hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

monitoring: docs + secrets.env for auth401 and webui pins

Browse source
This commit is contained in:
Hernâni Marques 2026-07-18 00:03:29 +02:00
parent ed4d2ab52f
commit 8de2e4d6c8
No known key found for this signature in database
3 changed files with 76 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/taler-monitoring/README.md
View file

@ -109,6 +109,26 @@ Each check prints **global** and **grouped** ids:
# Landing stats.json freshness (outside-in; age via generated_at_unix)
STATS_STALE_SECS=900 STATS_FAIL_SECS=3600 ./taler-monitoring.sh -d stage.lefrancpaysan.ch urls
# --- Full load (GOA / hacktivism) ---
# all = urls + inside + versions + sanity + e2e
# full = all + server + ladder + auth401 (long; needs secrets.env)
./taler-monitoring.sh -d hacktivism.ch full
./taler-monitoring.sh -d hacktivism.ch urls inside versions sanity server e2e ladder auth401
# SPA pin after selfbuild-webui.sh (container):
EXPECT_WEBUI_VERSION=1.6.11 EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11 \
WEBUI_OVERLAY_DENY='c778af04|master-11340' \
./taler-monitoring.sh -d hacktivism.ch urls
# Only 401 matrix (may create throwaway instance):
./taler-monitoring.sh -d hacktivism.ch auth401
# Stage FrancPaysan — durable mon401 account (password in francpaysan-secrets):
./taler-monitoring.sh -d stage.monnaie.lefrancpaysan.ch auth401
# secrets: ~/francpaysan-secrets/stage/instances/mon401.password
# ~/francpaysan-secrets/stage/default-instance-token.txt
# force throwaway create instead: AUTH401_PREFER_DURABLE=0 AUTH401_CREATE=1 …
```
### Landing `stats.json` (www.stats)

31
scripts/taler-monitoring/TESTS.md
View file

@ -52,6 +52,7 @@ Numbering follows **executed** checks (early skip may shift later NN inside the
| **www.stats-** | `/intro/stats.json` **reachable**; **timestamps** (`generated_at_unix` + human/ISO); **freshness** vs wall clock (`STATS_STALE_SECS` WARN, `STATS_FAIL_SECS` ERROR); **display fields** (bank-shape withdraws/accounts, or exchange-db / merchant-db keys); optional performance block; shared-feed equal `gen_unix` when bank collector is published to all three |
| **www.bank-** | `/config`, currency, alt_unit_names; integration/webui/intro; **auto-account.json** (required GOA/local; skip/soft off-GOA e.g. TESTPAYSAN); `/terms`, `/privacy` |
| **www.merchant-** | `/config` currency + currencies alt_unit_names; listed exchanges alt; webui/intro; **`/terms`**, **`/privacy`** |
| **www.webui-** | SPA fingerprints: **`/webui/version.txt`**, **`/webui/version-overlay.txt`**, `index.html` / `index.js`; optional pin via `EXPECT_WEBUI_VERSION` / `EXPECT_WEBUI_OVERLAY` / `WEBUI_OVERLAY_DENY` |
| **www.paivana-** | local GOA paywall front (redirect to template) |
| **www.landing-** | own-stack intro links; static assets (`qrcode.min.js` hard; `og-goa-shop.png` hard only GOA/local); **demo-withdraw.json** GOA-only; shop-pay soft; stage merchant shop: `shop-ui.js` + `shops.css` + `qrcode.min.js`; cross-links local |
| **www.qr-** | QR payloads: harvest `taler://` / `payto://` / app `data-qr-url` from landings + mint JSON; **form** check; **qrencode → zbarimg** exact roundtrip; optional static QR images. Needs `qrencode` + `zbar-tools`. Skip: `QR_CHECK=0` |
@ -106,7 +107,7 @@ When filing an issue, quote the full id + label, e.g.
---
## versions / sanity / ladder / server
## versions / sanity / ladder / server / auth401
| Area.group | Meaning |
|------------|---------|
@ -116,6 +117,34 @@ When filing an issue, quote the full id + label, e.g.
| **sanity.bank-** / **.exchange-** / **.merchant-** | public + optional server-side per component |
| **ladder.plan-** / **.load-** / **.withdraw-** / **.pay-** / **.report-** | amount ladder (GOA ceiling or stage TESTPAYSAN `max_wire`) |
| **server-** | SSH host ports / processes (flat unless grouped later) |
| **auth401.*** | merchant 401 / case matrix (WebUI APIs): **signup** `POST /instances` MIX id, **login** Basic user low vs MIX/UPPER, full **case** matrix, **password** bad/empty, **pwchange** `POST private/auth` + re-login, **admin-create** `POST /management/instances` (if admin token), **bearer**, **durable mon401**, **webui** SPA `toLowerCase` probe (`check_auth401.sh`) |
### SPA pin (after selfbuild-webui)
```bash
EXPECT_WEBUI_VERSION=1.6.11 \
EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11 \
WEBUI_OVERLAY_DENY='c778af04|master-11340' \
./taler-monitoring.sh -d hacktivism.ch urls
```
Skip SPA block: `CHECK_WEBUI_SPA=0`.
### Full load (maximum phases)
| Alias | Expands to (local GOA) |
|-------|-------------------------|
| **`all`** | `urls inside versions sanity e2e` |
| **`full`** | `urls inside versions sanity server e2e ladder auth401` |
```bash
cd ~/src/koopa/koopa-admin-log/scripts/taler-monitoring
# secrets.env with bank admin + merchant tokens (see secrets.env.example)
./taler-monitoring.sh -d hacktivism.ch full
# same, explicit:
./taler-monitoring.sh -d hacktivism.ch \
urls inside versions sanity server e2e ladder auth401
```
---

26
scripts/taler-monitoring/secrets.env.example
View file

@ -43,6 +43,32 @@
# PROGRESS_SHOW_EVERY=8
# PROGRESS_OFF=1
# --- Merchant SPA /webui/ fingerprints (urls phase, group www.webui) ---
# EXPECT_WEBUI_VERSION=1.6.11
# EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11
# WEBUI_OVERLAY_DENY=c778af04|master-11340
# CHECK_WEBUI_SPA=0
# --- auth401 phase (WebUI signup/login/pwchange/admin + case matrix) ---
# Default FULL=1 creates throwaway MIX instance + runs all groups.
# Stage also loads durable mon401 for extra durable.* checks:
# AUTH401_FULL=1
# AUTH401_CONTINUE=1 # optional: hard prereqs soft; full ERROR list always via EXIT trap
# CONTINUE_ON_ERROR=1 # alias for AUTH401_CONTINUE
# (auth401 no longer uses set -e — silent mid-run abort fixed)
# AUTH401_CREATE=1
# AUTH401_PREFER_DURABLE=0 # 1 = only mon401, skip throwaway signup
# AUTH401_INSTANCE=mon401
# AUTH401_PASSWORD=
# AUTH401_DURABLE_ID=mon401
# AUTH401_CREATE_PASSWORD=Mon401-Test-Pass!
# AUTH401_SKIP_IF_MFA=1
# AUTH401_BEARER= # default-instance-token (not admin)
# AUTH401_ADMIN_TOKEN= # required for admin-create group
# AUTH401_ADMIN_PASSWORD= # or login as AUTH401_ADMIN_USER=admin
# AUTH401_ADMIN_USER=admin
# FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
# --- Ladder (GOA withdraw ladder · explorer pool) ---
# Prefer SECRETS_ROOT / KOOPA_ADMIN_SECRETS (bank-explorer-password.txt).
# Overrides only if needed: