# taler-monitoring — test IDs by area

Every check line is numbered **per area** as `AREA-NNN` (zero-padded):

| Area | Phase script | Meaning |
|------|--------------|---------|
| **www** | `check_urls.sh` | public HTTPS (outside-in) |
| **inside** | `check_inside.sh` | containers / processes on koopa |
| **versions** | `check_versions.sh` | deb.taler.net available + packages vs trixie |
| **sanity** | `check_sanity.sh` | public + server per component |
| **server** | `check_server.sh` | SSH host ports / processes |
| **e2e** | `check_e2e.sh` | withdraw + pay cycle |

Format in output:

```text
[OK]    www-001  exchange /config https://exchange…/config
[ERROR] e2e-012  bank-auth: admin token failed
[BLOCKER] e2e-015  prereq: merchant HTTP 502
```

IDs are assigned **in run order** within the area (`set_area` resets the counter). Optional soft checks still consume a number when they WARN.

---

## www — public URLs (`./taler-monitoring.sh urls`)

| ID | Check |
|----|--------|
| www-… | exchange `/config`, currency, **alt_unit_names** |
| www-… | exchange `/keys` (+ alt_unit_names soft) |
| www-… | exchange `/intro/`, `/` (302→intro) |
| www-… | **exchange `/terms`** body (not empty / not API error) |
| www-… | **exchange `/privacy`** body |
| www-… | exchange `/terms/` (200 or redirect) |
| www-… | bank `/config`, currency, **alt_unit_names** |
| www-… | bank integration / webui / intro / `/` |
| www-… | **bank `/terms`** body |
| www-… | **bank `/privacy`** (or `/intro/privacy.html` fallback) |
| www-… | merchant `/config`, currency, currencies alt_unit_names |
| www-… | each merchant `exchanges[]` `/config` alt_unit_names |
| www-… | merchant `/intro/`, `/webui/`, `/` |
| www-… | **merchant `/terms`** body (dual-currency notice) |
| www-… | **merchant `/privacy`** body (must not be `not configured`) |
| www-… | merchant `/terms/` redirect |

**Legal docs rule:** HTTP 200, non-empty body, not plain `not configured`, not merchant API JSON `code:21`. On local stack, optional content needle (terms/privacy/FADP/GOA…).

**alt_unit_names rule:** wallet codec requires a non-empty map including scale key `"0"`. For multi-currency merchant, also follow every entry in `exchanges[]` and check that exchange’s public `/config`.

(IDs after a failed early check may shift if later soft checks are skipped when body missing — numbering follows **executed** checks.)

---

## inside — koopa SSH (`./taler-monitoring.sh inside`)

| ID | Check (typical order) |
|----|------------------------|
| inside-001 | ssh koopa |
| inside-002+ | per-component emit: container, ports, libeufin/httpd, postgres, local `/config`/`/keys`, wirewatch, DNS pin, caddy |

Remote lines `E|comp|LEVEL|key|detail` each become one numbered result.

---

## sanity — bank · exchange · merchant (`./taler-monitoring.sh sanity`)

| ID | Section |
|----|---------|
| sanity-001… | bank public + server |
| sanity-… | exchange public + server |
| sanity-… | merchant public + server |

Sequential through the whole script (one `set_area sanity`).

---

## versions — packages vs deb.taler.net (`./taler-monitoring.sh versions`)

### Outside (runner / public network — no SSH)

| ID (order) | Check |
|------------|--------|
| versions-… | DNS `deb.taler.net` |
| versions-… | HTTPS portal + apt base URL |
| versions-… | suite `InRelease` / `Release` |
| versions-… | suite `Packages` + `Packages.gz` |
| versions-… | sample pool `.deb` fetchable (Range 200/206) |
| versions-… | suite offers `taler-exchange`, `taler-merchant`, `libeufin-bank` |
| versions-… | optional `trixie-testing` Packages |
| versions-… | TLS verify (soft) |

### Inside (SSH koopa containers)

| ID | Check |
|----|--------|
| versions-… | ssh koopa |
| versions-… | each container → `InRelease` (pasta can reach apt repo) |
| versions-… | each container lists `deb.taler.net` in apt sources |
| versions-… | each installed `taler*` / `libeufin*` / `libtaler*` / `libdonau*` vs suite version |
| versions-… | core packages installed (`taler-exchange`, `libeufin-bank`, `taler-merchant`) |

Outside always runs. Inside skipped with `SKIP_SSH=1` (still reports outside results).

Compare rules:

- **match** suite → OK  
- **ahead** of suite (often testing/dev) → INFO  
- **behind** suite → ERROR for core packages, WARN otherwise (`TALER_PKG_BEHIND=error` forces ERROR)

Default suite: **trixie** (`TALER_APT_SUITE`, `TALER_APT_BASE=https://deb.taler.net/apt/debian`).

Without SSH (`SKIP_SSH=1` or remote domain): still runs outside-in repo checks; skips container install compare.

---

## server — SSH ports (`./taler-monitoring.sh server`)

| ID | Check |
|----|--------|
| server-001 | ssh |
| server-002+ | containers, local pasta ports, processes, caddy |

---

## e2e — payment path (`./taler-monitoring.sh e2e`)

| ID | Step (approx.) |
|----|----------------|
| e2e-001 | budget info |
| e2e-002 | wallet-cli present |
| e2e-003 | mode / currency info |
| e2e-004… | secrets, reachability gates |
| e2e-… | account, credit, withdraw, confirm, coins, order, pay |
| e2e-… | balances, dig on failure |

Blockers keep the same ID prefix: `[BLOCKER] e2e-0NN step: message`.

---

## Run one area

```bash
./taler-monitoring.sh urls      # www only
./taler-monitoring.sh inside    # inside only
./taler-monitoring.sh versions  # deb.taler.net + package drift
./taler-monitoring.sh e2e       # e2e only
./taler-monitoring.sh -d taler.net urls
```