+
+Web-based Configuration
++++++++++++++++++++++++
+
+By default, the regional currency conversion rates are 1:1. You can change the conversion rates and the ``admin`` debt limit via the bank's web interface as the ``admin`` user.
+
+Connecting to a Fiat Bank: the EBICS setup
+++++++++++++++++++++++++++++++++++++++++++
+
+To complete the conversion setup, you have to set up an EBICS subscriber using the fiat bank account you specified during the automated setup.
+
+When you sign up for an EBICS-enabled bank account, the bank will provide you
+with various credentials. Those must be provided in the
+``/etc/libeufin/libeufin-nexus.conf`` configuration file.
+
+.. note::
+  As legacy transactions in that bank account would likely confuse the system, it is advisable to use a fresh bank account with an empty transaction history.
+
+The following snippet shows the mandatory configuration values:
+
+.. _core-config:
+
+.. code-block:: ini
+
+  [nexus-ebics]
+  # Bank
+  HOST_BASE_URL = https://ebics.postfinance.ch/ebics/ebics.aspx
+  BANK_DIALECT = postfinance
+
+  # EBICS IDs
+  HOST_ID = PFEBICS
+  USER_ID = PFC00563
+  PARTNER_ID = PFC00563
+
+.. warning::
+  This combination of HOST_ID, USER_ID and PARTNER_ID must never be used by another instance of libeufin-nexus or by other EBICS clients, otherwise data will be lost.
+
+Reuse existing client keys
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you have client keys from a previous EBICS setup you can copy the JSON file to ``/var/lib/libeufin-nexus/client-ebics-keys.json``.
+
+Make sure this file is accessible to the user running ``libeufin-nexus``, you should run:
+
+.. code-block:: console
+
+  $ chown libeufin-nexus:libeufin-nexus /var/lib/libeufin-nexus/client-ebics-keys.json
+
+Create new client keys
+^^^^^^^^^^^^^^^^^^^^^^
+
+Run the following command to start the EBICS setup process:
+
+.. code-block:: console
+
+  $ sudo -u libeufin-nexus libeufin-nexus ebics-setup
+
+If the previous command failed when running EBICS INI with an error code of
+``EBICS_INVALID_USER_OR_USER_STATE``, you need to confirm your keys to your bank to
+activate your account.
+
+To that end, the previous run should have left a PDF document that you can
+print, sign and send to the bank.  Look for the message that looks like ``PDF
+file with keys created at '/tmp/libeufin-nexus-keys-$TIMESTAMP.pdf'``.
+
+Once the bank has received and processed this document you can continue.
+
+Get bank keys
+^^^^^^^^^^^^^
+
+Run the following command to finish the EBICS setup process:
+
+.. code-block:: console
+
+  $ sudo -u libeufin-nexus libeufin-nexus ebics-setup
+
+The EBICS setup is finished once the bank keys have been accepted.
+
+
+Configuring the Exchange for Conversion
++++++++++++++++++++++++++++++++++++++++
+
+In our automated setup the second account is automatically set up correctly
+without fees or special restrictions.  However, various additional
+*restrictions* and *options* could be configured.  Details are explained in
+the :ref:`regional conversion setup <regional-conversion-setup>` section for the
+manual setup and in the the manpage of ``taler-exchange-offline``.
+
+
+.. include:: ../frags/regional-system-on.rst
+.. include:: ../frags/deploying-tos.rst
+.. include:: ../frags/regional-manual-use.rst
+
+
+Installing Updates
+++++++++++++++++++
+
+The standard procedure for installing updates is to:
+
+ * First, make a backup (!)
+ * Stop Taler services
+ * Install new version
+ * Upgrade databases
+ * Start Taler services
+
+The "upgrade.sh" script in the "regional-currency/" folder of "deployment.git"
+shows how to do the above steps *except* for the backup.  For the backup, all
+critical bits of data will be in the Postgresql databases. Thus, we recommend
+following the database manual on making backups.
diff --git a/libeufin/regional-custom-manual.rst b/libeufin/regional-custom-manual.rst
new file mode 100644
index 00000000..580168f3
--- /dev/null
+++ b/libeufin/regional-custom-manual.rst
@@ -0,0 +1,181 @@
+..
+  This file is part of GNU TALER.
+  Copyright (C) 2014-2024 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 2.1, or (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+
+  @author Florian Dold
+  @author Marcello Stanisci
+  @author Christian Grothoff
+
+
+.. target audience: operator
+
+Regional Currency Custom Setup Manual
+#####################################
+
+This manual describes how to setup a regional currency manually. If you want a guided setup you can follow the :doc:`automated setup manual<regional-automated-manual>`.
+
+.. contents:: Table of Contents
+  :local:
+
+.. include:: ../frags/regional-manual-architecture.rst
+
+Custom Manual Setup
+===================
+
+You first need to setup the :ref:`libeufin-bank<libeufin-bank>` and integrate it with a Taler exchange.
+
+If you don't want your regional currency to be backed by a fiat currency, you can stop here.
+
+Enabling Currency Conversion
+++++++++++++++++++++++++++++
+
+You need to setup the :ref:`libeufin-nexus<libeufin-nexus>` using a bank account at a bank dealing in fiat currency that
+offers an online banking protocol supported by LibEuFin Nexus.
+
+Next, you have to enable conversion and should ensure that at least one TAN
+channel for :ref:`multi-factor authentication <libeufin-mfa>` is configured.
+
+The following snippet shows how to enable conversion in ``libeufin-bank`` configuration:
+
+.. code-block:: ini
+
+  [libeufin-bank]
+  ALLOW_CONVERSION = YES
+  FIAT_CURRENCY = EUR
+
+Make sure to (re)start the libeufin-bank after changing
+these configuration options:
+
+.. code-block:: console
+
+  # systemctl restart libeufin-bank
+
+
+Web-based Configuration
++++++++++++++++++++++++
+
+Now you have to set the conversion rates and the ``admin`` debt limit via the bank's web interface as the ``admin`` user.
+
+.. _regional-conversion-setup:
+
+Configuring the Exchange for Conversion
++++++++++++++++++++++++++++++++++++++++
+
+An exchange that supports currency conversion needs to advertise two bank
+accounts, one in the regional currency and a second in the fiat currency. The
+conversion logic ensures that wire transfers in either account are
+immediately reflected in the other account.
+
+This section explains how to enable currency conversion at the exchange,
+which is critical for wallets to know how to wire fiat currency to an
+exchange to obtain regional currency.
+
+You will need to use the ``taler-exchange-offline`` tool to inform the
+exchange about the **fiat** bank account that can be used for cash in
+operations and also specify the URL for currency conversion.  Additionally,
+you may also configure restrictions on the bank accounts that may originate
+the funds, for example, to prevent international wire transfers that may expose
+you to additional compliance risks.
+
+Given the ``$IBAN`` of the fiat currency bank account and ``$NAME`` as
+the (URL-encoded) name of the exchange-account owner, the following
+``taler-exchange-offline`` invocation can be used to notify wallets about
+the possibility of currency conversion (cash in):
+
+.. code-block:: console
+
+  # source config/user.conf
+  # sudo -u taler-exchange-offline \
+    taler-exchange-offline \
+      wire-fee now iban "${CURRENCY}":0 "${CURRENCY}":0 \
+      enable-account \
+        "${CONVERSION_PAYTO}" \
+        conversion-url "${PROTO}://bank.$DOMAIN_NAME/conversion-info/" \
+        display-hint 10 "CHF" \
+        debit-restriction deny \
+        credit-restriction \
+          regex \
+            'payto://iban/.*/CH.*?receiver-name=.*' \
+            'Swiss only' \
+            '{"de":"nur Schweiz","fr":"Suisse uniquement"}' \
+      upload
+
+Here, the ``$CONVERSION_URL`` must be set to the base URL of the conversion
+endpoint of the bank, which should be
+``https://bank.$DOMAIN/conversion-info/`` in our setup.
+
+The above commands set up the exchange to perform conversion with a
+restriction to only accept credit transfers from Swiss bank accounts.  You may
+want to configure such restrictions on the bank accounts that may originate
+funds to prevent international wire transfers that may expose you to
+additional compliance risks.
+
+You can leave out the "credit-restriction" if you want to allow international
+inbound wire transfers.
+
+The "debit-restriction" is largely mandatory as in this setup the
+``taler-exchange-transfer`` is only configured to deal with the regional
+currency bank.  Crediting fiat bank accounts must thus be done via the
+cash-out functionality of the regional currency bank account.
+
+The "display-hint" gives priority (10) for the fiat cash-in account over the
+regional currency account in the withdraw dialog of the wallets and labels the
+account with "CHF".
+
+.. note::
+
+  The above command adds a **second** bank account to the exchange.
+  You (or the guided setup script) should have already enabled the
+  regional currency bank account (without any "conversion-url").
+
+.. include:: ../frags/regional-system-on.rst
+.. include:: ../frags/deploying-tos.rst
+.. include:: ../frags/regional-manual-use.rst
+
+
+Maintenance
++++++++++++
+
+The ``taler-exchange-offline`` commands given above set fees only for the
+current year (``now``). Thus, before January 1st of each year, you must to set
+up new fees for the new calendar year.  In a regional currency setup, this
+typically requires up to three annual settings:
+
+.. code-block:: console
+
+  # YEAR=2025               # edit if necessary
+  # FIAT_CURRENCY=CHF       # edit if necessary
+  # REGIO_CURRENCY=NETZBON  # edit if necessary
+  # sudo -u taler-exchange-offline \
+      taler-exchange-offline \
+        wire-fee "$YEAR" \
+          iban "${FIAT_CURRENCY}":0 "${FIAT_CURRENCY}":0 \
+        wire-fee "$YEAR" \
+          x-taler-bank "${REGIO_CURRENCY}":0 "${REGIO_CURRENCY}":0 \
+        global-fee $YEAR \
+          "${REGIO_CURRENCY}:0" \
+          "${REGIO_CURRENCY}:0" \
+          "${REGIO_CURRENCY}:0"
+          4w 6y 4 \
+        upload
+
+If the fees are not all zero, simply change the respective place to specify
+a non-zero fee.
+
+.. note::
+
+  Additionally, the denomination signing keys will only have been
+  pre-generated for some time, depending on your ``LOOKAHEAD_SIGN``
+  configuration option. Thus, you may need to periodically run
+  the "taler-exchange-offline download sign upload" sequence as well!
diff --git a/libeufin/regional-manual.rst b/libeufin/regional-manual.rst
deleted file mode 100644
index e497e8c9..00000000
--- a/libeufin/regional-manual.rst
+++ /dev/null
@@ -1,482 +0,0 @@
-.. target audience: operator
-
-Regional Currency Setup Manual
-##############################
-
-In this manual, we explain how we model a regional currency and
-how to set up one using GNU Taler and LibEuFin technology.
-
-.. contents:: Table of Contents
-
-
-How to create/destroy regional currency
-=======================================
-
-In this model, the regional currency is backed by the fiat currency and users are
-offered two operations: *cash-in* to create regional currency starting from the fiat,
-and *cash-out* to destroy regional currency and obtain fiat currency back.
-
-The example below assumes that one single unit of regional currency is always backed
-by one single unit of fiat currency.
-
-Cash-in
-+++++++
-
-One fundamental entity to create the regional currency is the *master bank account*.
-The master bank account is hosted at one fiat bank and whenever it receives a *valid*
-fiat payment of N units, it triggers the creation of N units of regional currency.
-Such trigger causes the *admin bank account* at the regional bank to wire the N units of
-regional currency to the Taler exchange (regional) bank account.  At this point, the
-Taler exchange is ready to issue the regional coins to the Taler wallet that proves
-to own them.  Note: *valid* fiat payments are those with a Taler-relevant subject that
-should be generated by a Taler wallet.
-
-Cash-out
-++++++++
-
-Once a regional bank user confirms a cash-out operation of N units, the system sends
-a regional payment of N units to the *admin bank account*.  This latter triggers then
-a fiat payment of N units to the fiat bank account owned by the user who initiated the
-cash-out.
-
-How are GNU Taler & LibEuFin used to create the regional currency?
-==================================================================
-
-Following are the main components to operate a regional currency based
-on GNU Taler and LibEuFin technology.
-
-- LibEuFin Nexus: is responsible to drive the master (fiat) bank account both to learn
-  about incoming payments and to send fiat cash-out payments
-- LibEuFin Bank: offers basic banking operations, e.g. wire transfers, Taler withdrawals,
-  account management, cash-out's
-- Taler exchange: server side of Taler operations.
-- Taler wallet: client side of Taler operations.
-- Taler merchant backend: abstracts Taler details to the shops.
-
-
-Guided basic setup
-==================
-
-Prerequisites
-+++++++++++++
-
-For this manual, we assume that the system is deployed on a contemporary
-Debian GNU/Linux or Ubuntu LTS system using the binary packages provided.
-Furthermore, you should run the process on a system with one or more globally
-reachable IP address(es) *and* with various DNS names already pointing to
-these IPs.
-
-To further simplify the process, we suggest to use (or at least study) the
-automatic deployment scripts provided in the ``deployment.git`` Git repository
-in the ``regional-currency/`` folder.
-
-
-Obtaining the scripts
-+++++++++++++++++++++
-
-First, download the deployment scripts via Git:
-
-.. code-block:: console
-
-  $ git clone git://git.taler.net/deployment
-
-Guided Configuration
-++++++++++++++++++++
-
-This approach sets up a regional currency with cash-in/-out rates of 1:1.
-
-Navigate into the *regional-currency/* directory, and as **root** run:
-
-.. code-block:: console
-
-  # ./main.sh
-
-The script will start by asking you fundamental questions about the
-desired setup, in particular:
-
-  * The name of the regional currency. It must have 3 to 11 letters.
-    Currently only 'NETZBON' is supported.
-  * The ISO code of the fiat currency. Currently only 'CHF' is supported.
-  * The name of the regional currency bank. It will be shown to business
-    users when they interact with the system.
-  * Whether to use TLS or not. You should answer ``y`` in most cases.
-  * Whether to run taler-exchange-offline. Unless you need a high-security
-    setup and expect to run an offline key management process, say ``y``.
-    If you say ``n``, you will need to run ``taler-exchange-offline setup``
-    on your offline system and provide the master public key. Furthermore,
-    you should then study the exchange manual on offline key management to
-    finish the exchange setup process later.
-  * The admin password for the bank. Be absolutely sure to enter a very,
-    very long and high-entropy password, preferably use the autogenerated one.
-  * The DNS domain name of your setup (i.e: domain.tld). The installer will
-    create by itself all the needed subdomains for your domain name,
-    as (``bank.$DOMAIN``, ``exchange.$DOMAIN`` and ``backend.$DOMAIN``).
-    But, these subdomain names, must have been added beforehand to your
-    DNS domain control panel, and they must be pointing to the
-    IP address of the system on which you are running the
-    installation (before you execute the installer)).
-
-The information you entered as well as the generated bank admin password will be stored in a file called ``config/user.conf``.
-Should you run the script in the future (for example, to upgrade the installation),
-you will not be asked these questions a second time.
-
-After answering all of the questions, the actual installation will start. The
-scripts will download and configure various packages, which may take some time.
-Grab a coffee.
-
-.. note::
-
-  At this point, the setup is NOT connected to any fiat bank account!
-
-Connecting to a Fiat Bank
-=========================
-
-Some regional currencies are backed by assets in a fiat currency and allow users
-to convert fiat currency into the regional currency (``cash in``) and to convert
-regional currency into fiat currency (``cash out``). Restrictions, exchange rates
-and fees may apply to these conversions.  This section explains how to setup LibEuFin
-Nexus to communicate with the fiat bank account that backs the regional currency.
-
-Prerequisites
-+++++++++++++
-
-You must have a bank account at a bank dealing in fiat currency that offers an
-online banking protocol supported by LibEuFin Nexus. As legacy transactions
-in that bank account would likely confuse the system, it is highly advised to
-use a fresh bank account, with an empty transaction history.
-
-Today, the LibEuFin implementation supports EBICS 2.5 and 3.0 and has been
-tested with the Postfinance (CHF). Please note that banks tend to have their
-own dialects of finance messages and thus other retail banks may or may not work.
-Contact us if you need support for another bank or core banking protocol.
-
-EBICS setup
-+++++++++++
-
-.. include:: ../frags/ebics-setup.rst
-
-.. note::
-
-  For debug setups where the cash-ins are simulated :ref:`this way <withdraw-simulation>`,
-  this step can be entirely skipped.
-
-
-Enable regional currency conversion
-===================================
-
-Prerequisites
--------------
-
-This step assumes that you already have a working regional currency bank
-and have successfully connected to a backing fiat bank account.
-Follow the instructions from :ref:`EBICS subscriber setup <ebics-setup>`.
-
-Configuration
--------------
-
-Then you have to enable conversion and at least one TAN channel for cashout in the configuration file.
-
-.. code-block:: ini
-
-  [libeufin-bank]
-  ALLOW_CONVERSION = YES
-  FIAT_CURRENCY = EUR
-
-  TAN_SMS = libeufin-tan-sms.sh
-  # And/Or
-  TAN_EMAIL = libeufin-tan-email.sh
-
-
-You must have an exchange account with username ``exchange`` for conversion to work.
-Assuming that the configuration file exists at ``$config_file``, the following
-command would create one:
-
-.. code-block:: console
-
-  libeufin-bank create-account '{"username":"exchange","password":"password","name":"Cashout Exchange","is_taler_exchange":true}' -c $config_file
-
-Then the following command would start the server with conversion API enabled :
-
-.. code-block:: console
-
-  libeufin-bank serve -c $config_file
-
-Web-based Configuration
------------------------
-
-Now you should be able to setup conversion rates and ``admin`` debt limit though the Web
-interface of the bank as the ``admin`` user.
-
-Conversion ON!
---------------
-
-The last step is to run Nexus to import incoming bank
-transactions (cash in) and to trigger outgoing bank transactions (cash out).
-Refers to ``nexus-manual.conf`` for more details.
-
-
-
-Configuring the merchant
-========================
-
-In order to setup a shop, you need a merchant backend to run.  The guided setup
-installs and sets one backend up, but the user is required to complete the shop
-configuration via the Web browser.
-
-One fundamental piece of information are the banking details, to allow merchant
-receive payments from the exchange.  If you don't have a bank account at the regional
-bank, contact the administrator and get one.  After being able to login to the new
-bank account, you can see your IBAN by clicking on the ``Welcome, $USERNAME`` message
-in the profile page.  The IBAN is shown under the ``Internal IBAN`` box.
-
-Next, point your browser to ``$proto://backend.$domain_name/``.  You should
-be welcomed by the following merchant backoffice page:
-
-.. image:: merchant_first_login.png
-
-Such page offers to create a merchant profile: fill any required field (including
-your access token) and click to ``confirm``.  It should now be possible to associate
-the banking details to the profile just created: click to ``Bank account`` at the
-left of the page.  The following page should be shown:
-
-.. image:: no_default_account_yet.png
-
-Click on the blue "+" sign on the top right of the page, and expect the following
-page to appear:
-
-.. image:: enter_instance_details.png
-
-This tutorial is focused on IBAN, so choose ``iban`` as the account type, and
-expect the following page to appear:
-
-.. image:: instance_iban_config.png
-
-After providing the details and confirming, the shop is ready to generate orders
-and accept payments.
-
-Make an order
-+++++++++++++
-
-Click on ``Orders`` at the top left corner of the merchant backoffice page; the
-following page should appear
-
-.. image:: create_orders.png
-
-After having filled the required fields, the interface should show the following
-page with the related links to check the status of the order and let wallets pay
-for it.  Take note of the link beside ``Payment URI`` (we'll call it ``$payUri``).
-
-.. image:: payment_links.png
-
-In order to test the setup, it should be now possible to use the command line wallet
-to withdraw Taler coins and spend them to buy the order we just created.
-
-.. _withdraw-simulation:
-
-Pay for the order
-+++++++++++++++++
-
-This section explains how to pay for the order in a scenario where the fiat bank
-is simulated.  The simulation takes place by crafting ad-hoc XML files as if the
-bank would have issued them.  Such XML files carry information about incoming payments
-to the regional currency master bank account.  Finally, the XML files are passed
-to LibEuFin nexus via a convenient CLI method.  The responsible script for such
-simulation is ``withdraw.sh``.
-
-Run ``./withdraw.sh`` without any arguments.  Assuming that you ran the command
-as the ``test-user``, after the execution, 5 units of the regional currency should
-be found in the CLI wallet owned by ``test-user``.
-
-
-Check it with:
-
-.. code-block:: console
-
-  $ taler-wallet-cli balance
-
-If so, call the wallet in the following way to finally pay for the order just created:
-
-.. code-block:: console
-
-  $ taler-wallet-cli handle-uri $payUri
-
-.. note::
-
-   Reset the state before going to production, as it impacts the way nexus
-   asks records to the bank.  In particular, delete: any database and the
-   files ``config/user.conf`` and ``config/internal.conf``, and finally run
-   ``./main.sh`` again.
-
-
-Exchange-wallet integration
-===========================
-
-Although not strictly needed to start withdrawing regional money, this
-section explain how to enable the tight integration between Taler exchange
-and wallet, to let wallets learn about the possibility of withdrawing
-regional funds via a particular exchange.
-
-First, you need to use the ``taler-exchange-offline`` tool to inform the
-exchange about the fiat bank account that can be used for cash in operations
-and also specify the URL for currency conversion. Additionally, you may also
-configure restrictions on the bank accounts that may originate the funds, for
-example to prevent international wire transfers that may expose you to
-additional compliance risks.
-
-Given the ``$IBAN`` of the fiat currency bank account and ``$NAME`` as
-the (URL-encoded) name of the exchange-account owner, the following
-``taler-exchange-offline`` invocation can be used to notify wallets about
-the possibility of currency conversion (cash in):
-
-.. code-block:: console
-
-  # taler-exchange-offline \
-      enable-account \
-        payto://iban/$IBAN?receiver-name=$NAME \
-        conversion-url "$CONVERSION_URL" \
-      upload
-
-Here, the ``$CONVERSION_URL`` must be set to the base URL of the conversion
-endpoint of the bank, which should be ``https://bank.$DOMAIN/conversion-info/``
-in our setup.
-
-Wallet setup
-============
-
-This section describes the interaction between the Taler graphical wallet (Android,
-iOS, WebExtensions) and the regional currency system.
-
-You need to add your regional currency exchange to the wallet.  This can
-be done by scanning a QR code with a ``taler://withdraw-exchange/exchange.$DOMAIN``
-URL or by manually entering the URL into the respective ``Add exchange``
-dialogue.
-
-After starting the withdraw process and specifying the desired amount, the wallet
-should show you the details of the fiat wire transfer that must be made for the cash
-in to be completed.  Once the money has arrived at the fiat bank account, Nexus will
-obtain the transaction data and the regional currency bank will create the
-corresponding amount in regional currency, crediting the GNU Taler exchange account.
-In turn, the exchange will issue the respective amount to your wallet.
-
-For testing, you should be able to *deposit* regional currency directly
-into your LibEuFin Bank account from the Taler wallet.  Note: the wallet relies on the
-exchange to perform such deposit.  So once the exchange has credited the regional
-currency account to your account and assuming the cash out rules are satisfied, you
-should then be able to start a cash out operation.
-
-..
-  FIXME: uncomment once tested.
-
-  Enable regional currency conversion
-  ===================================
-
-  Prerequisites
-  +++++++++++++
-
-  This step assumes that you already have a working regional currency bank
-  and have successfully connected to a backing fiat bank account.
-
-  Additionally, for each account that is allowed to convert regional currency
-  into fiat, you must configure the (fiat) bank account number of the fiat
-  currency with the respective account profile.  Only the bank ``admin`` is
-  allowed to set fiat bank account numbers.
-
-  Furthermore, to achieve a reasonable security level, you must enable two
-  factor authentication for "cash out" transactions. This requires you to
-  configure an e-mail address or phone number for every account that supports
-  "cash out" transactions --- and to setup your system for sending e-mails or
-  SMS. This manual does not cover setting up e-mail.  For SMS delivery, you will
-  need to obtain credentials from an SMS provider and provide a script to send
-  messages via such a provider.
-
-  Configuration
-  +++++++++++++
-
-  You have to enable conversion and at least one TAN channel for cashout in the
-  ``/etc/libeufin/libeufin-bank.conf`` configuration file:
-
-  .. code-block:: console
-
-    [libeufin-bank]
-    ALLOW_CONVERSION = yes
-    FIAT_CURRENCY = EUR
-
-    TAN_SMS = libeufin-tan-sms.sh
-    # And/Or
-    TAN_EMAIL = libeufin-tan-email.sh
-
-  Afterwards, restart the bank:
-
-  .. code-block:: console
-
-    # systemctl restart libeufin-bank
-
-
-  The scripts TAN_SMS/EMAIL must accept the phone number / e-mail address
-  as the ``$1`` parameter and the content in their standard input.  The LibEuFin
-  repository offers them in ``contrib/``: adjust to your setup!
-
-  .. note::
-
-    the TAN_SMS script relies on a Telesign account.  For this reason,
-    it needs a telesign-secret file found in the PATH, that defines the
-    environment variables API_KEY and CUSTOMER_ID
-
-  Web-based Configuration
-  +++++++++++++++++++++++
-
-  Now you should be able to setup conversion rates and ``admin`` debt limit though the Web
-  interface of the bank as the ``admin`` user.
-
-
-  Conversion ON!
-  ++++++++++++++
-
-  The last step is to enable the Nexus services to import incoming bank
-  transactions (cash in) and to trigger outgoing bank transactions (cash out):
-
-  .. code-block:: console
-
-    # systemd enable --now libeufin-nexus-ebics-fetch
-    # systemd enable --now libeufin-nexus-ebics-submit
-
-  Going live!
-  ===========
-
-  Exchange setup
-  ++++++++++++++
-
-  First, you need to use the ``taler-exchange-offline`` tool to inform the
-  exchange about the fiat bank account that can be used for cash in operations
-  and also specify the URL for currency conversion. Additionally, you may also
-  configure restrictions on the bank accounts that may originate the funds, for
-  example to prevent international wire transfers that may expose you to
-  additional compliance risks.
-
-  Given the ``$IBAN`` of the fiat currency bank account and ``$NAME`` as
-  the (URL-encoded) name of the exchange-account owner, the following
-  ``taler-exchange-offline`` invocation can be used to inform wallets about
-  the possibility of currency conversion (cash in) when wallets download
-  ``/keys`` with bank account data from the exchange:
-
-  .. code-block:: console
-
-    # taler-exchange-offline \
-        enable-account \
-          payto://iban/$IBAN?receiver-name=$NAME \
-          conversion-url "$CONVERSION_URL" \
-        upload
-
-  Here, the ``$CONVERSION_URL`` must be set to the base URL of the conversion
-  endpoint of the bank, which should be ``https://bank.$DOMAIN/conversion-info/``
-  in our setup.
-
-Podman deployment
-=================
-
-The Podman-based deployment installs, configures, and launches any Taler and
-LibEuFin service with the aim of serving a regional currency.
-
-Please clone ``git://git.taler.net/deployment`` and checkout the ``regio``
-branch.  Navigate to the ``sandcastle-ng`` directory and read the README file:
-it should guide you through all the steps to running the regional currency.