setup-sandcastle.sh (39483B)
1 #!/usr/bin/env bash 2 3 # This scripts provisions all configuration and 4 # services for the Taler sandcastle container. 5 # 6 # Important: This script needs to be completely 7 # idempotent, nothing must break if it is executed 8 # multiple times. 9 10 set -eu 11 set -x 12 export LC_ALL="C.UTF-8" 13 14 if [[ -n ${SANDCASTLE_SKIP_SETUP:-} ]]; then 15 echo "skipping sandcastle setup, requested by environment var SANDCASTLE_SKIP_SETUP" 16 exit 1 17 fi 18 19 20 # Helper to replace a comment-delimited block of lines in a config file with 21 # the desired content. If the block doesn't exist yet, append it. 22 update_config_block() { 23 local config_file="$1" 24 local marker_tag="$2" 25 local new_content="$3" 26 local begin_marker="# begin ${marker_tag}" 27 local end_marker="# end ${marker_tag}" 28 if [[ ! -f "$config_file" ]]; then 29 echo "Error: Config file '$config_file' not found." >&2 30 return 1 31 fi 32 if grep -qF "$begin_marker" "$config_file"; then 33 # Markers exist. Replace the block. 34 # Escape newlines in the content so sed processes it as a single block 35 local escaped_content="${new_content//$'\n'/\\n}" 36 sed -i "/$begin_marker/,/$end_marker/c\\$begin_marker\n$escaped_content\n$end_marker" "$config_file" 37 else 38 # Markers do not exist. Append to the end. 39 printf "\n%s\n%s\n%s\n" "$begin_marker" "$new_content" "$end_marker" >> "$config_file" 40 fi 41 } 42 43 echo "Provisioning sandcastle" 44 45 # General configuration. 46 # Might eventually be moved to an external file. 47 48 # Source any overrides from external file 49 if [[ -e /overrides ]]; then 50 source /overrides 51 fi 52 53 # When serving on an external port (for localhost deployments), 54 # we use http. 55 if [[ ${EXTERNAL_PORT:-} =~ ^[0-9]+$ ]]; then 56 PROTO=http 57 PORT_SUFFIX=:$EXTERNAL_PORT 58 else 59 PROTO=https 60 PORT_SUFFIX= 61 fi 62 63 : ${CURRENCY:="KUDOS"} 64 : ${WIRE_METHOD:=x-taler-bank} 65 66 67 if [[ $WIRE_METHOD = iban ]]; then 68 EXCHANGE_IBAN=DE159593 69 EXCHANGE_PAYTO="payto://iban/$EXCHANGE_IBAN?receiver-name=Sandcastle+Echange+Inc" 70 71 # Randomly generated IBANs for the merchants 72 MERCHANT_IBAN_ADMIN=DE85500105175178585583 73 MERCHANT_IBAN_POS=DE4218710 74 MERCHANT_IBAN_BLOG=DE8292195 75 MERCHANT_IBAN_GNUNET=DE9709960 76 MERCHANT_IBAN_TALER=DE1740597 77 MERCHANT_IBAN_TOR=DE2648777 78 MERCHANT_IBAN_SANDBOX=DE949115029592 79 MERCHANT_IBAN_UMAMI=DE358841382499 80 81 MERCHANT_PAYTO_ADMIN="payto://iban/$MERCHANT_IBAN_ADMIN?receiver-name=Default+Merchant" 82 MERCHANT_PAYTO_POS="payto://iban/$MERCHANT_IBAN_POS?receiver-name=PoS+Merchant" 83 MERCHANT_PAYTO_BLOG="payto://iban/$MERCHANT_IBAN_BLOG?receiver-name=Blog+Merchant" 84 MERCHANT_PAYTO_GNUNET="payto://iban/$MERCHANT_IBAN_GNUNET?receiver-name=GNUnet+Merchant" 85 MERCHANT_PAYTO_TALER="payto://iban/$MERCHANT_IBAN_TALER?receiver-name=Taler+Merchant" 86 MERCHANT_PAYTO_TOR="payto://iban/$MERCHANT_IBAN_TOR?receiver-name=Tor+Merchant" 87 MERCHANT_PAYTO_UMAMI="payto://iban/$MERCHANT_IBAN_UMAMI?receiver-name=Umami" 88 MERCHANT_PAYTO_SANDBOX="payto://iban/$MERCHANT_IBAN_SANDBOX?receiver-name=Sandbox+Merchant" 89 elif [[ $WIRE_METHOD = x-taler-bank ]]; then 90 XTBHOST=sandcastle 91 EXCHANGE_PAYTO="payto://x-taler-bank/$XTBHOST/exchange?receiver-name=Sandcastle+Echange+Inc" 92 MERCHANT_PAYTO_ADMIN="payto://x-taler-bank/$XTBHOST/merchant-admin?receiver-name=Default+Merchant" 93 MERCHANT_PAYTO_POS="payto://x-taler-bank/$XTBHOST/merchant-pos?receiver-name=PoS+Merchant" 94 MERCHANT_PAYTO_BLOG="payto://x-taler-bank/$XTBHOST/merchant-blog?receiver-name=Blog+Merchant" 95 MERCHANT_PAYTO_GNUNET="payto://x-taler-bank/$XTBHOST/merchant-gnunet?receiver-name=GNUnet+Merchant" 96 MERCHANT_PAYTO_TALER="payto://x-taler-bank/$XTBHOST/merchant-taler?receiver-name=Taler+Merchant" 97 MERCHANT_PAYTO_TOR="payto://x-taler-bank/$XTBHOST/merchant-tor?receiver-name=Tor+Merchant" 98 MERCHANT_PAYTO_UMAMI="payto://x-taler-bank/$XTBHOST/merchant-umami?receiver-name=Umami" 99 MERCHANT_PAYTO_SANDBOX="payto://x-taler-bank/$XTBHOST/merchant-sandbox?receiver-name=Sandbox+Merchant" 100 else 101 echo "wire method $WIRE_METHOD not supported" 102 exit 1 103 fi 104 105 MYDOMAIN=${MYDOMAIN:="demo.taler.net"} 106 LANDING_DOMAIN=$MYDOMAIN 107 BANK_DOMAIN=bank.$MYDOMAIN 108 EXCHANGE_DOMAIN=exchange.$MYDOMAIN 109 MERCHANT_DOMAIN=backend.$MYDOMAIN 110 DONAU_DOMAIN=donau.$MYDOMAIN 111 BLOG_DOMAIN=shop.$MYDOMAIN 112 DONATIONS_DOMAIN=donations.$MYDOMAIN 113 DRUPAL_DOMAIN=drupal.$MYDOMAIN 114 CHALLENGER_DOMAIN=challenger.$MYDOMAIN 115 AUDITOR_DOMAIN=auditor.$MYDOMAIN 116 117 # Ports of the services running inside the container. 118 # Should be synchronized with the sandcastle-run script. 119 PORT_INTERNAL_EXCHANGE=8201 120 PORT_INTERNAL_MERCHANT=8301 121 PORT_INTERNAL_LIBEUFIN_BANK=8080 122 PORT_INTERNAL_LANDING=8501 123 PORT_INTERNAL_BLOG=8502 124 PORT_INTERNAL_DONATIONS=8503 125 PORT_INTERNAL_PROVISION=8504 126 PORT_INTERNAL_BANK_SPA=8505 127 PORT_INTERNAL_CHALLENGER=8506 128 PORT_INTERNAL_AUDITOR=8507 129 PORT_INTERNAL_DONAU=8508 130 PORT_INTERNAL_DRUPAL=8509 131 132 133 ENABLE_AUDITOR=0 134 135 # Just make sure the services are stopped 136 systemctl stop postgresql.service 137 systemctl stop taler-auditor.target 138 systemctl stop taler-exchange.target 139 systemctl stop taler-exchange-offline.timer 140 systemctl stop taler-merchant-httpd.service 141 systemctl stop taler-merchant.target 142 systemctl stop taler-demo-landing.service 143 systemctl stop taler-demo-blog.service 144 systemctl stop taler-demo-donations.service 145 systemctl stop libeufin-bank.service 146 systemctl stop donau-httpd.service 147 148 # libeufin-nexus is not used 149 systemctl stop libeufin-nexus-ebics-fetch.service 150 systemctl disable libeufin-nexus-ebics-fetch.service 151 systemctl stop libeufin-nexus-ebics-submit.service 152 systemctl disable libeufin-nexus-ebics-submit.service 153 154 systemctl reset-failed 155 156 # We now make sure that some important locations are symlinked to 157 # the persistent storage volume. 158 # Files that already exist in this location are moved to the storage volume 159 # and then symlinked. 160 # These locations are: 161 # /etc/taler 162 # /etc/libeufin 163 # /var/lib/taler 164 # postgres DB directory 165 166 function lift_dir() { 167 where=$1 168 src=$2 169 target=$3 170 if [[ -L $src ]]; then 171 # be idempotent 172 echo "$src is already a symlink" 173 elif [[ -d /$where/$target ]]; then 174 echo "symlinking existing /$where/$target" 175 rm -rf "$src" 176 ln -s "/$where/$target" "$src" 177 else 178 echo "symlinking new /$where/$target" 179 mv "$src" "/$where/$target" 180 ln -s "/$where/$target" "$src" 181 fi 182 } 183 184 lift_dir talerdata /var/lib/taler-exchange var-lib-taler-exchange 185 lift_dir talerdata /etc/taler-merchant etc-taler-merchant 186 lift_dir talerdata /etc/taler-exchange etc-taler-exchange 187 lift_dir talerdata /etc/taler-exchange etc-taler-auditor 188 lift_dir talerdata /etc/donau etc-donau 189 lift_dir talerdata /etc/libeufin etc-libeufin 190 # lift both config and data 191 lift_dir talerdata /etc/postgresql etc-postgresql 192 lift_dir talerdata /var/lib/postgresql var-lib-postgresql 193 # offline keys are in a separate volume 194 lift_dir talerdata_persistent /var/lib/taler-exchange/offline exchange-offline 195 196 # Usage: get_credential_pw COMPONENT/ACCOUNT 197 function get_credential_pw() { 198 if [[ ${USE_INSECURE_SANDBOX_PASSWORDS:-0} = 1 ]]; then 199 echo "sandbox" 200 return 201 fi 202 p=/credentials/$1 203 if [[ ! -f $p ]]; then 204 mkdir -p $(dirname "$p") 205 uuidgen -r >$p 206 fi 207 cat "$p" 208 } 209 210 import_instr=none 211 if [[ -d /exported && -e /exported/import-request ]]; then 212 import_instr=$(cat /exported/import-request) 213 fi 214 215 # If necessary, import the offline key. 216 # Done before everything else, as we need the key 217 # to generate the config. 218 219 if [[ $import_instr = all ]]; then 220 echo "Importing exchange offline key" 221 rm -rf /var/lib/taler-exchange/offline/* 222 cp -r /exported/taler-exchange/offline/* /var/lib/taler-exchange/offline/ 223 fi 224 225 # Adjust ownership. 226 # Necessary when the container is rebuilt with different user IDs. 227 chown --recursive taler-exchange-offline:taler-exchange-offline /var/lib/taler-exchange/offline/. || true 228 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf 229 chown taler-exchange-wire:root /etc/taler-exchange/secrets/exchange-accountcredentials-*.conf 230 chown taler-merchant-httpd:root /etc/taler-merchant/secrets/merchant-db.secret.conf 231 chown root:donau-db /etc/donau/secrets/donau-db.secret.conf 232 233 234 MASTER_PUBLIC_KEY=$(sudo -i -u taler-exchange-offline taler-exchange-offline -LDEBUG setup) 235 236 237 # 238 # Create the basic configuration files 239 # 240 241 mkdir -p /etc/challenger/conf.d 242 cat <<EOF >/etc/challenger/conf.d/setup-sandcastle.conf 243 [challenger] 244 BASE_URL = $PROTO://$CHALLENGER_DOMAIN$PORT_SUFFIX/ 245 ADDRESS_TYPE = email 246 AUTH_COMMAND = /data/sandcastle-challenger-auth 247 ADDRESS_RESTRICTIONS = {"email":{"hint":"not an e-mail address","regex":"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+$"}} 248 EOF 249 250 cat <<EOF >/etc/libeufin/libeufin-bank.conf 251 [libeufin-bank] 252 BASE_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/ 253 CURRENCY = $CURRENCY 254 DEFAULT_DEBT_LIMIT = $CURRENCY:500 255 REGISTRATION_BONUS = $CURRENCY:100 256 SPA_CAPTCHA_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/webui/#/operation/{woid} 257 SUGGESTED_WITHDRAWAL_EXCHANGE = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/ 258 ALLOW_REGISTRATION = yes 259 SERVE = tcp 260 PORT = 8080 261 # Bind address. 262 # Option soon to be deprecated! 263 ADDRESS = 0.0.0.0 264 WIRE_TYPE = $WIRE_METHOD 265 266 # Compat mode for now 267 PWD_CHECK = no 268 PWD_AUTH_COMPAT = yes 269 270 [currency-$CURRENCY] 271 ENABLED = YES 272 name = "${NAME:=Kudos}" 273 code = "$CURRENCY" 274 decimal_separator = "." 275 fractional_input_digits = ${FRACTIONALS:=2} 276 fractional_normal_digits = ${FRACTIONALS:=2} 277 fractional_trailing_zero_digits = ${FRACTIONALS:=2} 278 is_currency_name_leading = NO 279 alt_unit_names = {"0":"${ALT_UNIT_NAME:=ク}"} 280 EOF 281 282 cat <<EOF >/etc/libeufin/settings.json 283 { 284 "topNavSites": { 285 "Landing": "$PROTO://$LANDING_DOMAIN$PORT_SUFFIX/", 286 "Bank": "$PROTO://$BANK_DOMAIN$PORT_SUFFIX", 287 "Essay Shop": "$PROTO://$BLOG_DOMAIN$PORT_SUFFIX", 288 "Donations": "$PROTO://$DONATIONS_DOMAIN$PORT_SUFFIX", 289 } 290 } 291 EOF 292 293 # Generate /tmp/sandcastle-setup.conf 294 cat <<EOF >/tmp/sandcastle-setup.conf 295 [currency-$CURRENCY] 296 ENABLED = YES 297 name = "${NAME:=Kudos}" 298 code = "$CURRENCY" 299 decimal_separator = "." 300 fractional_input_digits = ${FRACTIONALS:=2} 301 fractional_normal_digits = ${FRACTIONALS:=2} 302 fractional_trailing_zero_digits = ${FRACTIONALS:=2} 303 is_currency_name_leading = NO 304 alt_unit_names = {"0":"${ALT_UNIT_NAME:=ク}"} 305 EOF 306 307 cp /tmp/sandcastle-setup.conf /etc/taler-exchange/conf.d/sandcastle-setup.conf 308 cp /tmp/sandcastle-setup.conf /etc/taler-merchant/conf.d/sandcastle-setup.conf 309 310 311 cat <<EOF >/etc/taler-exchange/conf.d/sandcastle-exchange.conf 312 [exchange] 313 CURRENCY = $CURRENCY 314 CURRENCY_ROUND_UNIT = $CURRENCY:0.01 315 AML_THRESHOLD = $CURRENCY:1000000 316 MASTER_PUBLIC_KEY = $MASTER_PUBLIC_KEY 317 BASE_URL = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/ 318 319 [taler-exchange-secmod-rsa] 320 LOOKAHEAD_SIGN = 4 weeks 321 322 [taler-exchange-secmod-eddsa] 323 LOOKAHEAD_SIGN = 4 weeks 324 325 [taler-exchange-secmod-cs] 326 LOOKAHEAD_SIGN = 4 weeks 327 328 [exchange-account-default] 329 PAYTO_URI = $EXCHANGE_PAYTO 330 ENABLE_DEBIT = YES 331 ENABLE_CREDIT = YES 332 @inline-secret@ exchange-accountcredentials-default ../secrets/exchange-accountcredentials-default.secret.conf 333 EOF 334 335 336 cat <<EOF >/etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf 337 [exchange-accountcredentials-default] 338 WIRE_GATEWAY_URL = $PROTO://$BANK_DOMAIN$PORT_SUFFIX/accounts/exchange/taler-wire-gateway/ 339 WIRE_GATEWAY_AUTH_METHOD = basic 340 USERNAME = exchange 341 PASSWORD = $(get_credential_pw bank/exchange) 342 EOF 343 344 if [[ $ENABLE_AUDITOR = 1 ]]; then 345 # Make sandcastle exchange config available to auditor 346 cp /etc/taler-exchange/conf.d/sandcastle-exchange.conf /etc/taler-auditor/conf.d/sandcastle-exchange.conf 347 348 # We run the offline tooling as root, maybe in the future there should be 349 # a separate user created by the Debian package for that. 350 AUDITOR_PUB=$(taler-auditor-offline setup) 351 352 cat <<EOF >/etc/taler-auditor/conf.d/sandcastle-auditor.conf 353 [auditor] 354 PUBLIC_KEY = $AUDITOR_PUB 355 356 [exchangedb] 357 358 $(dup_exchange_opt exchangedb IDLE_RESERVE_EXPIRATION_TIME) 359 $(dup_exchange_opt exchangedb LEGAL_RESERVE_EXPIRATION_TIME) 360 $(dup_exchange_opt exchangedb AGGREGATOR_SHIFT) 361 $(dup_exchange_opt exchangedb DEFAULT_PURSE_LIMIT) 362 363 [exchangedb-postgres] 364 $(dup_exchange_opt exchangedb-postgres CONFIG) 365 366 [exchange] 367 $(dup_exchange_opt exchange CURRENCY) 368 $(dup_exchange_opt exchange CURRENCY_ROUND_UNIT) 369 $(dup_exchange_opt exchange DB) 370 371 372 EOF 373 fi 374 375 # The config shipped with the package can conflict with the 376 # trusted sandcastle exchange if the currency is KUDOS. 377 rm -f /usr/share/taler-exchange/config.d/kudos.conf 378 rm -f /usr/share/taler-merchant/config.d/kudos.conf 379 380 381 MY_HELPER_EMAIL=${OVERRIDE_MERCHANT_HELPER_EMAIL:-/data/sandcastle-merchant-email-helper} 382 383 # By default, use standalone SPA 384 MERCHANT_SPA_SETTING= 385 if [[ ${STANDALONE_MERCHANT_SPA:-1} == 1 ]]; then 386 MERCHANT_SPA_SETTING="BACKOFFICE_SPA_DIR = /usr/local/share/taler-merchant-backoffice/" 387 fi 388 389 # We need to define the default currency for the UI. 390 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant.conf 391 [merchant] 392 CURRENCY = $CURRENCY 393 394 ENABLE_SELF_PROVISIONING = YES 395 396 MANDATORY_TAN_CHANNELS = email 397 398 HELPER_EMAIL = $MY_HELPER_EMAIL 399 400 $MERCHANT_SPA_SETTING 401 402 EOF 403 404 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant-exchanges.conf 405 [merchant-exchange-sandcastle] 406 EXCHANGE_BASE_URL = $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/ 407 MASTER_KEY = $MASTER_PUBLIC_KEY 408 CURRENCY = $CURRENCY 409 EOF 410 411 # Allow overrides to modify merchant config 412 [[ $(type -t hook_merchant_config) == function ]] && hook_merchant_config 413 414 # FIXME: This is a workaround, fix the packaging of taler-merchant-frontends here! 415 mkdir -p /etc/taler 416 417 418 cat <<EOF >/etc/taler/taler-merchant-frontends.conf 419 # Different entry point, we need to repeat some settings. 420 # In the future, taler-merchant-demos should become 421 # robust enough to read from the main config. 422 [taler] 423 CURRENCY = $CURRENCY 424 425 [frontend-demo-landing] 426 SERVE = http 427 HTTP_PORT = $PORT_INTERNAL_LANDING 428 429 [frontend-demo-blog] 430 SERVE = http 431 HTTP_PORT = $PORT_INTERNAL_BLOG 432 BACKEND_URL = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/blog/ 433 BACKEND_APIKEY = secret-token:$(get_credential_pw merchant/blog) 434 435 [frontend-demo-donations] 436 DONAU_URL = $PROTO://$DONAU_DOMAIN$PORT_SUFFIX/ 437 SERVE = http 438 HTTP_PORT = $PORT_INTERNAL_DONATIONS 439 BACKEND_URL_TOR = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/tor/ 440 BACKEND_APIKEY_TOR = secret-token:$(get_credential_pw merchant/tor) 441 BACKEND_URL_TALER = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/taler/ 442 BACKEND_APIKEY_TALER = secret-token:$(get_credential_pw merchant/taler) 443 BACKEND_URL_GNUNET = $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/gnunet/ 444 BACKEND_APIKEY_GNUNET = secret-token:$(get_credential_pw merchant/gnunet) 445 EOF 446 447 # This really should not exist, the taler-merchant-frontends 448 # should be easier to configure! 449 cat <<EOF >/etc/taler/taler-merchant-frontends.env 450 TALER_ENV_URL_INTRO=$PROTO://$LANDING_DOMAIN$PORT_SUFFIX/ 451 TALER_ENV_URL_LANDING=$PROTO://$LANDING_DOMAIN$PORT_SUFFIX/ 452 TALER_ENV_URL_BANK=$PROTO://$BANK_DOMAIN$PORT_SUFFIX/ 453 TALER_ENV_URL_MERCHANT_BLOG=$PROTO://$BLOG_DOMAIN$PORT_SUFFIX/ 454 TALER_ENV_URL_MERCHANT_DONATIONS=$PROTO://$DONATIONS_DOMAIN$PORT_SUFFIX/ 455 EOF 456 457 # 458 # Create databases 459 # 460 461 function wait_pg_ready() { 462 while true; do 463 ret=0 464 pg_isready || ret=$? 465 case "$ret" in 466 0) 467 echo "Postgres is ready" >&2 468 break 469 ;; 470 1|2) 471 echo "pg_isready returned status $ret, waiting" >&2 472 sleep 1 473 ;; 474 3) 475 echo "pg_isready returned status $ret, giving up" >&2 476 exit 3 477 ;; 478 esac 479 done 480 } 481 482 # Since the sandcastle is a test system, we turn fsync off for performance 483 # reasons (especially with the drupal setup). 484 # CAUTION: You do not want to set this in production, 485 # especially not for the taler-exchange. 486 pg_conftool 17 main set fsync off 487 488 backup_file=/exported/postgres-backup.sql 489 if [[ $import_instr = singledump ]]; then 490 echo "Importing database dump" 491 if [[ ! -e "$backup_file" ]]; then 492 echo "Requested import, but backup file does not exist" >&2 493 exit 1 494 fi 495 pg_dropcluster --stop 17 main || true 496 pg_createcluster 17 main 497 systemctl start postgresql.service 498 wait_pg_ready 499 sudo -u postgres psql postgres -f "$backup_file" 500 else 501 systemctl start postgresql.service 502 wait_pg_ready 503 fi 504 505 # Set up databases. 506 # Do that *before* we potentially do a per-service restore-from-backup. 507 508 challenger-dbconfig 509 510 # Sets up the database for both libeufin-bank and libeufin-nexus. We only need 511 # the libeufin-bank DB though. 512 libeufin-dbconfig 513 514 if [[ $ENABLE_AUDITOR = 1 ]]; then 515 # Add auditor user to DB group *before* running taler-exchange-dbconfig, 516 # so that DB permissions are adjusted accordingly. 517 usermod taler-auditor-httpd -aG taler-exchange-db 518 taler-auditor-dbconfig 519 fi 520 521 taler-exchange-dbconfig 522 523 taler-merchant-dbconfig 524 525 526 # 527 # Import backup if necessary. 528 # 529 530 if [[ $import_instr = all ]]; then 531 echo "Importing databases" 532 533 # FIXME: Consider backing up old DB before importing new one 534 # FIXME: This is rather hacky, it would be better to use "pg_dump -Fc" and "pg_restore" 535 sudo -u postgres dropdb taler-exchange 536 sudo -u postgres dropdb taler-merchant 537 sudo -u postgres dropdb libeufin 538 539 sudo -u postgres createdb taler-exchange 540 sudo -u postgres createdb taler-merchant 541 sudo -u postgres createdb libeufin 542 543 sudo -u postgres psql taler-exchange -f /exported/taler-exchange/taler-exchange.sql 544 sudo -u postgres psql taler-merchant -f /exported/taler-merchant/taler-merchant.sql 545 sudo -u postgres psql libeufin -f /exported/libeufin/libeufin.sql 546 547 libeufin-dbconfig 548 taler-exchange-dbconfig 549 taler-merchant-dbconfig 550 551 rm -rf /var/lib/taler-exchange/secmod-eddsa/* 552 cp -r /exported/taler-exchange/secmod-eddsa/* /var/lib/taler-exchange/secmod-eddsa/ 553 554 rm -rf /var/lib/taler-exchange/secmod-rsa/* 555 cp -r /exported/taler-exchange/secmod-rsa/* /var/lib/taler-exchange/secmod-rsa/ 556 557 rm -rf /var/lib/taler-exchange/secmod-cs/* 558 cp -r /exported/taler-exchange/secmod-cs/* /var/lib/taler-exchange/secmod-cs/ 559 fi 560 561 if [[ $import_instr != none ]]; then 562 echo "Marking import as done" 563 rm /exported/import-request 564 fi 565 566 # We need to adjust file ownership, as the container might have different user and group 567 # IDs than the volume. That can happen when the packages in the container are installed 568 # in a different order. 569 # This is only relevant for non-root ownership. 570 chown --recursive taler-exchange-offline:taler-exchange-offline /var/lib/taler-exchange/offline/* || true 571 chown --recursive taler-exchange-secmod-cs:taler-exchange-secmod /var/lib/taler-exchange/secmod-cs 572 chown --recursive taler-exchange-secmod-rsa:taler-exchange-secmod /var/lib/taler-exchange/secmod-rsa 573 chown --recursive taler-exchange-secmod-eddsa:taler-exchange-secmod /var/lib/taler-exchange/secmod-eddsa 574 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf 575 chown root:taler-auditor-httpd /etc/taler-auditor/secrets/auditor-db.secret.conf 576 chmod 440 /etc/taler-merchant/secrets/merchant-db.secret.conf 577 chown taler-merchant-httpd:root /etc/taler-merchant/secrets/merchant-db.secret.conf 578 chown root:taler-exchange-db /etc/taler-exchange/secrets/exchange-db.secret.conf 579 chown taler-exchange-wire:taler-exchange-db /etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf 580 581 582 # Caddy configuration. 583 # We use the caddy reverse proxy with automatic 584 # internal TLS setup to ensure that the services are 585 # reachable inside the container without any external 586 # DNS setup under the same domain name and with TLS 587 # from inside the container. 588 589 systemctl stop caddy.service 590 591 cat <<EOF >/etc/caddy/Caddyfile 592 { 593 servers { 594 trusted_proxies static private_ranges 595 } 596 } 597 598 # Services that only listen on unix domain sockets 599 # are reverse-proxied to serve on a TCP port. 600 601 :$PORT_INTERNAL_EXCHANGE { 602 reverse_proxy unix//run/taler-exchange/httpd/exchange-http.sock 603 } 604 605 :$PORT_INTERNAL_MERCHANT { 606 reverse_proxy unix//run/taler-merchant/httpd/merchant-http.sock { 607 # Set this, or otherwise wrong taler://pay URIs will be generated. 608 header_up X-Forwarded-Proto "https" 609 } 610 } 611 612 :$PORT_INTERNAL_DONAU { 613 reverse_proxy unix//run/donau/httpd/http.sock { 614 header_up X-Forwarded-Proto "https" 615 } 616 } 617 618 :$PORT_INTERNAL_BANK_SPA { 619 root * /usr/share/libeufin/spa 620 root /settings.json /etc/libeufin/ 621 file_server 622 } 623 624 :$PORT_INTERNAL_DRUPAL { 625 root * /talerdata/sandcastle-drupal/web/ 626 php_fastcgi unix/var/run/php/php8.4-fpm.sock 627 file_server 628 } 629 630 :$PORT_INTERNAL_AUDITOR { 631 reverse_proxy unix//run/taler-auditor/httpd/auditor-http.sock 632 } 633 634 :$PORT_INTERNAL_CHALLENGER { 635 handle { 636 reverse_proxy unix//run/challenger/httpd/challenger.http { 637 # Set this, or otherwise wrong taler://pay URIs will be generated. 638 header_up X-Forwarded-Proto "https" 639 } 640 } 641 642 # Serve challenges via HTTP. 643 # This is obviously completely insecure, but fine 644 # for the demo sandcastle. 645 handle_path /challenges/* { 646 root * /tmp/challenges/ 647 file_server { 648 browse 649 } 650 } 651 } 652 EOF 653 654 if [[ $PROTO = https ]]; then 655 cat <<EOF >>/etc/caddy/Caddyfile 656 657 # Internally reverse-proxy https://, 658 # so that service can talk to each other via 659 # https:// inside the container. 660 661 https://$BANK_DOMAIN { 662 tls internal 663 reverse_proxy :8080 { 664 # libeufin-bank should eventually not require this anymore, 665 # but currently doesn't work without this header. 666 header_up X-Forwarded-Prefix "" 667 } 668 } 669 670 https://$EXCHANGE_DOMAIN { 671 tls internal 672 reverse_proxy unix//run/taler-exchange/httpd/exchange-http.sock 673 } 674 675 https://$MERCHANT_DOMAIN { 676 tls internal 677 reverse_proxy unix//run/taler-merchant/httpd/merchant-http.sock { 678 # Set this, or otherwise wrong taler://pay URIs will be generated. 679 header_up X-Forwarded-Proto "https" 680 } 681 } 682 683 https://$DONAU_DOMAIN { 684 tls internal 685 reverse_proxy unix//run/donau/httpd/http.sock { 686 header_up X-Forwarded-Proto "https" 687 } 688 } 689 690 https://$AUDITOR_DOMAIN { 691 tls internal 692 reverse_proxy unix//run/taler-auditor/httpd/auditor-http.sock 693 } 694 695 https://$CHALLENGER_DOMAIN { 696 tls internal 697 reverse_proxy unix//run/challenger/httpd/challenger.http 698 } 699 700 EOF 701 702 else 703 # Config for HTTP without TLS. 704 705 cat <<EOF >>/etc/caddy/Caddyfile 706 707 http://$BANK_DOMAIN$PORT_SUFFIX { 708 reverse_proxy :8080 { 709 # libeufin-bank should eventually not require this anymore, 710 # but currently doesn't work without this header. 711 header_up X-Forwarded-Prefix "" 712 } 713 } 714 715 http://$EXCHANGE_DOMAIN$PORT_SUFFIX { 716 reverse_proxy unix//run/taler-exchange/httpd/exchange-http.sock 717 } 718 719 http://$MERCHANT_DOMAIN$PORT_SUFFIX { 720 reverse_proxy unix//run/taler-merchant/httpd/merchant-http.sock 721 } 722 723 http://$DONAU_DOMAIN$PORT_SUFFIX { 724 reverse_proxy unix//run/donau/httpd/http.sock 725 } 726 727 http://$AUDITOR_DOMAIN$PORT_SUFFIX { 728 reverse_proxy unix//run/taler-auditor/httpd/auditor-http.sock 729 } 730 731 http://$CHALLENGER_DOMAIN$PORT_SUFFIX { 732 reverse_proxy unix//run/challenger/httpd/challenger.http 733 } 734 735 http://$LANDING_DOMAIN$PORT_SUFFIX { 736 reverse_proxy :$PORT_INTERNAL_LANDING 737 } 738 739 http://$BLOG_DOMAIN$PORT_SUFFIX { 740 reverse_proxy :$PORT_INTERNAL_BLOG 741 } 742 743 http://$DONATIONS_DOMAIN$PORT_SUFFIX { 744 reverse_proxy :$PORT_INTERNAL_DONATIONS 745 } 746 747 http://$DRUPAL_DOMAIN$PORT_SUFFIX { 748 reverse_proxy :$PORT_INTERNAL_DRUPAL 749 } 750 751 EOF 752 753 fi 754 755 cat <<EOF >>/etc/hosts 756 # Start of Taler Sandcastle Domains 757 127.0.0.1 $LANDING_DOMAIN 758 127.0.0.1 $BANK_DOMAIN 759 127.0.0.1 $EXCHANGE_DOMAIN 760 127.0.0.1 $MERCHANT_DOMAIN 761 127.0.0.1 $BLOG_DOMAIN 762 127.0.0.1 $DONATIONS_DOMAIN 763 127.0.0.1 $CHALLENGER_DOMAIN 764 127.0.0.1 $DRUPAL_DOMAIN 765 # End of Taler Sandcastle Domains 766 EOF 767 768 systemctl start caddy.service 769 770 # Install local, internal CA certs for caddy 771 caddy trust 772 773 # Set up challenger 774 775 CHALLENGER_CLIENT_SECRET=secret-token:sandbox 776 CHALLENGER_CLIENT_ID=$(sudo -u challenger-httpd challenger-admin -q --add="$CHALLENGER_CLIENT_SECRET" https://$EXCHANGE_DOMAIN/kyc-proof/mychallenger) 777 echo Challenger client ID: $CHALLENGER_CLIENT_ID 778 779 systemctl enable --now challenger-httpd.service 780 781 # Set up bank 782 783 sudo -i -u libeufin-bank libeufin-bank edit-account admin --debit_threshold=$CURRENCY:1000000 784 sudo -i -u libeufin-bank libeufin-bank passwd admin $(get_credential_pw bank/admin) 785 786 systemctl enable --now libeufin-bank.service 787 788 BANK_BASEURL=$PROTO://$BANK_DOMAIN$PORT_SUFFIX/ 789 790 taler-harness deployment wait-taler-service taler-corebank ${BANK_BASEURL}config 791 792 sudo -i -u libeufin-bank libeufin-bank passwd exchange $(get_credential_pw bank/exchange) || true 793 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 794 --login exchange --exchange --public \ 795 --payto $EXCHANGE_PAYTO \ 796 --name Exchange \ 797 --password $(get_credential_pw bank/exchange) 798 799 sudo -i -u libeufin-bank libeufin-bank passwd merchant-admin $(get_credential_pw bank/merchant-admin) || true 800 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 801 --login merchant-admin --public \ 802 --payto $MERCHANT_PAYTO_ADMIN \ 803 --name "Default Demo Merchant" \ 804 --password $(get_credential_pw bank/merchant-admin) 805 806 sudo -i -u libeufin-bank libeufin-bank passwd merchant-pos $(get_credential_pw bank/merchant-pos) || true 807 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 808 --login merchant-pos --public \ 809 --payto $MERCHANT_PAYTO_POS \ 810 --name "PoS Merchant" \ 811 --password $(get_credential_pw bank/merchant-pos) 812 813 sudo -i -u libeufin-bank libeufin-bank passwd merchant-blog $(get_credential_pw bank/merchant-blog) || true 814 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 815 --login merchant-blog --public \ 816 --payto $MERCHANT_PAYTO_BLOG \ 817 --name "Blog Merchant" \ 818 --password $(get_credential_pw bank/merchant-blog) 819 820 sudo -i -u libeufin-bank libeufin-bank passwd merchant-gnunet $(get_credential_pw bank/merchant-gnunet) || true 821 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 822 --login merchant-gnunet --public \ 823 --payto "$MERCHANT_PAYTO_GNUNET" \ 824 --name "GNUnet Donations Merchant" \ 825 --password $(get_credential_pw bank/merchant-gnunet) 826 827 sudo -i -u libeufin-bank libeufin-bank passwd merchant-taler $(get_credential_pw bank/merchant-taler) || true 828 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 829 --login merchant-taler --public \ 830 --payto "$MERCHANT_PAYTO_TALER" \ 831 --name "Taler Donations Merchant" \ 832 --password $(get_credential_pw bank/merchant-taler) 833 834 sudo -i -u libeufin-bank libeufin-bank passwd merchant-tor $(get_credential_pw bank/merchant-tor) || true 835 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 836 --login merchant-tor --public \ 837 --payto "$MERCHANT_PAYTO_TOR" \ 838 --name "Tor Donations Merchant" \ 839 --password $(get_credential_pw bank/merchant-tor) 840 841 sudo -i -u libeufin-bank libeufin-bank passwd merchant-umami $(get_credential_pw bank/merchant-umami) || true 842 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 843 --login merchant-umami --public \ 844 --payto "$MERCHANT_PAYTO_UMAMI" \ 845 --name "Umami Merchant" \ 846 --password $(get_credential_pw bank/merchant-umami) 847 848 # Special bank account without a secure password 849 sudo -i -u libeufin-bank libeufin-bank passwd merchant-sandbox sandbox || true 850 taler-harness deployment provision-bank-account "${BANK_BASEURL}" \ 851 --login merchant-sandbox --public \ 852 --payto "$MERCHANT_PAYTO_SANDBOX" \ 853 --name "Sandbox Merchant" \ 854 --password sandbox 855 856 # Set up exchange 857 858 ## 859 ## Configure KYC if enabled 860 ## 861 862 if [[ ${ENABLE_KYC:-0} = 1 ]]; then 863 # KYC config 864 if [[ ${KYC_DIALECT:-simple} = simple ]]; then 865 source /data/setup-kyc-simple.sh 866 elif [[ ${KYC_DIALECT:-simple} = tops ]]; then 867 source /data/setup-kyc-tops.sh 868 fi 869 else 870 rm -f /etc/taler-exchange/conf.d/sandcastle-kyc.conf 871 fi 872 873 874 if [[ ! -e /etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf ]]; then 875 # Only create if necessary, as each [COIN-...] section 876 # has a unique name with a timestamp. 877 taler-harness deployment gen-coin-config \ 878 --min-amount "${CURRENCY}:0.01" \ 879 --max-amount "${CURRENCY}:100" \ 880 --no-fees \ 881 >"/etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf" 882 else 883 # Exchange broke backwards compatibility, fix up existing config file. 884 sed -i 's/COIN-/COIN_/gI' "/etc/taler-exchange/conf.d/sandcastle-$CURRENCY-coins.conf" 885 fi 886 887 taler-terms-generator -i /usr/share/taler-exchange/terms/exchange-tos-v0 888 taler-terms-generator -i /usr/share/taler-exchange/terms/exchange-pp-v0 889 890 systemctl enable --now taler-exchange.target 891 892 taler-harness deployment wait-taler-service taler-exchange $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/config 893 taler-harness deployment wait-endpoint $PROTO://$EXCHANGE_DOMAIN$PORT_SUFFIX/management/keys 894 895 sudo -i -u taler-exchange-offline \ 896 taler-exchange-offline \ 897 -c /etc/taler-exchange/taler-exchange.conf \ 898 download \ 899 sign \ 900 upload 901 902 sudo -i -u taler-exchange-offline \ 903 taler-exchange-offline \ 904 enable-account "${EXCHANGE_PAYTO}" \ 905 wire-fee now "$WIRE_METHOD" "${CURRENCY}":0 "${CURRENCY}":0 \ 906 global-fee now "${CURRENCY}":0 "${CURRENCY}":0 "${CURRENCY}":0 1h 6a 0 \ 907 upload 908 909 systemctl enable --now taler-exchange-offline.timer 910 911 function dup_exchange_opt() { 912 echo "$2 = $(taler-exchange-config -c /etc/taler-exchange/taler-exchange.conf -s $1 -o $2)" 913 } 914 915 # 916 # Set up exchange auditor 917 # 918 919 if [[ $ENABLE_AUDITOR = 1 ]]; then 920 systemctl enable --now taler-auditor.target 921 fi 922 923 # Set up merchant backend 924 925 MERCHANT_BASEURL=$PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/ 926 927 cat <<EOF >/etc/taler-merchant/conf.d/sandcastle-merchant-terms.conf 928 [merchant] 929 TERMS_ETAG = merchant-tos-demo-v0 930 TERMS_DIR = \${TALER_DATA_HOME}terms/ 931 EOF 932 933 taler-terms-generator -i /usr/share/taler-merchant/terms/merchant-tos-demo-v0.en.rst -o "$(taler-merchant-config -f -s merchant -o terms_dir)" 934 935 systemctl enable --now taler-merchant.target 936 taler-harness deployment wait-taler-service taler-merchant ${MERCHANT_BASEURL}config 937 938 function reset_merchant_pw() { 939 pw=$(get_credential_pw merchant/$1) 940 sudo -u taler-merchant-httpd taler-merchant-passwd --instance "$1" "$pw" 941 if [[ $? -eq 2 ]]; then 942 echo "Instance $1 does not exist" >&2 943 return 2 944 fi 945 if [[ $? -ne 0 ]]; then 946 echo "Failed to reset password for merchant instance $1" >&2 947 exit 1 948 fi 949 } 950 951 # FIXME: Move this into a harness tool (that just reads a config file)? 952 953 instance_missing=no 954 reset_merchant_pw admin || instance_missing=yes 955 if [[ $instance_missing = yes ]]; then 956 taler-harness deployment provision-merchant-instance \ 957 ${MERCHANT_BASEURL} \ 958 --management-token "secret-token:none" \ 959 --instance-password $(get_credential_pw merchant/admin) \ 960 --name Merchant \ 961 --id admin \ 962 --payto "$MERCHANT_PAYTO_ADMIN" 963 fi 964 965 ADMIN_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL} admin --password $(get_credential_pw merchant/admin)) 966 967 instance_missing=no 968 reset_merchant_pw pos || instance_missing=yes 969 if [[ $instance_missing = yes ]]; then 970 taler-harness deployment provision-merchant-instance \ 971 ${MERCHANT_BASEURL} \ 972 --management-token $ADMIN_TOK \ 973 --instance-password $(get_credential_pw merchant/pos) \ 974 --name "POS Merchant" \ 975 --id pos \ 976 --payto "$MERCHANT_PAYTO_POS" 977 fi 978 979 instance_missing=no 980 reset_merchant_pw blog || instance_missing=yes 981 if [[ $instance_missing = yes ]]; then 982 taler-harness deployment provision-merchant-instance \ 983 ${MERCHANT_BASEURL} \ 984 --management-token $ADMIN_TOK \ 985 --instance-password $(get_credential_pw merchant/blog) \ 986 --name "Blog Merchant" \ 987 --id blog \ 988 --payto "$MERCHANT_PAYTO_BLOG" 989 fi 990 991 instance_missing=no 992 reset_merchant_pw gnunet || instance_missing=yes 993 if [[ $instance_missing = yes ]]; then 994 taler-harness deployment provision-merchant-instance \ 995 ${MERCHANT_BASEURL} \ 996 --management-token $ADMIN_TOK \ 997 --instance-password $(get_credential_pw merchant/gnunet) \ 998 --name "GNUnet Merchant" \ 999 --id gnunet \ 1000 --payto "$MERCHANT_PAYTO_GNUNET" 1001 fi 1002 1003 instance_missing=no 1004 reset_merchant_pw taler || instance_missing=yes 1005 if [[ $instance_missing = yes ]]; then 1006 taler-harness deployment provision-merchant-instance \ 1007 ${MERCHANT_BASEURL} \ 1008 --management-token $ADMIN_TOK \ 1009 --instance-password $(get_credential_pw merchant/taler) \ 1010 --name "Taler Merchant" \ 1011 --id taler \ 1012 --payto "$MERCHANT_PAYTO_TALER" 1013 fi 1014 1015 instance_missing=no 1016 reset_merchant_pw tor || instance_missing=yes 1017 if [[ $instance_missing = yes ]]; then 1018 taler-harness deployment provision-merchant-instance \ 1019 ${MERCHANT_BASEURL} \ 1020 --management-token $ADMIN_TOK \ 1021 --instance-password $(get_credential_pw merchant/tor) \ 1022 --name "Tor Merchant" \ 1023 --id tor \ 1024 --payto "$MERCHANT_PAYTO_TOR" 1025 fi 1026 1027 instance_missing=no 1028 reset_merchant_pw umami || instance_missing=yes 1029 if [[ $instance_missing = yes ]]; then 1030 taler-harness deployment provision-merchant-instance \ 1031 ${MERCHANT_BASEURL} \ 1032 --management-token $ADMIN_TOK \ 1033 --instance-password $(get_credential_pw merchant/umami) \ 1034 --name "Umami Merchant" \ 1035 --id umami \ 1036 --payto "$MERCHANT_PAYTO_UMAMI" 1037 fi 1038 1039 # Special instance with fixed "sandbox" password 1040 sudo -u taler-merchant-httpd taler-merchant-passwd --instance sandbox sandbox || true 1041 taler-harness deployment provision-merchant-instance \ 1042 ${MERCHANT_BASEURL} \ 1043 --management-token $ADMIN_TOK \ 1044 --instance-password sandbox \ 1045 --name "sandbox merchant" \ 1046 --id sandbox \ 1047 --payto "$MERCHANT_PAYTO_SANDBOX" 1048 1049 # token families needed by demo blog 1050 1051 langs=(de en ar zh fr hi it ja ko pt pt_BR ru es sv tr uk) 1052 valid_before_ts=$(date -u +%s -d '+1 year') # one year later 1053 duration_us=$((30 * 24 * 60 * 60 * 1000000)) # 30 days 1054 validity_granularity_us=$((24 * 60 * 60 * 1000000)) # 1 day 1055 1056 # FIXME: Move this into a harness tool? 1057 for lang in "${langs[@]}"; do 1058 curl -X POST "${MERCHANT_BASEURL}instances/blog/private/tokenfamilies" \ 1059 -H "Authorization: Bearer secret-token:$(get_credential_pw merchant/blog)" \ 1060 -H "Content-Type: application/json" \ 1061 --data-raw "{ 1062 \"kind\": \"subscription\", 1063 \"slug\": \"blog_abo_${lang}\", 1064 \"name\": \"One month of access (${lang})\", 1065 \"description\": \"One month of access (${lang})\", 1066 \"description_i18n\": { 1067 \"de\": \"Ein monat lang Zugang zu den Artikeln\", 1068 \"en\": \"One month of access to articles\", 1069 \"fr\": \"Un mois d'accès aux articles\", 1070 \"es\": \"Un mes de acceso a los artículos\" 1071 }, 1072 \"valid_before\": { \"t_s\": ${valid_before_ts} }, 1073 \"duration\": { \"d_us\": ${duration_us} }, 1074 \"validity_granularity\": { \"d_us\": ${validity_granularity_us} } 1075 }" 1076 done 1077 1078 1079 1080 # Set up Donau 1081 1082 cat <<EOF >/etc/donau/conf.d/sandcastle.conf 1083 [donau] 1084 CURRENCY = $CURRENCY 1085 LEGAL_DOMAIN = Gnuland 1086 EXPIRE_LEGAL_YEARS = 3 1087 # We don't do the token yet, as the merchant doesn't support 1088 # authenticating with donau. 1089 # ADMIN_BEARER_TOKEN = secret-token:secret 1090 EOF 1091 1092 donau-dbconfig 1093 1094 if [[ ! -e /etc/donau/conf.d/sandcastle-$CURRENCY-units.conf ]]; then 1095 # Only create if necessary 1096 taler-harness deployment gen-doco-config \ 1097 --min-amount "${CURRENCY}:0.01" \ 1098 --max-amount "${CURRENCY}:100" \ 1099 >"/etc/donau/conf.d/sandcastle-$CURRENCY-units.conf" 1100 fi 1101 1102 systemctl enable --now donau.target 1103 1104 DONAU_BASE_URL=$PROTO://$DONAU_DOMAIN$PORT_SUFFIX/ 1105 1106 taler-harness deployment wait-taler-service donau ${DONAU_BASE_URL}config 1107 1108 1109 GNUNET_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/gnunet/ gnunet --password $(get_credential_pw merchant/gnunet)) 1110 taler-harness deployment provision-merchant-donau \ 1111 --merchant-auth-token $GNUNET_TOK \ 1112 --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/gnunet/ \ 1113 --donau-base-url $DONAU_BASE_URL \ 1114 --donau-auth-token secret-token:secret \ 1115 --currency $CURRENCY 1116 1117 TALER_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/taler/ taler --password $(get_credential_pw merchant/taler)) 1118 taler-harness deployment provision-merchant-donau \ 1119 --merchant-auth-token $TALER_TOK \ 1120 --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/taler/ \ 1121 --donau-base-url $DONAU_BASE_URL \ 1122 --donau-auth-token secret-token:secret \ 1123 --currency $CURRENCY 1124 1125 TOR_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/tor/ tor --password $(get_credential_pw merchant/tor)) 1126 taler-harness deployment provision-merchant-donau \ 1127 --merchant-auth-token $TOR_TOK \ 1128 --merchant-base-url $PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/tor/ \ 1129 --donau-base-url $DONAU_BASE_URL \ 1130 --donau-auth-token secret-token:secret \ 1131 --currency $CURRENCY 1132 1133 UMAMI_TOK=$(taler-harness merchant token ${MERCHANT_BASEURL}instances/umami/ umami --password $(get_credential_pw merchant/umami)) 1134 1135 # Now we set up the taler-merchant-demos 1136 1137 systemctl enable --now taler-demo-landing 1138 systemctl enable --now taler-demo-blog 1139 systemctl enable --now taler-demo-donations 1140 1141 # Turnstile (drupal/php) 1142 1143 1144 systemctl enable --now php8.4-fpm 1145 1146 DRUPAL_DB_PW=$(get_credential_pw db/drupal) 1147 DRUPAL_ADMIN_PW=$(get_credential_pw drupal/admin) 1148 1149 sudo -i -u postgres psql postgres -c "CREATE ROLE drupal WITH login;" || true 1150 sudo -i -u postgres psql postgres -c "ALTER ROLE drupal password '$DRUPAL_DB_PW';" 1151 sudo -u postgres createdb drupal --owner=drupal || true 1152 1153 # Needed by PHP's composer 1154 export HOME=/root 1155 1156 # FIXME: Would probably be better to checkout output of 1157 # drush status --fields=bootstrap --format=string 1158 1159 cd /talerdata/ 1160 if [[ ! -e /talerdata/sandcastle-drupal ]]; then 1161 composer create-project drupal/recommended-project:^10 sandcastle-drupal 1162 cd /talerdata/sandcastle-drupal 1163 composer require drush/drush 1164 # This can take a ridiculous amount of time! 1165 COMPOSER_PROCESS_TIMEOUT=0 composer exec -- drush site-install demo_umami --account-name=admin --account-pass=$DRUPAL_ADMIN_PW --account-mail=admin@localhost --db-url=pgsql://drupal:$DRUPAL_DB_PW@localhost/drupal --site-name=SandcastleUmami --yes 1166 fi 1167 1168 chown -R www-data:www-data /talerdata/sandcastle-drupal/ 1169 1170 ln -sf /opt/turnstile /talerdata/sandcastle-drupal/web/modules/taler_turnstile 1171 1172 snip=$(cat <<'EOF' 1173 $settings['reverse_proxy'] = TRUE; 1174 $settings['reverse_proxy_addresses'] = ['127.0.0.1', '10.0.0.0/8']; 1175 $settings['trusted_host_patterns'] = ['.*']; 1176 EOF 1177 ) 1178 1179 update_config_block /talerdata/sandcastle-drupal/web/sites/default/settings.php SANDCASTLE "$snip" 1180 1181 cd /talerdata/sandcastle-drupal 1182 composer exec -- drush upwd admin $DRUPAL_ADMIN_PW 1183 composer exec -- drush en taler_turnstile 1184 composer exec -- drush config:set taler_turnstile.settings access_token "$UMAMI_TOK" --yes 1185 composer exec -- drush config:set taler_turnstile.settings payment_backend_url "$PROTO://$MERCHANT_DOMAIN$PORT_SUFFIX/instances/umami/" --yes 1186 composer exec -- drush config:set --input-format=yaml taler_turnstile.settings enabled_content_types '["article", "recipe"]' --yes 1187 1188 snip=$(cat <<'EOF' | sed "s/@CURRENCY@/$CURRENCY/" 1189 $storage = \Drupal::entityTypeManager()->getStorage('taler_turnstile_price_category'); 1190 $e = $storage->create(['id'=>"normal", 'label'=>'Normal', 'description' => "Normal Article Price", 'prices' => ['%none%' => ['@CURRENCY@' => '0.3']]]); 1191 try { 1192 $e->save(); 1193 } catch (Exception $ex) { 1194 echo $ex->getMessage(); 1195 echo "\n"; 1196 } 1197 EOF 1198 ) 1199 composer exec -- drush php:eval "$snip" 1200 1201 snip=$(cat <<'EOF' 1202 $prcat_storage = \Drupal::entityTypeManager()->getStorage('taler_turnstile_price_category'); 1203 $node_storage = \Drupal::entityTypeManager()->getStorage('node'); 1204 $prcat = $prcat_storage->load('normal'); 1205 $nodes = $node_storage->loadByProperties(['type'=> ['article', 'recipe']]); 1206 foreach ($nodes as $k => $node) { 1207 echo 'updating node ' . $k . "\n"; 1208 if (!$node->hasField('field_taler_turnstile_prcat')) { 1209 echo 'prcat missing' . "\n"; 1210 continue; 1211 } 1212 $node->set('field_taler_turnstile_prcat', $prcat); 1213 $node->save(); 1214 } 1215 EOF 1216 ) 1217 composer exec -- drush php:eval "$snip" 1218 1219 composer exec -- drush cr 1220 1221 cd / 1222 1223 # FIXME: Maybe do some taler-wallet-cli test? 1224 # FIXME: How do we report errors occurring during the setup script?