diff --git a/README.md b/README.md
index f035530..8ab709a 100644
--- a/README.md
+++ b/README.md
@@ -138,7 +138,7 @@ Each check prints **global** and **grouped** ids:
 # inside: low-priv SSH francpaysan-stage-user (User stagepaysan) → podman
 #   containers stage-lfp-{bank,exchange-ansible,merchant} · ports 9032/9031/9030
 # stats: outside-in public …/intro/stats.json (age via generated_at_unix)
-# Admin credit for e2e: E2E_BANK_ADMIN_PASS=… or francpaysan-host secrets
+# Admin credit for e2e: E2E_BANK_ADMIN_PASS=… or stage host secrets
 #   (bank-admin-password.txt under /mnt/data/stagepaysan/bank/secrets/)
 # Override: INSIDE_SSH=… INSIDE_PROFILE=stage-lfp
 
@@ -374,7 +374,7 @@ snapshotted via SSH whenever the stack is under load:
 ```bash
 # LAN down? force WAN DNAT host
 KOOPA_SSH=koopa-external ./taler-monitoring.sh inside
-# or rely on automatic fallback (default KOOPA_SSH_FALLBACKS=koopa-external)
+# or rely on automatic fallback (KOOPA_SSH_FALLBACKS from env)
 
 METRICS_LOAD=0 ./taler-monitoring.sh e2e   # skip host probes
 LADDER_LOAD=0 ./taler-monitoring.sh ladder
@@ -383,7 +383,7 @@ LADDER_LOAD=0 ./taler-monitoring.sh ladder
 | Env | Default | Meaning |
 |-----|---------|---------|
 | `KOOPA_SSH` | `koopa` | primary SSH host |
-| `KOOPA_SSH_FALLBACKS` | `koopa-external` | tried if primary fails |
+| `KOOPA_SSH_FALLBACKS` | *(from env)* | tried if primary fails |
 | `METRICS_LOAD` | `1` | `0` = skip all host/container load probes |
 | `LADDER_LOAD` | `1` | `0` = skip load in ladder only |
 | `LADDER_PAY` | `1` | `0` = skip payment ladder after withdraws |
@@ -393,7 +393,7 @@ LADDER_LOAD=0 ./taler-monitoring.sh ladder
 
 ## Needs
 
-- SSH `koopa` or `koopa-external` (inside / load / sanity server bits)
+- SSH via `KOOPA_SSH` / `KOOPA_SSH_FALLBACKS` (env) (inside / load / sanity server bits)
 - secrets under `koopa-admin-secrets/...` for e2e
 - `taler-wallet-cli` for e2e
 
@@ -418,7 +418,7 @@ Soft mode only with `MONPAGES_REQUIRE_PUBLIC=0` (escape hatch).
 ./taler-monitoring.sh -d lefrancpaysan.ch monpages
 ```
 
-If pages are missing publicly: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh` on koopa
+If pages are missing publicly: `sudo $APPLY_MONITORING_LIVE` on koopa
 (FP: Infomaniak vhost for `/monitoring*`).
 
 ## Devtesting · fake-franken CHF (v1.13+)
diff --git a/TESTS.md b/TESTS.md
index cd80328..9826fd7 100644
--- a/TESTS.md
+++ b/TESTS.md
@@ -126,7 +126,7 @@ When filing an issue, quote the full id + label, e.g.
 | **aptdeploy.trixie-upgrade-** | upgrade-track `…-trixie-upgrade` (install once, then mytops-style upgrade) |
 | **aptdeploy.trixie-testing-upgrade-** | upgrade-track `…-trixie-testing-upgrade` |
 
-Standalone: `host-agent/run-aptdeploy.sh` (on koopa local; else `ssh koopa-external`).
+Standalone: `host-agent/run-aptdeploy.sh` (on koopa local; else ssh `$DEPLOY_SSH` / `$APT_DEPLOY_SSH`).
 
 ### surface (remote-only public inventory)
 
diff --git a/VERSION b/VERSION
index 43ded90..2e3a551 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.13.5
+1.13.6
diff --git a/VERSIONS.md b/VERSIONS.md
index c5815e4..4c22d33 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.13.6** | 2026-07-19 | **Bugfix:** machine paths and SSH hosts only via env (`~/.config/taler-monitoring/env` / `taler-monitoring-env`); suite loads env before defaults; no `/home/hernani` or bogus host hardcodes. |
 | **v1.13.5** | 2026-07-19 | **Bugfix:** progress bar — env-aware phase estimates (CHECK_BANK/LANDING, mon hosts); re-fit total after each phase (done+remaining); drop fake +12 for host-agent monpages post-check (fixes stage 42/139→46/46 snap). |
 | **v1.13.4** | 2026-07-19 | **Bugfix:** monpages race-proof — atomic HTML write; rsync `--delay-updates` + settle; fetch retries; larger head windows; pre-publish soft content (`MONPAGES_PRE_PUBLISH`); bootstrap markers. |
 | **v1.13.3** | 2026-07-19 | **Bugfix:** sticky **generated** time in **Europe/Zurich** (CEST/CET · MESZ/MEZ), not UTC `…Z`; ISO keeps offset for age JS. |
diff --git a/android-test/run-goa-gui-chain.sh b/android-test/run-goa-gui-chain.sh
index 1c20a63..5009b03 100755
--- a/android-test/run-goa-gui-chain.sh
+++ b/android-test/run-goa-gui-chain.sh
@@ -91,7 +91,7 @@ if [[ -z "${EXP_PW_FILE:-}" ]]; then
 fi
 # stage: try stagepaysan secret via ssh if missing
 if [[ ! -f "${EXP_PW_FILE:-}" && "$STACK" = "stage" ]]; then
-  for host in francpaysan-stage-user francpaysan-host; do
+  for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
     tmp=$(mktemp)
     if ssh -o BatchMode=yes -o ConnectTimeout=10 "$host" \
       'tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt' \
diff --git a/check_devtesting.sh b/check_devtesting.sh
index 575138c..088ddd7 100755
--- a/check_devtesting.sh
+++ b/check_devtesting.sh
@@ -34,7 +34,7 @@ if [ "${DEVTESTING_SKIP:-0}" = "1" ]; then
   exit 0
 fi
 
-: "${DEVTESTING_SSH:=taler-rusty-devtesting}"
+: "${DEVTESTING_SSH:=}"
 : "${DEVTESTING_AMOUNT:=CHF:1.00}"
 : "${DEVTESTING_EXCHANGE_IBAN:=CH6808573105529100001}"
 : "${SSH_CONNECT_TIMEOUT:=8}"
diff --git a/check_e2e.sh b/check_e2e.sh
index 05cb5f7..75a1157 100755
--- a/check_e2e.sh
+++ b/check_e2e.sh
@@ -426,7 +426,7 @@ else
   warn "alt_unit_names" "using built-in SI fallback"
 fi
 
-# Host + bank/exchange/merchant RAM/CPU/load (SSH koopa or koopa-external)
+# Host + bank/exchange/merchant RAM/CPU/load (SSH via KOOPA_SSH from env)
 set_group load
 section "e2e · load snapshot (before withdraw/pay)"
 metrics_report_load "${METRICS_DIR}/load-before.json" "e2e-start" || true
@@ -437,51 +437,50 @@ if [ "$E2E_REMOTE" = "1" ]; then
   ADMIN_PASS="${E2E_BANK_ADMIN_PASS:-${BANK_ADMIN_PASS:-}}"
   MPW="${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-}}"
   # Stage FrancPaysan: allow admin credit without committing passwords.
-  # Order: already-set env → local secrets tree → SSH francpaysan-host (ops laptop).
+  # Order: env → FRANCPAYSAN_SECRETS → SSH FRANCPAYSAN_SSH/INSIDE_SSH + remote secret paths.
   if [ -z "$ADMIN_PASS" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
     _fp_try=""
-    for _fp_try in \
-      "${FRANCPAYSAN_SECRETS:-}/stage/bank-admin-password.txt" \
-      "${HOME}/francpaysan-secrets/stage/bank-admin-password.txt" \
-      "${HOME}/src/francpaysan-secrets/stage/bank-admin-password.txt" \
-      "${HOME}/taler/src/francpaysan-secrets/stage/bank-admin-password.txt"
-    do
-      if [ -n "$_fp_try" ] && [ -f "$_fp_try" ]; then
+    if [ -n "${FRANCPAYSAN_SECRETS:-}" ]; then
+      _fp_try="${FRANCPAYSAN_SECRETS}/stage/bank-admin-password.txt"
+      if [ -f "$_fp_try" ]; then
         ADMIN_PASS=$(tr -d '\n\r' <"$_fp_try")
         info "bank admin secret" "from $_fp_try"
-        break
       fi
-    done
+    fi
     if [ -z "$ADMIN_PASS" ] && command -v ssh >/dev/null 2>&1; then
-      for _fp_host in "${FRANCPAYSAN_SSH:-francpaysan-host}" francpaysan-host; do
+      _remote_bank_sec="${FRANCPAYSAN_REMOTE_BANK_ADMIN_SECRET:-}"
+      [ -z "$_remote_bank_sec" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
+        _remote_bank_sec="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/bank/secrets/bank-admin-password.txt"
+      for _fp_host in ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"} ${INSIDE_SSH:+"$INSIDE_SSH"}; do
+        [ -n "$_fp_host" ] && [ -n "$_remote_bank_sec" ] || continue
         ADMIN_PASS=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "$_fp_host" \
-          'sudo cat /mnt/data/stagepaysan/bank/secrets/bank-admin-password.txt 2>/dev/null' \
+          "sudo cat ${_remote_bank_sec} 2>/dev/null" \
           2>/dev/null | tr -d '\n\r' || true)
         if [ -n "$ADMIN_PASS" ]; then
-          info "bank admin secret" "from ${_fp_host}:/mnt/data/stagepaysan/bank/secrets/"
+          info "bank admin secret" "from ${_fp_host} (remote path via env)"
           break
         fi
       done
     fi
-    unset _fp_try _fp_host
+    unset _fp_try _fp_host _remote_bank_sec
   fi
   # Stage merchant: public templates need no token; optional default-instance token
   if [ -z "$MPW" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
-    for _fp_try in \
-      "${FRANCPAYSAN_SECRETS:-}/stage/default-instance-token.txt" \
-      "${HOME}/francpaysan-secrets/stage/default-instance-token.txt"
-    do
-      if [ -n "$_fp_try" ] && [ -f "$_fp_try" ]; then
-        MPW=$(tr -d '\n\r' <"$_fp_try")
-        break
-      fi
-    done
-    if [ -z "$MPW" ] && command -v ssh >/dev/null 2>&1; then
-      MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "${FRANCPAYSAN_SSH:-francpaysan-host}" \
-        'sudo cat /mnt/data/stagepaysan/merchant/secrets/default-instance-token.txt 2>/dev/null' \
-        2>/dev/null | tr -d '\n\r' || true)
+    if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
+      MPW=$(tr -d '\n\r' <"${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt")
+    fi
+    if [ -z "$MPW" ] && command -v ssh >/dev/null 2>&1; then
+      _remote_mer_sec="${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:-}"
+      [ -z "$_remote_mer_sec" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
+        _remote_mer_sec="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/merchant/secrets/default-instance-token.txt"
+      _fp_host="${FRANCPAYSAN_SSH:-${INSIDE_SSH:-}}"
+      if [ -n "$_fp_host" ] && [ -n "$_remote_mer_sec" ]; then
+        MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "$_fp_host" \
+          "sudo cat ${_remote_mer_sec} 2>/dev/null" \
+          2>/dev/null | tr -d '\n\r' || true)
+      fi
+      unset _fp_host _remote_mer_sec
     fi
-    unset _fp_try
   fi
 else
   ADMIN_PASS="${E2E_BANK_ADMIN_PASS:-$(read_secret "taler-bank/bank-admin-password.txt" || true)}"
diff --git a/check_goa_ladder.sh b/check_goa_ladder.sh
index d7c60ae..410205f 100755
--- a/check_goa_ladder.sh
+++ b/check_goa_ladder.sh
@@ -195,25 +195,20 @@ resolve_explorer_pw() {
     || [[ "${TALER_DOMAIN:-}" == stage.*lefrancpaysan* ]] \
     || [[ "${TALER_DOMAIN:-}" == *stage.lefrancpaysan* ]]; then
     for f in \
-      "${FRANCPAYSAN_SECRETS:-}/stage/bank-explorer-password.txt" \
-      "${HOME}/francpaysan-secrets/stage/bank-explorer-password.txt" \
-      "${HOME}/src/francpaysan-secrets/stage/bank-explorer-password.txt" \
-      "${HOME}/taler/src/francpaysan-secrets/stage/bank-explorer-password.txt" \
+      ${FRANCPAYSAN_SECRETS:+"${FRANCPAYSAN_SECRETS}/stage/bank-explorer-password.txt"} \
       "${HOME}/.config/taler-landing/stage-bank-explorer-password.txt"
     do
       [ -n "$f" ] && [ -f "$f" ] || continue
       tr -d '\n\r' <"$f"
       return 0
     done
-    for host in \
-      "${INSIDE_SSH:-}" \
-      francpaysan-stage-user \
-      francpaysan-host
-    do
-      [ -n "$host" ] || continue
+    _remote_exp="${FRANCPAYSAN_REMOTE_BANK_EXPLORER_SECRET:-}"
+    [ -z "$_remote_exp" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
+      _remote_exp="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/bank/secrets/bank-explorer-password.txt"
+    for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
+      [ -n "$host" ] && [ -n "$_remote_exp" ] || continue
       pw=$(ssh -o BatchMode=yes -o ConnectTimeout=12 "$host" \
-        'tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt 2>/dev/null \
-         || sudo tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt 2>/dev/null' \
+        "tr -d '\\n\\r' <${_remote_exp} 2>/dev/null || sudo tr -d '\\n\\r' <${_remote_exp} 2>/dev/null" \
         2>/dev/null || true)
       if [ -n "$pw" ]; then
         printf '%s' "$pw"
@@ -230,7 +225,6 @@ resolve_explorer_pw() {
   fi
   for f in \
     "${SECRETS_ROOT:+${SECRETS_ROOT}/taler-bank/bank-explorer-password.txt}" \
-    "${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root/taler-bank/bank-explorer-password.txt" \
     "${HOME}/.config/taler-landing/bank-explorer-password.txt"
   do
     [ -n "$f" ] && [ -f "$f" ] || continue
@@ -962,23 +956,21 @@ if [ "${LADDER_PAY}" = "1" ] && [ -n "${PAY_LIST:-}" ] && [ "$FAIL_N_L" -eq 0 ];
     MPW=$(read_secret "taler-merchant/merchant-goa-demo-cp4zqk-password.txt" 2>/dev/null || true)
   fi
   if [ -z "$MPW" ] && [ "${CUR}" = "TESTPAYSAN" ]; then
-    for f in \
-      "${FRANCPAYSAN_SECRETS:-}/stage/default-instance-token.txt" \
-      "${HOME}/francpaysan-secrets/stage/default-instance-token.txt" \
-      "${HOME}/src/francpaysan-secrets/stage/default-instance-token.txt"
-    do
-      [ -f "$f" ] || continue
-      MPW=$(tr -d '\n\r' <"$f")
-      break
-    done
+    if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
+      MPW=$(tr -d '\n\r' <"${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt")
+    fi
     if [ -z "$MPW" ]; then
-      for host in "${INSIDE_SSH:-}" francpaysan-stage-user francpaysan-host; do
-        [ -n "$host" ] || continue
+      _remote_mer="${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:-}"
+      [ -z "$_remote_mer" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
+        _remote_mer="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/merchant/secrets/default-instance-token.txt"
+      for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
+        [ -n "$host" ] && [ -n "$_remote_mer" ] || continue
         MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=12 "$host" \
-          'tr -d "\n\r" </mnt/data/stagepaysan/merchant/secrets/default-instance-token.txt 2>/dev/null || true' \
+          "tr -d '\\n\\r' <${_remote_mer} 2>/dev/null || true" \
           2>/dev/null || true)
         [ -n "$MPW" ] && break
       done
+      unset _remote_mer
     fi
   fi
   if [ -z "$MPW" ]; then
diff --git a/check_inside.sh b/check_inside.sh
index 7f62880..08d3d5d 100755
--- a/check_inside.sh
+++ b/check_inside.sh
@@ -52,10 +52,10 @@ section "inside · collect (${PROFILE} · access=${INSIDE_ACCESS})"
 info "flags" "INSIDE_ACCESS=${INSIDE_ACCESS} INSIDE_PODMAN=${INSIDE_PODMAN:-0} INSIDE_MODE=${INSIDE_MODE:-} LOCAL_STACK=${LOCAL_STACK:-0} SKIP_SSH=${SKIP_SSH:-0} KOOPA_SSH=${KOOPA_SSH:-} INSIDE_SSH=${INSIDE_SSH:-}"
 
 # ---------------------------------------------------------------------------
-# stage-lfp: low-priv stagepaysan on francpaysan-host
+# stage-lfp: low-priv stagepaysan on the FP stage host (INSIDE_SSH)
 # ---------------------------------------------------------------------------
 if [ "$PROFILE" = "stage-lfp" ]; then
-  SSH_HOST="${INSIDE_SSH:-francpaysan-stage-user}"
+  SSH_HOST="${INSIDE_SSH:-}"
   BANK_CTR="${INSIDE_BANK_CTR:-stage-lfp-bank}"
   EX_CTR="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
   MER_CTR="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
diff --git a/check_monitoring_pages.sh b/check_monitoring_pages.sh
index ad1ead2..6135612 100755
--- a/check_monitoring_pages.sh
+++ b/check_monitoring_pages.sh
@@ -209,7 +209,7 @@ build_urls() {
         if [ "$fam" = "goa" ] || [ "$fam" = "fp" ]; then
           _catalog_urls "$fam"
           # On-disk discovery (err pages only exist after failed runs; extras welcome)
-          _discover_tree "${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}" "$fam"
+          [ -n "${DEPLOY_WWW_ROOT:-}" ] && _discover_tree "${DEPLOY_WWW_ROOT}" "$fam"
           _discover_tree "${MONPAGES_STAGING_BASE:-${HTML_OUT:-${HTML_BASE:-$HOME/monitoring-sites-staging}}}" "$fam"
         fi
         ;;
@@ -437,7 +437,7 @@ check_one() {
         continue
       fi
       _mon_fail_or_soft "public mon page missing" \
-        "$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle; apply: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)" || { rm -f "$body"; return 1; }
+        "$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle${APPLY_MONITORING_LIVE:+; apply: sudo $APPLY_MONITORING_LIVE})" || { rm -f "$body"; return 1; }
       rm -f "$body"
       return 0
     fi
@@ -578,7 +578,7 @@ done
 if [ "$ec" -ne 0 ]; then
   echo "  hint: public monitoring HTML not served (404 / merchant code 21)"
   echo "        publish staging HTML + configure reverse-proxy/Caddy handle for mon paths"
-  echo "        (on koopa: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)"
+  echo "        (set APPLY_MONITORING_LIVE in env; sudo "$APPLY_MONITORING_LIVE")"
   echo "        bare code 21: Caddy redir inside handle must be: redir * /path/ 302 (not redir /path/ 302)"
   if [ "$_fam" = "fp" ]; then
     echo "        FP: only FP mon hosts are checked — wire Infomaniak vhost for /monitoring*"
@@ -599,7 +599,7 @@ if [ "$ec" -ne 0 ]; then
       fi
     done
   fi
-  _www="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
+  _www="${DEPLOY_WWW_ROOT:-}"
   if [ -e "$_www" ] && [ ! -w "$_www" ]; then
     echo "        DEPLOY_WWW_ROOT=$_www not writable by $(id -un 2>/dev/null || echo user)"
   fi
diff --git a/check_versions.sh b/check_versions.sh
index 071d9f8..3abc9ae 100755
--- a/check_versions.sh
+++ b/check_versions.sh
@@ -178,7 +178,7 @@ if [ "${INSIDE_PODMAN:-0}" = "1" ] || [ "${INSIDE_MODE:-}" = "local-podman" ]; t
 elif [ "${INSIDE_PROFILE:-}" = "stage-lfp" ] \
   || [ "${EXPECT_CURRENCY:-}" = "TESTPAYSAN" ] \
   || [ -n "${INSIDE_SSH:-}" ]; then
-  _VERS_SSH_HOST="${INSIDE_SSH:-francpaysan-stage-user}"
+  _VERS_SSH_HOST="${INSIDE_SSH:-}"
   _VERS_BANK="${INSIDE_BANK_CTR:-stage-lfp-bank}"
   _VERS_EX="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
   _VERS_MER="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
diff --git a/host-agent/README.md b/host-agent/README.md
index e838ebf..8e006c6 100644
--- a/host-agent/README.md
+++ b/host-agent/README.md
@@ -21,7 +21,7 @@ Thin wrappers only set stack defaults:
 | `run-fp-stage-monitoring.sh` | FP stage | `stagepaysan` |
 | `run-fp-prod-monitoring.sh` | FP prod | `francpaysan` |
 | `run-host-report.sh` + `taler-monitoring-mytops-stage.{service,timer}` | mytops **stage / betel** only | `taler-monitoring` @ betel (4h) |
-| `run-aptdeploy.sh` | CLI: ensure + **aptdeploy** (no HTML) | local if hostname=koopa, else **ssh koopa-external** |
+| `run-aptdeploy.sh` | CLI: ensure + **aptdeploy** (no HTML) | local if hostname=koopa, else **ssh $DEPLOY_SSH** |
 | `run-aptdeploy-monitoring.sh` | apt-src tests → `/taler-monitoring-aptdeploy*` | `hernani` @ koopa (4h) |
 | `run-surface-monitoring.sh` | **surface** → only `/taler-monitoring-surface*` (ecosystem + mail + mattermost + versions) | `hernani` @ koopa (hourly) |
 | `run-mail-monitoring.sh` / `run-mattermost-monitoring.sh` | **deprecated v1.8.0** — aliases of surface | disabled timers |
@@ -110,7 +110,7 @@ cp ~/src/taler-monitoring/host-agent/env.example \
    ~/.config/taler-monitoring/env
 
 # ops workstation:
-./host-agent/install-host-agent.sh --remote koopa-external
+./host-agent/install-host-agent.sh --remote $DEPLOY_SSH
 
 # or on koopa:
 ~/src/taler-monitoring/host-agent/install-host-agent.sh
diff --git a/host-agent/ROOT-APPLY-MONITORING.md b/host-agent/ROOT-APPLY-MONITORING.md
index 3d4e298..0a594d1 100644
--- a/host-agent/ROOT-APPLY-MONITORING.md
+++ b/host-agent/ROOT-APPLY-MONITORING.md
@@ -17,15 +17,15 @@ Public URLs return **merchant/bank JSON** like:
 or a **404 HTML** page from the app reverse_proxy.
 
 Cause: live `/etc/caddy/Caddyfile` has **no** `handle /monitoring*` (falls through to
-API). Prepared config is only under **`/home/hernani/koopa-caddy/Caddyfile`**.
+API). Prepared config is only under **`$KOOPA_CADDY_DIR/Caddyfile`**.
 
 ## One-shot as root (recommended)
 
 ```bash
 # absolute path required: as root, ~ is /root (not /home/hernani)
-sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
+sudo $APPLY_MONITORING_LIVE
 # or already root:
-# /home/hernani/koopa-caddy/apply-monitoring-live.sh
+# $APPLY_MONITORING_LIVE
 ```
 
 **Caddy bare-path redir (v1.9.2+):** inside a `handle` block use
@@ -52,14 +52,14 @@ There is **no** public page `/taler-monitoring`. Each family needs **bare and sl
 | **taler-monitoring-aptdeploy** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-aptdeploy.timer` (4h) |
 
 HTML is generated as **hernani** into  
-`/home/hernani/monitoring-sites-staging/`.
+`$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/`.
 
 ## Manual equivalent
 
 ```bash
-rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
+rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
 chown -R hernani:caddy /var/www/monitoring-sites && chmod -R g+rwX /var/www/monitoring-sites
-sudo /home/hernani/koopa-caddy/apply.sh   # or apply-monitoring-live.sh
+sudo $KOOPA_CADDY_DIR/apply.sh   # or apply-monitoring-live.sh
 ```
 
 Expect **200** (HTML with sticky bar). Not merchant JSON `code:21`.
@@ -67,7 +67,7 @@ Expect **200** (HTML with sticky bar). Not merchant JSON `code:21`.
 ## After each monitoring run (if www is not hernani-writable)
 
 ```bash
-rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
+rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
 chown -R caddy:caddy /var/www/monitoring-sites
 ```
 
diff --git a/host-agent/apply-monitoring-live.sh b/host-agent/apply-monitoring-live.sh
index c073050..4916ba8 100755
--- a/host-agent/apply-monitoring-live.sh
+++ b/host-agent/apply-monitoring-live.sh
@@ -2,10 +2,10 @@
 # ONE-SHOT as root: publish monitoring HTML + enable Caddy handles
 #
 # Suite copy (taler-monitoring host-agent). Live install path on koopa:
-#   /home/hernani/koopa-caddy/apply-monitoring-live.sh
+#   ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
 # Prefer absolute path ( ~ expands to /root when already root ):
-#   sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
-#   /home/hernani/koopa-caddy/apply-monitoring-live.sh   # if already root
+#   sudo ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
+#   ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh   # if already root
 #
 # After editing here: rsync to koopa ~/koopa-caddy/ before root apply.
 set -euo pipefail
@@ -13,9 +13,9 @@ if [[ "$(id -u)" -ne 0 ]]; then
   exec sudo -E "$0" "$@"
 fi
 
-STAGING=/home/hernani/monitoring-sites-staging
-WWW=/var/www/monitoring-sites
-SRC=/home/hernani/koopa-caddy/Caddyfile
+STAGING="${DEPLOY_STAGING:-${HTML_OUT:-$HOME/monitoring-sites-staging}}"
+WWW="${DEPLOY_WWW_ROOT:?set DEPLOY_WWW_ROOT in env}"
+SRC="${KOOPA_CADDY_DIR:?set KOOPA_CADDY_DIR in env}/Caddyfile"
 DST=/etc/caddy/Caddyfile
 
 if [[ ! -f "$SRC" ]]; then
diff --git a/host-agent/ensure-apt-deploy-test-containers.sh b/host-agent/ensure-apt-deploy-test-containers.sh
index 980c0e0..5abd9c5 100755
--- a/host-agent/ensure-apt-deploy-test-containers.sh
+++ b/host-agent/ensure-apt-deploy-test-containers.sh
@@ -11,7 +11,7 @@
 #     koopa-taler-deploy-test-apt-src-trixie-upgrade
 #     koopa-taler-deploy-test-apt-src-trixie-testing-upgrade
 #
-# Run as hernani on koopa. From elsewhere use run-aptdeploy.sh (ssh koopa-external).
+# Run as hernani on koopa. From elsewhere use run-aptdeploy.sh (ssh $DEPLOY_SSH or $APT_DEPLOY_SSH).
 #
 set -euo pipefail
 
diff --git a/host-agent/install-host-agent.sh b/host-agent/install-host-agent.sh
index 0cea74c..4432a5e 100755
--- a/host-agent/install-host-agent.sh
+++ b/host-agent/install-host-agent.sh
@@ -4,14 +4,14 @@
 #   # on koopa as hernani:
 #   ~/src/taler-monitoring/host-agent/install-host-agent.sh
 #   # or from laptop:
-#   ./install-host-agent.sh --remote koopa-external
+#   ./install-host-agent.sh --remote $DEPLOY_SSH
 #
 # Suite tree is ONLY ~/src/taler-monitoring (standalone repo). No koopa-admin-log.
 #
 set -euo pipefail
 ROOT=$(cd "$(dirname "$0")" && pwd)
 REMOTE="${1:-}"
-[ "${1:-}" = "--remote" ] && REMOTE="${2:-koopa-external}"
+[ "${1:-}" = "--remote" ] && REMOTE="${2:-${DEPLOY_SSH:-}}"
 
 SUITE_URL="${SUITE_GIT_URL:-https://git.hacktivism.ch/hernani/taler-monitoring.git}"
 
diff --git a/host-agent/run-aptdeploy.sh b/host-agent/run-aptdeploy.sh
index 246d699..8c1f3cd 100755
--- a/host-agent/run-aptdeploy.sh
+++ b/host-agent/run-aptdeploy.sh
@@ -14,7 +14,7 @@ set -euo pipefail
 AGENT_DIR=$(cd "$(dirname "$0")" && pwd)
 BOOT_MON=$(cd "$AGENT_DIR/.." && pwd)
 MODE="${1:-all}"
-APT_DEPLOY_SSH="${APT_DEPLOY_SSH:-koopa-external}"
+APT_DEPLOY_SSH="${APT_DEPLOY_SSH:-${DEPLOY_SSH:-}}"
 OVERLAY_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/suite-overlay"
 
 on_koopa() {
diff --git a/host-agent/run-fp-prod-monitoring.sh b/host-agent/run-fp-prod-monitoring.sh
index 3dad0d6..c3556d3 100755
--- a/host-agent/run-fp-prod-monitoring.sh
+++ b/host-agent/run-fp-prod-monitoring.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# FrancPaysan PROD host-agent (user francpaysan on francpaysan-host).
+# FrancPaysan PROD host-agent (user francpaysan on ).
 # Shared reporting: run-host-report.sh (timeout, line-buffered log, first-run HTML).
 set -uo pipefail
 
diff --git a/host-agent/run-fp-stage-monitoring.sh b/host-agent/run-fp-stage-monitoring.sh
index 91db2da..3675ba6 100755
--- a/host-agent/run-fp-stage-monitoring.sh
+++ b/host-agent/run-fp-stage-monitoring.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# FrancPaysan STAGE host-agent (user stagepaysan on francpaysan-host).
+# FrancPaysan STAGE host-agent (user stagepaysan on ).
 # Shared reporting: run-host-report.sh (timeout, line-buffered log, first-run HTML).
 set -uo pipefail
 
diff --git a/host-agent/run-host-report.sh b/host-agent/run-host-report.sh
index fa1d6dd..2ddbc50 100755
--- a/host-agent/run-host-report.sh
+++ b/host-agent/run-host-report.sh
@@ -439,11 +439,11 @@ if [ -n "$DEPLOY_WWW" ]; then
   elif [ -e "$DEPLOY_WWW" ]; then
     echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW exists but is not writable by $(id -un)" >&2
     echo "       public FQDN pages will stay missing/stale — fix ownership or run:" >&2
-    echo "       sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
+    echo "       sudo ${APPLY_MONITORING_LIVE}" >&2
     ec=1
   else
     echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW missing — public pages not published" >&2
-    echo "       create tree + Caddy handles: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
+    echo "       create tree + Caddy handles: sudo ${APPLY_MONITORING_LIVE}" >&2
     ec=1
   fi
 else
@@ -479,7 +479,7 @@ if [ "$_monpages_failed" = "1" ]; then
   {
     echo ""
     echo "ERROR monpages: public FQDN monitoring HTML missing or merchant JSON code 21"
-    echo "ERROR monpages: fix with sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)"
+    echo "ERROR monpages: fix with sudo ${APPLY_MONITORING_LIVE} (www + Caddy handles)"
   } >>"$LOG"
   for host in $MON_HOSTS; do
     htmlify_host "$host"
diff --git a/lib.sh b/lib.sh
index 6dcccf9..0f89b83 100755
--- a/lib.sh
+++ b/lib.sh
@@ -1,5 +1,22 @@
 # shellcheck shell=bash
 # Shared helpers for taler-monitoring (laptop or koopa).
+#
+# Machine paths/SSH hosts: only from env (~/.config/taler-monitoring/env or
+# TALER_MONITORING_ENV=…), installed via taler-monitoring-env — never hardcode.
+
+# Load host env once (before any := defaults)
+if [ "${_TALER_MON_ENV_LOADED:-0}" != "1" ]; then
+  _mon_cfg="${TALER_MONITORING_ENV:-${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/env}"
+  if [ -f "$_mon_cfg" ]; then
+    # shellcheck disable=SC1090
+    set -a
+    # shellcheck disable=SC1091
+    . "$_mon_cfg"
+    set +a
+  fi
+  unset _mon_cfg
+  export _TALER_MON_ENV_LOADED=1
+fi
 
 # Default stack = GOA / hacktivism (overridden by TALER_DOMAIN / --domain)
 # i18n (en default; fr for FrancPaysan — see i18n.sh / TALER_MON_LANG)
@@ -22,9 +39,25 @@ fi
 : "${EXCHANGE_LOCAL:=http://127.0.0.1:9011}"
 : "${MERCHANT_LOCAL:=https://127.0.0.1:9010}"
 : "${LANDING_LOCAL:=http://127.0.0.1:9013}"
-: "${KOOPA_SSH:=koopa}"
-# When LAN Host "koopa" is unreachable, try WAN DNAT (see ~/.ssh/config Host koopa-external).
-: "${KOOPA_SSH_FALLBACKS:=koopa-external}"
+# Hostnames/paths: set via ~/.config/taler-monitoring/env (no hardcoded machine values).
+: "${KOOPA_SSH:=}"
+: "${KOOPA_SSH_FALLBACKS:=}"
+: "${INSIDE_SSH:=}"
+: "${FRANCPAYSAN_SSH:=}"
+: "${DEVTESTING_SSH:=}"
+: "${DEPLOY_SSH:=}"
+: "${FIRECUDA_SSH:=}"
+: "${HTML_OUT:=${HOME}/monitoring-sites-staging}"
+: "${DEPLOY_STAGING:=${HTML_OUT}}"
+: "${DEPLOY_WWW_ROOT:=}"
+: "${APPLY_MONITORING_LIVE:=}"
+: "${KOOPA_CADDY_DIR:=}"
+: "${FRANCPAYSAN_SECRETS:=}"
+: "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:=}"
+: "${FRANCPAYSAN_REMOTE_BANK_ADMIN_SECRET:=}"
+: "${FRANCPAYSAN_REMOTE_BANK_EXPLORER_SECRET:=}"
+: "${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:=}"
+: "${WALLET_CLI:=}"
 : "${MERCHANT_INSTANCE:=goa-demo-cp4zqk}"
 # Merchant portal /private API: instance ids must be lowercase or you get odd 401s.
 # (Display names may use capitals; path segment /instances/{id}/ must not.)
@@ -235,13 +268,13 @@ apply_taler_domain() {
         : "${E2E_TEMPLATE_MAP:=5=oeufs-6 4.5=pain-seigle 6=jus-pomme 8.5=fromage-chevre 12=miel-printemps 25=panier-legumes}"
         : "${E2E_PAY_VALUES:=5 8.5 6}"
         : "${E2E_WITHDRAW_VALUES:=20 50}"
-        # Inside checks as low-priv stagepaysan (podman, no sudo) — not koopa
+        # Inside checks as low-priv stagepaysan (podman, no sudo) — not koopa.
+        # INSIDE_SSH / container names: set in host env (no hardcoded SSH host).
         INSIDE_PROFILE="${INSIDE_PROFILE:-stage-lfp}"
-        INSIDE_SSH="${INSIDE_SSH:-francpaysan-stage-user}"
         INSIDE_BANK_CTR="${INSIDE_BANK_CTR:-stage-lfp-bank}"
         INSIDE_EXCHANGE_CTR="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
         INSIDE_MERCHANT_CTR="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
-        # Host pasta ports (127.0.0.1 on francpaysan-host)
+        # Host pasta ports (127.0.0.1 on the FP host (INSIDE_SSH))
         INSIDE_BANK_PORT="${INSIDE_BANK_PORT:-9032}"
         INSIDE_EXCHANGE_PORT="${INSIDE_EXCHANGE_PORT:-9031}"
         INSIDE_MERCHANT_PORT="${INSIDE_MERCHANT_PORT:-9030}"
@@ -381,7 +414,7 @@ mon_ssh_ok() {
     ssh "${SSH_BASE_OPTS[@]}" "$host" true >/dev/null 2>&1
 }
 
-# Pick a working SSH host: KOOPA_SSH first, then KOOPA_SSH_FALLBACKS (koopa-external).
+# Pick a working SSH host: KOOPA_SSH first, then KOOPA_SSH_FALLBACKS (from env).
 # Sets KOOPA_SSH to the first host that answers. 0 = ok, 1 = none.
 KOOPA_SSH_RESOLVED=0
 resolve_koopa_ssh() {
@@ -1195,26 +1228,8 @@ if [ -z "$SECRETS_ROOT" ]; then
     SECRETS_ROOT="${KOOPA_ADMIN_SECRETS}/koopa/host-root"
   fi
 fi
-if [ -z "$SECRETS_ROOT" ]; then
-  _mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  _admin_log="$(cd "${_mon_dir}/../.." && pwd)"
-  for d in \
-    "${_admin_log}/../koopa-admin-secrets/koopa/host-root" \
-    "${_admin_log}/../../koopa-admin-secrets/koopa/host-root" \
-    "${HOME}/taler/src/koopa-admin-secrets/koopa/host-root" \
-    "${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root" \
-    "${HOME}/koopa-admin-secrets/koopa/host-root" \
-    "/Users/newkamek/src/koopa/koopa-admin-secrets/koopa/host-root" \
-    "$(cd "${_admin_log}/../.." 2>/dev/null && pwd)/koopa-admin-secrets/koopa/host-root"
-  do
-    # resolve .. without requiring the dir to exist first for cd
-    if [ -d "$d/taler-bank" ]; then
-      SECRETS_ROOT=$(cd "$d" && pwd)
-      break
-    fi
-  done
-  unset _mon_dir _admin_log d
-fi
+# No further home-path probes — set SECRETS_ROOT or KOOPA_ADMIN_SECRETS in env.
+
 
 read_secret() {
   local rel="$1" base val=""
@@ -1259,7 +1274,7 @@ secrets_hint() {
 Prefer a local secrets file (not committed):
   cp secrets.env.example secrets.env
   \$EDITOR secrets.env
-Or set SECRETS_ROOT=\$HOME/src/koopa/koopa-admin-secrets/koopa/host-root
+Or set SECRETS_ROOT / KOOPA_ADMIN_SECRETS in ~/.config/taler-monitoring/env
 Or export E2E_BANK_ADMIN_PASS / E2E_MERCHANT_TOKEN for one shot.
 EOF
 }
@@ -1299,14 +1314,10 @@ find_wallet_cli() {
     echo "$WALLET_CLI"; return 0
   fi
   local c cand
-  for c in \
+  # WALLET_CLI / WALLET_CLI_CANDIDATES from env; then portable package paths only.
+  # shellcheck disable=SC2086
+  for c in ${WALLET_CLI_CANDIDATES:-} \
     "${HOME}/.local/bin/taler-wallet-cli.mjs" \
-    "${HOME}/taler/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
-    "${HOME}/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
-    "${HOME}/taler/opt/taler-wallet-cli/usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
-    /home/hernani/taler/opt/taler-wallet-cli/usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs \
-    /home/hernani/taler/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs \
-    /Users/newkamek/src/taler/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs \
     /usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs \
     /usr/share/taler-wallet-cli/bin/taler-wallet-cli.mjs
   do
diff --git a/metrics.sh b/metrics.sh
index 4c440ea..aac0630 100644
--- a/metrics.sh
+++ b/metrics.sh
@@ -513,7 +513,7 @@ metrics_taler_load() {
     _m_bank="${INSIDE_BANK_CTR:-stage-lfp-bank}"
     _m_mer="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
     _m_ex="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
-    _m_ssh="${INSIDE_SSH:-francpaysan-stage-user}"
+    _m_ssh="${INSIDE_SSH:-}"
   fi
   remote_py=$(cat <<PY
 import base64, json, os, re, subprocess, time
@@ -866,7 +866,7 @@ metrics_report_load() {
     return 0
   fi
   if ! metrics_taler_load "$out" "$label"; then
-    warn "load ${label}" "probe failed via ${KOOPA_SSH:-?} — try KOOPA_SSH=koopa-external"
+    warn "load ${label}" "probe failed via ${KOOPA_SSH:-?} — set KOOPA_SSH / KOOPA_SSH_FALLBACKS in env"
     return 1
   fi
   while IFS= read -r line; do
diff --git a/secrets.env.example b/secrets.env.example
index 9b3ce12..ccf885c 100644
--- a/secrets.env.example
+++ b/secrets.env.example
@@ -30,8 +30,8 @@
 # Default phases for -d stage.lefrancpaysan.ch: urls + inside + versions + e2e
 # inside uses francpaysan-stage-user (stagepaysan); stats from public HTTPS.
 # Admin credit (required for ATM withdraw ladder on stage):
-# E2E_BANK_ADMIN_PASS=…   # or auto-load via SSH francpaysan-host
-# FRANCPAYSAN_SSH=francpaysan-host
+# E2E_BANK_ADMIN_PASS=…   # or auto-load via SSH 
+# FRANCPAYSAN_SSH=
 # FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
 # Public shop pays use E2E_USE_TEMPLATES=1 (default on TESTPAYSAN) — no merchant token.
 
diff --git a/site-gen/README.md b/site-gen/README.md
index 584dbef..e7ddaf6 100644
--- a/site-gen/README.md
+++ b/site-gen/README.md
@@ -15,7 +15,7 @@ Applies to all nine fronts (GOA + FP stage + FP prod) in the default `SITES` lis
 | Host | Role |
 |------|------|
 | **optional outside runner** (SSH alias via `FIRECUDA_SSH`) | optional runner (public DNS) |
-| **koopa-external** | deploy staging + Caddy (root service) |
+| **deploy host (`DEPLOY_SSH`)** | deploy staging + Caddy (root service) |
 | **host-agents** | primary: GOA + FP on-box (`../host-agent/`) |
 
 No secrets in `settings.conf` — only hosts, paths, site list.
diff --git a/site-gen/ROOT-ON-KOOPA.md b/site-gen/ROOT-ON-KOOPA.md
index 8a862d1..86330a4 100644
--- a/site-gen/ROOT-ON-KOOPA.md
+++ b/site-gen/ROOT-ON-KOOPA.md
@@ -6,17 +6,17 @@ Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
 After host-agent / `generate-monitoring-sites.sh` + deploy (as hernani), files live in:
 
 ```text
-/home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
-/home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html
 ```
 
 ## One-shot as root (preferred)
 
 ```bash
 # absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
-sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
+sudo $APPLY_MONITORING_LIVE
 # same script is versioned in the suite:
-#   host-agent/apply-monitoring-live.sh  → install/sync to /home/hernani/koopa-caddy/
+#   host-agent/apply-monitoring-live.sh  → install/sync to $KOOPA_CADDY_DIR/
 ```
 
 That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
@@ -26,10 +26,10 @@ Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
 
 ```bash
 install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
-rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
+rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
 chown -R hernani:caddy /var/www/monitoring-sites
 
-install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
+install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
 caddy validate --config /etc/caddy/Caddyfile
 systemctl reload caddy
 systemctl is-active caddy
diff --git a/site-gen/caddy-monitoring-handles.snippet b/site-gen/caddy-monitoring-handles.snippet
index 47b6725..5689fff 100644
--- a/site-gen/caddy-monitoring-handles.snippet
+++ b/site-gen/caddy-monitoring-handles.snippet
@@ -28,10 +28,10 @@
 #   /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html
 #
 # Live apply on koopa (absolute path — ~ as root is /root):
-#   sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
+#   sudo ${APPLY_MONITORING_LIVE}
 # Runtime-only (no sudo; hernani admin API):
 #   curl -g -X POST http://[::1]:2019/load -H 'Content-Type: text/caddyfile' \
-#     --data-binary @/home/hernani/koopa-caddy/Caddyfile
+#     --data-binary @${KOOPA_CADDY_DIR}/Caddyfile
 
 # --- only inside taler.hacktivism.ch { ... } ---
     @mon_bare path /monitoring /monitoring_err \
diff --git a/site-gen/deploy-monitoring-sites.sh b/site-gen/deploy-monitoring-sites.sh
index c5718e1..fe3468b 100755
--- a/site-gen/deploy-monitoring-sites.sh
+++ b/site-gen/deploy-monitoring-sites.sh
@@ -13,8 +13,8 @@ set +a
 
 WORK_ROOT="${WORK_ROOT:-/tmp/taler-monitoring-sites-work}"
 HTML_DIR="$WORK_ROOT/html"
-DEPLOY_SSH="${DEPLOY_SSH:-koopa-external}"
-DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
+DEPLOY_SSH="${DEPLOY_SSH:-}"
+DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-}"
 
 if [ ! -d "$HTML_DIR" ]; then
   echo "no HTML_DIR $HTML_DIR — run generate-monitoring-sites.sh first" >&2
@@ -23,7 +23,7 @@ fi
 
 echo "deploy $HTML_DIR → ${DEPLOY_SSH}:${DEPLOY_WWW_ROOT}/"
 # Prefer writing to a hernani-owned staging dir if /var/www not writable
-STAGE_REMOTE="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
+STAGE_REMOTE="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
 
 ssh -o BatchMode=yes -o ConnectTimeout=20 "$DEPLOY_SSH" \
   "mkdir -p '$STAGE_REMOTE' '$DEPLOY_WWW_ROOT' 2>/dev/null || mkdir -p '$STAGE_REMOTE'"
diff --git a/site-gen/install-firecuda-timer.sh b/site-gen/install-firecuda-timer.sh
index 576dbff..52a28b3 100755
--- a/site-gen/install-firecuda-timer.sh
+++ b/site-gen/install-firecuda-timer.sh
@@ -43,8 +43,8 @@ SKIP_SSH=1
 CONTINUE_ON_ERROR=1
 PHASES_ERR=urls versions
 PHASES_OK=urls versions
-DEPLOY_SSH=koopa-external
-DEPLOY_STAGING=/home/hernani/monitoring-sites-staging
+DEPLOY_SSH=${DEPLOY_SSH:-}
+DEPLOY_STAGING=${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}
 WORK_ROOT=
 MONITORING_ROOT=..
 SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
diff --git a/site-gen/pull-firecuda-to-koopa.sh b/site-gen/pull-firecuda-to-koopa.sh
index 43b98e1..0b7dd4e 100755
--- a/site-gen/pull-firecuda-to-koopa.sh
+++ b/site-gen/pull-firecuda-to-koopa.sh
@@ -7,13 +7,13 @@ if [ -z "$FIRECUDA" ]; then
   echo "Set FIRECUDA_SSH to your outside-runner SSH host alias" >&2
   exit 2
 fi
-KOOPA="${DEPLOY_SSH:-koopa-external}"
+KOOPA="${DEPLOY_SSH:?set DEPLOY_SSH in env}"
 REMOTE_HTML="${FIRECUDA_HTML:-var/taler-monitoring-sites-work/html/}"
-STAGE="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
+STAGE="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
 
 echo "firecuda:$REMOTE_HTML → $KOOPA:$STAGE"
 ssh -o BatchMode=yes -o ConnectTimeout=20 "$KOOPA" "mkdir -p '$STAGE'"
 rsync -az --delete \
   "${FIRECUDA}:${REMOTE_HTML}" \
   "${KOOPA}:${STAGE}/"
-echo "OK staged. Root: rsync to /var/www/monitoring-sites (see ROOT-ON-KOOPA.md)"
+echo "OK staged. Root: rsync to  (see ROOT-ON-KOOPA.md)"
diff --git a/site-gen/run-on-firecuda.sh b/site-gen/run-on-firecuda.sh
index 38d26d6..263eb06 100755
--- a/site-gen/run-on-firecuda.sh
+++ b/site-gen/run-on-firecuda.sh
@@ -27,8 +27,8 @@ export PHASES_ERR="${PHASES_ERR:-urls versions}"
 export PHASES_OK="${PHASES_OK:-urls versions}"
 export WORK_ROOT="${WORK_ROOT:-$HOME/var/taler-monitoring-sites-work}"
 export MONITORING_ROOT="${MONITORING_ROOT:-$ROOT/..}"
-export DEPLOY_SSH="${DEPLOY_SSH:-koopa-external}"
-export DEPLOY_STAGING="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
+export DEPLOY_SSH="${DEPLOY_SSH:-}"
+export DEPLOY_STAGING="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
 
 # Prefer full 9-site list from settings or defaults inside generate script
 unset ONLY_HOSTS
@@ -48,7 +48,7 @@ if [ -n "${DEPLOY_SSH:-}" ] && [ "${DEPLOY_FROM_FIRECUDA:-0}" = "1" ]; then
 else
   echo "note: HTML at ${WORK_ROOT}/html — pull from laptop:"
   echo "  rsync -az outside-runner:var/taler-monitoring-sites-work/html/ \\"
-  echo "    koopa-external:monitoring-sites-staging/"
+  echo "    $DEPLOY_SSH:monitoring-sites-staging/"
   echo "  # or: ./pull-firecuda-to-koopa.sh"
 fi
 
diff --git a/site-gen/settings.conf.example b/site-gen/settings.conf.example
index 7b626d1..8b24c24 100644
--- a/site-gen/settings.conf.example
+++ b/site-gen/settings.conf.example
@@ -13,15 +13,15 @@ MONITORING_ROOT=..
 SKIP_SSH=1
 
 # Deploy staging on koopa (host Caddy later — root copies to /var/www)
-DEPLOY_SSH=koopa-external
+DEPLOY_SSH=  # set SSH host for deploy
 DEPLOY_SSH_FALLBACKS=koopa
 # Static files for Caddy file_server (created per hostname)
-DEPLOY_WWW_ROOT=/var/www/monitoring-sites
+DEPLOY_WWW_ROOT=  # e.g. /var/www/monitoring-sites
 DEPLOY_SUDO=sudo
 CADDY_CONFIG=/etc/caddy/Caddyfile
 CADDY_MIRROR_REL=configs/caddy/Caddyfile
 # Working tree on deploy host for apply (optional)
-KOOPA_CADDY_DIR=/home/hernani/koopa-caddy
+KOOPA_CADDY_DIR=  # absolute path to Caddy tree on mon host
 
 # Source link for HTML footer (Forgejo)
 SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
diff --git a/taler-monitoring.sh b/taler-monitoring.sh
index 16f5134..8822d21 100755
--- a/taler-monitoring.sh
+++ b/taler-monitoring.sh
@@ -150,7 +150,7 @@ Env (same meaning):
   PERF_WARN_MS  PERF_FAIL_MS   (urls latency; default 8000 / 20000)
   QR_CHECK=0    skip QR form + qrencode/zbarimg (urls phase)
   QR_ECC=M      qrencode ECC level (default M)
-  KOOPA_SSH  KOOPA_SSH_FALLBACKS   (default koopa → koopa-external)
+  KOOPA_SSH  KOOPA_SSH_FALLBACKS   (set KOOPA_SSH / KOOPA_SSH_FALLBACKS in env)
   METRICS_LOAD=0   skip host/container RAM/CPU probes (e2e/ladder/inside)
   EXPECT_WEBUI_VERSION=1.6.11   pin merchant /webui/version.txt (urls)
   EXPECT_WEBUI_OVERLAY=selfbuild  require substr in version-overlay.txt
@@ -187,6 +187,21 @@ SPA pin after selfbuild:
 EOF
 }
 
+# Machine-local paths/hosts from taler-monitoring-env install (no hardcodes in suite).
+# Install: ~/src/taler-monitoring-env/bin/install-env.sh <machine>
+if [ "${_TALER_MON_ENV_LOADED:-0}" != "1" ]; then
+  _mon_cfg="${TALER_MONITORING_ENV:-${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/env}"
+  if [ -f "$_mon_cfg" ]; then
+    # shellcheck disable=SC1090
+    set -a
+    # shellcheck disable=SC1091
+    . "$_mon_cfg"
+    set +a
+  fi
+  unset _mon_cfg
+  export _TALER_MON_ENV_LOADED=1
+fi
+
 # shellcheck source=lib.sh
 source "$ROOT/lib.sh"
 # ensure i18n after domain may change later