commit 2f9e597398dc78519401c365051415b3217d2f5b
parent f7e666a023a6c4fb05fe29ce8d6e7b64588923d0
Author: Florian Dold <dold@taler.net>
Date: Thu, 3 Sep 2026 00:00:04 +0200
regional-currency-ng: add service landing page
Diffstat:
7 files changed, 149 insertions(+), 10 deletions(-)
diff --git a/regional-currency-ng/ChangeLog b/regional-currency-ng/ChangeLog
@@ -1,4 +1,7 @@
Wed Sep 2 2026
+ Added an optional, default-enabled landing page on the deployment's
+ main domain with links to the bank, merchant backend, and exchange.
+
Updated the regional-currency role for the current trixie-testing
LibEuFin WebUI settings and packaged exchange legal documents.
diff --git a/regional-currency-ng/README.md b/regional-currency-ng/README.md
@@ -14,6 +14,7 @@ managed host must:
- run a supported Debian or Ubuntu release with PostgreSQL 15 or newer;
- be reachable over SSH by a user that can become root;
- have `bank.DOMAIN`, `exchange.DOMAIN`, and `backend.DOMAIN` resolve to it;
+- have `DOMAIN` resolve to it when the landing page is enabled (the default);
- allow inbound HTTP and, when TLS is enabled, HTTPS traffic.
Create an inventory
@@ -116,10 +117,16 @@ After deployment
The services are available at:
+- `https://DOMAIN/` (or HTTP when TLS is disabled), with links to the services;
- `https://bank.DOMAIN/` (or HTTP when TLS is disabled);
- `https://exchange.DOMAIN/`;
- `https://backend.DOMAIN/`.
+The landing page is enabled by default. Set
+`regional_currency_enable_landing_page: false` in the target inventory to
+remove its static files and bare-domain nginx virtual host. The service
+subdomains remain available.
+
When fiat conversion is enabled, complete the LibEuFin Nexus EBICS enrollment
with the bank while `regional_currency_enable_nexus_services` remains `false`.
Then set it to `true` in that host's inventory and run the playbook again. The
diff --git a/regional-currency-ng/inventory-wizard.py b/regional-currency-ng/inventory-wizard.py
@@ -264,9 +264,15 @@ def collect_configuration(
{
"regional_currency_currency": currency,
"regional_currency_domain": ask(
- "Base domain (bank.*, exchange.* and backend.* must resolve)",
+ "Base domain for the service hosts and optional landing page",
string_value(variables.get("regional_currency_domain")),
),
+ "regional_currency_enable_landing_page": ask_yes_no(
+ "Configure a landing page on the base domain",
+ bool_value(
+ variables.get("regional_currency_enable_landing_page"), True
+ ),
+ ),
"regional_currency_bank_name": ask(
"Human-readable bank name",
string_value(
diff --git a/regional-currency-ng/roles/regional_currency/defaults/main.yml b/regional-currency-ng/roles/regional_currency/defaults/main.yml
@@ -4,6 +4,7 @@ regional_currency_domain: ""
regional_currency_bank_name: Taler Bank
regional_currency_bank_admin_password: ""
regional_currency_bank_port: 8080
+regional_currency_enable_landing_page: true
regional_currency_testing_deployment: false
regional_currency_enable_conversion: false
regional_currency_fiat_currency: CHF
diff --git a/regional-currency-ng/roles/regional_currency/tasks/nginx.yml b/regional-currency-ng/roles/regional_currency/tasks/nginx.yml
@@ -4,10 +4,48 @@
path: "/etc/letsencrypt/live/backend.{{ regional_currency_domain }}/fullchain.pem"
register: regional_currency_tls_certificate
+- name: Check whether the TLS certificate covers the main domain
+ ansible.builtin.command:
+ argv:
+ - openssl
+ - x509
+ - -noout
+ - -checkhost
+ - "{{ regional_currency_domain }}"
+ - -in
+ - >-
+ /etc/letsencrypt/live/backend.{{ regional_currency_domain
+ }}/fullchain.pem
+ register: regional_currency_tls_certificate_covers_domain
+ changed_when: false
+ failed_when: false
+ when:
+ - regional_currency_enable_tls
+ - regional_currency_enable_landing_page
+ - regional_currency_tls_certificate.stat.exists
+
- name: Select the initial nginx protocol
ansible.builtin.set_fact:
regional_currency_nginx_tls_active: "{{ regional_currency_enable_tls and regional_currency_tls_certificate.stat.exists }}"
+- name: Create the regional-currency landing page directory
+ ansible.builtin.file:
+ path: /var/www/regional-currency
+ state: directory
+ owner: root
+ group: root
+ mode: "0755"
+ when: regional_currency_enable_landing_page
+
+- name: Install the regional-currency landing page
+ ansible.builtin.template:
+ src: landing-page.html.j2
+ dest: /var/www/regional-currency/index.html
+ owner: root
+ group: root
+ mode: "0644"
+ when: regional_currency_enable_landing_page
+
- name: Install LibEuFin bank rate-limit zones
ansible.builtin.template:
src: nginx-rate-limits.conf.j2
@@ -37,6 +75,8 @@
- backend
- bank
- exchange
+ - landing
+ when: item != "landing" or regional_currency_enable_landing_page
notify: Reload nginx
- name: Enable nginx virtual hosts
@@ -48,8 +88,26 @@
- backend
- bank
- exchange
+ - landing
+ when: item != "landing" or regional_currency_enable_landing_page
+ notify: Reload nginx
+
+- name: Disable the regional-currency landing page virtual host
+ ansible.builtin.file:
+ path: "{{ item }}"
+ state: absent
+ loop:
+ - "/etc/nginx/sites-enabled/landing.{{ regional_currency_domain }}"
+ - "/etc/nginx/sites-available/landing.{{ regional_currency_domain }}"
+ when: not regional_currency_enable_landing_page
notify: Reload nginx
+- name: Remove the disabled regional-currency landing page
+ ansible.builtin.file:
+ path: /var/www/regional-currency
+ state: absent
+ when: not regional_currency_enable_landing_page
+
- name: Enable and start nginx
ansible.builtin.service:
name: nginx
@@ -71,14 +129,34 @@
- "{{ regional_currency_tls_email }}"
- --cert-name
- "backend.{{ regional_currency_domain }}"
- - --domain
- - "backend.{{ regional_currency_domain }}"
- - --domain
- - "bank.{{ regional_currency_domain }}"
- - --domain
- - "exchange.{{ regional_currency_domain }}"
- creates: "/etc/letsencrypt/live/backend.{{ regional_currency_domain }}/fullchain.pem"
- when: regional_currency_enable_tls
+ - --expand
+ - --domains
+ - >-
+ {{
+ (
+ [
+ 'backend.' ~ regional_currency_domain,
+ 'bank.' ~ regional_currency_domain,
+ 'exchange.' ~ regional_currency_domain
+ ]
+ + (
+ [regional_currency_domain]
+ if regional_currency_enable_landing_page
+ else []
+ )
+ ) | join(',')
+ }}
+ changed_when: true
+ when:
+ - regional_currency_enable_tls
+ - >-
+ not regional_currency_tls_certificate.stat.exists
+ or (
+ regional_currency_enable_landing_page
+ and (
+ regional_currency_tls_certificate_covers_domain.rc | default(1)
+ ) != 0
+ )
- name: Enable TLS in nginx configuration
ansible.builtin.set_fact:
@@ -96,7 +174,10 @@
- backend
- bank
- exchange
- when: regional_currency_enable_tls
+ - landing
+ when:
+ - regional_currency_enable_tls
+ - item != "landing" or regional_currency_enable_landing_page
notify: Reload nginx
- name: Validate nginx configuration
diff --git a/regional-currency-ng/roles/regional_currency/templates/landing-page.html.j2 b/regional-currency-ng/roles/regional_currency/templates/landing-page.html.j2
@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+<head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <title>{{ regional_currency_currency }} regional currency</title>
+</head>
+<body>
+ <h1>{{ regional_currency_currency }} regional currency</h1>
+ <nav aria-label="Regional currency services">
+ <a href="{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/">Bank</a>
+ <a href="{{ regional_currency_protocol }}://backend.{{ regional_currency_domain }}/">Merchant</a>
+ <a href="{{ regional_currency_protocol }}://exchange.{{ regional_currency_domain }}/">Exchange</a>
+ </nav>
+</body>
+</html>
diff --git a/regional-currency-ng/roles/regional_currency/templates/nginx-landing.conf.j2 b/regional-currency-ng/roles/regional_currency/templates/nginx-landing.conf.j2
@@ -0,0 +1,25 @@
+{% if regional_currency_nginx_tls_active %}
+server {
+ listen 80;
+ listen [::]:80;
+ server_name {{ regional_currency_domain }};
+ return 308 https://$host$request_uri;
+}
+{% endif %}
+server {
+ listen {{ '443 ssl' if regional_currency_nginx_tls_active else '80' }};
+ listen [::]:{{ '443 ssl' if regional_currency_nginx_tls_active else '80' }};
+ server_name {{ regional_currency_domain }};
+{% if regional_currency_nginx_tls_active %}
+ ssl_certificate /etc/letsencrypt/live/backend.{{ regional_currency_domain }}/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/backend.{{ regional_currency_domain }}/privkey.pem;
+ include /etc/letsencrypt/options-ssl-nginx.conf;
+ ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+{% endif %}
+ root /var/www/regional-currency;
+ index index.html;
+
+ location / {
+ try_files $uri $uri/ =404;
+ }
+}
