PHI/aitrade

Fork 0

Files

T

kaedwen ea141eb012

Build and Push Docker Image / build-and-push (push) Failing after 1m41s

Details

initial

2026-07-02 20:09:44 +02:00

15 KiB

Raw Permalink Blame History

Interactive Brokers Gateway Setup

Übersicht

Keine API Keys nötig! IB Gateway verwendet direkte TCP-Verbindung, keine OAuth oder Tokens.

Authentifizierung

✅ IB Account Login (Username + Password)
✅ 2FA über IB Key App (Smartphone)
✅ Socket Connection von aitrade zum Gateway

1. IB Account erstellen

Paper Trading Account (Empfohlen für Tests)

https://www.interactivebrokers.com/en/trading/free-trial.php

Vorteile:

✅ Kostenlos
✅ Virtuelles Geld ($1M default)
✅ Echte Marktdaten
✅ Alle Features verfügbar

Live Trading Account

https://www.interactivebrokers.com/en/trading/open-account.php

Voraussetzungen:

Mindesteinlage (variiert nach Region)
Identitätsprüfung
W-8BEN/W-9 Formular (US-Steuern)

2. IB Gateway Setup mit Podman + Quadlet

Systemd Service mit Quadlet

Quadlet ist in Podman 4.4+ integriert und generiert automatisch systemd Services aus .container Files.

Datei: ~/.config/containers/systemd/ib-gateway.container

[Unit]
Description=Interactive Brokers Gateway (Paper Trading)
After=network-online.target
Wants=network-online.target

[Container]
Image=ghcr.io/unusualcode/ib-gateway-docker:latest
ContainerName=ib-gateway
AutoUpdate=registry

# Environment Variables
Environment=TWS_USERID=your_ib_username
Environment=TWS_PASSWORD=your_ib_password
Environment=TRADING_MODE=paper
Environment=VNC_PASSWORD=your_vnc_password
Environment=READ_ONLY_API=no
Environment=TWOFA_TIMEOUT_ACTION=restart

# Ports
PublishPort=4001:4001
PublishPort=5900:5900
PublishPort=6080:6080

# Volumes
Volume=ib-gateway-settings.volume:/root/Jts:Z

# Restart Policy
Restart=unless-stopped

# Health Check
HealthCmd=/usr/bin/nc -z localhost 4001
HealthInterval=30s
HealthTimeout=10s
HealthRetries=3

[Service]
# Restart delay after failure
RestartSec=30
# Kill timeout
TimeoutStopSec=70

[Install]
WantedBy=default.target

Wichtig: Ersetze your_ib_username und your_ib_password mit deinen IB Credentials!

Volume für persistente Settings

Datei: ~/.config/containers/systemd/ib-gateway-settings.volume

[Volume]

Das war's! Quadlet managed das Volume automatisch.

Service aktivieren & starten

# Systemd User Services neu laden
systemctl --user daemon-reload

# Service aktivieren (auto-start)
systemctl --user enable ib-gateway.service

# Service starten
systemctl --user start ib-gateway.service

# Status prüfen
systemctl --user status ib-gateway.service

# Logs ansehen
journalctl --user -u ib-gateway.service -f

# Service stoppen
systemctl --user stop ib-gateway.service

Podman Auto-Update aktivieren

Quadlet unterstützt automatische Image-Updates:

# Enable auto-update timer (täglich um 7 Uhr)
systemctl --user enable --now podman-auto-update.timer

# Manueller Update-Check
podman auto-update

# Timer Status
systemctl --user status podman-auto-update.timer

Mit AutoUpdate=registry im .container File updated Podman das IB Gateway Image automatisch.

3. VNC Zugriff (GUI)

IB Gateway ist eine Java GUI - VNC ermöglicht Remote-Zugriff:

Option A: VNC Client (Port 5900)

# Linux
vncviewer localhost:5900

# macOS
open vnc://localhost:5900

# Windows
# TightVNC oder RealVNC installieren

VNC Password: Wie in VNC_PASSWORD Environment Variable gesetzt

Option B: Browser (Port 6080)

# noVNC Web Interface
http://localhost:6080

Vorteil: Kein VNC Client nötig, funktioniert überall

4. IB Gateway Konfiguration

Nach dem ersten Start über VNC/noVNC:

API Settings aktivieren

Login mit IB Username + Password + 2FA
Configure → Settings → API → Settings
- ✅ Enable ActiveX and Socket Clients
- ✅ Read-Only API: No (für Trading)
- ✅ Socket Port: 4001 (Paper) oder 4002 (Paper TWS)
- ✅ Create API message log file: Optional für Debugging
Configure → Settings → API → Precautions
- ❌ Bypass Order Precautions for API orders (für Auto-Trading!)
Configure → Settings → API → Trusted IPs
- Add: 127.0.0.1
- Optional: Docker Bridge IP (meist 172.17.0.1)
Configure → Settings → Lock and Exit
- ✅ Auto restart: Yes
- ✅ Auto logoff time: 23:50 (vor Market Close)

2FA Setup

IB Key App installieren:

Activation:

IB Website → Secure Login System → IB Key
Scan QR Code mit IB Key App
Bei Gateway Login: App öffnen + Bestätigen

Auto-Restart bei 2FA Timeout:

TWOFA_TIMEOUT_ACTION=restart in .container File
Gateway startet neu wenn 2FA länger als 3 Min nicht bestätigt

5. aitrade mit Podman IB Gateway verbinden

Docker Compose anpassen

Datei: /projects/Private/aitrade/docker-compose.yaml

services:
  aitrade:
    # ... existing config
    environment:
      # IB Gateway Connection
      IB_GATEWAY_HOST: host.docker.internal
      IB_GATEWAY_PORT: "4001"
      IB_CLIENT_ID: "1"
    
    extra_hosts:
      - "host.docker.internal:host-gateway"

Wichtig: host.docker.internal funktioniert mit Docker Desktop und Podman automatisch.

Podman Quadlet für aitrade

Datei: ~/.config/containers/systemd/aitrade.container

[Unit]
Description=AI Trading Application
After=ib-gateway.service
Requires=ib-gateway.service

[Container]
Image=localhost/aitrade:local
ContainerName=aitrade
AutoUpdate=local

# Environment
Environment=IB_GATEWAY_HOST=10.88.0.1
Environment=IB_GATEWAY_PORT=4001
Environment=TRADING_STRATEGY=normal
Environment=DRY_RUN=true
Environment=TRADING_ENABLED=false

# Ports
PublishPort=8080:8080

# Volumes
Volume=aitrade-data.volume:/app/data:Z

# Network: Share with IB Gateway
Network=container:ib-gateway

# Restart
Restart=unless-stopped

[Service]
RestartSec=10

[Install]
WantedBy=default.target

Network Trick: Network=container:ib-gateway teilt den Network Stack - aitrade kann localhost:4001 verwenden!

Alternative: Podman Pod (beide Container im gleichen Pod):

Datei: ~/.config/containers/systemd/trading.pod

[Unit]
Description=Trading Pod (IB Gateway + aitrade)

[Pod]

[Install]
WantedBy=default.target

Datei: ~/.config/containers/systemd/ib-gateway.container

[Container]
# ... existing config
Pod=trading.pod

Datei: ~/.config/containers/systemd/aitrade.container

[Container]
# ... existing config
Pod=trading.pod
Environment=IB_GATEWAY_HOST=localhost

6. Connection Ports

Mode	Application	Port
Paper Trading	IB Gateway	`4001`
Paper Trading	TWS	`7497`
Live Trading	IB Gateway	`4001`
Live Trading	TWS	`7496`

Hinweis: Port 4001 für beides - Unterschied ist der Login (Paper vs Live Account)!

7. Testing & Troubleshooting

Gateway läuft?

# Podman Status
podman ps | grep ib-gateway

# Systemd Status
systemctl --user status ib-gateway.service

# TCP Port Check
nc -zv localhost 4001

# Logs
journalctl --user -u ib-gateway.service -n 50

aitrade Connection Test

# Start aitrade
cd /projects/Private/aitrade
docker-compose up -d

# Logs ansehen
docker-compose logs -f aitrade

# Erfolg:
# {"level":"INFO","msg":"connected to IB Gateway"}

# Fehler:
# {"level":"ERROR","msg":"failed to connect","error":"connection refused"}

Common Errors

Error: "Connection refused"

→ IB Gateway läuft nicht
→ Check: systemctl --user status ib-gateway.service
→ Check: nc -zv localhost 4001

Error: "Not connected after 30s"

→ Gateway läuft, aber API nicht enabled
→ Login via VNC: http://localhost:6080
→ Check: Configure → Settings → API → Enable Socket Clients

Error: "TWS Error 504: Not connected"

→ Gateway noch nicht eingeloggt
→ Check via VNC: http://localhost:6080
→ 2FA bestätigen in IB Key App

Error: "TWS Error 502: Couldn't connect to TWS"

→ Falscher Port
→ Paper: 4001, Live: 7496
→ Check config: IB_GATEWAY_PORT

VNC zeigt leeren Bildschirm

# Container neu starten
systemctl --user restart ib-gateway.service

# Logs prüfen
journalctl --user -u ib-gateway.service -n 100

# Java Prozess im Container prüfen
podman exec ib-gateway ps aux | grep java

2FA Timeout

# IB Key App öffnen und Login bestätigen
# Wenn zu spät → Container startet neu (TWOFA_TIMEOUT_ACTION=restart)

# Manueller Restart
systemctl --user restart ib-gateway.service

8. Production Setup

Secrets Management

Niemals Credentials ins Git committen!

Option A: systemd Credentials (Empfohlen)

# Credentials verschlüsselt speichern
systemd-creds encrypt --name=ib-username - ~/.config/ib-username.cred
# Eingabe: your_username

systemd-creds encrypt --name=ib-password - ~/.config/ib-password.cred
# Eingabe: your_password

Datei: ~/.config/containers/systemd/ib-gateway.container

[Container]
# ... existing config
# Entferne Environment= Zeilen für Credentials

[Service]
# Load encrypted credentials
LoadCredentialEncrypted=ib-username:%h/.config/ib-username.cred
LoadCredentialEncrypted=ib-password:%h/.config/ib-password.cred

# Set as environment variables
Environment=TWS_USERID=%d/ib-username
Environment=TWS_PASSWORD=%d/ib-password

Option B: Podman Secrets

# Secrets erstellen
echo "your_username" | podman secret create ib_username -
echo "your_password" | podman secret create ib_password -

# Secrets auflisten
podman secret ls

Datei: ~/.config/containers/systemd/ib-gateway.container

[Container]
# ... existing config
Secret=ib_username,type=env,target=TWS_USERID
Secret=ib_password,type=env,target=TWS_PASSWORD

Monitoring

Health Check Logs:

# Health Status
podman healthcheck run ib-gateway

# Health History
podman inspect ib-gateway --format='{{json .State.Health}}' | jq

Connection Monitoring Script:

Datei: /usr/local/bin/check-ib-gateway.sh

#!/bin/bash
set -euo pipefail

# Check TCP Port
if ! nc -z localhost 4001; then
    echo "IB Gateway port 4001 not reachable"
    exit 1
fi

# Check aitrade connection
if ! curl -sf http://localhost:8080/health > /dev/null; then
    echo "aitrade health check failed"
    exit 1
fi

echo "OK: IB Gateway and aitrade running"

Systemd Timer:

Datei: ~/.config/systemd/user/check-ib-gateway.service

[Unit]
Description=IB Gateway Health Check

[Service]
Type=oneshot
ExecStart=/usr/local/bin/check-ib-gateway.sh

Datei: ~/.config/systemd/user/check-ib-gateway.timer

[Unit]
Description=IB Gateway Health Check Timer

[Timer]
OnBootSec=5min
OnUnitActiveSec=5min

[Install]
WantedBy=timers.target

# Timer aktivieren
systemctl --user enable --now check-ib-gateway.timer

Backup der Gateway Settings

# Backup Volume
podman volume export ib-gateway-settings > ib-gateway-backup-$(date +%Y%m%d).tar

# Restore
podman volume import ib-gateway-settings < ib-gateway-backup-20260628.tar

9. Sicherheit

Firewall Rules

# Nur localhost darf auf IB Gateway zugreifen
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address="127.0.0.1" port port=4001 protocol=tcp accept'
sudo firewall-cmd --reload

# Oder mit iptables
sudo iptables -A INPUT -p tcp --dport 4001 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 4001 -j DROP

VNC nur lokal

# VNC Port nur auf localhost binden
# In .container File:
PublishPort=127.0.0.1:5900:5900
PublishPort=127.0.0.1:6080:6080

Security Best Practices

✅ 2FA aktiviert (IB Key App)
✅ Read-Only API für Testing (dann auf "no" für Trading)
✅ Trusted IPs beschränkt (nur 127.0.0.1)
✅ VNC Password gesetzt
✅ Credentials verschlüsselt (systemd-creds)
✅ Auto-Logout aktiviert (23:50 vor Market Close)
✅ DRY_RUN=true initial (Paper Trading)

10. Nützliche Commands

Podman Quadlet Management

# Alle User Services auflisten
systemctl --user list-units '*.service' | grep -E 'ib-gateway|aitrade'

# Service neu laden nach .container Änderungen
systemctl --user daemon-reload
systemctl --user restart ib-gateway.service

# Service disable (kein Auto-Start)
systemctl --user disable ib-gateway.service

# Logs seit Boot
journalctl --user -u ib-gateway.service -b

# Logs letzte Stunde
journalctl --user -u ib-gateway.service --since "1 hour ago"

Container Debugging

# Shell im Container
podman exec -it ib-gateway bash

# Java Prozesse
podman exec ib-gateway ps aux | grep java

# Port Bindings prüfen
podman port ib-gateway

# Volume Mountpoints
podman volume inspect ib-gateway-settings

# Resource Usage
podman stats ib-gateway

Quick Restart Workflow

# Alle Trading Services neu starten
systemctl --user restart ib-gateway.service aitrade.service

# Nur aitrade (nach Code-Change)
podman build -t localhost/aitrade:local .
systemctl --user restart aitrade.service

11. Zusammenfassung: Schnellstart

# 1. IB Paper Account erstellen
#    → https://www.interactivebrokers.com/en/trading/free-trial.php

# 2. IB Key App installieren (Smartphone)
#    → iOS/Android App Store

# 3. Quadlet Container File erstellen
mkdir -p ~/.config/containers/systemd
cat > ~/.config/containers/systemd/ib-gateway.container << 'EOF'
[Unit]
Description=Interactive Brokers Gateway (Paper Trading)

[Container]
Image=ghcr.io/unusualcode/ib-gateway-docker:latest
Environment=TWS_USERID=your_username
Environment=TWS_PASSWORD=your_password
Environment=TRADING_MODE=paper
Environment=VNC_PASSWORD=vnc123
PublishPort=4001:4001
PublishPort=6080:6080
Volume=ib-gateway-settings.volume:/root/Jts:Z
Restart=unless-stopped

[Install]
WantedBy=default.target
EOF

# 4. Volume erstellen
cat > ~/.config/containers/systemd/ib-gateway-settings.volume << 'EOF'
[Volume]
EOF

# 5. Service starten
systemctl --user daemon-reload
systemctl --user enable --now ib-gateway.service

# 6. VNC öffnen
firefox http://localhost:6080

# 7. API aktivieren (in VNC)
#    → Configure → Settings → API → Enable Socket Clients
#    → Port: 4001

# 8. aitrade starten
cd /projects/Private/aitrade
docker-compose up -d

# 9. Browser öffnen
firefox http://localhost:8080

# Fertig! 🚀

12. Links & Resources

IB Gateway Docker Image:

GitHub: https://github.com/UnusualAlpha/ib-gateway-docker
Registry: ghcr.io/unusualcode/ib-gateway-docker

Interactive Brokers:

Paper Trading: https://www.interactivebrokers.com/en/trading/free-trial.php
IB Key App: https://www.interactivebrokers.com/en/trading/ibkey.php
API Docs: https://interactivebrokers.github.io/tws-api/

Podman Quadlet:

aitrade:

README: /projects/Private/aitrade/README.md
Docker Guide: /projects/Private/aitrade/docs/DOCKER.md

15 KiB Raw Permalink Blame History

Interactive Brokers Gateway Setup

Übersicht

Authentifizierung

1. IB Account erstellen

Paper Trading Account (Empfohlen für Tests)

Live Trading Account

2. IB Gateway Setup mit Podman + Quadlet

Systemd Service mit Quadlet

Volume für persistente Settings

Service aktivieren & starten

Podman Auto-Update aktivieren

3. VNC Zugriff (GUI)

Option A: VNC Client (Port 5900)

Option B: Browser (Port 6080)

4. IB Gateway Konfiguration

API Settings aktivieren

2FA Setup

5. aitrade mit Podman IB Gateway verbinden

Docker Compose anpassen

Podman Quadlet für aitrade

6. Connection Ports

7. Testing & Troubleshooting

Gateway läuft?

aitrade Connection Test

Common Errors

VNC zeigt leeren Bildschirm

2FA Timeout

8. Production Setup

Secrets Management

Monitoring

Backup der Gateway Settings

9. Sicherheit

Firewall Rules

VNC nur lokal

Security Best Practices

10. Nützliche Commands

Podman Quadlet Management

Container Debugging

Quick Restart Workflow

11. Zusammenfassung: Schnellstart

12. Links & Resources

15 KiB

Raw Permalink Blame History