release 1.18.7: fix TSA mail catalog + FP stage e2e defaults

Mail/surface catalogs used non-resolving anastasis.taler-systems.com;
point to mail.anastasis.lu (pixel) and anastasis.lu. Stage mon defaults
include e2e with francpaysan-secrets + wallet-cli paths.

VERSION

@@ -1 +1 @@
-1.18.6
+1.18.7

VERSIONS.md

@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.18.7** | 2026-07-19 | **Bugfix:** mail/surface catalogs — TSA/Anastasis MX is **mail.anastasis.lu** (→ pixel), not non-resolving `anastasis.taler-systems.com`; add `anastasis.lu` + pixel host probes (fixes surface_err mail.*). **Also:** FP stage host-agent defaults include **e2e** + 1800s timeout; stagepaysan.env.example wires francpaysan-secrets + wallet-cli. |
 | **v1.18.6** | 2026-07-19 | **Bugfix:** TESTS.md table cell for `e2e.bankwd-` markdown typo from rename. |
 | **v1.18.5** | 2026-07-19 | **Bugfix:** TESTS.md e2e group list `atm` → `bankwd` (missed in 1.18.4). |
 | **v1.18.4** | 2026-07-19 | **Bugfix:** e2e group id **atm → bankwd** (`e2e.bankwd-*`); finish ATM wording cleanup so mon logs match **Bank withdraw** (no leftover “atm” phase label). Env `E2E_ATM_MAX` still accepted as alias. |

check_mail.sh

@@ -2,7 +2,8 @@
 # check_mail.sh — outside-in mail (MX / SMTP / IMAP / SPF / DMARC)
 #
 # Catalog: mail-catalog.conf (MAIL_CATALOG=… to override)
-# Covers firefly (taler.net, gnunet.org) and pixel (taler-systems.com, …).
+# Covers firefly (taler.net, gnunet.org) and Anastasis/TSA
+# (mail.anastasis.lu → pixel.taler-systems.com; anastasis.lu).
 #
 # Outside-only. Phase: mail
 #

host-agent/env/stagepaysan.env.example

@@ -1,8 +1,10 @@
 # Copy to:  ~/.config/taler-monitoring/env  (user stagepaysan)
 # Never inside the git tree — update-suite never overwrites this file.
 #
-# Shared reporting generation (run-host-report.sh / run-fp-stage-monitoring.sh):
+# Secrets: use francpaysan-secrets layout (operator tree or host mirror):
-#   RUN_TIMEOUT, line-buffered log, always HTML, commit link on git.hacktivism.ch
+#   $HOME/francpaysan-secrets/stage/bank-admin-password.txt
+#   $HOME/francpaysan-secrets/stage/default-instance-token.txt
+# On stage host, symlink those to /mnt/data/stagepaysan/*/secrets/…
 
 TALER_DOMAIN=stage.lefrancpaysan.ch
 INSIDE_PODMAN=1
@@ -10,21 +12,32 @@ INSIDE_MODE=local-podman
 INSIDE_PROFILE=stage-lfp
 LOCAL_STACK=0
 CONTINUE_ON_ERROR=1
-PHASES="urls inside versions"
+PHASES="urls inside versions monpages e2e"
-RUN_TIMEOUT=600
+RUN_TIMEOUT=1800
+E2E_TIMEOUT=900
+E2E_USE_TEMPLATES=1
 
 HTML_OUT=$HOME/monitoring-sites-staging
 MON_HOSTS="stage.bank.lefrancpaysan.ch stage.exchange.lefrancpaysan.ch stage.monnaie.lefrancpaysan.ch"
+DEPLOY_WWW_ROOT=/var/www/monitoring-sites
 
-# Git clone of taler-monitoring (repo root, not …/taler-monitoring (repo root))
 SUITE_DIR=$HOME/src/taler-monitoring
 SUITE_GIT_URL=https://git.hacktivism.ch/hernani/taler-monitoring.git
 SUITE_GIT_REF=main
 SUITE_UPDATE_MODE=reset
 SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
 
-# Optional public docroot if this user can write it
+FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
-# DEPLOY_WWW_ROOT=/var/www/monitoring-sites
+WALLET_CLI=$HOME/.local/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs
+WALLET_CLI_CANDIDATES="$HOME/.local/lib/taler-wallet-cli/node_modules/taler-wallet-cli/bin/taler-wallet-cli.mjs $HOME/.local/bin/taler-wallet-cli.mjs"
+
+INSIDE_BANK_CTR=stage-lfp-bank
+INSIDE_EXCHANGE_CTR=stage-lfp-exchange-ansible
+INSIDE_MERCHANT_CTR=stage-lfp-merchant
 
-# UI language for console + HTML sticky bar (en|fr)
 TALER_MON_LANG=fr
+MONPAGES_REQUIRE_PUBLIC=1
+MONPAGES_INVENTORY=job
+STRICT_EXIT=1
+AGENT_LABEL=fp-stage-host-agent
+STATE_NAME=taler-monitoring-stage-lfp

host-agent/run-fp-stage-monitoring.sh

@@ -18,8 +18,8 @@ export LOCAL_STACK="${LOCAL_STACK:-0}"
 export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 # monpages obligatory (ERROR): only FP stage mon hosts below — never GOA inventory
 export MONPAGES_REQUIRE_PUBLIC="${MONPAGES_REQUIRE_PUBLIC:-1}"
-export RUN_TIMEOUT="${RUN_TIMEOUT:-600}"
+export RUN_TIMEOUT="${RUN_TIMEOUT:-1800}"
-export PHASES="${PHASES:-urls inside versions monpages}"
+export PHASES="${PHASES:-urls inside versions monpages e2e}"
 export MON_HOSTS="${MON_HOSTS:-stage.bank.lefrancpaysan.ch stage.exchange.lefrancpaysan.ch stage.monnaie.lefrancpaysan.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
 export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"

host-agent/run-surface-monitoring.sh

@@ -6,7 +6,7 @@
 #   https://taler.hacktivism.ch/taler-monitoring-surface_err/
 #
 # This page covers remote ecosystem inventory: host/port probes, nmap OS
-# fingerprint, Mattermost, mail (firefly + anastasis), package/version signals.
+# fingerprint, Mattermost, mail (firefly + mail.anastasis.lu/pixel), package/version signals.
 # There are NO separate public pages for mail / mattermost (folded here).
 # Apt-src deploy tests keep their own page + timer:
 #   run-aptdeploy-monitoring.sh → /taler-monitoring-aptdeploy(+_err)/

mail-catalog.conf

@@ -3,16 +3,18 @@
 # Format (whitespace-separated; # comments):
 #   domain   expected_mx (comma)   mail_hosts (comma)   smtp_ports   imap_ports   label
 #
-# Only these mail planes (no hacktivism / ad-hoc MX):
+# Mail planes (outside-in only — no host login):
-#   • firefly.gnunet.org  — taler.net + gnunet.org
+#   • firefly.gnunet.org     — taler.net + gnunet.org
-#   • anastasis.taler-systems.com — Anastasis / TSA mail
+#   • mail.anastasis.lu      — Anastasis / TSA (A → pixel.taler-systems.com)
+#     (legacy catalog host anastasis.taler-systems.com does NOT resolve)
 #
 # Override path: MAIL_CATALOG=/path/to/file
 
 # --- firefly.gnunet.org ---
-taler.net                     firefly.gnunet.org              firefly.gnunet.org              25,465,587  143,993  firefly-taler
+taler.net                     firefly.gnunet.org              firefly.gnunet.org                         25,465,587  143,993  firefly-taler
-gnunet.org                    firefly.gnunet.org              firefly.gnunet.org              25,465,587  143,993  firefly-gnunet
+gnunet.org                    firefly.gnunet.org              firefly.gnunet.org                         25,465,587  143,993  firefly-gnunet
 
-# --- anastasis.taler-systems.com ---
+# --- Anastasis / TSA (MX mail.anastasis.lu → pixel) ---
-anastasis.taler-systems.com   anastasis.taler-systems.com     anastasis.taler-systems.com     25,465,587  143,993  anastasis-tsa
+# Port 587 often closed/filtered on this plane → WARN only (see check_mail.sh).
-taler-systems.com             anastasis.taler-systems.com     anastasis.taler-systems.com     25,465,587  143,993  tsa-via-anastasis
+taler-systems.com             mail.anastasis.lu               mail.anastasis.lu,pixel.taler-systems.com  25,465,587  143,993  tsa-anastasis
+anastasis.lu                  mail.anastasis.lu               mail.anastasis.lu                         25,465,587  143,993  anastasis-lu

surface-catalog.conf

@@ -46,7 +46,10 @@ bugs.gnunet.org               443     https   gnunet-bugs
 # --- taler-systems.com ---
 www.taler-systems.com         443     https   tsa-www
 taler-systems.com             443     https   tsa-apex
-anastasis.taler-systems.com   443,25,465,587,143,993  https   anastasis-mail
+# Anastasis / TSA mail plane (MX mail.anastasis.lu → pixel). Do NOT list
+# anastasis.taler-systems.com — it does not resolve (was a catalog typo).
+mail.anastasis.lu             443,25,465,587,143,993  https   anastasis-mail
+pixel.taler-systems.com       443,25,465,587,143,993  https   pixel-mail
 
 # --- mail (also covered by phase mail; listed for surface nmap/ports) ---
 firefly.gnunet.org            443,25,465,587,143,993  https   firefly-mail