ansible-taler-exchange

commit a957b75b5a36f4fde172a93a317442b70a3c6adb
parent c7bae1c299e7395db465ecd4d89a097873c3b238
Author: Florian Dold <dold@taler.net>
Date:   Fri, 31 Jul 2026 15:48:19 +0200

update the README

Diffstat:
M
README
 | 
58
++++++++++++++++++++++++++++++++++++++++++++++++++--------

1 file changed, 50 insertions(+), 8 deletions(-)
diff --git a/README b/README
@@ -9,6 +9,14 @@ to install the following ansible collection:
 $ ansible-galaxy collection install community.postgresql
 ```
 
+Playbooks that touch vaulted variables need the vault password in
+"vault_pass.txt", which is gitignored and shipped only as
+"vault_pass.txt.gpg":
+
+```
+$ gpg -d vault_pass.txt.gpg > vault_pass.txt
+```
+
 ## Running the main Playbooks
 
 The canonical playbooks are run via shell scripts in the top-level
@@ -48,13 +56,16 @@ $ ./contrib/encrypt inventories/host_vars/spec/prod-secrets.yml
 This command imports and checks the latest sanction lists:
 
 ```
-$ ./sanction-check.sh $DEPLOYMENT $LIST
+$ ./sanction-check.sh $TARGET $LIST
 ```
 
-where "$DEPLOYMENT" specifies the name of the deployment to
-use ("test" or "tops") and $LIST is the name of the sanction
-list file on the local disk.  This script currently always
-uses the "tops" inventory.
+where "$TARGET" is a host or group from "inventories/default" and $LIST
+is the path of the sanction list file on the local disk.
+
+Note that "SANCTION_LIST" means something else in the "exchange" role,
+where it is the name of a file under
+"roles/exchange/files/var/lib/taler-exchange/" that is deployed to the
+host and referenced from the exchange configuration.
 
 NOTE: this should still be further automated.
 
@@ -64,7 +75,7 @@ NOTE: this should still be further automated.
 First run:
 
 ```
-$ ./extract-borg-key.sh
+$ ./extract-borg-key.sh $DEPLOYMENT
 ```
 
 The resulting SSH public key should be added to the borg-account
@@ -182,6 +193,14 @@ to receive the backup.
 
 ### borg-start
 
+Deploys the backup script and the cron job that runs it daily.
+
+### cert
+
+Issues or renews a LetsEncrypt certificate with certbot and enables the
+nginx sites that use it. Included by the roles that own a vhost, not
+listed in a playbook directly.
+
 ### challenger
 
 Deploys the various challenger services for address verification.
@@ -193,11 +212,25 @@ Sets up Taler package repo and installs Taler packages.
 
 ### database
 
-Installs the Postgresql database.
+Installs the Postgresql database and, if ENABLE_RESTORE_BACKUP is set and
+the target has no database yet, restores the snapshot fetched by
+restore.sh.
+
+### devtesting
+
+Sets up a restricted account for faking wire transfers and inspecting
+challenger auth codes. Gated on "dangerously_enable_devtesting" and never
+to be enabled in production.
 
 ### exchange
 
-Deploys the Taler exchange
+Deploys the Taler exchange, then hands over to "exchange_$DEPLOYMENT_KIND"
+for the site-specific configuration.
+
+### exchange_tops
+
+Deployment-specific exchange configuration (denominations, KYC rules, fees,
+legal documents), selected by DEPLOYMENT_KIND.
 
 ### exchange-sanctionlist-import
 
@@ -227,3 +260,12 @@ used as part of the reboot playbook.
 ### webserver
 
 Configures Nginx reverse proxy (main service, not individual subdomains).
+
+
+## Checks
+
+```
+$ ./contrib/test-fact-helpers.sh   # the /bin helpers that generate local facts
+```
+
+Also run by the CI job in "contrib/ci/jobs/001-build".