Make the gp-server setup wizard grin-wallet-faithful about the two secrets
that belong to the operator, and let them decide how the till restarts.
- Wallet password: the wizard now PROMPTS for it (entered twice, confirmed to
match, hidden echo on a TTY) instead of auto-generating it. Only the service
secrets (API token, admin token, webhook secret) are still generated.
- Seed: a fresh 24-word seed is shown once and gated behind an explicit
"wrote it down" acknowledgement before proceeding, like grin-wallet init; the
paste-existing-recovery-phrase path is kept and gated the same way.
- Restart mode: the wizard offers both and defaults to unattended. Unattended
seals the chosen password to the host as a 0400 systemd credential so the
service auto-restarts (honest trade-off disclosed). Manual persists nothing
and writes a gp-server.service.d/manual.conf drop-in that repoints the
credential to a tmpfs path the operator populates via systemd-ask-password at
each start.
- Pure helpers (validate_password, passwords_match, RestartMode/parse, parse_ack,
render_manual_dropin, mode-aware render_env) unit-tested in gp-core; wizard
flow tested in gp-server (fresh/paste, unattended/manual, mismatch reprompt).
- Reconfigure keeps an existing wallet's seed, password, and restart mode
untouched (never re-prompts), so a running till is undisturbed.
- Updated deploy/gp-server.service, deploy/.env.example, README, and the
WooCommerce/Medusa quickstarts to drop all auto-generated-password wording.
- README: a Setup (recommended path) section leading with `gp-server setup`;
the env-var table reframed as the advanced/manual path. Deploy section notes
the plugin zip script.
- docs/woocommerce-quickstart.md, docs/medusa-quickstart.md: four-step operator
quick starts (install, run setup, paste the three values, test a payment).
Medusa notes its webhook route differs from the WooCommerce default.
- docs/api-integration.md: the direct-integration path (the way magick.market
integrates) - create-invoice, GET /invoice/{id}, bearer auth, and the
payment.confirmed webhook payload + HMAC signature + retry semantics, with
the base-units vs display-string amount distinction called out honestly.
2ro