Topic: [ANN] Open Source Webshop receiving payments with integrated Electrum wallet (Read 3036 times)

Not to mention their entire site (correct me if I'm wrong) is in Ruby / JavaScript for server-side programming.

That's right, Coinbase offers a ruby wrapper gem for their API (Bitcoin-central will do the same whith their new soon-to-be-released API).
My webshop uses only Pavol Rusnak's bitcoin-addrgen gem so it is entirely stand alone and does not rely on any third party.

Seems interesting.

Loving the combination of Rails + Bitcoin lately, Coinbase does it justice.

I developped microbitcoin.net in RoR (Rails 3) starting from Dave Thomas awesome tutorial "Agile Web Development in Rails".
It shows a bitcoin cart/checkout (allowing other payment methods) with email notification, bitcoin uri qrcode, pdf invoice download etc..
A new bitcoin address is generated for each transaction.
The app comes with full admin capability to create and update a product catalog.
I integrated a deterministic bitcoin wallet so that the shopkeeper can use a regular electrum wallet to watch payments while the customer-facing web server is not holding any private key.
The seed of the electrum wallet can be safely kept offline.
The app knows only the master public key of the wallet to generate bitcoin addresses: this is the safest option for a webshop accepting bitcoin payments.
I do not consider myself a coder ( I do not do code for Paymium) so there is still significant room for refactoring and improvements in the TO DO list on the github page.

Main features:

Product catalog with full admin capabilities: create products with pictures, update prices, etc.. Prices are set in bitcoin and shippig costs are set in fiat currency (e.g. euros). Amounts are displayed both in fiat currency and bitcoins.
Two-step check out: shipping details form, invoice. No sign up is required.
Bitcoin invoice: a new bitcoin address is generated for each invoice, using an electrum wallet master public key. This feature uses Pavol Rusnak's 'bitcoin-addrgen' gem.
PDF invoice: a pdf invoice is generated and can be downloaded by the customer at the time of order. If payment in bitcoin was selected, the pdf includes the bitcoin uri qrcode.
email notifications upon order and payment received (using blockchain.info API).
Photo gallery carousel
Javascript cart in side bar
Sidebar navigation with custom css (no bootstrap).
Static pages: FAQ, Shipping conditions, etc
Locale switch (flags)
No third party service is called except blockchain.info for payment receive notifications and bitcoincharts for current exchange rate. Default rate can be set in config file.

Usage

Download and install your electrum wallet application from electrum.org Install Rails 3 (upgrade to Rails 4 is on the TO DO list) Install postgreSQL database

$ git clone https://github.com/pierrenoizat/webshop.git

$ bundle install

Edit config/application.rb file to enter your own electrum wallet master public key (export master public key from your electrum wallet) as $MPK global variable.

Edit user.rb to change "wibble" by any random string of your choice in Digest::SHA2.hexdigest(password + "wibble" + salt)

Edit config/environments/development.rb and production.rb to enter your own gmail password.

Comment out the following line if you want to have emails delivered in development: config.actionmailer.performdeliveries = false

Edit db/seeds.rb to enter your admin user name and password for the postgreSQL database in user = User.create(:name => "Pierre", :password => "password", :password_confirmation => "password")

$ rake db:setup

$ rails server

Visit http://localhost:3000, start browsing the catalog and shopping.. Fork the code to go after the TO DO features.


More on preventing man-in-the-middle attacks

Publish the master public key on several social networks and key servers: this will allow your customers to check that the address belongs to you before paying your invoice (see bitcoinrad.io for details).
This is not a requirement but its a sure and simple way to mitigate the risk of a man-in-the-middle attack on your bitcoin payment addresses.
Knowing your master public key will allow also the taxman and your competitors to track your bitcoin revenues but this is the price to pay for ultimate security.
Bear in mind that your bitcoin sales are probably only a fraction of your sales since you offer several payment options.
If you are not comfortable with this level of transparency, then the audit server (see TO DO list) keeps your bitcoin sales figures private while achieving ultimate security at the cost of an additionnal server.

Thanks and Credits

Matej Danter, David Heinemeier Hansson, Sam Ruby, Pavol Rusnak, Chris Savery, Dave Thomas