diff --git a/.gitignore b/.gitignore
index 9f39d9e..822d63a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@ __pycache__/
*~
.tmp/
scripts/taler-monitoring/settings.conf
+# Local e2e/overrides — never commit (use secrets.env.example as template)
+scripts/taler-monitoring/secrets.env
+scripts/taler-monitoring/secrets.env.local
diff --git a/scripts/taler-monitoring/README.md b/scripts/taler-monitoring/README.md
index 7a711d6..3bd5f6a 100644
--- a/scripts/taler-monitoring/README.md
+++ b/scripts/taler-monitoring/README.md
@@ -24,25 +24,45 @@ End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
## Secrets (local GOA e2e)
-`check_e2e.sh` loads bank/merchant passwords from **koopa-admin-secrets**
-(not this repo). Search order:
+**Do not commit passwords.** Canonical trees: `~/src/koopa/koopa-admin-log` +
+sibling `~/src/koopa/koopa-admin-secrets`.
-1. `SECRETS_ROOT` → `…/taler-bank/bank-admin-password.txt`
-2. `KOOPA_ADMIN_SECRETS` → `$KOOPA_ADMIN_SECRETS/koopa/host-root/…`
-3. Sibling of this checkout: `../koopa-admin-secrets/koopa/host-root`
-4. `$HOME/taler/src/koopa-admin-secrets/koopa/host-root` (common laptop layout)
-5. `$HOME/.config/taler-landing/bank-admin-password.txt`
-6. SSH koopa: `/root/bank-admin-password.txt` or podman bank container
-
-If you keep admin-log at `~/koopa-admin-log` but secrets under `~/taler/src/…`:
+### Local file (recommended on laptop)
```bash
-export SECRETS_ROOT="$HOME/taler/src/koopa-admin-secrets/koopa/host-root"
-# or: export KOOPA_ADMIN_SECRETS="$HOME/taler/src/koopa-admin-secrets"
+cd ~/src/koopa/koopa-admin-log/scripts/taler-monitoring
+cp secrets.env.example secrets.env # gitignored
+$EDITOR secrets.env
./taler-monitoring.sh e2e
```
-Or one-shot: `E2E_BANK_ADMIN_PASS=… E2E_MERCHANT_TOKEN=… ./taler-monitoring.sh e2e`
+See **[secrets.env.example](./secrets.env.example)** for every variable that
+may appear (admin pass, merchant token, SECRETS_ROOT, progress knobs).
+
+### Search order
+
+1. Already-exported env (`E2E_BANK_ADMIN_PASS`, …)
+2. `secrets.env` next to this suite (`MONITORING_SECRETS_ENV=` override)
+3. `SECRETS_ROOT` / `KOOPA_ADMIN_SECRETS` file tree
+4. Sibling `../koopa-admin-secrets/koopa/host-root`
+5. `$HOME/src/koopa/koopa-admin-secrets/koopa/host-root`
+6. `$HOME/.config/taler-landing/bank-admin-password.txt`
+7. SSH koopa `/root/…` or bank container
+
+### Line IDs + progress
+
+Each check prints **global** and **grouped** ids:
+
+```text
+┌ OK ┐ #014 www.exchange-03 exchange /config · HTTP 200
+┌ WARN ┐ #015 www.stats-02 stats age soft · yellow badge (not red)
+┌ PROG ┐ ████████░░░░ 42% 14/55
+```
+
+- `#014` — run-wide counter (whole `./taler-monitoring.sh` invocation)
+- `www.exchange-03` — area.group-NN
+- **WARN** badge = **yellow**; **ERROR** = **red** only
+- Progress: auto estimate per phase, or `PROGRESS_TOTAL=N` / `PROGRESS_OFF=1`
## Commands
diff --git a/scripts/taler-monitoring/TESTS.md b/scripts/taler-monitoring/TESTS.md
index 022de8b..b238c3c 100644
--- a/scripts/taler-monitoring/TESTS.md
+++ b/scripts/taler-monitoring/TESTS.md
@@ -1,13 +1,18 @@
# taler-monitoring — grouped test IDs
-Every check line is numbered **`area.group-NN`** (two-digit group counter):
+Every check line has a **global** run number and a **grouped** id:
```text
-┌ OK ┐ www.exchange-01 exchange /config · HTTP 200
-┌ ERROR ┐ e2e.pay-03 order create failed · HTTP 502
-┌ BLOCKER┐ e2e.prereq-02 merchant secret missing
+┌ OK ┐ #001 www.exchange-01 exchange /config · HTTP 200
+┌ WARN ┐ #002 www.stats-02 soft age · yellow (never red)
+┌ ERROR ┐ #003 e2e.pay-03 order create failed · HTTP 502
+┌ BLOCKER┐ #004 e2e.prereq-02 merchant secret missing
+┌ PROG ┐ ████░░░░ 25% 4/16
```
+- `#NNN` — monotonic for the whole monitoring run
+- `area.group-NN` — logical block (resets per group, continues if re-entered)
+
| Area | Phase script | Groups (examples) |
|------|--------------|-------------------|
| **www** | `check_urls.sh` | `exchange` `perf` `stats` `bank` `merchant` `paivana` `landing` |
diff --git a/scripts/taler-monitoring/lib.sh b/scripts/taler-monitoring/lib.sh
index 1ef6f9a..1e14fe3 100755
--- a/scripts/taler-monitoring/lib.sh
+++ b/scripts/taler-monitoring/lib.sh
@@ -404,13 +404,28 @@ TEST_AREA=""
TEST_GROUP=""
TEST_N=0
LAST_TID=""
-GLOBAL_N=0
+# Global / progress: may continue across check_*.sh processes via TALER_MON_STATE
+GLOBAL_N="${GLOBAL_N:-0}"
LAST_GLOBAL=""
-# Progress: set_progress_total N (0 = unknown → bar shows done only)
-PROGRESS_DONE=0
+PROGRESS_DONE="${PROGRESS_DONE:-0}"
PROGRESS_TOTAL="${PROGRESS_TOTAL:-0}"
PROGRESS_SHOW_EVERY="${PROGRESS_SHOW_EVERY:-8}"
-PROGRESS_LAST_SHOWN=0
+PROGRESS_LAST_SHOWN="${PROGRESS_LAST_SHOWN:-0}"
+_mon_state_load() {
+ [ -n "${TALER_MON_STATE:-}" ] && [ -f "${TALER_MON_STATE}" ] || return 0
+ # shellcheck disable=SC1090
+ . "${TALER_MON_STATE}"
+}
+_mon_state_save() {
+ [ -n "${TALER_MON_STATE:-}" ] || return 0
+ {
+ printf 'GLOBAL_N=%s\n' "$GLOBAL_N"
+ printf 'PROGRESS_DONE=%s\n' "$PROGRESS_DONE"
+ printf 'PROGRESS_TOTAL=%s\n' "$PROGRESS_TOTAL"
+ printf 'PROGRESS_LAST_SHOWN=%s\n' "$PROGRESS_LAST_SHOWN"
+ } >"${TALER_MON_STATE}"
+}
+_mon_state_load
# Per-group counters so re-entering www.exchange after perf continues NN
# (shell vars TEST_CNT__).
_tid_key() {
@@ -467,15 +482,20 @@ set_group() {
_progress_maybe_show 1
}
set_progress_total() {
- # Optional: expected number of numbered checks in this run (or remaining phase).
+ # Optional: expected number of numbered checks in this run.
# PROGRESS_TOTAL=0 → no percent, only "done=N".
- PROGRESS_TOTAL="${1:-0}"
- PROGRESS_DONE=0
- PROGRESS_LAST_SHOWN=0
+ # Does not reset GLOBAL_N / PROGRESS_DONE if already mid-run (state file).
+ local n="${1:-0}"
+ PROGRESS_TOTAL="$n"
+ if [ "${PROGRESS_DONE:-0}" -eq 0 ]; then
+ PROGRESS_LAST_SHOWN=0
+ fi
+ _mon_state_save
}
add_progress_total() {
local n="${1:-0}"
PROGRESS_TOTAL=$((PROGRESS_TOTAL + n))
+ _mon_state_save
}
_progress_bar_line() {
local done="$1" total="$2" width=24 pct=0 filled empty i bar
@@ -534,6 +554,7 @@ _take_tid() {
LAST_TID=$(printf '%s-%02d' "$TEST_AREA" "$TEST_N")
fi
PROGRESS_DONE=$((PROGRESS_DONE + 1))
+ _mon_state_save
_progress_maybe_show 0
}
# Dim ids: "#003 www.exchange-01 " or empty
diff --git a/scripts/taler-monitoring/secrets.env.example b/scripts/taler-monitoring/secrets.env.example
new file mode 100644
index 0000000..2af0ffc
--- /dev/null
+++ b/scripts/taler-monitoring/secrets.env.example
@@ -0,0 +1,44 @@
+# taler-monitoring — local secrets template
+#
+# Copy to secrets.env (gitignored) and fill values, OR export the same vars:
+# cp secrets.env.example secrets.env
+# $EDITOR secrets.env
+#
+# Never commit secrets.env. Prefer file paths under koopa-admin-secrets
+# for long-term storage; this file is for laptop one-shots / overrides.
+#
+# Load order: env already set > secrets.env > SECRETS_ROOT files > SSH koopa
+
+# --- Preferred: point at secrets tree (no passwords in this file) ---
+# Sibling of admin-log on this machine:
+# KOOPA_ADMIN_SECRETS=$HOME/src/koopa/koopa-admin-secrets
+# Or host-root only:
+# SECRETS_ROOT=$HOME/src/koopa/koopa-admin-secrets/koopa/host-root
+
+# --- Or paste passwords / tokens (local GOA e2e) ---
+# Bank admin (libeufin-bank admin) — funds / creates accounts in e2e
+# E2E_BANK_ADMIN_PASS=
+# BANK_ADMIN_PASS= # alias, same meaning
+
+# Merchant instance token for private orders (goa-demo-cp4zqk on hacktivism)
+# Full "secret-token:…" or raw secret (Bearer prefix added by e2e)
+# E2E_MERCHANT_TOKEN=
+# MERCHANT_TOKEN=
+# MERCHANT_INSTANCE_PASSWORD=
+
+# Optional overrides
+# MERCHANT_INSTANCE=goa-demo-cp4zqk
+# EXPECT_CURRENCY=GOA
+# E2E_TIMEOUT=340
+# PROGRESS_TOTAL=120
+# PROGRESS_SHOW_EVERY=8
+# PROGRESS_OFF=1
+
+# Values that typically appear on a full stack (for orientation only):
+# bank-admin-password.txt
+# bank-explorer-password.txt
+# bank-exchange-password.txt
+# bank-goa-demo-cp4zqk-password.txt
+# merchant-goa-demo-cp4zqk-password.txt
+# exchange-attribute-encryption.secret.conf
+# (see ../SECRETS.md and koopa-admin-secrets/MAP.md)
diff --git a/scripts/taler-monitoring/taler-monitoring.sh b/scripts/taler-monitoring/taler-monitoring.sh
index 52d3d29..04af0b9 100755
--- a/scripts/taler-monitoring/taler-monitoring.sh
+++ b/scripts/taler-monitoring/taler-monitoring.sh
@@ -66,6 +66,13 @@ EOF
# shellcheck source=lib.sh
source "$ROOT/lib.sh"
+# Optional gitignored secrets.env next to this suite (or MONITORING_SECRETS_ENV=)
+load_monitoring_secrets_env 2>/dev/null || true
+
+# Persist #NNN + progress across check_*.sh child processes
+TALER_MON_STATE=$(mktemp "${TMPDIR:-/tmp}/taler-mon-state.XXXXXX")
+export TALER_MON_STATE
+trap 'rm -f "${TALER_MON_STATE:-}"' EXIT
PHASES=()
DOMAIN_SET=0
@@ -212,11 +219,30 @@ if [ "${#PHASES[@]}" -eq 0 ]; then
PHASES=(urls)
fi
+# Rough expected check counts for progress % (override: PROGRESS_TOTAL=N)
+if [ "${PROGRESS_TOTAL:-0}" = "0" ] || [ -z "${PROGRESS_TOTAL:-}" ]; then
+ _pt=0
+ for p in "${PHASES[@]}"; do
+ case "$p" in
+ urls) _pt=$((_pt + 55)) ;;
+ inside) _pt=$((_pt + 25)) ;;
+ versions) _pt=$((_pt + 20)) ;;
+ sanity) _pt=$((_pt + 30)) ;;
+ server) _pt=$((_pt + 15)) ;;
+ e2e) _pt=$((_pt + 90)) ;;
+ ladder|goa-ladder) _pt=$((_pt + 80)) ;;
+ esac
+ done
+ set_progress_total "$_pt"
+ unset _pt
+fi
+
printf 'target domain=%s\n' "${TALER_DOMAIN}"
printf ' bank %s\n' "$BANK_PUBLIC"
printf ' exchange %s\n' "$EXCHANGE_PUBLIC"
printf ' merchant %s\n' "$MERCHANT_PUBLIC"
printf ' currency expect=%s skip_ssh=%s\n' "${EXPECT_CURRENCY:-any}" "$SKIP_SSH"
+printf ' progress total≈%s (set PROGRESS_TOTAL= to override; PROGRESS_OFF=1 to hide)\n' "${PROGRESS_TOTAL:-0}"
chmod +x "$ROOT"/check_*.sh 2>/dev/null || true