release 1.7.4: monpages bare-URL soft check

Without trailing slash, some frontends still hit the merchant (code 21)
even when /monitoring/ serves suite HTML. Bare URLs WARN unless
MONPAGES_BARE_STRICT=1.

VERSION

@@ -1 +1 @@
-1.7.3
+1.7.4

VERSIONS.md

@@ -13,11 +13,12 @@ Tags and `VERSION` use **MAJOR.FEATURE.FIX** (three components), introduced in *
 | **FEATURE** | New capabilities (phases, HTML features, i18n packs, …) |
 | **FIX** | Bugfixes and docs that do not add a feature |
 
-Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.7.3`). File `VERSION` omits the `v` prefix.
+Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.7.4`). File `VERSION` omits the `v` prefix.
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
 | **v1.8.0** | *planned* | **L10n** packs for user-facing strings: **fr-CH** (FrancPaysan) and **de-CH** (hacktivism / Taler CH German). |
+| **v1.7.4** | 2026-07-18 | **Bugfix:** monpages bare URLs (`/monitoring` without `/`) WARN by default (trailing slash remains ERROR); avoids false red when slash form is live. |
 | **v1.7.3** | 2026-07-18 | Monitoring **pages themselves** as suite scope: README section + sticky “What this monitors” block (monpages / public HTML paths). |
 | **v1.7.2** | 2026-07-18 | **Bugfix:** Caddy static handles — `root` must be host dir + matcher `/monitoring*` (not leaf dir + `/monitoring/`), else file_server returns empty 404 after apply. |
 | **v1.7.1** | 2026-07-18 | Host-agent default `STRICT_EXIT=1`; monpages staging-vs-public diagnosis; re-htmlify after public check fails. |
@@ -37,7 +38,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.7.3`). File `VERSION` omits the `v` pre
 
 ## Sticky bar version (v1.3.0+)
 
-Generated HTML shows the installed release tag (e.g. `v1.7.3`) and links to Forgejo:
+Generated HTML shows the installed release tag (e.g. `v1.7.4`) and links to Forgejo:
 
 `https://git.hacktivism.ch/hernani/taler-monitoring/src/tag/<tag>`
 
@@ -67,5 +68,5 @@ Full locale packs (fr-CH / de-CH): **v1.8.0** (planned).
 
 ```bash
 git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring
-cd ~/src/taler-monitoring && git checkout v1.7.3
+cd ~/src/taler-monitoring && git checkout v1.7.4
 ```

check_monitoring_pages.sh

@@ -101,19 +101,44 @@ is_monitoring_html() {
   return 1
 }
 
+_is_bare_url() {
+  local url="$1"
+  case " ${MONPAGES_BARE_URLS:-} " in
+    *" $url "*) return 0 ;;
+  esac
+  case "$url" in
+    */) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
 check_one() {
   local url="$1"
-  local body code hint
+  local body code hint soft=0
   body=$(mktemp)
   code=$(curl -skS -L --max-redirs 5 -m "${TIMEOUT}" -o "$body" -w '%{http_code}' "$url" 2>/dev/null || echo 000)
+  if _is_bare_url "$url" && [ "${MONPAGES_BARE_STRICT:-0}" != "1" ]; then
+    soft=1
+  fi
   if grep -qE '"code"[[:space:]]*:[[:space:]]*21' "$body" 2>/dev/null \
     || grep -qiE 'There is no endpoint defined for the URL' "$body" 2>/dev/null; then
+    if [ "$soft" = "1" ]; then
+      warn "public mon page bare URL" \
+        "$url -> HTTP $code code 21 (prefer trailing slash; set MONPAGES_BARE_STRICT=1 to ERROR)"
+      rm -f "$body"
+      return 0
+    fi
     fail "public mon page missing" \
       "$url -> HTTP $code merchant/API JSON code 21 (Caddy handle not live — sudo ~/koopa-caddy/apply-monitoring-live.sh)"
     rm -f "$body"
     return 1
   fi
   if [ "$code" != "200" ]; then
+    if [ "$soft" = "1" ]; then
+      warn "public mon page bare URL" "$url -> HTTP $code (prefer trailing slash form)"
+      rm -f "$body"
+      return 0
+    fi
     fail "public mon page" "$url -> HTTP $code (want 200 HTML)"
     rm -f "$body"
     return 1
@@ -145,21 +170,29 @@ while IFS= read -r line; do
   URLS+=("$line")
 done < <(build_urls)
 
-# also check non-trailing-slash forms (Caddy redir or merchant fallthrough)
-_extra=()
-for u in "${URLS[@]}"; do
-  case "$u" in
-    */) _bare=${u%/}; [ -n "$_bare" ] && _extra+=("$_bare") ;;
-  esac
-done
-for u in "${_extra[@]+"${_extra[@]}"}"; do
-  skip=0
-  for e in "${URLS[@]+"${URLS[@]}"}"; do
-    [ "$e" = "$u" ] && skip=1 && break
+# Bare URLs without trailing slash: optional soft check (default on).
+# Many reverse proxies only redirect /monitoring → /monitoring/; bare may hit the app (code 21).
+# MONPAGES_CHECK_BARE=0  → skip bare entirely
+# MONPAGES_BARE_STRICT=1 → bare failures are ERROR (default: WARN if slash form exists)
+if [ "${MONPAGES_CHECK_BARE:-1}" = "1" ]; then
+  _extra=()
+  for u in "${URLS[@]}"; do
+    case "$u" in
+      */) _bare=${u%/}; [ -n "$_bare" ] && _extra+=("$_bare") ;;
+    esac
   done
-  [ "$skip" = "1" ] && continue
-  URLS+=("$u")
-done
+  for u in "${_extra[@]+"${_extra[@]}"}"; do
+    skip=0
+    for e in "${URLS[@]+"${URLS[@]}"}"; do
+      [ "$e" = "$u" ] && skip=1 && break
+    done
+    [ "$skip" = "1" ] && continue
+    URLS+=("$u")
+    # mark bare for soft handling via env list
+    MONPAGES_BARE_URLS="${MONPAGES_BARE_URLS:-} $u"
+  done
+  export MONPAGES_BARE_URLS
+fi
 
 if [ "${#URLS[@]}" -eq 0 ]; then
   fail "monpages" "no URLs to check (set MON_HOSTS or MONITORING_PAGE_URLS)"