setup-sandcastle.sh - sandcastle-ng - Scripts for the deployment of Sandcastle (GNU Taler)

setup-sandcastle.sh (51702B)
      1 #!/usr/bin/env bash
      2 
      3 # This scripts provisions all configuration and
      4 # services for the Taler sandcastle container.
      5 #
      6 # Important: This script needs to be completely
      7 # idempotent, nothing must break if it is executed
      8 # multiple times.
      9 
     10 set -eu
     11 set -x
     12 export LC_ALL="C.UTF-8"
     13 
     14 if [[ -n ${SANDCASTLE_SKIP_SETUP:-} ]]; then
     15   echo "skipping sandcastle setup, requested by environment var SANDCASTLE_SKIP_SETUP"
     16   exit 1
     17 fi
     18 
     19 
     20 # Helper to replace a comment-delimited block of lines in a config file with
     21 # the desired content. If the block doesn't exist yet, append it.
     22 update_config_block() {
     23   local config_file="$1"
     24   local marker_tag="$2"
     25   local new_content="$3"
     26   local begin_marker="# begin ${marker_tag}"
     27   local end_marker="# end ${marker_tag}"
     28   if [[ ! -f "$config_file" ]]; then
     29     echo "Error: Config file '$config_file' not found." >&2
     30     return 1
     31   fi
     32   if grep -qF "$begin_marker" "$config_file"; then
     33     # Markers exist. Replace the block.
     34     # Escape newlines in the content so sed processes it as a single block
     35     local escaped_content="${new_content//$'\n'/\\n}"
     36     sed -i "/$begin_marker/,/$end_marker/c\\$begin_marker\n$escaped_content\n$end_marker" "$config_file"
     37   else
     38     # Markers do not exist. Append to the end.
     39     printf "\n%s\n%s\n%s\n" "$begin_marker" "$new_content" "$end_marker" >> "$config_file"
     40   fi
     41 }
     42 
     43 SANDCASTLE_STATUS_DIR=/var/www/sandcastle/metrics
     44 SANDCASTLE_STATUS_FILE=$SANDCASTLE_STATUS_DIR/sandcastle-status
     45 
     46 # Atomically publish the version information for the status endpoint after a
     47 # successful deployment.
     48 write_sandcastle_status() {
     49   local temporary_file
     50   local sandcastle_version=unknown
     51   local architecture
     52   local component_dir
     53   local component
     54   local package
     55   local versions
     56   local turnstile_version
     57 
     58   if [[ -s /usr/share/sandcastle/version ]]; then
     59     sandcastle_version=$(</usr/share/sandcastle/version)
     60   fi
     61   architecture=$(dpkg --print-architecture)
     62   mkdir -p "$SANDCASTLE_STATUS_DIR"
     63   temporary_file=$(mktemp "$SANDCASTLE_STATUS_FILE.XXXXXX")
     64 
     65   {
     66     printf 'sandcastle: %s\n' "$sandcastle_version"
     67     printf 'deployed-at: %s\n' "$(date --utc +%Y-%m-%dT%H:%M:%SZ)"
     68     printf 'components:\n'
     69     for component_dir in "/packages/$architecture"/*; do
     70       [[ -d $component_dir ]] || continue
     71       component=${component_dir##*/}
     72       versions=$(
     73         for package in "$component_dir"/*.deb; do
     74           [[ -f $package ]] || continue
     75           dpkg-deb --field "$package" Version
     76         done | sort --unique | paste --serial --delimiters=,
     77       )
     78       [[ -n $versions ]] || continue
     79       printf '  %s: %s\n' "$component" "$versions"
     80     done
     81     if turnstile_version=$(
     82       git -C /opt/turnstile describe --tags --always --dirty 2>/dev/null
     83     ); then
     84       printf '  turnstile: %s\n' "$turnstile_version"
     85     fi
     86   } >"$temporary_file"
     87 
     88   chmod 644 "$temporary_file"
     89   mv "$temporary_file" "$SANDCASTLE_STATUS_FILE"
     90 }
     91 
     92 echo "Provisioning sandcastle"
     93 rm -f "$SANDCASTLE_STATUS_FILE" "$SANDCASTLE_STATUS_FILE".*
     94 
     95 # General configuration.
     96 # Might eventually be moved to an external file.
     97 
     98 # Source any overrides from external file
     99 if [[ -e /overrides ]]; then
    100   source /overrides
    101 fi
    102 
    103 # When serving on an external port (for localhost deployments),
    104 # we use http.
    105 if [[ ${EXTERNAL_PORT:-} =~ ^[0-9]+$ ]]; then
    106   PROTO=http
    107   PORT_SUFFIX=:$EXTERNAL_PORT
    108 else
    109   PROTO=https
    110   PORT_SUFFIX=
    111 fi
    112 
    113 : ${CURRENCY:="KUDOS"}
    114 : ${WIRE_METHOD:=x-taler-bank}
    115 
    116 
    117 if [[ $WIRE_METHOD = iban ]]; then
    118   EXCHANGE_IBAN=DE159593
    119   EXCHANGE_PAYTO="payto://iban/$EXCHANGE_IBAN?receiver-name=Sandcastle+Echange+Inc"
    120 
    121   # Randomly generated IBANs for the merchants
    122   MERCHANT_IBAN_ADMIN=DE85500105175178585583
    123   MERCHANT_IBAN_POS=DE4218710
    124   MERCHANT_IBAN_BLOG=DE8292195
    125   MERCHANT_IBAN_GNUNET=DE9709960
    126   MERCHANT_IBAN_TALER=DE1740597
    127   MERCHANT_IBAN_TOR=DE2648777
    128   MERCHANT_IBAN_SANDBOX=DE949115029592
    129   MERCHANT_IBAN_UMAMI=DE358841382499
    130   MERCHANT_IBAN_PAIVANA=DE5183926
    131   MERCHANT_IBAN_TESTING=DE38936850270207298566
    132 
    133   MERCHANT_PAYTO_ADMIN="payto://iban/$MERCHANT_IBAN_ADMIN?receiver-name=Default+Merchant"
    134   MERCHANT_PAYTO_TESTING="payto://iban/$MERCHANT_IBAN_TESTING?receiver-name=Testing+Merchant"
    135   MERCHANT_PAYTO_POS="payto://iban/$MERCHANT_IBAN_POS?receiver-name=PoS+Merchant"
    136   MERCHANT_PAYTO_BLOG="payto://iban/$MERCHANT_IBAN_BLOG?receiver-name=Blog+Merchant"
    137   MERCHANT_PAYTO_GNUNET="payto://iban/$MERCHANT_IBAN_GNUNET?receiver-name=GNUnet+Merchant"
    138   MERCHANT_PAYTO_TALER="payto://iban/$MERCHANT_IBAN_TALER?receiver-name=Taler+Merchant"
    139   MERCHANT_PAYTO_TOR="payto://iban/$MERCHANT_IBAN_TOR?receiver-name=Tor+Merchant"
    140   MERCHANT_PAYTO_UMAMI="payto://iban/$MERCHANT_IBAN_UMAMI?receiver-name=Umami"
    141   MERCHANT_PAYTO_PAIVANA="payto://iban/$MERCHANT_IBAN_PAIVANA?receiver-name=Paivana+Merchant"
    142   MERCHANT_PAYTO_SANDBOX="payto://iban/$MERCHANT_IBAN_SANDBOX?receiver-name=Sandbox+Merchant"
    143 elif [[ $WIRE_METHOD = x-taler-bank ]]; then
    144   XTBHOST=sandcastle
    145   EXCHANGE_PAYTO="payto://x-taler-bank/$XTBHOST/exchange?receiver-name=Sandcastle+Exchange+Inc"
    146   MERCHANT_PAYTO_ADMIN="payto://x-taler-bank/$XTBHOST/merchant-admin?receiver-name=Admin+Merchant"
    147   MERCHANT_PAYTO_TESTING="payto://x-taler-bank/$XTBHOST/merchant-testing?receiver-name=Default+Merchant"
    148   MERCHANT_PAYTO_POS="payto://x-taler-bank/$XTBHOST/merchant-pos?receiver-name=PoS+Merchant"
    149   MERCHANT_PAYTO_BLOG="payto://x-taler-bank/$XTBHOST/merchant-blog?receiver-name=Blog+Merchant"
    150   MERCHANT_PAYTO_GNUNET="payto://x-taler-bank/$XTBHOST/merchant-gnunet?receiver-name=GNUnet+Merchant"
    151   MERCHANT_PAYTO_TALER="payto://x-taler-bank/$XTBHOST/merchant-taler?receiver-name=Taler+Merchant"
    152   MERCHANT_PAYTO_TOR="payto://x-taler-bank/$XTBHOST/merchant-tor?receiver-name=Tor+Merchant"
    153   MERCHANT_PAYTO_UMAMI="payto://x-taler-bank/$XTBHOST/merchant-umami?receiver-name=Umami"
    154   MERCHANT_PAYTO_PAIVANA="payto://x-taler-bank/$XTBHOST/merchant-paivana?receiver-name=Paivana+Merchant"
    155   MERCHANT_PAYTO_SANDBOX="payto://x-taler-bank/$XTBHOST/merchant-sandbox?receiver-name=Sandbox+Merchant"
    156 else
    157   echo "wire method $WIRE_METHOD not supported"
    158   exit 1
    159 fi
    160 
    161 MYDOMAIN=${MYDOMAIN:="demo.taler.net"}
    162 LANDING_DOMAIN=$MYDOMAIN
    163 BANK_DOMAIN=bank.$MYDOMAIN
    164 EXCHANGE_DOMAIN=exchange.$MYDOMAIN
    165 MERCHANT_DOMAIN=backend.$MYDOMAIN
    166 DONAU_DOMAIN=donau.$MYDOMAIN
    167 BLOG_DOMAIN=shop.$MYDOMAIN
    168 DONATIONS_DOMAIN=donations.$MYDOMAIN
    169 DRUPAL_DOMAIN=drupal.$MYDOMAIN
    170 CHALLENGER_DOMAIN=challenger.$MYDOMAIN
    171 AUDITOR_DOMAIN=auditor.$MYDOMAIN
    172 PAIVANA_DOMAIN=paivana.$MYDOMAIN
    173 
    174 # Website that is put behind the Paivana paywall.
    175 # Note that this is an *upstream* server, it is not
    176 # served by the sandcastle itself.
    177 PAIVANA_DESTINATION=${PAIVANA_DESTINATION:-https://docs.taler.net/}
    178 
    179 # Port of libeufin-bank running inside the container.
    180 # Should be synchronized with the sandcastle-run script.
    181 PORT_INTERNAL_LIBEUFIN_BANK=8080
    182 
    183 
    184 ENABLE_AUDITOR=0
    185 
    186 # Just make sure the services are stopped
    187 systemctl stop postgresql.service
    188 systemctl stop taler-auditor.target
    189 systemctl stop taler-auditor-httpd.socket
    190 systemctl stop taler-exchange.target
    191 systemctl stop taler-exchange-httpd.socket
    192 systemctl stop taler-exchange-offline.timer
    193 systemctl stop taler-merchant-httpd.service
    194 systemctl stop taler-merchant-httpd.socket
    195 systemctl stop taler-merchant.target
    196 systemctl stop taler-demo-landing.service
    197 systemctl stop taler-demo-blog.service
    198 systemctl stop taler-demo-donations.service
    199 systemctl stop libeufin-bank.service
    200 systemctl stop donau-httpd.service
    201 systemctl stop donau-httpd.socket
    202 systemctl stop paivana-httpd.service
    203 systemctl stop paivana-httpd.socket
    204 
    205 # libeufin-nexus is not used
    206 systemctl stop libeufin-nexus-ebics-fetch.service
    207 systemctl disable libeufin-nexus-ebics-fetch.service
    208 systemctl stop libeufin-nexus-ebics-submit.service
    209 systemctl disable libeufin-nexus-ebics-submit.service
    210 
    211 systemctl reset-failed
    212 
    213 # We now make sure that some important locations are symlinked to
    214 # the persistent storage volume.
    215 # Files that already exist in this location are moved to the storage volume
    216 # and then symlinked.
    217 # These locations are:
    218 # /etc/taler
    219 # /etc/libeufin
    220 # /var/lib/taler
    221 # postgres DB directory
    222 
    223 function lift_dir() {
    224   where=$1
    225   src=$2
    226   target=$3
    227   if [[ -L $src ]]; then
    228     # be idempotent
    229     echo "$src is already a symlink"
    230   elif [[ -d /$where/$target ]]; then
    231     echo "symlinking existing /$where/$target"
    232     rm -rf "$src"
    233     ln -s "/$where/$target" "$src"
    234   else
    235     echo "symlinking new /$where/$target"
    236     mv "$src" "/$where/$target"
    237     ln -s "/$where/$target" "$src"
    238   fi
    239 }
    240 
    241 lift_dir talerdata /var/lib/taler-exchange var-lib-taler-exchange
    242 lift_dir talerdata /etc/taler-merchant etc-taler-merchant
    243 lift_dir talerdata /etc/taler-exchange etc-taler-exchange
    244 lift_dir talerdata /etc/taler-exchange etc-taler-auditor
    245 lift_dir talerdata /etc/donau etc-donau
    246 lift_dir talerdata /etc/libeufin etc-libeufin
    247 # lift both config and data
    248 lift_dir talerdata /etc/postgresql etc-postgresql
    249 lift_dir talerdata /var/lib/postgresql var-lib-postgresql
    250 # offline keys are in a separate volume
    251 lift_dir talerdata_persistent /var/lib/taler-exchange/offline exchange-offline
    252 
    253 # Usage: get_credential_pw COMPONENT/ACCOUNT
    254 function get_credential_pw() {
    255   if [[ ${USE_INSECURE_SANDBOX_PASSWORDS:-0} = 1 ]]; then
    256     echo "sandbox"
    257     return
    258   fi
    259   p=/credentials/$1
    260   if [[ ! -f $p ]]; then
    261     mkdir -p $(dirname "$p")
    262     uuidgen -r >$p
    263   fi
    264   cat "$p"
    265 }
    266 
    267 import_instr=none
    268 if [[ -d /exported && -e /exported/import-request ]]; then
    269   import_instr=$(cat /exported/import-request)
    270 fi
    271 
    272 # If necessary, import the offline key.
    273 # Done before everything else, as we need the key
    274 # to generate the config.
    275 
    276 if [[ $import_instr = all ]]; then
    277   echo "Importing exchange offline key"
    278   rm -rf /var/lib/taler-exchange/offline/*
    279   cp -r /exported/taler-exchange/offline/* /var/lib/taler-exchange/offline/
    280 fi
    281 
    282 # Adjust ownership.
    283 # Necessary when the container is rebuilt with different user IDs.
    284 chown --recursive taler-exchange-offline:taler-exchange-offline /var/lib/taler-exchange/offline/. || true
    285 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf
    286 chown taler-exchange-wire:root /etc/taler-exchange/secrets/exchange-accountcredentials-*.conf
    287 chown taler-merchant-httpd:root /etc/taler-merchant/secrets/merchant-db.secret.conf
    288 chown root:donau-db /etc/donau/secrets/donau-db.secret.conf
    289 
    290 
    291 MASTER_PUBLIC_KEY=$(sudo -u taler-exchange-offline taler-exchange-offline -LDEBUG setup)
    292 
    293 
    294 #
    295 # Create the basic configuration files
    296 #
    297 
    298 mkdir -p /etc/challenger/conf.d
    299 cat <<EOF >/etc/challenger/conf.d/setup-sandcastle.conf
    300 [challenger]
    301 BASE_URL = $PROTO://$CHALLENGER_DOMAIN$PORT_SUFFIX/
    302 ADDRESS_TYPE = email
    303 AUTH_COMMAND = /data/sandcastle-challenger-auth
    304 ADDRESS_RESTRICTIONS = {"email":{"hint":"not an e-mail address","regex":"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+$"}}
    305 EOF
    306 
    307 # Move systemd-activated HTTP listeners into the bind-mounted directory so the
    308 # host can use them directly without an extra reverse-proxy hop.
    309 configure_public_socket() {
    310   local unit=$1
    311   local socket_path=$2
    312   local drop_in_dir=/etc/systemd/system/$unit.d
    313 
    314   mkdir -p "$drop_in_dir"
    315   cat <<EOF >"$drop_in_dir/sandcastle.conf"
    316 [Socket]
    317 ListenStream=
    318 ListenStream=$socket_path
    319 SocketMode=0666
    320 RemoveOnStop=yes
    321 EOF
    322 }
    323 
    324 configure_public_socket taler-exchange-httpd.socket /sockets/exchange.sock
    325 configure_public_socket taler-merchant-httpd.socket /sockets/merchant-backend.sock
    326 configure_public_socket taler-auditor-httpd.socket /sockets/auditor.sock
    327 configure_public_socket donau-httpd.socket /sockets/donau.sock
    328 configure_public_socket paivana-httpd.socket /sockets/paivana.sock
    329 
    330 mkdir -p /etc/paivana
    331 cat <<EOF >/etc/paivana/paivana.conf
    332 [paivana]
    333 # Serve on the socket provided by paivana-httpd.socket.
    334 SERVE = systemd
    335 
    336 # Public base URL of the paywall.
    337 BASE_URL = $PROTO://$PAIVANA_DOMAIN$PORT_SUFFIX/
    338 
    339 # Upstream site that is protected by the paywall.
    340 DESTINATION_BASE_URL = $PAIVANA_DESTINATION
    341 
    342 # Merchant instance that sells access to the site.
    343 MERCHANT_BACKEND_URL = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/paivana/
    344 MERCHANT_ACCESS_TOKEN = secret-token:$(get_credential_pw merchant/paivana)
    345 
    346 # Stable key for the access cookie MAC, so that paid clients
    347 # survive a restart of paivana-httpd.
    348 SECRET = $(get_credential_pw paivana/secret)
    349 
    350 # Static resources are served without payment, as the
    351 # protected site is otherwise unusable after paying.
    352 WHITELIST = ^/(favicon\.ico|robots\.txt|.*\.(css|js|png|jpe?g|gif|svg|ico|webp|woff2?|ttf|eot))\$
    353 EOF
    354 
    355 # The config contains the merchant access token and the cookie secret.
    356 chown paivana-httpd:root /etc/paivana/paivana.conf
    357 chmod 640 /etc/paivana/paivana.conf
    358 
    359 # The paywall runs behind a reverse proxy, so we need
    360 # '-f' to get the client address from X-Forwarded-For.  With '-g'
    361 # a single payment unlocks the entire site instead of just the
    362 # URL that was paid for.
    363 mkdir -p /etc/systemd/system/paivana-httpd.service.d
    364 cat <<EOF >/etc/systemd/system/paivana-httpd.service.d/sandcastle.conf
    365 [Unit]
    366 # Paywall templates are fetched from the merchant backend on
    367 # startup, so keep retrying until the merchant is up.
    368 After=taler-merchant-httpd.service
    369 StartLimitIntervalSec=0
    370 
    371 [Service]
    372 ExecStart=
    373 ExecStart=/usr/bin/paivana-httpd -c /etc/paivana/paivana.conf -f -g -L INFO
    374 EOF
    375 
    376 systemctl daemon-reload
    377 
    378 cat <<EOF >/etc/libeufin/libeufin-bank.conf
    379 [libeufin-bank]
    380 BASE_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/
    381 CURRENCY = $CURRENCY
    382 DEFAULT_DEBT_LIMIT = $CURRENCY:500
    383 REGISTRATION_BONUS = $CURRENCY:100
    384 SPA_CAPTCHA_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/webui/#/operation/{woid}
    385 SUGGESTED_WITHDRAWAL_EXCHANGE = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/
    386 ALLOW_REGISTRATION = yes
    387 SERVE = tcp
    388 PORT = $PORT_INTERNAL_LIBEUFIN_BANK
    389 # Bind address.
    390 # Option soon to be deprecated!
    391 ADDRESS = 127.0.0.1
    392 WIRE_TYPE = $WIRE_METHOD
    393 
    394 # Compat mode for now
    395 PWD_CHECK = no
    396 PWD_AUTH_COMPAT = yes
    397 
    398 [currency-$CURRENCY]
    399 ENABLED = YES
    400 name = "${NAME:=Kudos}"
    401 code = "$CURRENCY"
    402 decimal_separator = "."
    403 fractional_input_digits = ${FRACTIONALS:=2}
    404 fractional_normal_digits = ${FRACTIONALS:=2}
    405 fractional_trailing_zero_digits = ${FRACTIONALS:=2}
    406 is_currency_name_leading = NO
    407 alt_unit_names = {"0":"${ALT_UNIT_NAME:=ク}"}
    408 EOF
    409 
    410 cat <<EOF >/usr/share/libeufin-bank-webui/settings.json
    411 {
    412   "backendBaseURL": "$PROTO://$BANK_DOMAIN$PORT_SUFFIX/",
    413   "iconLinkURL": "$PROTO://$LANDING_DOMAIN$PORT_SUFFIX/",
    414   "enableDemoHeader": true,
    415   "showPublicAccounts": true,
    416   "defaultSuggestedAmount": 10,
    417   "topNavSites": {
    418     "Introduction": "$PROTO://$LANDING_DOMAIN$PORT_SUFFIX/",
    419     "Bank": "$PROTO://$BANK_DOMAIN$PORT_SUFFIX/",
    420     "Essay Shop": "$PROTO://$BLOG_DOMAIN$PORT_SUFFIX/",
    421     "Donations": "$PROTO://$DONATIONS_DOMAIN$PORT_SUFFIX/"
    422   }
    423 }
    424 EOF
    425 
    426 # Generate /tmp/sandcastle-setup.conf
    427 cat <<EOF >/tmp/sandcastle-setup.conf
    428 [currency-$CURRENCY]
    429 ENABLED = YES
    430 name = "${NAME:=Kudos}"
    431 code = "$CURRENCY"
    432 decimal_separator = "."
    433 fractional_input_digits = ${FRACTIONALS:=2}
    434 fractional_normal_digits = ${FRACTIONALS:=2}
    435 fractional_trailing_zero_digits = ${FRACTIONALS:=2}
    436 is_currency_name_leading = NO
    437 alt_unit_names = {"0":"${ALT_UNIT_NAME:=ク}"}
    438 EOF
    439 
    440 cp /tmp/sandcastle-setup.conf /etc/taler-exchange/conf.d/sandcastle-setup.conf
    441 cp /tmp/sandcastle-setup.conf /etc/taler-merchant/conf.d/sandcastle-setup.conf
    442 
    443 
    444 cat <<EOF >/etc/taler-exchange/conf.d/sandcastle-exchange.conf
    445 [exchange]
    446 CURRENCY = $CURRENCY
    447 CURRENCY_ROUND_UNIT = $CURRENCY:0.01
    448 TINY_AMOUNT = $CURRENCY:0.01
    449 AML_THRESHOLD = $CURRENCY:1000000
    450 MASTER_PUBLIC_KEY = $MASTER_PUBLIC_KEY
    451 BASE_URL = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/
    452 
    453 [taler-exchange-secmod-rsa]
    454 LOOKAHEAD_SIGN = 4 weeks
    455 
    456 [taler-exchange-secmod-eddsa]
    457 LOOKAHEAD_SIGN = 4 weeks
    458 
    459 [taler-exchange-secmod-cs]
    460 LOOKAHEAD_SIGN = 4 weeks
    461 
    462 [exchange-account-default]
    463 PAYTO_URI = $EXCHANGE_PAYTO
    464 ENABLE_DEBIT = YES
    465 ENABLE_CREDIT = YES
    466 @inline-secret@ exchange-accountcredentials-default ../secrets/exchange-accountcredentials-default.secret.conf
    467 EOF
    468 
    469 
    470 cat <<EOF >/etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf
    471 [exchange-accountcredentials-default]
    472 WIRE_GATEWAY_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/accounts/exchange/taler-wire-gateway/
    473 WIRE_GATEWAY_AUTH_METHOD = basic
    474 USERNAME = exchange
    475 PASSWORD = $(get_credential_pw bank/exchange)
    476 EOF
    477 
    478 if [[ $ENABLE_AUDITOR = 1 ]]; then
    479   # Make sandcastle exchange config available to auditor
    480   cp /etc/taler-exchange/conf.d/sandcastle-exchange.conf /etc/taler-auditor/conf.d/sandcastle-exchange.conf
    481 
    482   # We run the offline tooling as root, maybe in the future there should be
    483   # a separate user created by the Debian package for that.
    484   AUDITOR_PUB=$(taler-auditor-offline setup)
    485 
    486   cat <<EOF >/etc/taler-auditor/conf.d/sandcastle-auditor.conf
    487 [auditor]
    488 PUBLIC_KEY = $AUDITOR_PUB
    489 
    490 [exchangedb]
    491 
    492 $(dup_exchange_opt exchangedb IDLE_RESERVE_EXPIRATION_TIME)
    493 $(dup_exchange_opt exchangedb LEGAL_RESERVE_EXPIRATION_TIME)
    494 $(dup_exchange_opt exchangedb AGGREGATOR_SHIFT)
    495 $(dup_exchange_opt exchangedb DEFAULT_PURSE_LIMIT)
    496 
    497 [exchangedb-postgres]
    498 $(dup_exchange_opt exchangedb-postgres CONFIG)
    499 
    500 [exchange]
    501 $(dup_exchange_opt exchange CURRENCY)
    502 $(dup_exchange_opt exchange CURRENCY_ROUND_UNIT)
    503 $(dup_exchange_opt exchange DB)
    504 
    505 
    506 EOF
    507 fi
    508 
    509 # The config shipped with the package can conflict with the
    510 # trusted sandcastle exchange if the currency is KUDOS.
    511 rm -f /usr/share/taler-exchange/config.d/kudos.conf
    512 rm -f /usr/share/taler-merchant/config.d/kudos.conf
    513 
    514 MY_HELPER_EMAIL=${OVERRIDE_MERCHANT_HELPER_EMAIL:-/data/sandcastle-merchant-email-helper}
    515 
    516 # We need to define the default currency for the UI.
    517 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant.conf
    518 [merchant]
    519 # Default currency
    520 CURRENCY = $CURRENCY
    521 ENABLE_SELF_PROVISIONING = YES
    522 MANDATORY_TAN_CHANNELS = email
    523 HELPER_EMAIL = $MY_HELPER_EMAIL
    524 
    525 BASE_URL = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/
    526 
    527 # Will be the default in future merchant versions
    528 # => Can be removed after 1.6 release
    529 BACKOFFICE_SPA_DIR = /usr/share/taler-merchant-webui/
    530 
    531 EOF
    532 
    533 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant-exchanges.conf
    534 [merchant-exchange-sandcastle]
    535 EXCHANGE_BASE_URL = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/
    536 MASTER_KEY = $MASTER_PUBLIC_KEY
    537 CURRENCY = $CURRENCY
    538 EOF
    539 
    540 # Allow overrides to modify merchant config
    541 [[ $(type -t hook_merchant_config) == function ]] && hook_merchant_config
    542 
    543 mkdir -p /etc/taler-merchant-demos
    544 install -d -o taler-merchant-demos -g taler-merchant-demos /run/taler-merchant-demos
    545 
    546 cat <<EOF >/etc/taler-merchant-demos/taler-merchant-demos.conf
    547 [taler]
    548 CURRENCY = $CURRENCY
    549 
    550 [frontend-demo]
    551 LANDING_URL = $PROTO://$LANDING_DOMAIN$PORT_SUFFIX/
    552 BANK_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/
    553 BLOG_URL = $PROTO://$BLOG_DOMAIN$PORT_SUFFIX/
    554 DONATIONS_URL = $PROTO://$DONATIONS_DOMAIN$PORT_SUFFIX/
    555 
    556 [frontend-demo-landing]
    557 HTTP_SERVE = unix
    558 HTTP_UNIXPATH = /run/taler-merchant-demos/landing.sock
    559 HTTP_UNIXPATH_MODE = 666
    560 
    561 [frontend-demo-blog]
    562 HTTP_SERVE = unix
    563 HTTP_UNIXPATH = /sockets/blog.sock
    564 HTTP_UNIXPATH_MODE = 666
    565 BACKEND_URL = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/blog/
    566 BACKEND_APIKEY = secret-token:$(get_credential_pw merchant/blog)
    567 ENABLE_TOKENS = ${ENABLE_SUBSCRIPTIONS:-no}
    568 
    569 [frontend-demo-donations]
    570 DONAU_URL = $PROTO://$DONAU_DOMAIN$PORT_SUFFIX/
    571 HTTP_SERVE = unix
    572 HTTP_UNIXPATH = /sockets/donations.sock
    573 HTTP_UNIXPATH_MODE = 666
    574 BACKEND_URL_TOR = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/tor/
    575 BACKEND_APIKEY_TOR = secret-token:$(get_credential_pw merchant/tor)
    576 BACKEND_URL_TALER = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/taler/
    577 BACKEND_APIKEY_TALER = secret-token:$(get_credential_pw merchant/taler)
    578 BACKEND_URL_GNUNET = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/gnunet/
    579 BACKEND_APIKEY_GNUNET = secret-token:$(get_credential_pw merchant/gnunet)
    580 EOF
    581 
    582 #
    583 # Create databases
    584 #
    585 
    586 function wait_pg_ready() {
    587   while true; do
    588     ret=0
    589     pg_isready || ret=$?
    590     case "$ret" in
    591       0)
    592         echo "Postgres is ready" >&2
    593         break
    594         ;;
    595       1|2)
    596         echo "pg_isready returned status $ret, waiting" >&2
    597         sleep 1
    598         ;;
    599       3)
    600         echo "pg_isready returned status $ret, giving up" >&2
    601         exit 3
    602         ;;
    603     esac
    604   done
    605 }
    606 
    607 PG_VERSION="17"
    608 
    609 # Since the sandcastle is a test system, we turn fsync off for performance
    610 # reasons (especially with the drupal setup).
    611 # CAUTION: You do not want to set this in production,
    612 # especially not for the taler-exchange.
    613 pg_conftool $PG_VERSION main set fsync off
    614 # Higher limits needed for migration
    615 pg_conftool $PG_VERSION main set max_locks_per_transaction 512
    616 pg_conftool $PG_VERSION main set max_pred_locks_per_transaction 512
    617 
    618 backup_file=/exported/postgres-backup.sql
    619 if [[ $import_instr = singledump ]]; then
    620   echo "Importing database dump"
    621   if [[ ! -e "$backup_file" ]]; then
    622     echo "Requested import, but backup file does not exist" >&2
    623     exit 1
    624   fi
    625   pg_dropcluster --stop 17 main || true
    626   pg_createcluster 17 main
    627   systemctl start postgresql.service
    628   wait_pg_ready
    629   sudo -u postgres psql postgres -f "$backup_file"
    630 else
    631   systemctl start postgresql.service
    632   wait_pg_ready
    633 fi
    634 
    635 # Set up databases.
    636 # Do that *before* we potentially do a per-service restore-from-backup.
    637 
    638 challenger-dbconfig
    639 
    640 # Sets up the database for both libeufin-bank and libeufin-nexus.  We only need
    641 # the libeufin-bank DB though.
    642 libeufin-dbconfig
    643 
    644 if [[ $ENABLE_AUDITOR = 1 ]]; then
    645   # Add auditor user to DB group *before* running taler-exchange-dbconfig,
    646   # so that DB permissions are adjusted accordingly.
    647   usermod taler-auditor-httpd -aG taler-exchange-db
    648   taler-auditor-dbconfig
    649 fi
    650 
    651 taler-exchange-dbconfig
    652 
    653 taler-merchant-dbconfig
    654 
    655 
    656 #
    657 # Import backup if necessary.
    658 #
    659 
    660 if [[ $import_instr = all ]]; then
    661   echo "Importing databases"
    662 
    663   # FIXME: Consider backing up old DB before importing new one
    664   # FIXME: This is rather hacky, it would be better to use "pg_dump -Fc" and "pg_restore"
    665   sudo -u postgres dropdb taler-exchange
    666   sudo -u postgres dropdb taler-merchant
    667   sudo -u postgres dropdb libeufin
    668 
    669   sudo -u postgres createdb taler-exchange
    670   sudo -u postgres createdb taler-merchant
    671   sudo -u postgres createdb libeufin
    672 
    673   sudo -u postgres psql taler-exchange -f /exported/taler-exchange/taler-exchange.sql
    674   sudo -u postgres psql taler-merchant -f /exported/taler-merchant/taler-merchant.sql
    675   sudo -u postgres psql libeufin -f /exported/libeufin/libeufin.sql
    676 
    677   libeufin-dbconfig
    678   taler-exchange-dbconfig
    679   taler-merchant-dbconfig
    680 
    681   rm -rf /var/lib/taler-exchange/secmod-eddsa/*
    682   cp -r /exported/taler-exchange/secmod-eddsa/* /var/lib/taler-exchange/secmod-eddsa/
    683 
    684   rm -rf /var/lib/taler-exchange/secmod-rsa/*
    685   cp -r /exported/taler-exchange/secmod-rsa/* /var/lib/taler-exchange/secmod-rsa/
    686 
    687   rm -rf /var/lib/taler-exchange/secmod-cs/*
    688   cp -r /exported/taler-exchange/secmod-cs/* /var/lib/taler-exchange/secmod-cs/
    689 fi
    690 
    691 if [[ $import_instr != none ]]; then
    692   echo "Marking import as done"
    693   rm /exported/import-request
    694 fi
    695 
    696 # We need to adjust file ownership, as the container might have different user and group
    697 # IDs than the volume. That can happen when the packages in the container are installed
    698 # in a different order.
    699 # This is only relevant for non-root ownership.
    700 chown --recursive taler-exchange-offline:taler-exchange-offline /var/lib/taler-exchange/offline/* || true
    701 chown --recursive taler-exchange-secmod-cs:taler-exchange-secmod /var/lib/taler-exchange/secmod-cs
    702 chown --recursive taler-exchange-secmod-rsa:taler-exchange-secmod /var/lib/taler-exchange/secmod-rsa
    703 chown --recursive taler-exchange-secmod-eddsa:taler-exchange-secmod /var/lib/taler-exchange/secmod-eddsa
    704 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf
    705 chown root:taler-auditor-httpd /etc/taler-auditor/secrets/auditor-db.secret.conf
    706 chmod 440 /etc/taler-merchant/secrets/merchant-db.secret.conf
    707 chown taler-merchant-httpd:root /etc/taler-merchant/secrets/merchant-db.secret.conf
    708 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf
    709 chown taler-exchange-wire:taler-exchange-db /etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf
    710 
    711 
    712 # Caddy configuration.
    713 # We use the caddy reverse proxy with automatic
    714 # internal TLS setup to ensure that the services are
    715 # reachable inside the container without any external
    716 # DNS setup under the same domain name and with TLS
    717 # from inside the container.
    718 
    719 systemctl stop caddy.service
    720 
    721 cat <<EOF >/etc/caddy/Caddyfile
    722 {
    723   servers {
    724       trusted_proxies static private_ranges
    725   }
    726 }
    727 
    728 (sandcastle_bank) {
    729   reverse_proxy 127.0.0.1:$PORT_INTERNAL_LIBEUFIN_BANK {
    730     # libeufin-bank should eventually not require this anymore,
    731     # but currently doesn't work without this header.
    732     header_up X-Forwarded-Prefix ""
    733   }
    734 }
    735 
    736 (sandcastle_landing) {
    737   handle /metrics/sandcastle-status {
    738     root * /var/www/sandcastle
    739     header Content-Type "text/plain; charset=utf-8"
    740     file_server
    741   }
    742   handle {
    743     reverse_proxy unix//run/taler-merchant-demos/landing.sock
    744   }
    745 }
    746 
    747 (sandcastle_drupal) {
    748   root * /talerdata/sandcastle-drupal/web/
    749   php_fastcgi unix/var/run/php/php8.4-fpm.sock
    750   file_server
    751 }
    752 
    753 (sandcastle_challenger) {
    754   handle {
    755     reverse_proxy unix//run/challenger/httpd/challenger-http.sock {
    756       # Set this, or otherwise wrong taler://pay URIs will be generated.
    757       header_up X-Forwarded-Proto "https"
    758     }
    759   }
    760 
    761   # Serve challenges via HTTP.
    762   # This is obviously completely insecure, but fine
    763   # for the demo sandcastle.
    764   handle_path /challenges/* {
    765     root * /tmp/challenges/
    766     file_server {
    767       browse
    768     }
    769   }
    770 }
    771 
    772 # Caddy owns sockets only where it bridges a TCP-only service, composes
    773 # additional routing, or serves the application itself.  Native services or
    774 # their socket units own the others.
    775 
    776 http:// {
    777   bind unix//sockets/bank.sock|0666
    778   import sandcastle_bank
    779 }
    780 
    781 http:// {
    782   bind unix//sockets/landing.sock|0666
    783   import sandcastle_landing
    784 }
    785 
    786 http:// {
    787   bind unix//sockets/challenger.sock|0666
    788   import sandcastle_challenger
    789 }
    790 
    791 http:// {
    792   bind unix//sockets/drupal.sock|0666
    793   import sandcastle_drupal
    794 }
    795 EOF
    796 
    797 if [[ $PROTO = https ]]; then
    798   cat <<EOF >>/etc/caddy/Caddyfile
    799 
    800 # Internally reverse-proxy https://,
    801 # so that service can talk to each other via
    802 # https:// inside the container.
    803 
    804 https://$BANK_DOMAIN {
    805   tls internal
    806   import sandcastle_bank
    807 }
    808 
    809 https://$LANDING_DOMAIN {
    810   tls internal
    811   import sandcastle_landing
    812 }
    813 
    814 https://$EXCHANGE_DOMAIN {
    815   tls internal
    816   reverse_proxy unix//sockets/exchange.sock
    817 }
    818 
    819 https://$MERCHANT_DOMAIN {
    820   tls internal
    821   reverse_proxy unix//sockets/merchant-backend.sock {
    822     # Set this, or otherwise wrong taler://pay URIs will be generated.
    823     header_up X-Forwarded-Proto "https"
    824   }
    825 }
    826 
    827 https://$DONAU_DOMAIN {
    828   tls internal
    829   reverse_proxy unix//sockets/donau.sock {
    830     header_up X-Forwarded-Proto "https"
    831   }
    832 }
    833 
    834 https://$AUDITOR_DOMAIN {
    835   tls internal
    836   reverse_proxy unix//sockets/auditor.sock
    837 }
    838 
    839 https://$CHALLENGER_DOMAIN {
    840   tls internal
    841   reverse_proxy unix//run/challenger/httpd/challenger-http.sock
    842 }
    843 
    844 https://$PAIVANA_DOMAIN {
    845   tls internal
    846   reverse_proxy unix//sockets/paivana.sock
    847 }
    848 
    849 EOF
    850 
    851 else
    852   # Config for HTTP without TLS.
    853 
    854   cat <<EOF >>/etc/caddy/Caddyfile
    855 
    856 http://$BANK_DOMAIN$PORT_SUFFIX {
    857   import sandcastle_bank
    858 }
    859 
    860 http://$EXCHANGE_DOMAIN$PORT_SUFFIX {
    861   reverse_proxy unix//sockets/exchange.sock
    862 }
    863 
    864 http://$MERCHANT_DOMAIN$PORT_SUFFIX {
    865   reverse_proxy unix//sockets/merchant-backend.sock
    866 }
    867 
    868 http://$DONAU_DOMAIN$PORT_SUFFIX {
    869   reverse_proxy unix//sockets/donau.sock
    870 }
    871 
    872 http://$AUDITOR_DOMAIN$PORT_SUFFIX {
    873   reverse_proxy unix//sockets/auditor.sock
    874 }
    875 
    876 http://$CHALLENGER_DOMAIN$PORT_SUFFIX {
    877   reverse_proxy unix//run/challenger/httpd/challenger-http.sock
    878 }
    879 
    880 http://$LANDING_DOMAIN$PORT_SUFFIX {
    881   import sandcastle_landing
    882 }
    883 
    884 http://$BLOG_DOMAIN$PORT_SUFFIX {
    885   reverse_proxy unix//sockets/blog.sock
    886 }
    887 
    888 http://$DONATIONS_DOMAIN$PORT_SUFFIX {
    889   reverse_proxy unix//sockets/donations.sock
    890 }
    891 
    892 http://$DRUPAL_DOMAIN$PORT_SUFFIX {
    893   import sandcastle_drupal
    894 }
    895 
    896 http://$PAIVANA_DOMAIN$PORT_SUFFIX {
    897   reverse_proxy unix//sockets/paivana.sock
    898 }
    899 
    900 EOF
    901 
    902 fi
    903 
    904 cat <<EOF >>/etc/hosts
    905 # Start of Taler Sandcastle Domains
    906 127.0.0.1 $LANDING_DOMAIN
    907 127.0.0.1 $BANK_DOMAIN
    908 127.0.0.1 $EXCHANGE_DOMAIN
    909 127.0.0.1 $MERCHANT_DOMAIN
    910 127.0.0.1 $BLOG_DOMAIN
    911 127.0.0.1 $DONATIONS_DOMAIN
    912 127.0.0.1 $DONAU_DOMAIN
    913 127.0.0.1 $CHALLENGER_DOMAIN
    914 127.0.0.1 $DRUPAL_DOMAIN
    915 127.0.0.1 $PAIVANA_DOMAIN
    916 # End of Taler Sandcastle Domains
    917 EOF
    918 
    919 systemctl start caddy.service
    920 
    921 # Install local, internal CA certs for caddy
    922 caddy trust
    923 
    924 # Set up challenger
    925 
    926 CHALLENGER_CLIENT_SECRET=secret-token:sandbox
    927 CHALLENGER_CLIENT_ID=$(sudo -u challenger-httpd challenger-admin -q --add="$CHALLENGER_CLIENT_SECRET" https://$EXCHANGE_DOMAIN/kyc-proof/mychallenger)
    928 echo Challenger client ID: $CHALLENGER_CLIENT_ID
    929 
    930 systemctl enable --now challenger-httpd.service
    931 
    932 # Set up bank
    933 
    934 sudo -u libeufin-bank libeufin-bank edit-account admin --debit_threshold=$CURRENCY:10000000
    935 sudo -u libeufin-bank libeufin-bank passwd admin $(get_credential_pw bank/admin)
    936 
    937 systemctl enable --now libeufin-bank.service
    938 
    939 BANK_BASEURL=$PROTO://$BANK_DOMAIN$PORT_SUFFIX/
    940 
    941 taler-harness deployment wait-taler-service taler-corebank ${BANK_BASEURL}config
    942 
    943 sudo -u libeufin-bank libeufin-bank passwd exchange $(get_credential_pw bank/exchange) || true
    944 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    945   --login exchange --exchange --public \
    946   --payto $EXCHANGE_PAYTO \
    947   --name Exchange \
    948   --password $(get_credential_pw bank/exchange)
    949 
    950 sudo -u libeufin-bank libeufin-bank passwd merchant-admin $(get_credential_pw bank/merchant-admin) || true
    951 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    952   --login merchant-admin --public \
    953   --payto $MERCHANT_PAYTO_ADMIN \
    954   --name "Default Demo Merchant" \
    955   --password $(get_credential_pw bank/merchant-admin)
    956 
    957 sudo -u libeufin-bank libeufin-bank passwd merchant-testing $(get_credential_pw bank/merchant-testing) || true
    958 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    959   --login merchant-testing --public \
    960   --payto $MERCHANT_PAYTO_TESTING \
    961   --name "Testing Merchant" \
    962   --password $(get_credential_pw bank/merchant-testing)
    963 
    964 sudo -u libeufin-bank libeufin-bank passwd merchant-pos $(get_credential_pw bank/merchant-pos) || true
    965 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    966   --login merchant-pos --public \
    967   --payto $MERCHANT_PAYTO_POS \
    968   --name "PoS Merchant" \
    969   --password $(get_credential_pw bank/merchant-pos)
    970 
    971 sudo -u libeufin-bank libeufin-bank passwd merchant-blog $(get_credential_pw bank/merchant-blog) || true
    972 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    973   --login merchant-blog --public \
    974   --payto $MERCHANT_PAYTO_BLOG \
    975   --name "Blog Merchant" \
    976   --password $(get_credential_pw bank/merchant-blog)
    977 
    978 sudo -u libeufin-bank libeufin-bank passwd merchant-gnunet $(get_credential_pw bank/merchant-gnunet) || true
    979 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    980   --login merchant-gnunet --public \
    981   --payto "$MERCHANT_PAYTO_GNUNET" \
    982   --name "GNUnet Donations Merchant" \
    983   --password $(get_credential_pw bank/merchant-gnunet)
    984 
    985 sudo -u libeufin-bank libeufin-bank passwd merchant-taler $(get_credential_pw bank/merchant-taler) || true
    986 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    987   --login merchant-taler --public \
    988   --payto "$MERCHANT_PAYTO_TALER" \
    989   --name "Taler Donations Merchant" \
    990   --password $(get_credential_pw bank/merchant-taler)
    991 
    992 sudo -u libeufin-bank libeufin-bank passwd merchant-tor $(get_credential_pw bank/merchant-tor) || true
    993 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
    994   --login merchant-tor --public \
    995   --payto "$MERCHANT_PAYTO_TOR" \
    996   --name "Tor Donations Merchant" \
    997   --password $(get_credential_pw bank/merchant-tor)
    998 
    999 sudo -u libeufin-bank libeufin-bank passwd merchant-umami $(get_credential_pw bank/merchant-umami) || true
   1000 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
   1001   --login merchant-umami --public \
   1002   --payto "$MERCHANT_PAYTO_UMAMI" \
   1003   --name "Umami Merchant" \
   1004   --password $(get_credential_pw bank/merchant-umami)
   1005 
   1006 sudo -u libeufin-bank libeufin-bank passwd merchant-paivana $(get_credential_pw bank/merchant-paivana) || true
   1007 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
   1008   --login merchant-paivana --public \
   1009   --payto "$MERCHANT_PAYTO_PAIVANA" \
   1010   --name "Paivana Merchant" \
   1011   --password $(get_credential_pw bank/merchant-paivana)
   1012 
   1013 # Special bank account without a secure password
   1014 sudo -u libeufin-bank libeufin-bank passwd merchant-sandbox sandbox || true
   1015 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \
   1016   --login merchant-sandbox --public \
   1017   --payto "$MERCHANT_PAYTO_SANDBOX" \
   1018   --name "Sandbox Merchant" \
   1019   --password sandbox
   1020 
   1021 # Set up exchange
   1022 
   1023 ##
   1024 ## Configure KYC if enabled
   1025 ##
   1026 
   1027 if [[ ${ENABLE_KYC:-0} = 1 ]]; then
   1028   # KYC config
   1029   if [[ ${KYC_DIALECT:-simple} = simple ]]; then
   1030     source /data/setup-kyc-simple.sh
   1031   elif [[ ${KYC_DIALECT:-simple} = tops ]]; then
   1032     source /data/setup-kyc-tops.sh
   1033   fi
   1034 else
   1035   rm -f /etc/taler-exchange/conf.d/sandcastle-kyc.conf
   1036 fi
   1037 
   1038 
   1039 if [[ ! -e /etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf ]]; then
   1040   # Only create if necessary, as each [COIN-...] section
   1041   # has a unique name with a timestamp.
   1042   taler-harness deployment gen-coin-config \
   1043     --min-amount "${CURRENCY}:0.01" \
   1044     --max-amount "${CURRENCY}:100" \
   1045     --no-fees \
   1046     >"/etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf"
   1047 else
   1048   # Exchange broke backwards compatibility, fix up existing config file.
   1049   sed -i 's/COIN-/COIN_/gI' "/etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf"
   1050 fi
   1051 
   1052 taler-terms-generator -i /usr/share/taler-exchange/terms/exchange-tos-v0
   1053 taler-terms-generator -i /usr/share/taler-exchange/terms/exchange-pp-v0
   1054 
   1055 systemctl enable --now taler-exchange.target
   1056 
   1057 taler-harness deployment wait-taler-service taler-exchange $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/config
   1058 taler-harness deployment wait-endpoint $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/management/keys
   1059 
   1060 sudo -u taler-exchange-offline \
   1061   taler-exchange-offline \
   1062   -c /etc/taler-exchange/taler-exchange.conf \
   1063   download \
   1064   sign \
   1065   upload
   1066 
   1067 sudo -u taler-exchange-offline \
   1068   taler-exchange-offline \
   1069   enable-account "${EXCHANGE_PAYTO}" \
   1070   wire-fee now "$WIRE_METHOD" "${CURRENCY}":0 "${CURRENCY}":0 \
   1071   global-fee now "${CURRENCY}":0 "${CURRENCY}":0 "${CURRENCY}":0 1h 6a 0 \
   1072   upload
   1073 
   1074 systemctl enable --now taler-exchange-offline.timer
   1075 
   1076 function dup_exchange_opt() {
   1077   echo "$2 = $(taler-exchange-config -c /etc/taler-exchange/taler-exchange.conf -s $1 -o $2)"
   1078 }
   1079 
   1080 #
   1081 # Set up exchange auditor
   1082 #
   1083 
   1084 if [[ $ENABLE_AUDITOR = 1 ]]; then
   1085   systemctl enable --now taler-auditor.target
   1086 fi
   1087 
   1088 # Set up merchant backend
   1089 
   1090 MERCHANT_BASEURL=$PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/
   1091 
   1092 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant-terms.conf
   1093 [merchant]
   1094 TERMS_ETAG = merchant-tos-demo-v0
   1095 TERMS_DIR = \${TALER_DATA_HOME}terms/
   1096 EOF
   1097 
   1098 taler-terms-generator -i /usr/share/taler-merchant/terms/merchant-tos-demo-v0.en.rst -o "$(taler-merchant-config -f -s merchant -o terms_dir)"
   1099 
   1100 systemctl enable --now taler-merchant.target
   1101 taler-harness deployment wait-taler-service taler-merchant ${MERCHANT_BASEURL}config
   1102 
   1103 function reset_merchant_pw() {
   1104   pw=$(get_credential_pw merchant/$1)
   1105   sudo -u taler-merchant-httpd taler-merchant-passwd --instance "$1" "$pw"
   1106   if [[ $? -eq 2 ]]; then
   1107     echo "Instance $1 does not exist" >&2
   1108     return 2
   1109   fi
   1110   if [[ $? -ne 0 ]]; then
   1111     echo "Failed to reset password for merchant instance $1" >&2
   1112     exit 1
   1113   fi
   1114 }
   1115 
   1116 # FIXME: Move this into a harness tool (that just reads a config file)?
   1117 
   1118 instance_missing=no
   1119 reset_merchant_pw admin || instance_missing=yes
   1120 if [[ $instance_missing = yes ]]; then
   1121   taler-harness deployment provision-merchant-instance \
   1122     ${MERCHANT_BASEURL} \
   1123     --management-token "secret-token:none" \
   1124     --instance-password $(get_credential_pw merchant/admin) \
   1125     --name Merchant \
   1126     --id admin \
   1127     --payto "$MERCHANT_PAYTO_ADMIN"
   1128 fi
   1129 
   1130 ADMIN_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL} admin --password $(get_credential_pw merchant/admin))
   1131 
   1132 instance_missing=no
   1133 reset_merchant_pw pos || instance_missing=yes
   1134 if [[ $instance_missing = yes ]]; then
   1135   taler-harness deployment provision-merchant-instance \
   1136     ${MERCHANT_BASEURL} \
   1137     --management-token $ADMIN_TOK \
   1138     --instance-password $(get_credential_pw merchant/pos) \
   1139     --name "POS Merchant" \
   1140     --id pos \
   1141     --payto "$MERCHANT_PAYTO_POS"
   1142 fi
   1143 
   1144 instance_missing=no
   1145 reset_merchant_pw testing || instance_missing=yes
   1146 if [[ $instance_missing = yes ]]; then
   1147   taler-harness deployment provision-merchant-instance \
   1148     ${MERCHANT_BASEURL} \
   1149     --management-token $ADMIN_TOK \
   1150     --instance-password $(get_credential_pw merchant/testing) \
   1151     --name "Testing Merchant" \
   1152     --id testing \
   1153     --payto "$MERCHANT_PAYTO_TESTING"
   1154 fi
   1155 
   1156 instance_missing=no
   1157 reset_merchant_pw blog || instance_missing=yes
   1158 if [[ $instance_missing = yes ]]; then
   1159   taler-harness deployment provision-merchant-instance \
   1160     ${MERCHANT_BASEURL} \
   1161     --management-token $ADMIN_TOK \
   1162     --instance-password $(get_credential_pw merchant/blog) \
   1163     --name "Blog Merchant" \
   1164     --id blog \
   1165     --payto "$MERCHANT_PAYTO_BLOG"
   1166 fi
   1167 
   1168 instance_missing=no
   1169 reset_merchant_pw gnunet || instance_missing=yes
   1170 if [[ $instance_missing = yes ]]; then
   1171   taler-harness deployment provision-merchant-instance \
   1172     ${MERCHANT_BASEURL} \
   1173     --management-token $ADMIN_TOK \
   1174     --instance-password $(get_credential_pw merchant/gnunet) \
   1175     --name "GNUnet Merchant" \
   1176     --id gnunet \
   1177     --payto "$MERCHANT_PAYTO_GNUNET"
   1178 fi
   1179 
   1180 instance_missing=no
   1181 reset_merchant_pw taler || instance_missing=yes
   1182 if [[ $instance_missing = yes ]]; then
   1183   taler-harness deployment provision-merchant-instance \
   1184     ${MERCHANT_BASEURL} \
   1185     --management-token $ADMIN_TOK \
   1186     --instance-password $(get_credential_pw merchant/taler) \
   1187     --name "Taler Merchant" \
   1188     --id taler \
   1189     --payto "$MERCHANT_PAYTO_TALER"
   1190 fi
   1191 
   1192 instance_missing=no
   1193 reset_merchant_pw tor || instance_missing=yes
   1194 if [[ $instance_missing = yes ]]; then
   1195   taler-harness deployment provision-merchant-instance \
   1196     ${MERCHANT_BASEURL} \
   1197     --management-token $ADMIN_TOK \
   1198     --instance-password $(get_credential_pw merchant/tor) \
   1199     --name "Tor Merchant" \
   1200     --id tor \
   1201     --payto "$MERCHANT_PAYTO_TOR"
   1202 fi
   1203 
   1204 instance_missing=no
   1205 reset_merchant_pw umami || instance_missing=yes
   1206 if [[ $instance_missing = yes ]]; then
   1207   taler-harness deployment provision-merchant-instance \
   1208     ${MERCHANT_BASEURL} \
   1209     --management-token $ADMIN_TOK \
   1210     --instance-password $(get_credential_pw merchant/umami) \
   1211     --name "Umami Merchant" \
   1212     --id umami \
   1213     --payto "$MERCHANT_PAYTO_UMAMI"
   1214 fi
   1215 
   1216 instance_missing=no
   1217 reset_merchant_pw paivana || instance_missing=yes
   1218 if [[ $instance_missing = yes ]]; then
   1219   taler-harness deployment provision-merchant-instance \
   1220     ${MERCHANT_BASEURL} \
   1221     --management-token $ADMIN_TOK \
   1222     --instance-password $(get_credential_pw merchant/paivana) \
   1223     --name "Paivana Merchant" \
   1224     --id paivana \
   1225     --payto "$MERCHANT_PAYTO_PAIVANA"
   1226 fi
   1227 
   1228 # Special instance with fixed "sandbox" password
   1229 sudo -u taler-merchant-httpd taler-merchant-passwd --instance sandbox sandbox || true
   1230 taler-harness deployment provision-merchant-instance \
   1231   ${MERCHANT_BASEURL} \
   1232   --management-token $ADMIN_TOK \
   1233   --instance-password sandbox \
   1234   --name "sandbox merchant" \
   1235   --id sandbox \
   1236   --payto "$MERCHANT_PAYTO_SANDBOX"
   1237 
   1238 # token families needed by demo blog
   1239 
   1240 langs=(de en ar zh fr hi it ja ko pt pt_BR ru es sv tr uk)
   1241 duration_us=$((30 * 24 * 60 * 60 * 1000000)) # 30 days
   1242 validity_granularity_us=$((24 * 60 * 60 * 1000000)) # 1 day
   1243 # valid_before is intentionally omitted so token families remain valid forever.
   1244 
   1245 provision_token_family() {
   1246   local instance_url=$1
   1247   local access_token=$2
   1248   local slug=$3
   1249   local request_body=$4
   1250   local response_file
   1251   local response_status
   1252   local update_body
   1253 
   1254   response_file=$(mktemp)
   1255   response_status=$(curl -X POST "${instance_url}private/tokenfamilies" \
   1256     -H "Authorization: Bearer $access_token" \
   1257     -H "Content-Type: application/json" \
   1258     --data-raw "$request_body" \
   1259     --silent --show-error \
   1260     --output "$response_file" \
   1261     --write-out '%{http_code}')
   1262 
   1263   case "$response_status" in
   1264     204)
   1265       ;;
   1266     409)
   1267       response_status=$(curl "${instance_url}private/tokenfamilies/${slug}" \
   1268         -H "Authorization: Bearer $access_token" \
   1269         --silent --show-error \
   1270         --output "$response_file" \
   1271         --write-out '%{http_code}')
   1272       if [[ $response_status != 200 ]]; then
   1273         echo "Failed to retrieve existing token family ${slug} (HTTP $response_status)" >&2
   1274         cat "$response_file" >&2
   1275         rm -f "$response_file"
   1276         return 1
   1277       fi
   1278 
   1279       # PATCH only the mutable fields, preserving the original validity start.
   1280       # Omitting valid_before changes the validity end to "forever".
   1281       update_body=$(jq '
   1282         {name, description, description_i18n, valid_after}
   1283         + (if .extra_data == null then {} else {extra_data} end)
   1284       ' "$response_file")
   1285       response_status=$(curl -X PATCH "${instance_url}private/tokenfamilies/${slug}" \
   1286         -H "Authorization: Bearer $access_token" \
   1287         -H "Content-Type: application/json" \
   1288         --data-raw "$update_body" \
   1289         --silent --show-error \
   1290         --output "$response_file" \
   1291         --write-out '%{http_code}')
   1292       if [[ $response_status != 204 ]]; then
   1293         echo "Failed to update token family ${slug} (HTTP $response_status)" >&2
   1294         cat "$response_file" >&2
   1295         rm -f "$response_file"
   1296         return 1
   1297       fi
   1298       ;;
   1299     *)
   1300       echo "Failed to create token family ${slug} (HTTP $response_status)" >&2
   1301       cat "$response_file" >&2
   1302       rm -f "$response_file"
   1303       return 1
   1304       ;;
   1305   esac
   1306   rm -f "$response_file"
   1307 }
   1308 
   1309 # FIXME: Move this into a harness tool?
   1310 for lang in "${langs[@]}"; do
   1311   blog_token_family="{
   1312   \"kind\": \"subscription\",
   1313   \"slug\": \"blog_abo_${lang}\",
   1314   \"name\": \"One month of access (${lang})\",
   1315   \"description\": \"One month of access (${lang})\",
   1316   \"description_i18n\": {
   1317     \"de\": \"Ein monat lang Zugang zu den Artikeln\",
   1318     \"en\": \"One month of access to articles\",
   1319     \"fr\": \"Un mois d'accès aux articles\",
   1320     \"es\": \"Un mes de acceso a los artículos\"
   1321   },
   1322   \"duration\": { \"d_us\": ${duration_us} },
   1323   \"validity_granularity\": { \"d_us\": ${validity_granularity_us} }
   1324 }"
   1325   provision_token_family \
   1326     "${MERCHANT_BASEURL}instances/blog/" \
   1327     "secret-token:$(get_credential_pw merchant/blog)" \
   1328     "blog_abo_${lang}" \
   1329     "$blog_token_family"
   1330 done
   1331 
   1332 
   1333 # Set up the Paivana paywall.
   1334 # The paywall itself is configured entirely via merchant templates,
   1335 # see /etc/paivana/paivana.conf for the daemon configuration.
   1336 
   1337 PAIVANA_INSTANCE_URL=${MERCHANT_BASEURL}instances/paivana/
   1338 PAIVANA_TOKEN=secret-token:$(get_credential_pw merchant/paivana)
   1339 
   1340 # Subscription offered as an alternative to paying per visit.
   1341 # Reuses the validity settings of the blog subscriptions above.
   1342 paivana_token_family="{
   1343   \"kind\": \"subscription\",
   1344   \"slug\": \"paivana_abo\",
   1345   \"name\": \"One month of access\",
   1346   \"description\": \"One month of access to $PAIVANA_DESTINATION\",
   1347   \"duration\": { \"d_us\": ${duration_us} },
   1348   \"validity_granularity\": { \"d_us\": ${validity_granularity_us} }
   1349 }"
   1350 provision_token_family \
   1351   "$PAIVANA_INSTANCE_URL" \
   1352   "$PAIVANA_TOKEN" \
   1353   paivana_abo \
   1354   "$paivana_token_family"
   1355 
   1356 # paivana-httpd learns which URLs cost how much from the templates
   1357 # of its merchant instance.  A single template covering the whole
   1358 # site is enough here, as paivana-httpd runs with '-g'.
   1359 paivana_template=$(cat <<EOF
   1360 {
   1361   "template_id": "paivana",
   1362   "template_description": "Paywall for $PAIVANA_DESTINATION",
   1363   "template_contract": {
   1364     "template_type": "paivana",
   1365     "summary": "Access to $PAIVANA_DESTINATION",
   1366     "website_regex": ".*",
   1367     "max_pickup_duration": { "d_us": $((24 * 60 * 60 * 1000000)) },
   1368     "choices": [
   1369       {
   1370         "amount": "$CURRENCY:1",
   1371         "description": "Pay for one day of access"
   1372       },
   1373       {
   1374         "amount": "$CURRENCY:10",
   1375         "description": "Buy a one month subscription",
   1376         "outputs": [ { "type": "token", "token_family_slug": "paivana_abo" } ]
   1377       },
   1378       {
   1379         "amount": "$CURRENCY:0",
   1380         "description": "Use my subscription",
   1381         "inputs": [ { "type": "token", "token_family_slug": "paivana_abo" } ],
   1382         "outputs": [ { "type": "token", "token_family_slug": "paivana_abo" } ]
   1383       }
   1384     ]
   1385   }
   1386 }
   1387 EOF
   1388 )
   1389 
   1390 paivana_response=$(mktemp)
   1391 paivana_status=$(curl -X POST "${PAIVANA_INSTANCE_URL}private/templates" \
   1392   -H "Authorization: Bearer $PAIVANA_TOKEN" \
   1393   -H "Content-Type: application/json" \
   1394   --data-raw "$paivana_template" \
   1395   -s -o "$paivana_response" -w '%{http_code}')
   1396 
   1397 case "$paivana_status" in
   1398   204)
   1399     ;;
   1400   409)
   1401     # Template exists already, update it so that changes take effect.
   1402     paivana_status=$(curl -X PATCH "${PAIVANA_INSTANCE_URL}private/templates/paivana" \
   1403       -H "Authorization: Bearer $PAIVANA_TOKEN" \
   1404       -H "Content-Type: application/json" \
   1405       --data-raw "$(jq 'del(.template_id)' <<<"$paivana_template")" \
   1406       -s -o "$paivana_response" -w '%{http_code}')
   1407     if [[ $paivana_status != 204 ]]; then
   1408       echo "Failed to update Paivana template (HTTP $paivana_status)" >&2
   1409       cat "$paivana_response" >&2
   1410       exit 1
   1411     fi
   1412     ;;
   1413   *)
   1414     echo "Failed to create Paivana template (HTTP $paivana_status)" >&2
   1415     cat "$paivana_response" >&2
   1416     exit 1
   1417     ;;
   1418 esac
   1419 rm -f "$paivana_response"
   1420 
   1421 systemctl enable --now paivana-httpd.socket
   1422 systemctl enable --now paivana-httpd.service
   1423 
   1424 
   1425 # Set up Donau
   1426 
   1427 cat <<EOF >/etc/donau/conf.d/sandcastle.conf
   1428 [donau]
   1429 CURRENCY = $CURRENCY
   1430 LEGAL_DOMAIN = Gnuland
   1431 EXPIRE_LEGAL_YEARS = 3
   1432 # We don't do the token yet, as the merchant doesn't support
   1433 # authenticating with donau.
   1434 # ADMIN_BEARER_TOKEN = secret-token:secret
   1435 EOF
   1436 
   1437 donau-dbconfig
   1438 
   1439 if [[ ! -e /etc/donau/conf.d/sandcastle-$CURRENCY-units.conf ]]; then
   1440   # Only create if necessary
   1441   taler-harness deployment gen-doco-config \
   1442     --min-amount "${CURRENCY}:0.01" \
   1443     --max-amount "${CURRENCY}:100" \
   1444     >"/etc/donau/conf.d/sandcastle-$CURRENCY-units.conf"
   1445 fi
   1446 
   1447 systemctl enable --now donau.target
   1448 
   1449 DONAU_BASE_URL=$PROTO://$DONAU_DOMAIN$PORT_SUFFIX/
   1450 
   1451 taler-harness deployment wait-taler-service donau ${DONAU_BASE_URL}config
   1452 
   1453 if [[ ${ENABLE_TALDIR:-0} == 1 ]]; then
   1454   # Mailbox and Directory
   1455   mkdir -p /etc/taler-directory
   1456   cp /usr/share/taler-directory/taldir.conf.example /etc/taler-directory/taler-directory.conf
   1457   taler-directory-dbconfig
   1458   systemctl enable --now taler-directory.service
   1459 fi
   1460 
   1461 if [[ ${ENABLE_MAILBOX:-0} == 1 ]]; then
   1462   mkdir -p /etc/taler-mailbox
   1463   cp /usr/share/taler-mailbox/mailbox.conf.example /etc/taler-mailbox/taler-mailbox.conf
   1464   sed -i 's/localhost:11000/localhost:12000/' /etc/taler-mailbox/taler-mailbox.conf
   1465   taler-mailbox-dbconfig
   1466   systemctl enable --now taler-mailbox.service
   1467 fi
   1468 
   1469 GNUNET_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/gnunet/ gnunet --password $(get_credential_pw merchant/gnunet))
   1470 taler-harness deployment provision-merchant-donau \
   1471   --merchant-auth-token $GNUNET_TOK \
   1472   --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/gnunet/ \
   1473   --donau-base-url $DONAU_BASE_URL \
   1474   --donau-auth-token secret-token:secret \
   1475   --currency $CURRENCY
   1476 
   1477 TALER_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/taler/ taler --password $(get_credential_pw merchant/taler))
   1478 taler-harness deployment provision-merchant-donau \
   1479   --merchant-auth-token $TALER_TOK \
   1480   --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/taler/ \
   1481   --donau-base-url $DONAU_BASE_URL \
   1482   --donau-auth-token secret-token:secret \
   1483   --currency $CURRENCY
   1484 
   1485 TOR_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/tor/ tor --password $(get_credential_pw merchant/tor))
   1486 taler-harness deployment provision-merchant-donau \
   1487   --merchant-auth-token $TOR_TOK \
   1488   --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/tor/ \
   1489   --donau-base-url $DONAU_BASE_URL \
   1490   --donau-auth-token secret-token:secret \
   1491   --currency $CURRENCY
   1492 
   1493 UMAMI_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/umami/ umami --password $(get_credential_pw merchant/umami))
   1494 
   1495 # Now we set up the taler-merchant-demos
   1496 
   1497 systemctl enable --now taler-demo-landing
   1498 systemctl enable --now taler-demo-blog
   1499 systemctl enable --now taler-demo-donations
   1500 
   1501 # Turnstile (drupal/php)
   1502 if [[ ${ENABLE_TURNSTILE:-1} = 1 ]]; then
   1503 
   1504 systemctl enable --now php8.4-fpm
   1505 
   1506 DRUPAL_DB_PW=$(get_credential_pw db/drupal)
   1507 DRUPAL_ADMIN_PW=$(get_credential_pw drupal/admin)
   1508 
   1509 sudo -i -u postgres psql postgres -c "CREATE ROLE drupal WITH login;" || true
   1510 sudo -i -u postgres psql postgres -c "ALTER ROLE drupal password '$DRUPAL_DB_PW';"
   1511 sudo -u postgres createdb drupal --owner=drupal || true
   1512 
   1513 # Needed by PHP's composer
   1514 export HOME=/root
   1515 
   1516 # FIXME: Would probably be better to checkout output of
   1517 # drush status --fields=bootstrap --format=string
   1518 
   1519 cd /talerdata/
   1520 if [[ ! -e /talerdata/sandcastle-drupal ]]; then
   1521   composer create-project drupal/recommended-project:^10 sandcastle-drupal
   1522   cd /talerdata/sandcastle-drupal
   1523   composer require drush/drush
   1524   # This can take a ridiculous amount of time!
   1525   COMPOSER_PROCESS_TIMEOUT=0 composer exec -- drush site-install demo_umami --account-name=admin --account-pass=$DRUPAL_ADMIN_PW --account-mail=admin@localhost --db-url=pgsql://drupal:$DRUPAL_DB_PW@localhost/drupal --site-name=SandcastleUmami --yes
   1526 fi
   1527 
   1528 chown -R www-data:www-data /talerdata/sandcastle-drupal/
   1529 
   1530 ln -sf /opt/turnstile /talerdata/sandcastle-drupal/web/modules/taler_turnstile
   1531 
   1532 snip=$(cat <<'EOF'
   1533 $settings['reverse_proxy'] = TRUE;
   1534 $settings['reverse_proxy_addresses'] = ['127.0.0.1', '10.0.0.0/8'];
   1535 $settings['trusted_host_patterns'] = ['.*'];
   1536 EOF
   1537 )
   1538 
   1539 update_config_block /talerdata/sandcastle-drupal/web/sites/default/settings.php SANDCASTLE "$snip"
   1540 
   1541 cd /talerdata/sandcastle-drupal
   1542 composer exec -- drush upwd admin $DRUPAL_ADMIN_PW
   1543 composer exec -- drush en taler_turnstile
   1544 composer exec -- drush config:set taler_turnstile.settings access_token "$UMAMI_TOK" --yes
   1545 composer exec -- drush config:set taler_turnstile.settings payment_backend_url "$PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/umami/" --yes
   1546 composer exec -- drush config:set --input-format=yaml taler_turnstile.settings enabled_content_types '["article", "recipe"]' --yes
   1547 
   1548 snip=$(cat <<'EOF' | sed "s/@CURRENCY@/$CURRENCY/"
   1549 $storage = \Drupal::entityTypeManager()->getStorage('taler_turnstile_price_category');
   1550 $e = $storage->create(['id'=>"normal", 'label'=>'Normal', 'description' => "Normal Article Price", 'prices' => ['%none%' => ['@CURRENCY@' => '0.3']]]);
   1551 try {
   1552   $e->save();
   1553 } catch (Exception $ex) {
   1554   echo $ex->getMessage();
   1555   echo "\n";
   1556 }
   1557 EOF
   1558 )
   1559 composer exec -- drush php:eval "$snip"
   1560 
   1561 snip=$(cat <<'EOF'
   1562 $prcat_storage = \Drupal::entityTypeManager()->getStorage('taler_turnstile_price_category');
   1563 $node_storage = \Drupal::entityTypeManager()->getStorage('node');
   1564 $prcat = $prcat_storage->load('normal');
   1565 $nodes = $node_storage->loadByProperties(['type'=> ['article', 'recipe']]);
   1566 foreach ($nodes as $k => $node) {
   1567   echo 'updating node ' . $k . "\n";
   1568   if (!$node->hasField('field_taler_turnstile_prcat')) {
   1569     echo 'prcat missing' . "\n";
   1570     continue;
   1571   }
   1572   $node->set('field_taler_turnstile_prcat', $prcat);
   1573   $node->save();
   1574 }
   1575 EOF
   1576 )
   1577 composer exec -- drush php:eval "$snip"
   1578 
   1579 composer exec -- drush cr
   1580 
   1581 fi
   1582 
   1583 cd /
   1584 
   1585 write_sandcastle_status
   1586 
   1587 # FIXME: Maybe do some taler-wallet-cli test?
   1588 # FIXME: How do we report errors occurring during the setup script?
	sandcastle-ng Scripts for the deployment of Sandcastle (GNU Taler)
	Log \| Files \| Refs \| README