monitoring: surface inventory and apt-deploy check phases

scripts/taler-monitoring/TESTS.md

@@ -18,6 +18,8 @@ Every check line has a **global** run number and a **grouped** id:
 | **www** | `check_urls.sh` | `exchange` `perf` `stats` `bank` `merchant` `paivana` `landing` `qr` |
 | **inside** | `check_inside.sh` | `ssh` `bank` `exchange` `merchant` `caddy` `load` |
 | **versions** | `check_versions.sh` | `outside` `inside` `compare` |
+| **aptdeploy** | `check_apt_deploy.sh` | `trixie` `trixie-testing` (koopa podman apt-src merchant smoke) |
+| **surface** | `check_surface.sh` | **remote-only** ecosystem / `-d` domain inventory (not in default/all/full) |
 | **sanity** | `check_sanity.sh` | `bank` `exchange` `merchant` |
 | **server** | `check_server.sh` | (flat `server-NN` or host groups) |
 | **e2e** | `check_e2e.sh` | `prereq` `load` `bank` `wallet` `atm` `settle` `pay` `shop` `paivana` `dig` `report` |
@@ -73,12 +75,14 @@ Numbering follows **executed** checks (early skip may shift later NN inside the
 
 | Group | Checks |
 |-------|--------|
-| **inside.ssh-** | ssh reachability / remote collect |
+| **inside.host-** | **host-podman**: reachability via `podman exec` on this machine (GOA host / `INSIDE_PODMAN=1`) — not SSH |
+| **inside.ssh-** | **ssh**: from laptop/remote — SSH to `KOOPA_SSH` / `INSIDE_SSH`, then podman there |
 | **inside.bank-** | container, libeufin, postgres, local `/config`, nginx, DNS pins |
 | **inside.exchange-** | container, httpd, wirewatch, aggregator, transfer, local keys, DNS |
 | **inside.merchant-** | container, httpd, wirewatch, depositcheck, DNS |
 | **inside.caddy-** | host reverse-proxy process |
 | **inside.load-** | host loadavg + RAM; per-container RSS/CPU |
+| **inside.disk-** / **aptdeploy.disk-** / **versions.disk-** / **server.disk-** | free space via `df`: **WARN** if use ≥ `DISK_WARN_USED_PCT` (85), **ERROR** if full or use ≥ `DISK_ERR_USED_PCT` (95); host + containers |
 
 Remote lines `E|comp|LEVEL|key|detail` each become one numbered result under that component group.
 
@@ -112,8 +116,28 @@ When filing an issue, quote the full id + label, e.g.
 | Area.group | Meaning |
 |------------|---------|
 | **versions.outside-** | deb.taler.net suite index |
-| **versions.inside-** | packages in containers |
+| **versions.host-** | host-podman: packages via local `podman exec` (`INSIDE_PODMAN=1`) |
+| **versions.ssh-** | ssh: packages via `KOOPA_SSH` / `INSIDE_SSH` from laptop/remote |
 | **versions.compare-** | installed vs suite |
+| **aptdeploy.trixie-fresh-** | fresh rebuild container `…-apt-src-trixie` |
+| **aptdeploy.trixie-testing-fresh-** | fresh rebuild `…-trixie-testing` |
+| **aptdeploy.trixie-upgrade-** | upgrade-track `…-trixie-upgrade` (install once, then mytops-style upgrade) |
+| **aptdeploy.trixie-testing-upgrade-** | upgrade-track `…-trixie-testing-upgrade` |
+
+Standalone: `host-agent/run-aptdeploy.sh` (on koopa local; else `ssh koopa-external`).
+
+### surface (remote-only public inventory)
+
+```bash
+./taler-monitoring.sh surface                      # taler.net / gnunet / taler-systems / mattermost / …
+./taler-monitoring.sh -d hacktivism.ch surface     # all things under that domain
+```
+
+- Catalog: `surface-catalog.conf` (extend as hosts are found)
+- DNS, optional ICMP, TCP ports, then **protocol** checks (HTTPS/HTTP/SSH) before ERROR
+- TLS cert expiry; Server-header / `/config` version hints; else **WARN: version unknown**
+- OSV CVE query when package+version known → **ERROR** on hits
+- Never SSH / never podman on the *targets*
 | **sanity.bank-** / **.exchange-** / **.merchant-** | public + optional server-side per component |
 | **ladder.plan-** / **.load-** / **.withdraw-** / **.pay-** / **.report-** | amount ladder (GOA ceiling or stage TESTPAYSAN `max_wire`) |
 | **server-** | SSH host ports / processes (flat unless grouped later) |