docs: login-health README single-CTR GOA inventory

scripts/login-health/README.md

@@ -1,115 +1,81 @@
 # login-health — status on SSH login (koopa)
 
-When you **SSH into koopa**, show a short **pre-collected** health snapshot so you see whether **git.hacktivism.ch** (Forgejo), Taler GOA, Caddy edge, and the rest of the LIVE inventory are up.
+SSH login shows a short **pre-collected** snapshot: Forgejo, GOA (`goa-regio-ng`), Caddy edge, host Tor, rest of inventory.
 
-Inventory source: `host/overview/LIVE.md`, `configs/ports.md`.
+Inventory: `configs/ports.md` + this script’s arrays (not `host/overview/`).
 
-## New / changed services (mandatory)
+## New / changed services
 
-Whenever a **new service** is added on koopa (or ports/vhosts change), update **in the same work package**:
+Same package:
 
 1. `koopa-login-health.sh` — `EXPECT_CONTAINERS`, `PROBES`, critical vs optional  
-2. `host/overview/LIVE.md` + `configs/ports.md` (and `services.md` if the diagram changes)  
+2. `configs/ports.md`  
-3. Deploy script to `~/.local/bin/koopa-login-health` on koopa (laptop commits/pushes; **no git commit on koopa**)  
+3. Deploy → `~/.local/bin/koopa-login-health` on koopa (no git commit on koopa)  
-4. `koopa-login-health collect` so the next SSH login is not stale  
+4. `koopa-login-health collect`
 
-Grok workflows: `koopa-services-health` (inventory drift) + `commit-rules` (planning rule 10).
+Workflow: `koopa-services-health`.
 
 ## Design: no probes at login
 
-| Path | What runs |
+| Path | What |
-|------|-----------|
+|------|------|
-| **systemd user timer** (every **5 min** + soon after boot) | `koopa-login-health collect` — podman, Caddy, loopback HTTP, write snapshot |
+| **user timer** (5 min + after boot) | `collect` — podman, Caddy, Tor, loopback HTTP → snapshot |
-| **SSH / bashrc** | `koopa-login-health show` only — **cat** last snapshot (milliseconds, no curl/podman) |
+| **SSH / bashrc** | `show` only — cat snapshot |
 
-Snapshot files (`XDG_STATE_HOME`, default `~/.local/state/koopa-login-health/`):
+State: `~/.local/state/koopa-login-health/` (`status.compact` / `.verbose` / `.meta`).  
-
+Stale if older than `KOOPA_HEALTH_STALE_SEC` (default 900).
-| File | Content |
-|------|---------|
-| `status.compact` | login view (WARN/FAIL + overall) |
-| `status.verbose` | full line list |
-| `status.meta` | `overall=`, `collected_at=` (unix), RFC date |
-
-If the snapshot is older than **`KOOPA_HEALTH_STALE_SEC`** (default **900** = 15 min), `show` prints a **stale** warning (timer likely down).
 
 ## Login must never break
 
-| Guard | What it does |
+`KOOPA_HEALTH_FROM_LOGIN=1` → exit 0 · `timeout 2s` · `|| true` · `bash -n` on install.  
-|-------|----------------|
-| **show only** | bashrc never runs `collect` |
-| **`KOOPA_HEALTH_FROM_LOGIN=1`** | always exit 0 |
-| **`timeout 2s`** | wall cap to cat a few KB |
-| **`\|\| true` / `set +e`** | hook cannot abort the shell |
-| **`bash -n`** on install | refuse a broken bashrc hook |
-
 Skip: `KOOPA_SKIP_HEALTH=1 ssh koopa`
 
 ## What you see
 
 ```text
-koopa health  koopa  Wed, …
+koopa health  koopa  Sat, 19 Sep 2026 …
 git.hacktivism.ch = Forgejo :9024/:9200 · edge Caddy :9000/:9001
-  OK  all critical checks passed (42 ok)
+  OK  all critical checks passed (… ok)
-overall: OK   ok=42 warn=0 fail=0
+overall: OK   ok=… warn=0 fail=0
-  checked: Wed, … (3m ago)  [timer snapshot; not live at login]
 ```
 
-## Checks (on collect only)
+## Checks (collect only)
 
 | Area | What |
 |------|------|
 | Edge | `caddy.service`, proxy sockets |
+| Tor | host `tor.service` (ORPort 8080 / ControlPort 9051) — WARN if down |
 | Listen | critical + optional ports |
-| Podman | LIVE container names |
+| Podman | `goa-regio-ng`, forgejo, optional apps |
-| HTTP | loopback backends (2s curl, parallel) |
+| HTTP | loopback backends (2s curl) |
 | Git SSH | TCP `:9200` |
 
-**Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports.  
+**Critical** (FAIL): `goa-regio-ng`, `koopa-forgejo`, edge/ports **9010–9012**, **9024**, **9200**.  
-**Optional** (→ WARN): castopod, bonfire, lemmy, decidim, prime, bt, paivana, tops, tor, nym.
+**Optional** (WARN): castopod, bonfire, lemmy, decidim, prime, bt, paivana, tops, nym.
 
-Collect also checks **linger** and that Lemmy/Decidim user units are **enabled** (reboot survival).
+GOA = single CTR `goa-regio-ng` (pasta **9010–9015**). Landings **9013–9015** host-side (`~/goa-landing-deploy`).  
+Legacy `taler-hacktivism*` / `koopa-tor-relay` are not expected.
 
 Read-only. No restarts, no secrets.
 
-## Install (on koopa as `hernani`)
+## Install (koopa as `hernani`)
 
 ```bash
 cd ~/src/koopa/koopa-admin-log
 ./scripts/login-health/install-login-health.sh
-```
-
-Installs binary, user units, bashrc hook, enables timer, runs one collect.
-
-Linger (so the timer runs after reboot without an open SSH session):
-
-```bash
 sudo loginctl enable-linger hernani
 ```
 
 ## Manual
 
 ```bash
-koopa-login-health              # show compact snapshot
+koopa-login-health
-koopa-login-health show -v      # verbose snapshot
+koopa-login-health show -v
-koopa-login-health show -q      # overall (+ stale note)
+koopa-login-health collect
-koopa-login-health collect      # refresh now (same as the timer unit)
-systemctl --user start koopa-login-health.service
 systemctl --user status koopa-login-health.timer
 ```
 
-## Uninstall
-
-```bash
-systemctl --user disable --now koopa-login-health.timer
-rm -f ~/.config/systemd/user/koopa-login-health.{service,timer}
-systemctl --user daemon-reload
-rm -f ~/.local/bin/koopa-login-health
-# remove marked block in ~/.bashrc
-rm -rf ~/.local/state/koopa-login-health
-```
-
 ## Related
 
-- Grok workflow `koopa-services-health` (laptop public HTTPS + generated mon pages)  
+- `configs/ports.md` · `host/tor/README.md` (host Tor)  
-- `scripts/taler-sanity/check_stack-health.sh` (deeper Taler, often root)  
 - units: `configs/systemd/user/koopa-login-health.{service,timer}`