From 6c92cd1c1b4e418ba4e7c646e2da17aab783a38e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sat, 18 Jul 2026 21:29:45 +0200 Subject: [PATCH] docs: monitoring public HTML needs Caddy/www root apply (I-09) Document merchant JSON code 21 on /monitoring* as infra (not suite). Topic note, day log, ISSUES I-09, pointer README, sync prepared Caddyfile. --- 2026/2026-07-18--monitoring-public-caddy.md | 66 ++++++++++++++++++ 2026/2026-07-18.md | 7 ++ ISSUES.md | 24 ++++++- configs/caddy/Caddyfile | 77 +++++++++++++++++++-- configs/caddy/README.md | 8 +++ scripts/taler-monitoring/README.md | 27 ++++---- 6 files changed, 189 insertions(+), 20 deletions(-) create mode 100644 2026/2026-07-18--monitoring-public-caddy.md create mode 100644 2026/2026-07-18.md diff --git a/2026/2026-07-18--monitoring-public-caddy.md b/2026/2026-07-18--monitoring-public-caddy.md new file mode 100644 index 0000000..2f84af7 --- /dev/null +++ b/2026/2026-07-18--monitoring-public-caddy.md @@ -0,0 +1,66 @@ +# 2026-07-18 — Monitoring-HTML öffentlich: Caddy / www (Infra) + +## Symptom + +Öffentliche URLs liefern **Merchant-JSON code 21** (HTTP 404), kein sticky-bar HTML: + +- `https://taler.hacktivism.ch/monitoring/` +- `https://bank.hacktivism.ch/monitoring/` +- `https://exchange.hacktivism.ch/monitoring/` +- `https://taler.hacktivism.ch/taler-monitoring-surface/` +- `https://taler.hacktivism.ch/taler-monitoring-aptdeploy/` +- `https://taler.hacktivism.ch/taler-monitoring-mattermost/` +- `https://taler.hacktivism.ch/taler-monitoring-mail/` + +(jeweils auch ohne trailing slash und `*_err/` wo vorhanden) + +## Nicht die Suite + +Standalone-Repo **taler-monitoring** (aktuell z. B. **v1.7.1**, `~/src/taler-monitoring`): + +| Ort | Status | +|-----|--------| +| Staging `~/monitoring-sites-staging/…/*/index.html` | **vorhanden** (sticky-bar) | +| Host-agent Timer | aktiv; meldet Deploy/monpages-Fehler (`STRICT_EXIT=1` ab v1.7.1) | +| Live `/var/www/monitoring-sites` | unvollständig / veraltet; **nicht** schreibbar für `hernani` | +| Live `/etc/caddy/Caddyfile` | **keine** `handle /monitoring*` (Stand 2026-07-18) | +| Vorbereitet | `~/koopa-caddy/Caddyfile` (Handles vor `reverse_proxy`) | + +Caddy läuft als System-Unit (`User=caddy`, **`ProtectHome=true`**) → Staging unter `/home/hernani` ist für Caddy **nicht** lesbar. Auslieferung muss über **`/var/www/monitoring-sites`**. + +## Root-Fix (einmal) + +```bash +sudo ~/koopa-caddy/apply-monitoring-live.sh +``` + +Das Script: + +1. `rsync` Staging → `/var/www/monitoring-sites/` +2. Ownership/ACL: `hernani` schreibbar, Gruppe `caddy` +3. Installiert vorbereitete Caddyfile → `/etc/caddy/Caddyfile`, `caddy validate`, `systemctl reload caddy` +4. Smoke-curl der Monitoring-URLs (darf **nicht** code 21 sein) + +Danach sollten Host-Agent-Läufe selbst nach www rsyncen (wenn ACL greift). + +## Verifikation + +```bash +curl -sS -o /dev/null -w "%{http_code}\n" https://taler.hacktivism.ch/monitoring/ +# expect 200 + HTML with sticky-bar, not JSON code 21 + +grep -c "handle /monitoring" /etc/caddy/Caddyfile +# expect > 0 + +test -w /var/www/monitoring-sites && echo www_writable +``` + +## Suite vs. Ops + +| Repo | Rolle | +|------|--------| +| [taler-monitoring](https://git.hacktivism.ch/hernani/taler-monitoring) | Checks, HTML-Generator, host-agent | +| **koopa-admin-log** (dieses Repo) | Caddy-Spiegel, Apply-Skript-Hinweise, Issues | +| `~/koopa-caddy/` | Live-Apply-Quelle auf dem Host (nicht Secrets) | + +Siehe Issue **I-09** in `ISSUES.md`. diff --git a/2026/2026-07-18.md b/2026/2026-07-18.md new file mode 100644 index 0000000..13feba3 --- /dev/null +++ b/2026/2026-07-18.md @@ -0,0 +1,7 @@ +# 2026-07-18 + +- **taler-monitoring** standalone weiter (Tags bis **v1.7.1**): monpages, mattermost, mail, `--ver`, `STRICT_EXIT=1` +- **Infra:** öffentliche Monitoring-HTML weiter **code 21** — live Caddy ohne Handles, www nicht hernani-schreibbar + → Topic: `2026-07-18--monitoring-public-caddy.md`, Issue **I-09** + → Fix: `sudo ~/koopa-caddy/apply-monitoring-live.sh` (noch ausstehend, braucht root) +- Suite-Pfad kanonisch: `~/src/taler-monitoring` (nicht unter admin-log) diff --git a/ISSUES.md b/ISSUES.md index 4e89ea6..efb5921 100644 --- a/ISSUES.md +++ b/ISSUES.md @@ -1,6 +1,6 @@ # Open issues -Stand **2026-07-17** (koopa, live). Keine Secrets. +Stand **2026-07-18** (koopa, live). Keine Secrets. ## Index @@ -14,9 +14,31 @@ Stand **2026-07-17** (koopa, live). Keine Secrets. | [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` | | [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` | | [I-08](#i-2026-07-17-08) | medium | open | Landing-stats → standalone `taler-landing-stats` | +| [I-09](#i-2026-07-18-09) | high | open | Monitoring-HTML öffentlich: Caddy/www (code 21) | --- + +--- + +### I-2026-07-18-09 + +**Monitoring-HTML öffentlich: Caddy handles / www (merchant code 21)** +Severity: high · Host: koopa · Status: open + +Öffentliche `/monitoring*` und `/taler-monitoring-*` → Merchant **JSON code 21**. +Staging unter `~/monitoring-sites-staging` ist befüllt; live `/etc/caddy/Caddyfile` hat keine Monitoring-Handles; `/var/www/monitoring-sites` nicht schreibbar für `hernani`. + +**Fix (root):** + +```bash +sudo ~/koopa-caddy/apply-monitoring-live.sh +``` + +Details: `2026/2026-07-18--monitoring-public-caddy.md` +Suite: https://git.hacktivism.ch/hernani/taler-monitoring (v1.7.1+) + + ### I-2026-07-16-01 **firewalld: Nym-Ports auf koopa unbestätigt** diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile index 7b960b9..f16cb53 100644 --- a/configs/caddy/Caddyfile +++ b/configs/caddy/Caddyfile @@ -37,22 +37,85 @@ taler.hacktivism.ch { } } + # surface + aptdeploy HTML (taler.hacktivism.ch only) + handle /taler-monitoring-surface_err { + redir /taler-monitoring-surface_err/ 302 + } + handle /taler-monitoring-surface_err/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface_err + file_server + } + handle /taler-monitoring-surface { + redir /taler-monitoring-surface/ 302 + } + handle /taler-monitoring-surface/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface + file_server + } + handle /taler-monitoring-aptdeploy_err { + redir /taler-monitoring-aptdeploy_err/ 302 + } + handle /taler-monitoring-aptdeploy_err/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy_err + file_server + } + handle /taler-monitoring-aptdeploy { + redir /taler-monitoring-aptdeploy/ 302 + } + handle /taler-monitoring-aptdeploy/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy + file_server + } + + handle /taler-monitoring-mattermost_err { + redir /taler-monitoring-mattermost_err/ 302 + } + handle /taler-monitoring-mattermost_err/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost_err + file_server + } + handle /taler-monitoring-mattermost { + redir /taler-monitoring-mattermost/ 302 + } + handle /taler-monitoring-mattermost/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost + file_server + } + + handle /taler-monitoring-mail_err { + redir /taler-monitoring-mail_err/ 302 + } + handle /taler-monitoring-mail_err/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail_err + file_server + } + handle /taler-monitoring-mail { + redir /taler-monitoring-mail/ 302 + } + handle /taler-monitoring-mail/ { + root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail + file_server + } + # taler-monitoring console HTML (host static — not in app containers) handle /monitoring_err { redir /monitoring_err/ 302 } handle /monitoring_err/ { - root * /var/www/monitoring-sites/{host}/monitoring_err + root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring_err file_server } handle /monitoring { redir /monitoring/ 302 } handle /monitoring/ { - root * /var/www/monitoring-sites/{host}/monitoring + root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring file_server } + + + # SPA: /webui → /webui/ redir /webui /webui/ 302 @@ -83,17 +146,18 @@ exchange.hacktivism.ch { redir /monitoring_err/ 302 } handle /monitoring_err/ { - root * /var/www/monitoring-sites/{host}/monitoring_err + root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring_err file_server } handle /monitoring { redir /monitoring/ 302 } handle /monitoring/ { - root * /var/www/monitoring-sites/{host}/monitoring + root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring file_server } + reverse_proxy 127.0.0.1:9011 { import proxy_public } @@ -116,17 +180,18 @@ bank.hacktivism.ch { redir /monitoring_err/ 302 } handle /monitoring_err/ { - root * /var/www/monitoring-sites/{host}/monitoring_err + root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err file_server } handle /monitoring { redir /monitoring/ 302 } handle /monitoring/ { - root * /var/www/monitoring-sites/{host}/monitoring + root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring file_server } + # Static terms/privacy on landing nginx :9013 handle /terms* { reverse_proxy 127.0.0.1:9013 { diff --git a/configs/caddy/README.md b/configs/caddy/README.md index 432d73c..db596b8 100644 --- a/configs/caddy/README.md +++ b/configs/caddy/README.md @@ -7,3 +7,11 @@ | `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy | Also: `host/caddy/Caddyfile` (same as `Caddyfile` here). + +## Monitoring static HTML (2026-07-18) + +Handles for `/monitoring*` and `/taler-monitoring-*` live in this `Caddyfile` (prepared under `~/koopa-caddy/`). +They must appear **before** the merchant `reverse_proxy`. + +Live install + www ACL: `sudo ~/koopa-caddy/apply-monitoring-live.sh` +See `2026/2026-07-18--monitoring-public-caddy.md` and ISSUES **I-09**. diff --git a/scripts/taler-monitoring/README.md b/scripts/taler-monitoring/README.md index a0acf02..b29815c 100644 --- a/scripts/taler-monitoring/README.md +++ b/scripts/taler-monitoring/README.md @@ -1,26 +1,27 @@ # taler-monitoring has moved -The monitoring suite is no longer part of **koopa-admin-log**. +The monitoring **suite** is a standalone repository (not maintained under this tree). | | | |--|--| | **Repository** | https://git.hacktivism.ch/hernani/taler-monitoring | | **Clone** | `git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring` | -| **Tag** | `v1.0` (initial standalone release) | -| **History** | `VERSIONS.md` in that repo | +| **Install path** | `~/src/taler-monitoring` | +| **Version** | `./taler-monitoring.sh --ver` (tags `vMAJOR.FEATURE.FIX`, e.g. v1.7.1) | -## Quick start +## Host-agent (user systemd on koopa) ```bash -git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring -cd ~/src/taler-monitoring -./taler-monitoring.sh -d hacktivism.ch urls -# host-agent (koopa): -./host-agent/install-host-agent.sh +~/src/taler-monitoring/host-agent/install-host-agent.sh ``` -Landing configs and Caddy site configs for GOA remain in **koopa-admin-log** -(`configs/`). The host-agent path unit still watches those paths when present. +## Public HTML (infra on this host) -Do **not** add monitoring scripts back into this directory — develop and push -against **taler-monitoring** only. +Generated under `~/monitoring-sites-staging/`. +**Live** requires root publish + Caddy handles — see: + +- `2026/2026-07-18--monitoring-public-caddy.md` +- `ISSUES.md` → **I-09** +- Apply: `sudo ~/koopa-caddy/apply-monitoring-live.sh` + +Do not re-introduce the full suite under `scripts/taler-monitoring/`.