monitoring: find SECRETS_ROOT for e2e bank admin password

scripts/taler-monitoring/README.md

@@ -22,6 +22,28 @@ Catalog: **[TESTS.md](./TESTS.md)**.
 
 End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
 
+## Secrets (local GOA e2e)
+
+`check_e2e.sh` loads bank/merchant passwords from **koopa-admin-secrets**
+(not this repo). Search order:
+
+1. `SECRETS_ROOT` → `…/taler-bank/bank-admin-password.txt`
+2. `KOOPA_ADMIN_SECRETS` → `$KOOPA_ADMIN_SECRETS/koopa/host-root/…`
+3. Sibling of this checkout: `../koopa-admin-secrets/koopa/host-root`
+4. `$HOME/taler/src/koopa-admin-secrets/koopa/host-root` (common laptop layout)
+5. `$HOME/.config/taler-landing/bank-admin-password.txt`
+6. SSH koopa: `/root/bank-admin-password.txt` or podman bank container
+
+If you keep admin-log at `~/koopa-admin-log` but secrets under `~/taler/src/…`:
+
+```bash
+export SECRETS_ROOT="$HOME/taler/src/koopa-admin-secrets/koopa/host-root"
+# or: export KOOPA_ADMIN_SECRETS="$HOME/taler/src/koopa-admin-secrets"
+./taler-monitoring.sh e2e
+```
+
+Or one-shot: `E2E_BANK_ADMIN_PASS=… E2E_MERCHANT_TOKEN=… ./taler-monitoring.sh e2e`
+
 ## Commands
 
 ```bash
@@ -32,6 +54,7 @@ End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
 ./taler-monitoring.sh sanity
 ./taler-monitoring.sh e2e
 
+
 # Other domains — public HTTPS only, never SSH
 ./taler-monitoring.sh -d taler.net
 ./taler-monitoring.sh --domain taler-ops.ch

scripts/taler-monitoring/check_e2e.sh

@@ -440,11 +440,15 @@ else
   MPW="${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-$(read_secret "taler-merchant/merchant-goa-demo-cp4zqk-password.txt" || true)}}"
 fi
 if [ -n "$ADMIN_PASS" ]; then
-  ok "bank admin secret"
+  ok "bank admin secret" "${SECRETS_ROOT:+SECRETS_ROOT=${SECRETS_ROOT}}"
 elif [ "$E2E_REMOTE" = "1" ]; then
   warn "bank admin secret" "missing — will try public registration only"
 else
   blocker "prereq" "bank admin password missing (SECRETS_ROOT or koopa /root)"
+  info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'}"
+  if type secrets_hint >/dev/null 2>&1; then
+    while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint)
+  fi
   exit 1
 fi
 if [ -n "$MPW" ]; then
@@ -460,6 +464,10 @@ elif [ "$E2E_REMOTE" = "1" ]; then
   warn "merchant secret" "missing — private orders fail unless E2E_USE_TEMPLATES=1 (set E2E_MERCHANT_TOKEN)"
 else
   blocker "prereq" "merchant instance password missing"
+  info "secrets" "SECRETS_ROOT=${SECRETS_ROOT:-'(unset)'} — need taler-merchant/merchant-*-password.txt"
+  if type secrets_hint >/dev/null 2>&1; then
+    while IFS= read -r _line; do info "secrets-hint" "$_line"; done < <(secrets_hint)
+  fi
   exit 1
 fi
 # Authorization header for merchant private API (never double secret-token:)

scripts/taler-monitoring/lib.sh

@@ -758,25 +758,84 @@ PY
   done <<<"$list"
 }
 
+# Live bank/merchant passwords: sibling **koopa-admin-secrets** (never in admin-log).
+# Override: SECRETS_ROOT=/path/to/koopa-admin-secrets/koopa/host-root
+#           or KOOPA_ADMIN_SECRETS=/path/to/koopa-admin-secrets
 SECRETS_ROOT="${SECRETS_ROOT:-}"
+_secrets_search_log() { :; } # placeholder if we later want debug
 if [ -z "$SECRETS_ROOT" ]; then
+  _mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  _admin_log="$(cd "${_mon_dir}/../.." && pwd)"
+  # Prefer explicit env pointing at the secrets *repo* root
+  if [ -n "${KOOPA_ADMIN_SECRETS:-}" ] && [ -d "${KOOPA_ADMIN_SECRETS}/koopa/host-root/taler-bank" ]; then
+    SECRETS_ROOT="${KOOPA_ADMIN_SECRETS}/koopa/host-root"
+  fi
+fi
+if [ -z "$SECRETS_ROOT" ]; then
+  _mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  _admin_log="$(cd "${_mon_dir}/../.." && pwd)"
   for d in \
-    "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/koopa-admin-secrets/koopa/host-root" \
+    "${_admin_log}/../koopa-admin-secrets/koopa/host-root" \
+    "${_admin_log}/../../koopa-admin-secrets/koopa/host-root" \
+    "${HOME}/taler/src/koopa-admin-secrets/koopa/host-root" \
+    "${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root" \
+    "${HOME}/koopa-admin-secrets/koopa/host-root" \
     "/Users/newkamek/src/koopa/koopa-admin-secrets/koopa/host-root" \
-    "$HOME/src/koopa/koopa-admin-secrets/koopa/host-root"
+    "$(cd "${_admin_log}/../.." 2>/dev/null && pwd)/koopa-admin-secrets/koopa/host-root"
   do
-    if [ -d "$d/taler-bank" ]; then SECRETS_ROOT=$d; break; fi
+    # resolve .. without requiring the dir to exist first for cd
+    if [ -d "$d/taler-bank" ]; then
+      SECRETS_ROOT=$(cd "$d" && pwd)
+      break
+    fi
   done
+  unset _mon_dir _admin_log d
 fi
 
 read_secret() {
-  local rel="$1"
+  local rel="$1" base val=""
-  if [ -n "${SECRETS_ROOT:-}" ] && [ -f "${SECRETS_ROOT}/${rel}" ]; then
+  base=$(basename "$rel")
-    tr -d '\n' <"${SECRETS_ROOT}/${rel}"
+  if [ -n "${SECRETS_ROOT:-}" ]; then
+    if [ -f "${SECRETS_ROOT}/${rel}" ]; then
+      tr -d '\n\r' <"${SECRETS_ROOT}/${rel}"
+      return 0
+    fi
+    # also accept flat layout under host-root/
+    if [ -f "${SECRETS_ROOT}/${base}" ]; then
+      tr -d '\n\r' <"${SECRETS_ROOT}/${base}"
+      return 0
+    fi
+  fi
+  # Optional: copy under ~/.config/taler-landing/ (landing-stats style)
+  if [ -f "${HOME}/.config/taler-landing/${base}" ]; then
+    tr -d '\n\r' <"${HOME}/.config/taler-landing/${base}"
     return 0
   fi
-  koopa_ssh_ok || return 1
+  # Live on koopa host /root (same basenames as deploy)
-  koopa_ssh_run 10 "tr -d '\\n' </root/$(basename "$rel") 2>/dev/null || true" 2>/dev/null
+  if koopa_ssh_ok; then
+    val=$(koopa_ssh_run 12 "tr -d '\\n\\r' </root/${base} 2>/dev/null || true" 2>/dev/null || true)
+    if [ -n "$val" ]; then
+      printf '%s' "$val"
+      return 0
+    fi
+    # container path used by some installs
+    val=$(koopa_ssh_run 12 \
+      "podman exec taler-hacktivism-bank tr -d '\\n\\r' </root/${base} 2>/dev/null || true" 2>/dev/null || true)
+    if [ -n "$val" ]; then
+      printf '%s' "$val"
+      return 0
+    fi
+  fi
+  return 1
+}
+
+# Human hint when secrets missing (e2e prereq)
+secrets_hint() {
+  cat <<EOF
+Set SECRETS_ROOT to koopa-admin-secrets/koopa/host-root (contains taler-bank/),
+or KOOPA_ADMIN_SECRETS to the secrets repo root, or export E2E_BANK_ADMIN_PASS.
+Example (this machine): SECRETS_ROOT=\$HOME/taler/src/koopa-admin-secrets/koopa/host-root
+EOF
 }
 
 find_wallet_cli() {