docs: monitoring public HTML needs Caddy/www root apply (I-09)

Document merchant JSON code 21 on /monitoring* as infra (not suite).
Topic note, day log, ISSUES I-09, pointer README, sync prepared Caddyfile.

2026/2026-07-18--monitoring-public-caddy.md

@@ -0,0 +1,66 @@
+# 2026-07-18 — Monitoring-HTML öffentlich: Caddy / www (Infra)
+
+## Symptom
+
+Öffentliche URLs liefern **Merchant-JSON code 21** (HTTP 404), kein sticky-bar HTML:
+
+- `https://taler.hacktivism.ch/monitoring/`
+- `https://bank.hacktivism.ch/monitoring/`
+- `https://exchange.hacktivism.ch/monitoring/`
+- `https://taler.hacktivism.ch/taler-monitoring-surface/`
+- `https://taler.hacktivism.ch/taler-monitoring-aptdeploy/`
+- `https://taler.hacktivism.ch/taler-monitoring-mattermost/`
+- `https://taler.hacktivism.ch/taler-monitoring-mail/`
+
+(jeweils auch ohne trailing slash und `*_err/` wo vorhanden)
+
+## Nicht die Suite
+
+Standalone-Repo **taler-monitoring** (aktuell z. B. **v1.7.1**, `~/src/taler-monitoring`):
+
+| Ort | Status |
+|-----|--------|
+| Staging `~/monitoring-sites-staging/…/*/index.html` | **vorhanden** (sticky-bar) |
+| Host-agent Timer | aktiv; meldet Deploy/monpages-Fehler (`STRICT_EXIT=1` ab v1.7.1) |
+| Live `/var/www/monitoring-sites` | unvollständig / veraltet; **nicht** schreibbar für `hernani` |
+| Live `/etc/caddy/Caddyfile` | **keine** `handle /monitoring*` (Stand 2026-07-18) |
+| Vorbereitet | `~/koopa-caddy/Caddyfile` (Handles vor `reverse_proxy`) |
+
+Caddy läuft als System-Unit (`User=caddy`, **`ProtectHome=true`**) → Staging unter `/home/hernani` ist für Caddy **nicht** lesbar. Auslieferung muss über **`/var/www/monitoring-sites`**.
+
+## Root-Fix (einmal)
+
+```bash
+sudo ~/koopa-caddy/apply-monitoring-live.sh
+```
+
+Das Script:
+
+1. `rsync` Staging → `/var/www/monitoring-sites/`
+2. Ownership/ACL: `hernani` schreibbar, Gruppe `caddy`
+3. Installiert vorbereitete Caddyfile → `/etc/caddy/Caddyfile`, `caddy validate`, `systemctl reload caddy`
+4. Smoke-curl der Monitoring-URLs (darf **nicht** code 21 sein)
+
+Danach sollten Host-Agent-Läufe selbst nach www rsyncen (wenn ACL greift).
+
+## Verifikation
+
+```bash
+curl -sS -o /dev/null -w "%{http_code}\n" https://taler.hacktivism.ch/monitoring/
+# expect 200 + HTML with sticky-bar, not JSON code 21
+
+grep -c "handle /monitoring" /etc/caddy/Caddyfile
+# expect > 0
+
+test -w /var/www/monitoring-sites && echo www_writable
+```
+
+## Suite vs. Ops
+
+| Repo | Rolle |
+|------|--------|
+| [taler-monitoring](https://git.hacktivism.ch/hernani/taler-monitoring) | Checks, HTML-Generator, host-agent |
+| **koopa-admin-log** (dieses Repo) | Caddy-Spiegel, Apply-Skript-Hinweise, Issues |
+| `~/koopa-caddy/` | Live-Apply-Quelle auf dem Host (nicht Secrets) |
+
+Siehe Issue **I-09** in `ISSUES.md`.

2026/2026-07-18.md

@@ -0,0 +1,7 @@
+# 2026-07-18
+
+- **taler-monitoring** standalone weiter (Tags bis **v1.7.1**): monpages, mattermost, mail, `--ver`, `STRICT_EXIT=1`
+- **Infra:** öffentliche Monitoring-HTML weiter **code 21** — live Caddy ohne Handles, www nicht hernani-schreibbar
+  → Topic: `2026-07-18--monitoring-public-caddy.md`, Issue **I-09**
+  → Fix: `sudo ~/koopa-caddy/apply-monitoring-live.sh` (noch ausstehend, braucht root)
+- Suite-Pfad kanonisch: `~/src/taler-monitoring` (nicht unter admin-log)

ISSUES.md

@@ -1,6 +1,6 @@
 # Open issues
 
-Stand **2026-07-17** (koopa, live). Keine Secrets.
+Stand **2026-07-18** (koopa, live). Keine Secrets.
 
 ## Index
 
@@ -14,9 +14,31 @@ Stand **2026-07-17** (koopa, live). Keine Secrets.
 | [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` |
 | [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` |
 | [I-08](#i-2026-07-17-08) | medium | open | Landing-stats → standalone `taler-landing-stats` |
+| [I-09](#i-2026-07-18-09) | high | open | Monitoring-HTML öffentlich: Caddy/www (code 21) |
 
 ---
 
+
+---
+
+### I-2026-07-18-09
+
+**Monitoring-HTML öffentlich: Caddy handles / www (merchant code 21)**  
+Severity: high · Host: koopa · Status: open
+
+Öffentliche `/monitoring*` und `/taler-monitoring-*` → Merchant **JSON code 21**.  
+Staging unter `~/monitoring-sites-staging` ist befüllt; live `/etc/caddy/Caddyfile` hat keine Monitoring-Handles; `/var/www/monitoring-sites` nicht schreibbar für `hernani`.
+
+**Fix (root):**
+
+```bash
+sudo ~/koopa-caddy/apply-monitoring-live.sh
+```
+
+Details: `2026/2026-07-18--monitoring-public-caddy.md`  
+Suite: https://git.hacktivism.ch/hernani/taler-monitoring (v1.7.1+)
+
+
 ### I-2026-07-16-01
 
 **firewalld: Nym-Ports auf koopa unbestätigt**  

configs/caddy/Caddyfile

@@ -37,22 +37,85 @@ taler.hacktivism.ch {
         }
     }
 
+    # surface + aptdeploy HTML (taler.hacktivism.ch only)
+    handle /taler-monitoring-surface_err {
+        redir /taler-monitoring-surface_err/ 302
+    }
+    handle /taler-monitoring-surface_err/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface_err
+        file_server
+    }
+    handle /taler-monitoring-surface {
+        redir /taler-monitoring-surface/ 302
+    }
+    handle /taler-monitoring-surface/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface
+        file_server
+    }
+    handle /taler-monitoring-aptdeploy_err {
+        redir /taler-monitoring-aptdeploy_err/ 302
+    }
+    handle /taler-monitoring-aptdeploy_err/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy_err
+        file_server
+    }
+    handle /taler-monitoring-aptdeploy {
+        redir /taler-monitoring-aptdeploy/ 302
+    }
+    handle /taler-monitoring-aptdeploy/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy
+        file_server
+    }
+
+    handle /taler-monitoring-mattermost_err {
+        redir /taler-monitoring-mattermost_err/ 302
+    }
+    handle /taler-monitoring-mattermost_err/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost_err
+        file_server
+    }
+    handle /taler-monitoring-mattermost {
+        redir /taler-monitoring-mattermost/ 302
+    }
+    handle /taler-monitoring-mattermost/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost
+        file_server
+    }
+
+    handle /taler-monitoring-mail_err {
+        redir /taler-monitoring-mail_err/ 302
+    }
+    handle /taler-monitoring-mail_err/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail_err
+        file_server
+    }
+    handle /taler-monitoring-mail {
+        redir /taler-monitoring-mail/ 302
+    }
+    handle /taler-monitoring-mail/ {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail
+        file_server
+    }
+
     # taler-monitoring console HTML (host static — not in app containers)
     handle /monitoring_err {
         redir /monitoring_err/ 302
     }
     handle /monitoring_err/ {
-        root * /var/www/monitoring-sites/{host}/monitoring_err
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring_err
         file_server
     }
     handle /monitoring {
         redir /monitoring/ 302
     }
     handle /monitoring/ {
-        root * /var/www/monitoring-sites/{host}/monitoring
+        root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring
         file_server
     }
 
+
+
+
     # SPA: /webui → /webui/
     redir /webui /webui/ 302
 
@@ -83,17 +146,18 @@ exchange.hacktivism.ch {
         redir /monitoring_err/ 302
     }
     handle /monitoring_err/ {
-        root * /var/www/monitoring-sites/{host}/monitoring_err
+        root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring_err
         file_server
     }
     handle /monitoring {
         redir /monitoring/ 302
     }
     handle /monitoring/ {
-        root * /var/www/monitoring-sites/{host}/monitoring
+        root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring
         file_server
     }
 
+
     reverse_proxy 127.0.0.1:9011 {
         import proxy_public
     }
@@ -116,17 +180,18 @@ bank.hacktivism.ch {
         redir /monitoring_err/ 302
     }
     handle /monitoring_err/ {
-        root * /var/www/monitoring-sites/{host}/monitoring_err
+        root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err
         file_server
     }
     handle /monitoring {
         redir /monitoring/ 302
     }
     handle /monitoring/ {
-        root * /var/www/monitoring-sites/{host}/monitoring
+        root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring
         file_server
     }
 
+
     # Static terms/privacy on landing nginx :9013
     handle /terms* {
         reverse_proxy 127.0.0.1:9013 {

configs/caddy/README.md

@@ -7,3 +7,11 @@
 | `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy |
 
 Also: `host/caddy/Caddyfile` (same as `Caddyfile` here).
+
+## Monitoring static HTML (2026-07-18)
+
+Handles for `/monitoring*` and `/taler-monitoring-*` live in this `Caddyfile` (prepared under `~/koopa-caddy/`).  
+They must appear **before** the merchant `reverse_proxy`.  
+
+Live install + www ACL: `sudo ~/koopa-caddy/apply-monitoring-live.sh`  
+See `2026/2026-07-18--monitoring-public-caddy.md` and ISSUES **I-09**.

scripts/taler-monitoring/README.md

@@ -1,26 +1,27 @@
 # taler-monitoring has moved
 
-The monitoring suite is no longer part of **koopa-admin-log**.
+The monitoring **suite** is a standalone repository (not maintained under this tree).
 
 | | |
 |--|--|
 | **Repository** | https://git.hacktivism.ch/hernani/taler-monitoring |
 | **Clone** | `git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring` |
-| **Tag** | `v1.0` (initial standalone release) |
+| **Install path** | `~/src/taler-monitoring` |
-| **History** | `VERSIONS.md` in that repo |
+| **Version** | `./taler-monitoring.sh --ver` (tags `vMAJOR.FEATURE.FIX`, e.g. v1.7.1) |
 
-## Quick start
+## Host-agent (user systemd on koopa)
 
 ```bash
-git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring
+~/src/taler-monitoring/host-agent/install-host-agent.sh
-cd ~/src/taler-monitoring
-./taler-monitoring.sh -d hacktivism.ch urls
-# host-agent (koopa):
-./host-agent/install-host-agent.sh
 ```
 
-Landing configs and Caddy site configs for GOA remain in **koopa-admin-log**
+## Public HTML (infra on this host)
-(`configs/`). The host-agent path unit still watches those paths when present.
 
-Do **not** add monitoring scripts back into this directory — develop and push
+Generated under `~/monitoring-sites-staging/`.  
-against **taler-monitoring** only.
+**Live** requires root publish + Caddy handles — see:
+
+- `2026/2026-07-18--monitoring-public-caddy.md`
+- `ISSUES.md` → **I-09**
+- Apply: `sudo ~/koopa-caddy/apply-monitoring-live.sh`
+
+Do not re-introduce the full suite under `scripts/taler-monitoring/`.