From bf8a915a011e9c8cdb0198c4532bafba3f367aca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Fri, 17 Jul 2026 18:11:24 +0200 Subject: [PATCH] monitoring: find SECRETS_ROOT for e2e bank admin password --- scripts/taler-monitoring/README.md | 23 ++++++++ scripts/taler-monitoring/check_e2e.sh | 10 +++- scripts/taler-monitoring/lib.sh | 75 ++++++++++++++++++++++++--- 3 files changed, 99 insertions(+), 9 deletions(-) diff --git a/scripts/taler-monitoring/README.md b/scripts/taler-monitoring/README.md index c422bb7..7a711d6 100644 --- a/scripts/taler-monitoring/README.md +++ b/scripts/taler-monitoring/README.md @@ -22,6 +22,28 @@ Catalog: **[TESTS.md](./TESTS.md)**. End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included). +## Secrets (local GOA e2e) + +`check_e2e.sh` loads bank/merchant passwords from **koopa-admin-secrets** +(not this repo). Search order: + +1. `SECRETS_ROOT` → `…/taler-bank/bank-admin-password.txt` +2. `KOOPA_ADMIN_SECRETS` → `$KOOPA_ADMIN_SECRETS/koopa/host-root/…` +3. Sibling of this checkout: `../koopa-admin-secrets/koopa/host-root` +4. `$HOME/taler/src/koopa-admin-secrets/koopa/host-root` (common laptop layout) +5. `$HOME/.config/taler-landing/bank-admin-password.txt` +6. SSH koopa: `/root/bank-admin-password.txt` or podman bank container + +If you keep admin-log at `~/koopa-admin-log` but secrets under `~/taler/src/…`: + +```bash +export SECRETS_ROOT="$HOME/taler/src/koopa-admin-secrets/koopa/host-root" +# or: export KOOPA_ADMIN_SECRETS="$HOME/taler/src/koopa-admin-secrets" +./taler-monitoring.sh e2e +``` + +Or one-shot: `E2E_BANK_ADMIN_PASS=… E2E_MERCHANT_TOKEN=… ./taler-monitoring.sh e2e` + ## Commands ```bash @@ -32,6 +54,7 @@ End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included). ./taler-monitoring.sh sanity ./taler-monitoring.sh e2e + # Other domains — public HTTPS only, never SSH ./taler-monitoring.sh -d taler.net ./taler-monitoring.sh --domain taler-ops.ch diff --git a/scripts/taler-monitoring/check_e2e.sh b/scripts/taler-monitoring/check_e2e.sh index ee4ea08..905e85d 100755 --- a/scripts/taler-monitoring/check_e2e.sh +++ b/scripts/taler-monitoring/check_e2e.sh @@ -440,11 +440,15 @@ else MPW="${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-$(read_secret "taler-merchant/merchant-goa-demo-cp4zqk-password.txt" || true)}}" fi if [ -n "$ADMIN_PASS" ]; then - ok "bank admin secret" + ok "bank admin secret" "${SECRETS_ROOT:+SECRETS_ROOT=${SECRETS_ROOT}}" elif [ "$E2E_REMOTE" = "1" ]; then warn "bank admin secret" "missing — will try public registration only" else blocker "prereq" "bank admin password missing (SECRETS_ROOT or koopa /root)" + info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'}" + if type secrets_hint >/dev/null 2>&1; then + while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint) + fi exit 1 fi if [ -n "$MPW" ]; then @@ -460,6 +464,10 @@ elif [ "$E2E_REMOTE" = "1" ]; then warn "merchant secret" "missing — private orders fail unless E2E_USE_TEMPLATES=1 (set E2E_MERCHANT_TOKEN)" else blocker "prereq" "merchant instance password missing" + info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'} — need taler-merchant/merchant-*-password.txt" + if type secrets_hint >/dev/null 2>&1; then + while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint) + fi exit 1 fi # Authorization header for merchant private API (never double secret-token:) diff --git a/scripts/taler-monitoring/lib.sh b/scripts/taler-monitoring/lib.sh index 65c6005..938be14 100755 --- a/scripts/taler-monitoring/lib.sh +++ b/scripts/taler-monitoring/lib.sh @@ -758,25 +758,84 @@ PY done <<<"$list" } +# Live bank/merchant passwords: sibling **koopa-admin-secrets** (never in admin-log). +# Override: SECRETS_ROOT=/path/to/koopa-admin-secrets/koopa/host-root +# or KOOPA_ADMIN_SECRETS=/path/to/koopa-admin-secrets SECRETS_ROOT="${SECRETS_ROOT:-}" +_secrets_search_log() { :; } # placeholder if we later want debug if [ -z "$SECRETS_ROOT" ]; then + _mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + _admin_log="$(cd "${_mon_dir}/../.." && pwd)" + # Prefer explicit env pointing at the secrets *repo* root + if [ -n "${KOOPA_ADMIN_SECRETS:-}" ] && [ -d "${KOOPA_ADMIN_SECRETS}/koopa/host-root/taler-bank" ]; then + SECRETS_ROOT="${KOOPA_ADMIN_SECRETS}/koopa/host-root" + fi +fi +if [ -z "$SECRETS_ROOT" ]; then + _mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + _admin_log="$(cd "${_mon_dir}/../.." && pwd)" for d in \ - "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/koopa-admin-secrets/koopa/host-root" \ + "${_admin_log}/../koopa-admin-secrets/koopa/host-root" \ + "${_admin_log}/../../koopa-admin-secrets/koopa/host-root" \ + "${HOME}/taler/src/koopa-admin-secrets/koopa/host-root" \ + "${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root" \ + "${HOME}/koopa-admin-secrets/koopa/host-root" \ "/Users/newkamek/src/koopa/koopa-admin-secrets/koopa/host-root" \ - "$HOME/src/koopa/koopa-admin-secrets/koopa/host-root" + "$(cd "${_admin_log}/../.." 2>/dev/null && pwd)/koopa-admin-secrets/koopa/host-root" do - if [ -d "$d/taler-bank" ]; then SECRETS_ROOT=$d; break; fi + # resolve .. without requiring the dir to exist first for cd + if [ -d "$d/taler-bank" ]; then + SECRETS_ROOT=$(cd "$d" && pwd) + break + fi done + unset _mon_dir _admin_log d fi read_secret() { - local rel="$1" - if [ -n "${SECRETS_ROOT:-}" ] && [ -f "${SECRETS_ROOT}/${rel}" ]; then - tr -d '\n' <"${SECRETS_ROOT}/${rel}" + local rel="$1" base val="" + base=$(basename "$rel") + if [ -n "${SECRETS_ROOT:-}" ]; then + if [ -f "${SECRETS_ROOT}/${rel}" ]; then + tr -d '\n\r' <"${SECRETS_ROOT}/${rel}" + return 0 + fi + # also accept flat layout under host-root/ + if [ -f "${SECRETS_ROOT}/${base}" ]; then + tr -d '\n\r' <"${SECRETS_ROOT}/${base}" + return 0 + fi + fi + # Optional: copy under ~/.config/taler-landing/ (landing-stats style) + if [ -f "${HOME}/.config/taler-landing/${base}" ]; then + tr -d '\n\r' <"${HOME}/.config/taler-landing/${base}" return 0 fi - koopa_ssh_ok || return 1 - koopa_ssh_run 10 "tr -d '\\n' /dev/null || true" 2>/dev/null + # Live on koopa host /root (same basenames as deploy) + if koopa_ssh_ok; then + val=$(koopa_ssh_run 12 "tr -d '\\n\\r' /dev/null || true" 2>/dev/null || true) + if [ -n "$val" ]; then + printf '%s' "$val" + return 0 + fi + # container path used by some installs + val=$(koopa_ssh_run 12 \ + "podman exec taler-hacktivism-bank tr -d '\\n\\r' /dev/null || true" 2>/dev/null || true) + if [ -n "$val" ]; then + printf '%s' "$val" + return 0 + fi + fi + return 1 +} + +# Human hint when secrets missing (e2e prereq) +secrets_hint() { + cat <