release 1.13.6: env-only machine paths and SSH hosts
Load ~/.config/taler-monitoring/env (taler-monitoring-env profiles) before suite defaults. Drop hardcoded operator homes and host aliases from scripts; apply/staging/www/secrets/wallet via env.
This commit is contained in:
Hernâni Marques
parent
d7a0ceb90b
commit
0c94fb3d2e
32 changed files with 175 additions and 157 deletions
10
README.md
10
README.md
|
|
@ -138,7 +138,7 @@ Each check prints **global** and **grouped** ids:
|
|||
# inside: low-priv SSH francpaysan-stage-user (User stagepaysan) → podman
|
||||
# containers stage-lfp-{bank,exchange-ansible,merchant} · ports 9032/9031/9030
|
||||
# stats: outside-in public …/intro/stats.json (age via generated_at_unix)
|
||||
# Admin credit for e2e: E2E_BANK_ADMIN_PASS=… or francpaysan-host secrets
|
||||
# Admin credit for e2e: E2E_BANK_ADMIN_PASS=… or stage host secrets
|
||||
# (bank-admin-password.txt under /mnt/data/stagepaysan/bank/secrets/)
|
||||
# Override: INSIDE_SSH=… INSIDE_PROFILE=stage-lfp
|
||||
|
||||
|
|
@ -374,7 +374,7 @@ snapshotted via SSH whenever the stack is under load:
|
|||
```bash
|
||||
# LAN down? force WAN DNAT host
|
||||
KOOPA_SSH=koopa-external ./taler-monitoring.sh inside
|
||||
# or rely on automatic fallback (default KOOPA_SSH_FALLBACKS=koopa-external)
|
||||
# or rely on automatic fallback (KOOPA_SSH_FALLBACKS from env)
|
||||
|
||||
METRICS_LOAD=0 ./taler-monitoring.sh e2e # skip host probes
|
||||
LADDER_LOAD=0 ./taler-monitoring.sh ladder
|
||||
|
|
@ -383,7 +383,7 @@ LADDER_LOAD=0 ./taler-monitoring.sh ladder
|
|||
| Env | Default | Meaning |
|
||||
|-----|---------|---------|
|
||||
| `KOOPA_SSH` | `koopa` | primary SSH host |
|
||||
| `KOOPA_SSH_FALLBACKS` | `koopa-external` | tried if primary fails |
|
||||
| `KOOPA_SSH_FALLBACKS` | *(from env)* | tried if primary fails |
|
||||
| `METRICS_LOAD` | `1` | `0` = skip all host/container load probes |
|
||||
| `LADDER_LOAD` | `1` | `0` = skip load in ladder only |
|
||||
| `LADDER_PAY` | `1` | `0` = skip payment ladder after withdraws |
|
||||
|
|
@ -393,7 +393,7 @@ LADDER_LOAD=0 ./taler-monitoring.sh ladder
|
|||
|
||||
## Needs
|
||||
|
||||
- SSH `koopa` or `koopa-external` (inside / load / sanity server bits)
|
||||
- SSH via `KOOPA_SSH` / `KOOPA_SSH_FALLBACKS` (env) (inside / load / sanity server bits)
|
||||
- secrets under `koopa-admin-secrets/...` for e2e
|
||||
- `taler-wallet-cli` for e2e
|
||||
|
||||
|
|
@ -418,7 +418,7 @@ Soft mode only with `MONPAGES_REQUIRE_PUBLIC=0` (escape hatch).
|
|||
./taler-monitoring.sh -d lefrancpaysan.ch monpages
|
||||
```
|
||||
|
||||
If pages are missing publicly: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh` on koopa
|
||||
If pages are missing publicly: `sudo $APPLY_MONITORING_LIVE` on koopa
|
||||
(FP: Infomaniak vhost for `/monitoring*`).
|
||||
|
||||
## Devtesting · fake-franken CHF (v1.13+)
|
||||
|
|
|
|||
2
TESTS.md
2
TESTS.md
|
|
@ -126,7 +126,7 @@ When filing an issue, quote the full id + label, e.g.
|
|||
| **aptdeploy.trixie-upgrade-** | upgrade-track `…-trixie-upgrade` (install once, then mytops-style upgrade) |
|
||||
| **aptdeploy.trixie-testing-upgrade-** | upgrade-track `…-trixie-testing-upgrade` |
|
||||
|
||||
Standalone: `host-agent/run-aptdeploy.sh` (on koopa local; else `ssh koopa-external`).
|
||||
Standalone: `host-agent/run-aptdeploy.sh` (on koopa local; else ssh `$DEPLOY_SSH` / `$APT_DEPLOY_SSH`).
|
||||
|
||||
### surface (remote-only public inventory)
|
||||
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
1.13.5
|
||||
1.13.6
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
|
|||
|
||||
| Tag | Date (UTC) | Notes |
|
||||
|-----|------------|--------|
|
||||
| **v1.13.6** | 2026-07-19 | **Bugfix:** machine paths and SSH hosts only via env (`~/.config/taler-monitoring/env` / `taler-monitoring-env`); suite loads env before defaults; no `/home/hernani` or bogus host hardcodes. |
|
||||
| **v1.13.5** | 2026-07-19 | **Bugfix:** progress bar — env-aware phase estimates (CHECK_BANK/LANDING, mon hosts); re-fit total after each phase (done+remaining); drop fake +12 for host-agent monpages post-check (fixes stage 42/139→46/46 snap). |
|
||||
| **v1.13.4** | 2026-07-19 | **Bugfix:** monpages race-proof — atomic HTML write; rsync `--delay-updates` + settle; fetch retries; larger head windows; pre-publish soft content (`MONPAGES_PRE_PUBLISH`); bootstrap markers. |
|
||||
| **v1.13.3** | 2026-07-19 | **Bugfix:** sticky **generated** time in **Europe/Zurich** (CEST/CET · MESZ/MEZ), not UTC `…Z`; ISO keeps offset for age JS. |
|
||||
|
|
|
|||
|
|
@ -91,7 +91,7 @@ if [[ -z "${EXP_PW_FILE:-}" ]]; then
|
|||
fi
|
||||
# stage: try stagepaysan secret via ssh if missing
|
||||
if [[ ! -f "${EXP_PW_FILE:-}" && "$STACK" = "stage" ]]; then
|
||||
for host in francpaysan-stage-user francpaysan-host; do
|
||||
for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
|
||||
tmp=$(mktemp)
|
||||
if ssh -o BatchMode=yes -o ConnectTimeout=10 "$host" \
|
||||
'tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt' \
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ if [ "${DEVTESTING_SKIP:-0}" = "1" ]; then
|
|||
exit 0
|
||||
fi
|
||||
|
||||
: "${DEVTESTING_SSH:=taler-rusty-devtesting}"
|
||||
: "${DEVTESTING_SSH:=}"
|
||||
: "${DEVTESTING_AMOUNT:=CHF:1.00}"
|
||||
: "${DEVTESTING_EXCHANGE_IBAN:=CH6808573105529100001}"
|
||||
: "${SSH_CONNECT_TIMEOUT:=8}"
|
||||
|
|
|
|||
51
check_e2e.sh
51
check_e2e.sh
|
|
@ -426,7 +426,7 @@ else
|
|||
warn "alt_unit_names" "using built-in SI fallback"
|
||||
fi
|
||||
|
||||
# Host + bank/exchange/merchant RAM/CPU/load (SSH koopa or koopa-external)
|
||||
# Host + bank/exchange/merchant RAM/CPU/load (SSH via KOOPA_SSH from env)
|
||||
set_group load
|
||||
section "e2e · load snapshot (before withdraw/pay)"
|
||||
metrics_report_load "${METRICS_DIR}/load-before.json" "e2e-start" || true
|
||||
|
|
@ -437,51 +437,50 @@ if [ "$E2E_REMOTE" = "1" ]; then
|
|||
ADMIN_PASS="${E2E_BANK_ADMIN_PASS:-${BANK_ADMIN_PASS:-}}"
|
||||
MPW="${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-}}"
|
||||
# Stage FrancPaysan: allow admin credit without committing passwords.
|
||||
# Order: already-set env → local secrets tree → SSH francpaysan-host (ops laptop).
|
||||
# Order: env → FRANCPAYSAN_SECRETS → SSH FRANCPAYSAN_SSH/INSIDE_SSH + remote secret paths.
|
||||
if [ -z "$ADMIN_PASS" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
|
||||
_fp_try=""
|
||||
for _fp_try in \
|
||||
"${FRANCPAYSAN_SECRETS:-}/stage/bank-admin-password.txt" \
|
||||
"${HOME}/francpaysan-secrets/stage/bank-admin-password.txt" \
|
||||
"${HOME}/src/francpaysan-secrets/stage/bank-admin-password.txt" \
|
||||
"${HOME}/taler/src/francpaysan-secrets/stage/bank-admin-password.txt"
|
||||
do
|
||||
if [ -n "$_fp_try" ] && [ -f "$_fp_try" ]; then
|
||||
if [ -n "${FRANCPAYSAN_SECRETS:-}" ]; then
|
||||
_fp_try="${FRANCPAYSAN_SECRETS}/stage/bank-admin-password.txt"
|
||||
if [ -f "$_fp_try" ]; then
|
||||
ADMIN_PASS=$(tr -d '\n\r' <"$_fp_try")
|
||||
info "bank admin secret" "from $_fp_try"
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
if [ -z "$ADMIN_PASS" ] && command -v ssh >/dev/null 2>&1; then
|
||||
for _fp_host in "${FRANCPAYSAN_SSH:-francpaysan-host}" francpaysan-host; do
|
||||
_remote_bank_sec="${FRANCPAYSAN_REMOTE_BANK_ADMIN_SECRET:-}"
|
||||
[ -z "$_remote_bank_sec" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
|
||||
_remote_bank_sec="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/bank/secrets/bank-admin-password.txt"
|
||||
for _fp_host in ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"} ${INSIDE_SSH:+"$INSIDE_SSH"}; do
|
||||
[ -n "$_fp_host" ] && [ -n "$_remote_bank_sec" ] || continue
|
||||
ADMIN_PASS=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "$_fp_host" \
|
||||
'sudo cat /mnt/data/stagepaysan/bank/secrets/bank-admin-password.txt 2>/dev/null' \
|
||||
"sudo cat ${_remote_bank_sec} 2>/dev/null" \
|
||||
2>/dev/null | tr -d '\n\r' || true)
|
||||
if [ -n "$ADMIN_PASS" ]; then
|
||||
info "bank admin secret" "from ${_fp_host}:/mnt/data/stagepaysan/bank/secrets/"
|
||||
info "bank admin secret" "from ${_fp_host} (remote path via env)"
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
unset _fp_try _fp_host
|
||||
unset _fp_try _fp_host _remote_bank_sec
|
||||
fi
|
||||
# Stage merchant: public templates need no token; optional default-instance token
|
||||
if [ -z "$MPW" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
|
||||
for _fp_try in \
|
||||
"${FRANCPAYSAN_SECRETS:-}/stage/default-instance-token.txt" \
|
||||
"${HOME}/francpaysan-secrets/stage/default-instance-token.txt"
|
||||
do
|
||||
if [ -n "$_fp_try" ] && [ -f "$_fp_try" ]; then
|
||||
MPW=$(tr -d '\n\r' <"$_fp_try")
|
||||
break
|
||||
if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
|
||||
MPW=$(tr -d '\n\r' <"${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt")
|
||||
fi
|
||||
done
|
||||
if [ -z "$MPW" ] && command -v ssh >/dev/null 2>&1; then
|
||||
MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "${FRANCPAYSAN_SSH:-francpaysan-host}" \
|
||||
'sudo cat /mnt/data/stagepaysan/merchant/secrets/default-instance-token.txt 2>/dev/null' \
|
||||
_remote_mer_sec="${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:-}"
|
||||
[ -z "$_remote_mer_sec" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
|
||||
_remote_mer_sec="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/merchant/secrets/default-instance-token.txt"
|
||||
_fp_host="${FRANCPAYSAN_SSH:-${INSIDE_SSH:-}}"
|
||||
if [ -n "$_fp_host" ] && [ -n "$_remote_mer_sec" ]; then
|
||||
MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=8 "$_fp_host" \
|
||||
"sudo cat ${_remote_mer_sec} 2>/dev/null" \
|
||||
2>/dev/null | tr -d '\n\r' || true)
|
||||
fi
|
||||
unset _fp_try
|
||||
unset _fp_host _remote_mer_sec
|
||||
fi
|
||||
fi
|
||||
else
|
||||
ADMIN_PASS="${E2E_BANK_ADMIN_PASS:-$(read_secret "taler-bank/bank-admin-password.txt" || true)}"
|
||||
|
|
|
|||
|
|
@ -195,25 +195,20 @@ resolve_explorer_pw() {
|
|||
|| [[ "${TALER_DOMAIN:-}" == stage.*lefrancpaysan* ]] \
|
||||
|| [[ "${TALER_DOMAIN:-}" == *stage.lefrancpaysan* ]]; then
|
||||
for f in \
|
||||
"${FRANCPAYSAN_SECRETS:-}/stage/bank-explorer-password.txt" \
|
||||
"${HOME}/francpaysan-secrets/stage/bank-explorer-password.txt" \
|
||||
"${HOME}/src/francpaysan-secrets/stage/bank-explorer-password.txt" \
|
||||
"${HOME}/taler/src/francpaysan-secrets/stage/bank-explorer-password.txt" \
|
||||
${FRANCPAYSAN_SECRETS:+"${FRANCPAYSAN_SECRETS}/stage/bank-explorer-password.txt"} \
|
||||
"${HOME}/.config/taler-landing/stage-bank-explorer-password.txt"
|
||||
do
|
||||
[ -n "$f" ] && [ -f "$f" ] || continue
|
||||
tr -d '\n\r' <"$f"
|
||||
return 0
|
||||
done
|
||||
for host in \
|
||||
"${INSIDE_SSH:-}" \
|
||||
francpaysan-stage-user \
|
||||
francpaysan-host
|
||||
do
|
||||
[ -n "$host" ] || continue
|
||||
_remote_exp="${FRANCPAYSAN_REMOTE_BANK_EXPLORER_SECRET:-}"
|
||||
[ -z "$_remote_exp" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
|
||||
_remote_exp="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/bank/secrets/bank-explorer-password.txt"
|
||||
for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
|
||||
[ -n "$host" ] && [ -n "$_remote_exp" ] || continue
|
||||
pw=$(ssh -o BatchMode=yes -o ConnectTimeout=12 "$host" \
|
||||
'tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt 2>/dev/null \
|
||||
|| sudo tr -d "\n\r" </mnt/data/stagepaysan/bank/secrets/bank-explorer-password.txt 2>/dev/null' \
|
||||
"tr -d '\\n\\r' <${_remote_exp} 2>/dev/null || sudo tr -d '\\n\\r' <${_remote_exp} 2>/dev/null" \
|
||||
2>/dev/null || true)
|
||||
if [ -n "$pw" ]; then
|
||||
printf '%s' "$pw"
|
||||
|
|
@ -230,7 +225,6 @@ resolve_explorer_pw() {
|
|||
fi
|
||||
for f in \
|
||||
"${SECRETS_ROOT:+${SECRETS_ROOT}/taler-bank/bank-explorer-password.txt}" \
|
||||
"${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root/taler-bank/bank-explorer-password.txt" \
|
||||
"${HOME}/.config/taler-landing/bank-explorer-password.txt"
|
||||
do
|
||||
[ -n "$f" ] && [ -f "$f" ] || continue
|
||||
|
|
@ -962,23 +956,21 @@ if [ "${LADDER_PAY}" = "1" ] && [ -n "${PAY_LIST:-}" ] && [ "$FAIL_N_L" -eq 0 ];
|
|||
MPW=$(read_secret "taler-merchant/merchant-goa-demo-cp4zqk-password.txt" 2>/dev/null || true)
|
||||
fi
|
||||
if [ -z "$MPW" ] && [ "${CUR}" = "TESTPAYSAN" ]; then
|
||||
for f in \
|
||||
"${FRANCPAYSAN_SECRETS:-}/stage/default-instance-token.txt" \
|
||||
"${HOME}/francpaysan-secrets/stage/default-instance-token.txt" \
|
||||
"${HOME}/src/francpaysan-secrets/stage/default-instance-token.txt"
|
||||
do
|
||||
[ -f "$f" ] || continue
|
||||
MPW=$(tr -d '\n\r' <"$f")
|
||||
break
|
||||
done
|
||||
if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
|
||||
MPW=$(tr -d '\n\r' <"${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt")
|
||||
fi
|
||||
if [ -z "$MPW" ]; then
|
||||
for host in "${INSIDE_SSH:-}" francpaysan-stage-user francpaysan-host; do
|
||||
[ -n "$host" ] || continue
|
||||
_remote_mer="${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:-}"
|
||||
[ -z "$_remote_mer" ] && [ -n "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:-}" ] && \
|
||||
_remote_mer="${FRANCPAYSAN_REMOTE_SECRETS_ROOT}/merchant/secrets/default-instance-token.txt"
|
||||
for host in ${INSIDE_SSH:+"$INSIDE_SSH"} ${FRANCPAYSAN_SSH:+"$FRANCPAYSAN_SSH"}; do
|
||||
[ -n "$host" ] && [ -n "$_remote_mer" ] || continue
|
||||
MPW=$(ssh -o BatchMode=yes -o ConnectTimeout=12 "$host" \
|
||||
'tr -d "\n\r" </mnt/data/stagepaysan/merchant/secrets/default-instance-token.txt 2>/dev/null || true' \
|
||||
"tr -d '\\n\\r' <${_remote_mer} 2>/dev/null || true" \
|
||||
2>/dev/null || true)
|
||||
[ -n "$MPW" ] && break
|
||||
done
|
||||
unset _remote_mer
|
||||
fi
|
||||
fi
|
||||
if [ -z "$MPW" ]; then
|
||||
|
|
|
|||
|
|
@ -52,10 +52,10 @@ section "inside · collect (${PROFILE} · access=${INSIDE_ACCESS})"
|
|||
info "flags" "INSIDE_ACCESS=${INSIDE_ACCESS} INSIDE_PODMAN=${INSIDE_PODMAN:-0} INSIDE_MODE=${INSIDE_MODE:-} LOCAL_STACK=${LOCAL_STACK:-0} SKIP_SSH=${SKIP_SSH:-0} KOOPA_SSH=${KOOPA_SSH:-} INSIDE_SSH=${INSIDE_SSH:-}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# stage-lfp: low-priv stagepaysan on francpaysan-host
|
||||
# stage-lfp: low-priv stagepaysan on the FP stage host (INSIDE_SSH)
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ "$PROFILE" = "stage-lfp" ]; then
|
||||
SSH_HOST="${INSIDE_SSH:-francpaysan-stage-user}"
|
||||
SSH_HOST="${INSIDE_SSH:-}"
|
||||
BANK_CTR="${INSIDE_BANK_CTR:-stage-lfp-bank}"
|
||||
EX_CTR="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
|
||||
MER_CTR="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
|
||||
|
|
|
|||
|
|
@ -209,7 +209,7 @@ build_urls() {
|
|||
if [ "$fam" = "goa" ] || [ "$fam" = "fp" ]; then
|
||||
_catalog_urls "$fam"
|
||||
# On-disk discovery (err pages only exist after failed runs; extras welcome)
|
||||
_discover_tree "${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}" "$fam"
|
||||
[ -n "${DEPLOY_WWW_ROOT:-}" ] && _discover_tree "${DEPLOY_WWW_ROOT}" "$fam"
|
||||
_discover_tree "${MONPAGES_STAGING_BASE:-${HTML_OUT:-${HTML_BASE:-$HOME/monitoring-sites-staging}}}" "$fam"
|
||||
fi
|
||||
;;
|
||||
|
|
@ -437,7 +437,7 @@ check_one() {
|
|||
continue
|
||||
fi
|
||||
_mon_fail_or_soft "public mon page missing" \
|
||||
"$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle; apply: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)" || { rm -f "$body"; return 1; }
|
||||
"$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle${APPLY_MONITORING_LIVE:+; apply: sudo $APPLY_MONITORING_LIVE})" || { rm -f "$body"; return 1; }
|
||||
rm -f "$body"
|
||||
return 0
|
||||
fi
|
||||
|
|
@ -578,7 +578,7 @@ done
|
|||
if [ "$ec" -ne 0 ]; then
|
||||
echo " hint: public monitoring HTML not served (404 / merchant code 21)"
|
||||
echo " publish staging HTML + configure reverse-proxy/Caddy handle for mon paths"
|
||||
echo " (on koopa: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)"
|
||||
echo " (set APPLY_MONITORING_LIVE in env; sudo "$APPLY_MONITORING_LIVE")"
|
||||
echo " bare code 21: Caddy redir inside handle must be: redir * /path/ 302 (not redir /path/ 302)"
|
||||
if [ "$_fam" = "fp" ]; then
|
||||
echo " FP: only FP mon hosts are checked — wire Infomaniak vhost for /monitoring*"
|
||||
|
|
@ -599,7 +599,7 @@ if [ "$ec" -ne 0 ]; then
|
|||
fi
|
||||
done
|
||||
fi
|
||||
_www="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
|
||||
_www="${DEPLOY_WWW_ROOT:-}"
|
||||
if [ -e "$_www" ] && [ ! -w "$_www" ]; then
|
||||
echo " DEPLOY_WWW_ROOT=$_www not writable by $(id -un 2>/dev/null || echo user)"
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -178,7 +178,7 @@ if [ "${INSIDE_PODMAN:-0}" = "1" ] || [ "${INSIDE_MODE:-}" = "local-podman" ]; t
|
|||
elif [ "${INSIDE_PROFILE:-}" = "stage-lfp" ] \
|
||||
|| [ "${EXPECT_CURRENCY:-}" = "TESTPAYSAN" ] \
|
||||
|| [ -n "${INSIDE_SSH:-}" ]; then
|
||||
_VERS_SSH_HOST="${INSIDE_SSH:-francpaysan-stage-user}"
|
||||
_VERS_SSH_HOST="${INSIDE_SSH:-}"
|
||||
_VERS_BANK="${INSIDE_BANK_CTR:-stage-lfp-bank}"
|
||||
_VERS_EX="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
|
||||
_VERS_MER="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ Thin wrappers only set stack defaults:
|
|||
| `run-fp-stage-monitoring.sh` | FP stage | `stagepaysan` |
|
||||
| `run-fp-prod-monitoring.sh` | FP prod | `francpaysan` |
|
||||
| `run-host-report.sh` + `taler-monitoring-mytops-stage.{service,timer}` | mytops **stage / betel** only | `taler-monitoring` @ betel (4h) |
|
||||
| `run-aptdeploy.sh` | CLI: ensure + **aptdeploy** (no HTML) | local if hostname=koopa, else **ssh koopa-external** |
|
||||
| `run-aptdeploy.sh` | CLI: ensure + **aptdeploy** (no HTML) | local if hostname=koopa, else **ssh $DEPLOY_SSH** |
|
||||
| `run-aptdeploy-monitoring.sh` | apt-src tests → `/taler-monitoring-aptdeploy*` | `hernani` @ koopa (4h) |
|
||||
| `run-surface-monitoring.sh` | **surface** → only `/taler-monitoring-surface*` (ecosystem + mail + mattermost + versions) | `hernani` @ koopa (hourly) |
|
||||
| `run-mail-monitoring.sh` / `run-mattermost-monitoring.sh` | **deprecated v1.8.0** — aliases of surface | disabled timers |
|
||||
|
|
@ -110,7 +110,7 @@ cp ~/src/taler-monitoring/host-agent/env.example \
|
|||
~/.config/taler-monitoring/env
|
||||
|
||||
# ops workstation:
|
||||
./host-agent/install-host-agent.sh --remote koopa-external
|
||||
./host-agent/install-host-agent.sh --remote $DEPLOY_SSH
|
||||
|
||||
# or on koopa:
|
||||
~/src/taler-monitoring/host-agent/install-host-agent.sh
|
||||
|
|
|
|||
|
|
@ -17,15 +17,15 @@ Public URLs return **merchant/bank JSON** like:
|
|||
or a **404 HTML** page from the app reverse_proxy.
|
||||
|
||||
Cause: live `/etc/caddy/Caddyfile` has **no** `handle /monitoring*` (falls through to
|
||||
API). Prepared config is only under **`/home/hernani/koopa-caddy/Caddyfile`**.
|
||||
API). Prepared config is only under **`$KOOPA_CADDY_DIR/Caddyfile`**.
|
||||
|
||||
## One-shot as root (recommended)
|
||||
|
||||
```bash
|
||||
# absolute path required: as root, ~ is /root (not /home/hernani)
|
||||
sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
sudo $APPLY_MONITORING_LIVE
|
||||
# or already root:
|
||||
# /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
# $APPLY_MONITORING_LIVE
|
||||
```
|
||||
|
||||
**Caddy bare-path redir (v1.9.2+):** inside a `handle` block use
|
||||
|
|
@ -52,14 +52,14 @@ There is **no** public page `/taler-monitoring`. Each family needs **bare and sl
|
|||
| **taler-monitoring-aptdeploy** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-aptdeploy.timer` (4h) |
|
||||
|
||||
HTML is generated as **hernani** into
|
||||
`/home/hernani/monitoring-sites-staging/`.
|
||||
`$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/`.
|
||||
|
||||
## Manual equivalent
|
||||
|
||||
```bash
|
||||
rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
|
||||
rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
|
||||
chown -R hernani:caddy /var/www/monitoring-sites && chmod -R g+rwX /var/www/monitoring-sites
|
||||
sudo /home/hernani/koopa-caddy/apply.sh # or apply-monitoring-live.sh
|
||||
sudo $KOOPA_CADDY_DIR/apply.sh # or apply-monitoring-live.sh
|
||||
```
|
||||
|
||||
Expect **200** (HTML with sticky bar). Not merchant JSON `code:21`.
|
||||
|
|
@ -67,7 +67,7 @@ Expect **200** (HTML with sticky bar). Not merchant JSON `code:21`.
|
|||
## After each monitoring run (if www is not hernani-writable)
|
||||
|
||||
```bash
|
||||
rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
|
||||
rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
|
||||
chown -R caddy:caddy /var/www/monitoring-sites
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -2,10 +2,10 @@
|
|||
# ONE-SHOT as root: publish monitoring HTML + enable Caddy handles
|
||||
#
|
||||
# Suite copy (taler-monitoring host-agent). Live install path on koopa:
|
||||
# /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
# ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
|
||||
# Prefer absolute path ( ~ expands to /root when already root ):
|
||||
# sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
# /home/hernani/koopa-caddy/apply-monitoring-live.sh # if already root
|
||||
# sudo ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
|
||||
# ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh # if already root
|
||||
#
|
||||
# After editing here: rsync to koopa ~/koopa-caddy/ before root apply.
|
||||
set -euo pipefail
|
||||
|
|
@ -13,9 +13,9 @@ if [[ "$(id -u)" -ne 0 ]]; then
|
|||
exec sudo -E "$0" "$@"
|
||||
fi
|
||||
|
||||
STAGING=/home/hernani/monitoring-sites-staging
|
||||
WWW=/var/www/monitoring-sites
|
||||
SRC=/home/hernani/koopa-caddy/Caddyfile
|
||||
STAGING="${DEPLOY_STAGING:-${HTML_OUT:-$HOME/monitoring-sites-staging}}"
|
||||
WWW="${DEPLOY_WWW_ROOT:?set DEPLOY_WWW_ROOT in env}"
|
||||
SRC="${KOOPA_CADDY_DIR:?set KOOPA_CADDY_DIR in env}/Caddyfile"
|
||||
DST=/etc/caddy/Caddyfile
|
||||
|
||||
if [[ ! -f "$SRC" ]]; then
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
# koopa-taler-deploy-test-apt-src-trixie-upgrade
|
||||
# koopa-taler-deploy-test-apt-src-trixie-testing-upgrade
|
||||
#
|
||||
# Run as hernani on koopa. From elsewhere use run-aptdeploy.sh (ssh koopa-external).
|
||||
# Run as hernani on koopa. From elsewhere use run-aptdeploy.sh (ssh $DEPLOY_SSH or $APT_DEPLOY_SSH).
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
|
|
|
|||
|
|
@ -4,14 +4,14 @@
|
|||
# # on koopa as hernani:
|
||||
# ~/src/taler-monitoring/host-agent/install-host-agent.sh
|
||||
# # or from laptop:
|
||||
# ./install-host-agent.sh --remote koopa-external
|
||||
# ./install-host-agent.sh --remote $DEPLOY_SSH
|
||||
#
|
||||
# Suite tree is ONLY ~/src/taler-monitoring (standalone repo). No koopa-admin-log.
|
||||
#
|
||||
set -euo pipefail
|
||||
ROOT=$(cd "$(dirname "$0")" && pwd)
|
||||
REMOTE="${1:-}"
|
||||
[ "${1:-}" = "--remote" ] && REMOTE="${2:-koopa-external}"
|
||||
[ "${1:-}" = "--remote" ] && REMOTE="${2:-${DEPLOY_SSH:-}}"
|
||||
|
||||
SUITE_URL="${SUITE_GIT_URL:-https://git.hacktivism.ch/hernani/taler-monitoring.git}"
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ set -euo pipefail
|
|||
AGENT_DIR=$(cd "$(dirname "$0")" && pwd)
|
||||
BOOT_MON=$(cd "$AGENT_DIR/.." && pwd)
|
||||
MODE="${1:-all}"
|
||||
APT_DEPLOY_SSH="${APT_DEPLOY_SSH:-koopa-external}"
|
||||
APT_DEPLOY_SSH="${APT_DEPLOY_SSH:-${DEPLOY_SSH:-}}"
|
||||
OVERLAY_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/suite-overlay"
|
||||
|
||||
on_koopa() {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
#!/usr/bin/env bash
|
||||
# FrancPaysan PROD host-agent (user francpaysan on francpaysan-host).
|
||||
# FrancPaysan PROD host-agent (user francpaysan on ).
|
||||
# Shared reporting: run-host-report.sh (timeout, line-buffered log, first-run HTML).
|
||||
set -uo pipefail
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
#!/usr/bin/env bash
|
||||
# FrancPaysan STAGE host-agent (user stagepaysan on francpaysan-host).
|
||||
# FrancPaysan STAGE host-agent (user stagepaysan on ).
|
||||
# Shared reporting: run-host-report.sh (timeout, line-buffered log, first-run HTML).
|
||||
set -uo pipefail
|
||||
|
||||
|
|
|
|||
|
|
@ -439,11 +439,11 @@ if [ -n "$DEPLOY_WWW" ]; then
|
|||
elif [ -e "$DEPLOY_WWW" ]; then
|
||||
echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW exists but is not writable by $(id -un)" >&2
|
||||
echo " public FQDN pages will stay missing/stale — fix ownership or run:" >&2
|
||||
echo " sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
|
||||
echo " sudo ${APPLY_MONITORING_LIVE}" >&2
|
||||
ec=1
|
||||
else
|
||||
echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW missing — public pages not published" >&2
|
||||
echo " create tree + Caddy handles: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
|
||||
echo " create tree + Caddy handles: sudo ${APPLY_MONITORING_LIVE}" >&2
|
||||
ec=1
|
||||
fi
|
||||
else
|
||||
|
|
@ -479,7 +479,7 @@ if [ "$_monpages_failed" = "1" ]; then
|
|||
{
|
||||
echo ""
|
||||
echo "ERROR monpages: public FQDN monitoring HTML missing or merchant JSON code 21"
|
||||
echo "ERROR monpages: fix with sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)"
|
||||
echo "ERROR monpages: fix with sudo ${APPLY_MONITORING_LIVE} (www + Caddy handles)"
|
||||
} >>"$LOG"
|
||||
for host in $MON_HOSTS; do
|
||||
htmlify_host "$host"
|
||||
|
|
|
|||
81
lib.sh
81
lib.sh
|
|
@ -1,5 +1,22 @@
|
|||
# shellcheck shell=bash
|
||||
# Shared helpers for taler-monitoring (laptop or koopa).
|
||||
#
|
||||
# Machine paths/SSH hosts: only from env (~/.config/taler-monitoring/env or
|
||||
# TALER_MONITORING_ENV=…), installed via taler-monitoring-env — never hardcode.
|
||||
|
||||
# Load host env once (before any := defaults)
|
||||
if [ "${_TALER_MON_ENV_LOADED:-0}" != "1" ]; then
|
||||
_mon_cfg="${TALER_MONITORING_ENV:-${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/env}"
|
||||
if [ -f "$_mon_cfg" ]; then
|
||||
# shellcheck disable=SC1090
|
||||
set -a
|
||||
# shellcheck disable=SC1091
|
||||
. "$_mon_cfg"
|
||||
set +a
|
||||
fi
|
||||
unset _mon_cfg
|
||||
export _TALER_MON_ENV_LOADED=1
|
||||
fi
|
||||
|
||||
# Default stack = GOA / hacktivism (overridden by TALER_DOMAIN / --domain)
|
||||
# i18n (en default; fr for FrancPaysan — see i18n.sh / TALER_MON_LANG)
|
||||
|
|
@ -22,9 +39,25 @@ fi
|
|||
: "${EXCHANGE_LOCAL:=http://127.0.0.1:9011}"
|
||||
: "${MERCHANT_LOCAL:=https://127.0.0.1:9010}"
|
||||
: "${LANDING_LOCAL:=http://127.0.0.1:9013}"
|
||||
: "${KOOPA_SSH:=koopa}"
|
||||
# When LAN Host "koopa" is unreachable, try WAN DNAT (see ~/.ssh/config Host koopa-external).
|
||||
: "${KOOPA_SSH_FALLBACKS:=koopa-external}"
|
||||
# Hostnames/paths: set via ~/.config/taler-monitoring/env (no hardcoded machine values).
|
||||
: "${KOOPA_SSH:=}"
|
||||
: "${KOOPA_SSH_FALLBACKS:=}"
|
||||
: "${INSIDE_SSH:=}"
|
||||
: "${FRANCPAYSAN_SSH:=}"
|
||||
: "${DEVTESTING_SSH:=}"
|
||||
: "${DEPLOY_SSH:=}"
|
||||
: "${FIRECUDA_SSH:=}"
|
||||
: "${HTML_OUT:=${HOME}/monitoring-sites-staging}"
|
||||
: "${DEPLOY_STAGING:=${HTML_OUT}}"
|
||||
: "${DEPLOY_WWW_ROOT:=}"
|
||||
: "${APPLY_MONITORING_LIVE:=}"
|
||||
: "${KOOPA_CADDY_DIR:=}"
|
||||
: "${FRANCPAYSAN_SECRETS:=}"
|
||||
: "${FRANCPAYSAN_REMOTE_SECRETS_ROOT:=}"
|
||||
: "${FRANCPAYSAN_REMOTE_BANK_ADMIN_SECRET:=}"
|
||||
: "${FRANCPAYSAN_REMOTE_BANK_EXPLORER_SECRET:=}"
|
||||
: "${FRANCPAYSAN_REMOTE_MERCHANT_TOKEN:=}"
|
||||
: "${WALLET_CLI:=}"
|
||||
: "${MERCHANT_INSTANCE:=goa-demo-cp4zqk}"
|
||||
# Merchant portal /private API: instance ids must be lowercase or you get odd 401s.
|
||||
# (Display names may use capitals; path segment /instances/{id}/ must not.)
|
||||
|
|
@ -235,13 +268,13 @@ apply_taler_domain() {
|
|||
: "${E2E_TEMPLATE_MAP:=5=oeufs-6 4.5=pain-seigle 6=jus-pomme 8.5=fromage-chevre 12=miel-printemps 25=panier-legumes}"
|
||||
: "${E2E_PAY_VALUES:=5 8.5 6}"
|
||||
: "${E2E_WITHDRAW_VALUES:=20 50}"
|
||||
# Inside checks as low-priv stagepaysan (podman, no sudo) — not koopa
|
||||
# Inside checks as low-priv stagepaysan (podman, no sudo) — not koopa.
|
||||
# INSIDE_SSH / container names: set in host env (no hardcoded SSH host).
|
||||
INSIDE_PROFILE="${INSIDE_PROFILE:-stage-lfp}"
|
||||
INSIDE_SSH="${INSIDE_SSH:-francpaysan-stage-user}"
|
||||
INSIDE_BANK_CTR="${INSIDE_BANK_CTR:-stage-lfp-bank}"
|
||||
INSIDE_EXCHANGE_CTR="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
|
||||
INSIDE_MERCHANT_CTR="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
|
||||
# Host pasta ports (127.0.0.1 on francpaysan-host)
|
||||
# Host pasta ports (127.0.0.1 on the FP host (INSIDE_SSH))
|
||||
INSIDE_BANK_PORT="${INSIDE_BANK_PORT:-9032}"
|
||||
INSIDE_EXCHANGE_PORT="${INSIDE_EXCHANGE_PORT:-9031}"
|
||||
INSIDE_MERCHANT_PORT="${INSIDE_MERCHANT_PORT:-9030}"
|
||||
|
|
@ -381,7 +414,7 @@ mon_ssh_ok() {
|
|||
ssh "${SSH_BASE_OPTS[@]}" "$host" true >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# Pick a working SSH host: KOOPA_SSH first, then KOOPA_SSH_FALLBACKS (koopa-external).
|
||||
# Pick a working SSH host: KOOPA_SSH first, then KOOPA_SSH_FALLBACKS (from env).
|
||||
# Sets KOOPA_SSH to the first host that answers. 0 = ok, 1 = none.
|
||||
KOOPA_SSH_RESOLVED=0
|
||||
resolve_koopa_ssh() {
|
||||
|
|
@ -1195,26 +1228,8 @@ if [ -z "$SECRETS_ROOT" ]; then
|
|||
SECRETS_ROOT="${KOOPA_ADMIN_SECRETS}/koopa/host-root"
|
||||
fi
|
||||
fi
|
||||
if [ -z "$SECRETS_ROOT" ]; then
|
||||
_mon_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
_admin_log="$(cd "${_mon_dir}/../.." && pwd)"
|
||||
for d in \
|
||||
"${_admin_log}/../koopa-admin-secrets/koopa/host-root" \
|
||||
"${_admin_log}/../../koopa-admin-secrets/koopa/host-root" \
|
||||
"${HOME}/taler/src/koopa-admin-secrets/koopa/host-root" \
|
||||
"${HOME}/src/koopa/koopa-admin-secrets/koopa/host-root" \
|
||||
"${HOME}/koopa-admin-secrets/koopa/host-root" \
|
||||
"/Users/newkamek/src/koopa/koopa-admin-secrets/koopa/host-root" \
|
||||
"$(cd "${_admin_log}/../.." 2>/dev/null && pwd)/koopa-admin-secrets/koopa/host-root"
|
||||
do
|
||||
# resolve .. without requiring the dir to exist first for cd
|
||||
if [ -d "$d/taler-bank" ]; then
|
||||
SECRETS_ROOT=$(cd "$d" && pwd)
|
||||
break
|
||||
fi
|
||||
done
|
||||
unset _mon_dir _admin_log d
|
||||
fi
|
||||
# No further home-path probes — set SECRETS_ROOT or KOOPA_ADMIN_SECRETS in env.
|
||||
|
||||
|
||||
read_secret() {
|
||||
local rel="$1" base val=""
|
||||
|
|
@ -1259,7 +1274,7 @@ secrets_hint() {
|
|||
Prefer a local secrets file (not committed):
|
||||
cp secrets.env.example secrets.env
|
||||
\$EDITOR secrets.env
|
||||
Or set SECRETS_ROOT=\$HOME/src/koopa/koopa-admin-secrets/koopa/host-root
|
||||
Or set SECRETS_ROOT / KOOPA_ADMIN_SECRETS in ~/.config/taler-monitoring/env
|
||||
Or export E2E_BANK_ADMIN_PASS / E2E_MERCHANT_TOKEN for one shot.
|
||||
EOF
|
||||
}
|
||||
|
|
@ -1299,14 +1314,10 @@ find_wallet_cli() {
|
|||
echo "$WALLET_CLI"; return 0
|
||||
fi
|
||||
local c cand
|
||||
for c in \
|
||||
# WALLET_CLI / WALLET_CLI_CANDIDATES from env; then portable package paths only.
|
||||
# shellcheck disable=SC2086
|
||||
for c in ${WALLET_CLI_CANDIDATES:-} \
|
||||
"${HOME}/.local/bin/taler-wallet-cli.mjs" \
|
||||
"${HOME}/taler/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
|
||||
"${HOME}/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
|
||||
"${HOME}/taler/opt/taler-wallet-cli/usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs" \
|
||||
/home/hernani/taler/opt/taler-wallet-cli/usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs \
|
||||
/home/hernani/taler/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs \
|
||||
/Users/newkamek/src/taler/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs \
|
||||
/usr/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs \
|
||||
/usr/share/taler-wallet-cli/bin/taler-wallet-cli.mjs
|
||||
do
|
||||
|
|
|
|||
|
|
@ -513,7 +513,7 @@ metrics_taler_load() {
|
|||
_m_bank="${INSIDE_BANK_CTR:-stage-lfp-bank}"
|
||||
_m_mer="${INSIDE_MERCHANT_CTR:-stage-lfp-merchant}"
|
||||
_m_ex="${INSIDE_EXCHANGE_CTR:-stage-lfp-exchange-ansible}"
|
||||
_m_ssh="${INSIDE_SSH:-francpaysan-stage-user}"
|
||||
_m_ssh="${INSIDE_SSH:-}"
|
||||
fi
|
||||
remote_py=$(cat <<PY
|
||||
import base64, json, os, re, subprocess, time
|
||||
|
|
@ -866,7 +866,7 @@ metrics_report_load() {
|
|||
return 0
|
||||
fi
|
||||
if ! metrics_taler_load "$out" "$label"; then
|
||||
warn "load ${label}" "probe failed via ${KOOPA_SSH:-?} — try KOOPA_SSH=koopa-external"
|
||||
warn "load ${label}" "probe failed via ${KOOPA_SSH:-?} — set KOOPA_SSH / KOOPA_SSH_FALLBACKS in env"
|
||||
return 1
|
||||
fi
|
||||
while IFS= read -r line; do
|
||||
|
|
|
|||
|
|
@ -30,8 +30,8 @@
|
|||
# Default phases for -d stage.lefrancpaysan.ch: urls + inside + versions + e2e
|
||||
# inside uses francpaysan-stage-user (stagepaysan); stats from public HTTPS.
|
||||
# Admin credit (required for ATM withdraw ladder on stage):
|
||||
# E2E_BANK_ADMIN_PASS=… # or auto-load via SSH francpaysan-host
|
||||
# FRANCPAYSAN_SSH=francpaysan-host
|
||||
# E2E_BANK_ADMIN_PASS=… # or auto-load via SSH
|
||||
# FRANCPAYSAN_SSH=
|
||||
# FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
|
||||
# Public shop pays use E2E_USE_TEMPLATES=1 (default on TESTPAYSAN) — no merchant token.
|
||||
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ Applies to all nine fronts (GOA + FP stage + FP prod) in the default `SITES` lis
|
|||
| Host | Role |
|
||||
|------|------|
|
||||
| **optional outside runner** (SSH alias via `FIRECUDA_SSH`) | optional runner (public DNS) |
|
||||
| **koopa-external** | deploy staging + Caddy (root service) |
|
||||
| **deploy host (`DEPLOY_SSH`)** | deploy staging + Caddy (root service) |
|
||||
| **host-agents** | primary: GOA + FP on-box (`../host-agent/`) |
|
||||
|
||||
No secrets in `settings.conf` — only hosts, paths, site list.
|
||||
|
|
|
|||
|
|
@ -6,17 +6,17 @@ Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
|
|||
After host-agent / `generate-monitoring-sites.sh` + deploy (as hernani), files live in:
|
||||
|
||||
```text
|
||||
/home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
|
||||
/home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html
|
||||
$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
|
||||
$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html
|
||||
```
|
||||
|
||||
## One-shot as root (preferred)
|
||||
|
||||
```bash
|
||||
# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
|
||||
sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
sudo $APPLY_MONITORING_LIVE
|
||||
# same script is versioned in the suite:
|
||||
# host-agent/apply-monitoring-live.sh → install/sync to /home/hernani/koopa-caddy/
|
||||
# host-agent/apply-monitoring-live.sh → install/sync to $KOOPA_CADDY_DIR/
|
||||
```
|
||||
|
||||
That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
|
||||
|
|
@ -26,10 +26,10 @@ Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
|
|||
|
||||
```bash
|
||||
install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
|
||||
rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
|
||||
rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
|
||||
chown -R hernani:caddy /var/www/monitoring-sites
|
||||
|
||||
install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
|
||||
install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
|
||||
caddy validate --config /etc/caddy/Caddyfile
|
||||
systemctl reload caddy
|
||||
systemctl is-active caddy
|
||||
|
|
|
|||
|
|
@ -28,10 +28,10 @@
|
|||
# /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html
|
||||
#
|
||||
# Live apply on koopa (absolute path — ~ as root is /root):
|
||||
# sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
|
||||
# sudo ${APPLY_MONITORING_LIVE}
|
||||
# Runtime-only (no sudo; hernani admin API):
|
||||
# curl -g -X POST http://[::1]:2019/load -H 'Content-Type: text/caddyfile' \
|
||||
# --data-binary @/home/hernani/koopa-caddy/Caddyfile
|
||||
# --data-binary @${KOOPA_CADDY_DIR}/Caddyfile
|
||||
|
||||
# --- only inside taler.hacktivism.ch { ... } ---
|
||||
@mon_bare path /monitoring /monitoring_err \
|
||||
|
|
|
|||
|
|
@ -13,8 +13,8 @@ set +a
|
|||
|
||||
WORK_ROOT="${WORK_ROOT:-/tmp/taler-monitoring-sites-work}"
|
||||
HTML_DIR="$WORK_ROOT/html"
|
||||
DEPLOY_SSH="${DEPLOY_SSH:-koopa-external}"
|
||||
DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
|
||||
DEPLOY_SSH="${DEPLOY_SSH:-}"
|
||||
DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-}"
|
||||
|
||||
if [ ! -d "$HTML_DIR" ]; then
|
||||
echo "no HTML_DIR $HTML_DIR — run generate-monitoring-sites.sh first" >&2
|
||||
|
|
@ -23,7 +23,7 @@ fi
|
|||
|
||||
echo "deploy $HTML_DIR → ${DEPLOY_SSH}:${DEPLOY_WWW_ROOT}/"
|
||||
# Prefer writing to a hernani-owned staging dir if /var/www not writable
|
||||
STAGE_REMOTE="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
|
||||
STAGE_REMOTE="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
|
||||
|
||||
ssh -o BatchMode=yes -o ConnectTimeout=20 "$DEPLOY_SSH" \
|
||||
"mkdir -p '$STAGE_REMOTE' '$DEPLOY_WWW_ROOT' 2>/dev/null || mkdir -p '$STAGE_REMOTE'"
|
||||
|
|
|
|||
|
|
@ -43,8 +43,8 @@ SKIP_SSH=1
|
|||
CONTINUE_ON_ERROR=1
|
||||
PHASES_ERR=urls versions
|
||||
PHASES_OK=urls versions
|
||||
DEPLOY_SSH=koopa-external
|
||||
DEPLOY_STAGING=/home/hernani/monitoring-sites-staging
|
||||
DEPLOY_SSH=${DEPLOY_SSH:-}
|
||||
DEPLOY_STAGING=${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}
|
||||
WORK_ROOT=
|
||||
MONITORING_ROOT=..
|
||||
SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
|
||||
|
|
|
|||
|
|
@ -7,13 +7,13 @@ if [ -z "$FIRECUDA" ]; then
|
|||
echo "Set FIRECUDA_SSH to your outside-runner SSH host alias" >&2
|
||||
exit 2
|
||||
fi
|
||||
KOOPA="${DEPLOY_SSH:-koopa-external}"
|
||||
KOOPA="${DEPLOY_SSH:?set DEPLOY_SSH in env}"
|
||||
REMOTE_HTML="${FIRECUDA_HTML:-var/taler-monitoring-sites-work/html/}"
|
||||
STAGE="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
|
||||
STAGE="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
|
||||
|
||||
echo "firecuda:$REMOTE_HTML → $KOOPA:$STAGE"
|
||||
ssh -o BatchMode=yes -o ConnectTimeout=20 "$KOOPA" "mkdir -p '$STAGE'"
|
||||
rsync -az --delete \
|
||||
"${FIRECUDA}:${REMOTE_HTML}" \
|
||||
"${KOOPA}:${STAGE}/"
|
||||
echo "OK staged. Root: rsync to /var/www/monitoring-sites (see ROOT-ON-KOOPA.md)"
|
||||
echo "OK staged. Root: rsync to (see ROOT-ON-KOOPA.md)"
|
||||
|
|
|
|||
|
|
@ -27,8 +27,8 @@ export PHASES_ERR="${PHASES_ERR:-urls versions}"
|
|||
export PHASES_OK="${PHASES_OK:-urls versions}"
|
||||
export WORK_ROOT="${WORK_ROOT:-$HOME/var/taler-monitoring-sites-work}"
|
||||
export MONITORING_ROOT="${MONITORING_ROOT:-$ROOT/..}"
|
||||
export DEPLOY_SSH="${DEPLOY_SSH:-koopa-external}"
|
||||
export DEPLOY_STAGING="${DEPLOY_STAGING:-/home/hernani/monitoring-sites-staging}"
|
||||
export DEPLOY_SSH="${DEPLOY_SSH:-}"
|
||||
export DEPLOY_STAGING="${DEPLOY_STAGING:-${DEPLOY_STAGING:-$HOME/monitoring-sites-staging}}"
|
||||
|
||||
# Prefer full 9-site list from settings or defaults inside generate script
|
||||
unset ONLY_HOSTS
|
||||
|
|
@ -48,7 +48,7 @@ if [ -n "${DEPLOY_SSH:-}" ] && [ "${DEPLOY_FROM_FIRECUDA:-0}" = "1" ]; then
|
|||
else
|
||||
echo "note: HTML at ${WORK_ROOT}/html — pull from laptop:"
|
||||
echo " rsync -az outside-runner:var/taler-monitoring-sites-work/html/ \\"
|
||||
echo " koopa-external:monitoring-sites-staging/"
|
||||
echo " $DEPLOY_SSH:monitoring-sites-staging/"
|
||||
echo " # or: ./pull-firecuda-to-koopa.sh"
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -13,15 +13,15 @@ MONITORING_ROOT=..
|
|||
SKIP_SSH=1
|
||||
|
||||
# Deploy staging on koopa (host Caddy later — root copies to /var/www)
|
||||
DEPLOY_SSH=koopa-external
|
||||
DEPLOY_SSH= # set SSH host for deploy
|
||||
DEPLOY_SSH_FALLBACKS=koopa
|
||||
# Static files for Caddy file_server (created per hostname)
|
||||
DEPLOY_WWW_ROOT=/var/www/monitoring-sites
|
||||
DEPLOY_WWW_ROOT= # e.g. /var/www/monitoring-sites
|
||||
DEPLOY_SUDO=sudo
|
||||
CADDY_CONFIG=/etc/caddy/Caddyfile
|
||||
CADDY_MIRROR_REL=configs/caddy/Caddyfile
|
||||
# Working tree on deploy host for apply (optional)
|
||||
KOOPA_CADDY_DIR=/home/hernani/koopa-caddy
|
||||
KOOPA_CADDY_DIR= # absolute path to Caddy tree on mon host
|
||||
|
||||
# Source link for HTML footer (Forgejo)
|
||||
SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
|
||||
|
|
|
|||
|
|
@ -150,7 +150,7 @@ Env (same meaning):
|
|||
PERF_WARN_MS PERF_FAIL_MS (urls latency; default 8000 / 20000)
|
||||
QR_CHECK=0 skip QR form + qrencode/zbarimg (urls phase)
|
||||
QR_ECC=M qrencode ECC level (default M)
|
||||
KOOPA_SSH KOOPA_SSH_FALLBACKS (default koopa → koopa-external)
|
||||
KOOPA_SSH KOOPA_SSH_FALLBACKS (set KOOPA_SSH / KOOPA_SSH_FALLBACKS in env)
|
||||
METRICS_LOAD=0 skip host/container RAM/CPU probes (e2e/ladder/inside)
|
||||
EXPECT_WEBUI_VERSION=1.6.11 pin merchant /webui/version.txt (urls)
|
||||
EXPECT_WEBUI_OVERLAY=selfbuild require substr in version-overlay.txt
|
||||
|
|
@ -187,6 +187,21 @@ SPA pin after selfbuild:
|
|||
EOF
|
||||
}
|
||||
|
||||
# Machine-local paths/hosts from taler-monitoring-env install (no hardcodes in suite).
|
||||
# Install: ~/src/taler-monitoring-env/bin/install-env.sh <machine>
|
||||
if [ "${_TALER_MON_ENV_LOADED:-0}" != "1" ]; then
|
||||
_mon_cfg="${TALER_MONITORING_ENV:-${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/env}"
|
||||
if [ -f "$_mon_cfg" ]; then
|
||||
# shellcheck disable=SC1090
|
||||
set -a
|
||||
# shellcheck disable=SC1091
|
||||
. "$_mon_cfg"
|
||||
set +a
|
||||
fi
|
||||
unset _mon_cfg
|
||||
export _TALER_MON_ENV_LOADED=1
|
||||
fi
|
||||
|
||||
# shellcheck source=lib.sh
|
||||
source "$ROOT/lib.sh"
|
||||
# ensure i18n after domain may change later
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue