feat: EBICS bank detect, regio FLODOS, and check skips

check_amount_ladder.sh

@@ -41,6 +41,11 @@ load_monitoring_secrets_env 2>/dev/null || true
 # Area ladder.* — withdraw/pay amount ladder (any EXPECT_CURRENCY / stack)
 # Groups: ladder.plan / ladder.load / ladder.withdraw / ladder.pay / ladder.report
 set_area ladder
+if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
+  set_group plan
+  info "ladder" "skipped — backend=${TALER_BANK_BACKEND:-ebics} (needs public x-taler-bank)"
+  exit 0
+fi
 set_group plan
 SECTION_T0=$(date +%s)
 now_ms() { python3 -c 'import time; print(int(time.time()*1000))'; }
@@ -128,6 +133,16 @@ INST="${MERCHANT_INSTANCE}"
 # Uses bank max_wire_transfer_amount and exchange min denom when still on GOA defaults.
 apply_ladder_stack_defaults() {
   [ "${LADDER_STACK_AUTO}" = "1" ] || return 0
+  if [ "${CUR}" = "FLODOS" ] || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
+    CUR="FLODOS"
+    # demo bank: keep ladder inside a small funded pool (override with LADDER_MAX_AMOUNT=)
+    if [ "${LADDER_MAX_AMOUNT}" = "4503599627370496" ] || [ "${LADDER_MAX_AMOUNT}" = "${GOA_LADDER_CEILING:-}" ]; then
+      LADDER_MAX_AMOUNT="${REGIO_LADDER_MAX:-20}"
+    fi
+    LADDER_MIN_AMOUNT="${LADDER_MIN_AMOUNT:-0.02}"
+    info "ladder stack" "FLODOS/regio · max=${CUR}:${LADDER_MAX_AMOUNT} min=${CUR}:${LADDER_MIN_AMOUNT}"
+    return 0
+  fi
   if [ "${CUR}" != "TESTPAYSAN" ]; then
     case "${TALER_DOMAIN:-}" in
       stage.lefrancpaysan.ch|stage.bank.lefrancpaysan.ch|stage.exchange.lefrancpaysan.ch|stage.monnaie.lefrancpaysan.ch)
@@ -259,6 +274,28 @@ resolve_explorer_pw() {
     return 0
   fi
 
+  # regio.taler.net (FLODOS) — dedicated pool user, not admin (override default EXP_USER=explorer)
+  if [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ] \
+    || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
+    if [ -n "${REGIO_BANK_EXPLORER_USER_FILE:-}" ] && [ -f "${REGIO_BANK_EXPLORER_USER_FILE}" ]; then
+      EXP_USER=$(tr -d '\n\r' <"${REGIO_BANK_EXPLORER_USER_FILE}")
+    elif [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt" ]; then
+      EXP_USER=$(tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt")
+    else
+      EXP_USER="${EXP_USER:-lena.v92}"
+      [ "$EXP_USER" = "explorer" ] && EXP_USER=lena.v92
+    fi
+    export EXP_USER
+    if [ -n "${REGIO_BANK_EXPLORER_SECRET:-}" ] && [ -f "${REGIO_BANK_EXPLORER_SECRET}" ]; then
+      tr -d '\n\r' <"${REGIO_BANK_EXPLORER_SECRET}"
+      return 0
+    fi
+    if [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-password.txt" ]; then
+      tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-password.txt"
+      return 0
+    fi
+  fi
+
   # Stage TESTPAYSAN — never use GOA koopa-admin-secrets explorer pw first
   if [ "${CUR}" = "TESTPAYSAN" ] \
     || [[ "${TALER_DOMAIN:-}" == stage.*lefrancpaysan* ]] \
@@ -532,6 +569,18 @@ metrics_report_load "$LOAD_BEFORE" "ladder-start" || true
 # Fresh wallet per rung — baseline empty (or last-rung DB if re-used later)
 metrics_report_coins "ladder-start" || true
 
+# EXP_USER must be set in this shell (resolve_explorer_pw runs in $(…) subshell)
+if [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ] \
+  || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]] || [ "${TALER_DOMAIN:-}" = "regio" ]; then
+  if [ -n "${REGIO_BANK_EXPLORER_USER_FILE:-}" ] && [ -f "${REGIO_BANK_EXPLORER_USER_FILE}" ]; then
+    EXP_USER=$(tr -d '\n\r' <"${REGIO_BANK_EXPLORER_USER_FILE}")
+  elif [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && [ -f "${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt" ]; then
+    EXP_USER=$(tr -d '\n\r' <"${TALER_DEPLOYMENT_SECRETS}/regio/bank-explorer-user.txt")
+  elif [ -z "${EXP_USER:-}" ] || [ "${EXP_USER}" = "explorer" ]; then
+    EXP_USER=lena.v92
+  fi
+  export EXP_USER
+fi
 if ! EXP_PW=$(resolve_explorer_pw); then
   err bank "explorer password missing" \
     "set EXP_PW / EXP_PW_FILE or SECRETS_ROOT=…/koopa/host-root (taler-bank/bank-explorer-password.txt)${SECRETS_ROOT:+ · SECRETS_ROOT=${SECRETS_ROOT}}"
@@ -539,9 +588,9 @@ if ! EXP_PW=$(resolve_explorer_pw); then
   exit 1
 fi
 if [ -n "${SECRETS_ROOT:-}" ]; then
-  info "explorer secret" "resolved (SECRETS_ROOT=${SECRETS_ROOT} · stage uses stagepaysan secret first when CUR=TESTPAYSAN)"
+  info "explorer secret" "resolved user=${EXP_USER} (SECRETS_ROOT=${SECRETS_ROOT})"
 else
-  info "explorer secret" "resolved via EXP_PW / EXP_PW_FILE / stage SSH / koopa"
+  info "explorer secret" "resolved user=${EXP_USER} via EXP_PW / file / stage SSH / koopa"
 fi
 if [ -n "${CLI_JS:-}" ] && [ -f "${CLI_JS}" ]; then
   ok "wallet-cli" "$CLI_JS"
@@ -556,20 +605,66 @@ if ! wcli balance >"$SCRATCH/wcli-smoke.out" 2>&1; then
   exit 1
 fi
 
-# --- auto-account ---
+# --- personal account (intro auto-account, else open registration) ---
 t0=$(now_ms)
-if ! curl -sS -m 30 -o "$SCRATCH/auto-account.json" "${BANK}/intro/auto-account.json"; then
+_acct_ok=0
-  err bank "auto-account.json unreachable"
+if curl -sS -m 30 -o "$SCRATCH/auto-account.json" "${BANK}/intro/auto-account.json" \
+  && python3 -c 'import json; d=json.load(open("'"$SCRATCH"'/auto-account.json")); assert d.get("ok") or d.get("username")' 2>/dev/null; then
+  _acct_ok=1
+elif [ "${CUR:-}" = "FLODOS" ] || [[ "${TALER_DOMAIN:-}" == *regio.taler.net* ]]; then
+  # regio has no /intro landings — register a discreet one-shot user (disposable mail list)
+  _mail_file="${REGIO_DISPOSABLE_EMAILS:-${TALER_DEPLOYMENT_SECRETS:+$TALER_DEPLOYMENT_SECRETS/regio/disposable-emails.txt}}"
+  _email=""
+  if [ -n "${_mail_file:-}" ] && [ -f "$_mail_file" ]; then
+    _email=$(awk -F'\t' '$2=="UNUSED" && $1 !~ /^#/ {print $1; exit}' "$_mail_file")
+  fi
+  : "${_email:=sofia.keller4@grr.la}"
+  _user=$(printf '%s' "$_email" | python3 -c 'import sys; e=sys.stdin.read().strip().split("@")[0]; print((e.replace(".","")[:10])+str(abs(hash(e))%100))')
+  _pw=$(openssl rand -base64 18 | tr -d '/+=' | head -c 20)
+  _name=$(printf '%s' "$_email" | python3 -c 'import sys; e=sys.stdin.read().strip().split("@")[0].replace("."," ").title(); print(e)')
+  _code=$(curl -sS -m 20 -o "$SCRATCH/auto-account.raw" -w '%{http_code}' -X POST \
+    -H 'Content-Type: application/json' \
+    -d "{\"username\":\"${_user}\",\"password\":\"${_pw}\",\"name\":\"${_name}\",\"email\":\"${_email}\"}" \
+    "${BANK}/accounts")
+  if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
+    python3 - "$_user" "$_pw" "$_name" "$_email" "$SCRATCH/auto-account.json" <<'PY'
+import json,sys
+u,p,n,e,out=sys.argv[1:6]
+json.dump({"ok":True,"created_for_you":True,"username":u,"password":p,"name":n,"email":e,"balance":"FLODOS:0"}, open(out,"w"))
+PY
+    if [ -n "${_mail_file:-}" ] && [ -f "$_mail_file" ]; then
+      python3 - "$_mail_file" "$_email" "$_user" <<'PY'
+from pathlib import Path
+import sys
+p,email,user=Path(sys.argv[1]),sys.argv[2],sys.argv[3]
+lines=[]
+for line in p.read_text().splitlines():
+  if line.startswith(email+"\t") or line.startswith(email+" "):
+    parts=line.split("\t")
+    while len(parts)<3: parts.append("")
+    parts[1]="USED"
+    parts[2]=f"personal {user}"
+    line="\t".join(parts)
+  lines.append(line)
+p.write_text("\n".join(lines)+"\n")
+PY
+    fi
+    _acct_ok=1
+    info "personal account" "open-register ${_user} (no /intro; disposable mail)"
+  else
+    err bank "open register failed HTTP ${_code}" "$(head -c 120 "$SCRATCH/auto-account.raw" | tr '\n' ' ')"
     exit 1
   fi
+fi
 ms_auto=$(elapsed_ms "$t0")
-if ! python3 -c 'import json; d=json.load(open("'"$SCRATCH"'/auto-account.json")); assert d.get("ok") or d.get("username")' 2>/dev/null; then
+if [ "$_acct_ok" != "1" ]; then
-  err bank "auto-account create failed" "$(head -c 120 "$SCRATCH/auto-account.json" | tr '\n' ' ')"
+  err bank "auto-account create failed" "$(head -c 120 "$SCRATCH/auto-account.json" 2>/dev/null | tr '\n' ' ')"
   exit 1
 fi
 ACCT_USER=$(python3 -c 'import json; print(json.load(open("'"$SCRATCH"'/auto-account.json"))["username"])')
-ok "auto-account ${ACCT_USER} (${ms_auto}ms) — personal ${CUR}:0; pool=explorer"
+ok "auto-account ${ACCT_USER} (${ms_auto}ms) — personal ${CUR}:0; pool=${EXP_USER:-explorer}"
 info "auto-account password" "(see $SCRATCH/auto-account.json — not logged)"
+unset _acct_ok _mail_file _email _user _pw _name _code
 
 # --- explorer token ---
 t0=$(now_ms)

check_e2e.sh

@@ -489,6 +489,17 @@ if [ "$E2E_REMOTE" = "1" ]; then
     fi
     unset _fp_try _fp_host _remote_bank_sec
   fi
+  # regio.taler.net (FLODOS): path from taler-deployment-secrets via env
+  if [ -z "$ADMIN_PASS" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "FLODOS" ]; then
+    _regio_sec="${REGIO_BANK_ADMIN_SECRET:-}"
+    [ -z "$_regio_sec" ] && [ -n "${TALER_DEPLOYMENT_SECRETS:-}" ] && \
+      _regio_sec="${TALER_DEPLOYMENT_SECRETS}/regio/bank-admin-password.txt"
+    if [ -n "$_regio_sec" ] && [ -f "$_regio_sec" ]; then
+      ADMIN_PASS=$(tr -d '\n\r' <"$_regio_sec")
+      info "bank admin secret" "from $_regio_sec"
+    fi
+    unset _regio_sec
+  fi
   # Stage merchant: public templates need no token; optional default-instance token
   if [ -z "$MPW" ] && [ "${CUR:-${EXPECT_CURRENCY:-}}" = "TESTPAYSAN" ]; then
     if [ -n "${FRANCPAYSAN_SECRETS:-}" ] && [ -f "${FRANCPAYSAN_SECRETS}/stage/default-instance-token.txt" ]; then
@@ -552,6 +563,12 @@ merchant_auth_header() {
   esac
 }
 
+# EBICS / no public bank.* — withdraw path needs x-taler-bank (libeufin)
+if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
+  info "e2e" "skipped — backend=${TALER_BANK_BACKEND:-ebics} (no public bank.* / x-taler-bank)"
+  exit 0
+fi
+
 # Public reachability gates (remote: soft-skip if bank/merchant absent)
 for pair in \
   "bank|$BANK_PUBLIC/config" \

check_sanity.sh

@@ -31,6 +31,9 @@ set_area sanity
 set_group bank
 section "sanity · bank"
 # ---------------------------------------------------------------------------
+if [ "${CHECK_BANK:-1}" != "1" ] || [ "${TALER_BANK_BACKEND:-}" = "ebics" ]; then
+  info "bank" "IBAN/EBICS (CHECK_BANK=${CHECK_BANK:-0} · backend=${TALER_BANK_BACKEND:-ebics} — no public bank.*)"
+else
 expect_code "bank public /config" 200 "$BANK_PUBLIC/config"
 expect_code "bank public /taler-integration/config" 200 "$BANK_PUBLIC/taler-integration/config"
 expect_code "bank public /webui/" 200 "$BANK_PUBLIC/webui/"
@@ -98,6 +101,7 @@ REMOTE
 else
   warn "bank server-side" "ssh ${KOOPA_SSH} unavailable"
 fi
+fi
 
 # ---------------------------------------------------------------------------
 set_group exchange

domains.conf

@@ -5,9 +5,13 @@
 #
 # - name: what -d / TALER_DOMAIN matches (aliases allowed as extra lines)
 # - bank / exchange / merchant: hostname or full https:// URL
+#   bank may be "-" / ebics / none when the stack is IBAN/EBICS (no public
+#   libeufin bank.*). monitord also auto-detects from exchange /keys payto://
+#   (x-taler-bank → expect bank.*; iban-only → ebics_no_bank, blue).
 # - currency: GOA | KUDOS | CHF | … (empty or "-" = report only)
 # - local: 1 = koopa SSH/inside/e2e stack; 0 = public-only
-# - landing: 1 = check /intro landings + assets; 0 = skip (no GOA-style landings)
+# - landing: 1 = custom /intro landings (GOA + FrancPaysan/TESTPAYSAN stage only).
+#            0 = no /intro (demo/test/regio/TOPS — not the custom landing stack)
 # - lang: UI language for mon console/HTML (en|fr|de). Source of truth when
 #         TALER_MON_LANG_SET≠1. Workstation TALER_MON_LANG=en does not override.
 #         **de is supported but must not be used as a profile default** (no row
@@ -21,26 +25,37 @@
 # CLI: --lang en|fr|de  ·  TALER_MON_LANG_SET=1 locks UI lang
 # Alternate file: TALER_DOMAINS_CONF=/path/to/domains.conf
 
-# Local GOA (koopa) — landings matter · UI en · locale de-CH
+# Local GOA (koopa) — merchant host taler.hacktivism.ch · landings · UI en · locale de-CH
+# monitord includes local=1 by default (stack id hacktivism.ch).
 koopa              bank.hacktivism.ch   exchange.hacktivism.ch   taler.hacktivism.ch      GOA    1  1  en  de-CH  hacktivism.ch
 hacktivism         bank.hacktivism.ch   exchange.hacktivism.ch   taler.hacktivism.ch      GOA    1  1  en  de-CH  hacktivism.ch
 hacktivism.ch      bank.hacktivism.ch   exchange.hacktivism.ch   taler.hacktivism.ch      GOA    1  1  en  de-CH
+taler.hacktivism.ch bank.hacktivism.ch  exchange.hacktivism.ch   taler.hacktivism.ch      GOA    1  1  en  de-CH  hacktivism.ch
 
-# Public demo (KUDOS)
+# Public demo (KUDOS) — no custom /intro landings
-taler.net          bank.demo.taler.net  exchange.demo.taler.net  backend.demo.taler.net    KUDOS  0  1  en  de-CH  demo.taler.net
+taler.net          bank.demo.taler.net  exchange.demo.taler.net  backend.demo.taler.net    KUDOS  0  0  en  de-CH  demo.taler.net
-demo.taler.net     bank.demo.taler.net  exchange.demo.taler.net  backend.demo.taler.net    KUDOS  0  1  en  de-CH
+demo.taler.net     bank.demo.taler.net  exchange.demo.taler.net  backend.demo.taler.net    KUDOS  0  0  en  de-CH
 
 # Public test stack (TESTKUDOS)
 test.taler.net     bank.test.taler.net  exchange.test.taler.net  backend.test.taler.net    TESTKUDOS  0  0  en  de-CH
 
-# TOPS CHF
+# TOPS CHF — EBICS/IBAN wire (no public bank.*); monitord softens bank via /keys
 taler-ops.ch       bank.taler-ops.ch    exchange.taler-ops.ch    my.taler-ops.ch           CHF    0  0  en  de-CH
 my.taler-ops.ch    bank.taler-ops.ch    exchange.taler-ops.ch    my.taler-ops.ch           CHF    0  0  en  de-CH  taler-ops.ch
 stage.taler-ops.ch      bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0  0  en  de-CH
 stage.my.taler-ops.ch    bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0  0  en  de-CH  stage.taler-ops.ch
 my.stage.taler-ops.ch    bank.stage.taler-ops.ch exchange.stage.taler-ops.ch stage.my.taler-ops.ch CHF 0  0  en  de-CH  stage.taler-ops.ch
 
+# Public regional-currency demo (FLODOS) — taler-deployment / regio.taler.net
+regio.taler.net        bank.regio.taler.net  exchange.regio.taler.net  backend.regio.taler.net  FLODOS  0  0  en  de-CH
+bank.regio.taler.net    bank.regio.taler.net  exchange.regio.taler.net  backend.regio.taler.net  FLODOS  0  0  en  de-CH  regio.taler.net
+exchange.regio.taler.net bank.regio.taler.net exchange.regio.taler.net  backend.regio.taler.net  FLODOS  0  0  en  de-CH  regio.taler.net
+backend.regio.taler.net bank.regio.taler.net  exchange.regio.taler.net  backend.regio.taler.net  FLODOS  0  0  en  de-CH  regio.taler.net
+regio                  bank.regio.taler.net  exchange.regio.taler.net  backend.regio.taler.net  FLODOS  0  0  en  de-CH  regio.taler.net
+
 # Franc Paysan — UI fr · regional locale fr-CH (Suisse romande)
+# currency "-" = no Taler prod stack yet (static site only; monitord: static_pending).
+# Stage TESTPAYSAN below is the live Taler stack.
 lefrancpaysan.ch            bank.lefrancpaysan.ch  exchange.lefrancpaysan.ch  monnaie.lefrancpaysan.ch  -  0  0  fr  fr-CH
 monnaie.lefrancpaysan.ch    bank.lefrancpaysan.ch  exchange.lefrancpaysan.ch  monnaie.lefrancpaysan.ch  -  0  0  fr  fr-CH  lefrancpaysan.ch
 bank.lefrancpaysan.ch       bank.lefrancpaysan.ch  exchange.lefrancpaysan.ch  monnaie.lefrancpaysan.ch  -  0  0  fr  fr-CH  lefrancpaysan.ch

host-agent/env/mytops-stage.env.example

@@ -27,7 +27,9 @@ TALER_MON_LANG=en
 AGENT_LABEL=mytops-stage-host-agent
 STATE_NAME=taler-monitoring-mytops-stage
 SUITE_UPDATE_STRICT=1
+# EBICS/IBAN wire — no public bank.* (also auto-detected from exchange /keys)
 CHECK_BANK=0
+CHECK_BANK_SET=1
 MERCHANT_REQUIRED=1
 CHECK_LANDING=0
 # rusty devtesting (SSH Host taler-rusty-devtesting → devtesting@rusty.taler-ops.ch)

lib.sh

@@ -79,6 +79,12 @@ fi
 : "${EXCHANGE_LOCAL:=http://127.0.0.1:9011}"
 : "${MERCHANT_LOCAL:=https://127.0.0.1:9010}"
 : "${LANDING_LOCAL:=http://127.0.0.1:9013}"
+# Public libeufin bank.* checks (urls/sanity/e2e). Auto 0 for EBICS/IBAN wire.
+: "${CHECK_BANK:=1}"
+: "${CHECK_BANK_SET:=0}"
+# x-taler-bank | ebics | unknown — filled by resolve_taler_bank_backend
+: "${TALER_BANK_BACKEND:=}"
+: "${TALER_BANK_BACKEND_SET:=0}"
 # Hostnames/paths: set via ~/.config/taler-monitoring/env (no hardcoded machine values).
 : "${KOOPA_SSH:=}"
 : "${KOOPA_SSH_FALLBACKS:=}"
@@ -149,16 +155,77 @@ MERCHANT_PUBLIC=${MERCHANT_PUBLIC%/}
 _MONITOR_LIB_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 : "${TALER_DOMAINS_CONF:=${_MONITOR_LIB_DIR}/domains.conf}"
 
-# host_or_url → https://… (no trailing slash)
+# host_or_url → https://… (no trailing slash). Empty for EBICS skip tokens.
 _to_https_base() {
   local x="${1%/}"
-  case "$x" in
+  case "$(printf '%s' "$x" | tr '[:upper:]' '[:lower:]')" in
+    ""|"-"|"."|"none"|"n/a"|"na"|"ebics"|"iban"|"skip"|"off")
+      printf ''
+      ;;
     https://*|http://*) printf '%s' "$x" ;;
-    "") printf '' ;;
     *) printf 'https://%s' "$x" ;;
   esac
 }
 
+# True when domains.conf bank column means "no public bank.*"
+bank_host_configured() {
+  local b
+  b=$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')
+  case "$b" in
+    ""|"-"|"."|"none"|"n/a"|"na"|"ebics"|"iban"|"skip"|"off") return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+# Fetch exchange /keys and classify → x-taler-bank|ebics|unknown
+# (python fetch avoids SIGPIPE/pipefail on huge /keys bodies)
+detect_taler_bank_backend_from_keys() {
+  local ex="${EXCHANGE_PUBLIC%/}"
+  [ -n "$ex" ] || { printf 'unknown'; return 0; }
+  python3 -c '
+import re, ssl, sys, urllib.error, urllib.request
+ex = sys.argv[1].rstrip("/")
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+req = urllib.request.Request(
+    ex + "/keys",
+    headers={"User-Agent": "taler-monitoring/bank-backend"},
+    method="GET",
+)
+try:
+    with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
+        text = resp.read(600000).decode("utf-8", "replace")
+except Exception:
+    print("unknown")
+    raise SystemExit(0)
+methods = {m.lower() for m in re.findall(r"payto://([a-z0-9-]+)/", text, flags=re.I)}
+if "x-taler-bank" in methods:
+    print("x-taler-bank")
+elif "iban" in methods:
+    print("ebics")
+else:
+    print("unknown")
+' "$ex" 2>/dev/null || printf 'unknown'
+}
+
+# Set TALER_BANK_BACKEND + auto CHECK_BANK=0 for EBICS (unless CHECK_BANK_SET=1).
+resolve_taler_bank_backend() {
+  local backend="${TALER_BANK_BACKEND:-}"
+  if [ "${TALER_BANK_BACKEND_SET:-0}" = "1" ] && [ -n "$backend" ]; then
+    :
+  elif [ -z "${BANK_PUBLIC}" ]; then
+    backend=ebics
+  else
+    backend=$(detect_taler_bank_backend_from_keys)
+  fi
+  TALER_BANK_BACKEND="$backend"
+  if [ "$TALER_BANK_BACKEND" = "ebics" ] && [ "${CHECK_BANK_SET:-0}" != "1" ]; then
+    CHECK_BANK=0
+  fi
+  export TALER_BANK_BACKEND CHECK_BANK CHECK_BANK_SET TALER_BANK_BACKEND_SET
+}
+
 # 1 = check GOA-style /intro landing pages (assets, link crawl, demo-withdraw).
 # 0 = skip (e.g. taler-ops.ch / mytops — no public landings).
 : "${CHECK_LANDING:=1}"
@@ -166,12 +233,19 @@ _to_https_base() {
 # Declare bank + exchange + merchant (+ currency, local stack, landing, domain id).
 # Usage:
 #   set_taler_stack BANK EXCHANGE MERCHANT [CURRENCY] [LOCAL 0|1] [LANDING 0|1] [TALER_DOMAIN]
-# BANK/EXCHANGE/MERCHANT: hostname or full URL
+# BANK/EXCHANGE/MERCHANT: hostname or full URL; bank may be "-" / ebics (no public bank.*)
 set_taler_stack() {
   local bank="${1:-}" exchange="${2:-}" merchant="${3:-}"
   local currency="${4:-}" local_stack="${5:-0}" landing="${6:-}" domain_id="${7:-}"
 
+  if bank_host_configured "$bank"; then
     BANK_PUBLIC=$(_to_https_base "$bank")
+  else
+    BANK_PUBLIC=""
+    if [ "${TALER_BANK_BACKEND_SET:-0}" != "1" ]; then
+      TALER_BANK_BACKEND=ebics
+    fi
+  fi
   EXCHANGE_PUBLIC=$(_to_https_base "$exchange")
   MERCHANT_PUBLIC=$(_to_https_base "$merchant")
   # currency "-" or empty → report-only (do not force GOA)
@@ -452,6 +526,11 @@ apply_taler_domain() {
   if [ "${LOCAL_STACK}" = "1" ]; then
     INSIDE_PROFILE="${INSIDE_PROFILE:-koopa}"
   fi
+
+  # EBICS/IBAN (TOPS) → no public bank.*; x-taler-bank → keep CHECK_BANK
+  if [ "${TALER_SKIP_BANK_BACKEND_DETECT:-0}" != "1" ]; then
+    resolve_taler_bank_backend
+  fi
 }
 
 # Apply TALER_DOMAIN from env once (CLI exports TALER_DOMAIN_APPLIED=1 after overrides).

secrets.env.example

@@ -26,6 +26,14 @@
 # MERCHANT_TOKEN=
 # MERCHANT_INSTANCE_PASSWORD=
 
+# --- regio.taler.net (FLODOS / taler-deployment) ---
+# Prefer path via taler-monitoring-env (no password here):
+# TALER_DEPLOYMENT_SECRETS=$HOME/src/taler-deployment-secrets
+# REGIO_BANK_ADMIN_USER=admin
+# REGIO_BANK_ADMIN_SECRET=$HOME/src/taler-deployment-secrets/regio/bank-admin-password.txt
+# One-shot override:
+# E2E_BANK_ADMIN_PASS=…   # same as bank admin password
+
 # --- FrancPaysan STAGE (TESTPAYSAN) e2e ---
 # Default phases for -d stage.lefrancpaysan.ch: urls + inside + versions + e2e
 # inside uses francpaysan-stage-user (stagepaysan); stats from public HTTPS.

taler-monitoring.sh

@@ -99,6 +99,7 @@ Phases:
   max-ladder  max-search: highest withdrawable + highest payable (≤ available)
   goa-ladder  alias of ladder (legacy phase name; same check_amount_ladder.sh)
   auth401  merchant Basic-auth / case matrix (HTTP 401 paths; may create throwaway instance)
+  ansible-smoke  taler-deployment site.yml syntax + optional podman tracks (TASK112)
   aptdeploy  koopa podman apt-src smoke: taler-merchant in
              koopa-taler-deploy-test-apt-src-trixie{,-testing}
   surface  REMOTE-ONLY public inventory (NOT in default/all/full):
@@ -283,7 +284,7 @@ while [ $# -gt 0 ]; do
       shift
       ;;
     --no-probe) NO_PROBE=1; shift ;;
-    urls|inside|versions|sanity|server|e2e|zero-pay|zeropay|sticker-pay|template-zero|ladder|goa-ladder|max-ladder|maxladder|auth401|aptdeploy|apt-deploy|apt_src|surface|ecosystem|mattermost|mail|monpages|pages|devtesting|franken|fake-franken|fake_franken|all|full) PHASES+=("$1"); shift ;;
+    urls|inside|versions|sanity|server|e2e|zero-pay|zeropay|sticker-pay|template-zero|ladder|goa-ladder|max-ladder|maxladder|auth401|aptdeploy|apt-deploy|apt_src|ansible-smoke|ansible_smoke|surface|ecosystem|mattermost|mail|monpages|pages|devtesting|franken|fake-franken|fake_franken|all|full) PHASES+=("$1"); shift ;;
     *)
       # bare domain shorthand: ./taler-monitoring.sh taler.net
       if [[ "$1" == *.* && "$1" != *://* && "$1" != -* ]]; then
@@ -308,6 +309,11 @@ if [ -n "$BANK_OVERRIDE" ]; then BANK_PUBLIC="$BANK_OVERRIDE"; fi
 if [ -n "$EXCHANGE_OVERRIDE" ]; then EXCHANGE_PUBLIC="$EXCHANGE_OVERRIDE"; fi
 if [ -n "$MERCHANT_OVERRIDE" ]; then MERCHANT_PUBLIC="$MERCHANT_OVERRIDE"; fi
 
+# Wire backend (x-taler-bank vs EBICS) after CLI overrides — sets CHECK_BANK for EBICS
+if [ "${TALER_SKIP_BANK_BACKEND_DETECT:-0}" != "1" ]; then
+  resolve_taler_bank_backend
+fi
+
 # Only koopa may use SSH. Remote domains: public + optional e2e (no SSH).
 if [ "${LOCAL_STACK:-1}" != "1" ]; then
   SKIP_SSH=1
@@ -324,6 +330,7 @@ fi
 # Export so check_*.sh (re-source lib) see the same targets via env
 export TALER_DOMAIN BANK_PUBLIC EXCHANGE_PUBLIC MERCHANT_PUBLIC
 export EXPECT_CURRENCY SKIP_SSH LOCAL_STACK TALER_DOMAIN_PROBE CHECK_LANDING
+export CHECK_BANK CHECK_BANK_SET TALER_BANK_BACKEND TALER_BANK_BACKEND_SET
 export TALER_DOMAIN_FROM_CLI="${TALER_DOMAIN_FROM_CLI:-0}"
 export DOMAIN_SET="${DOMAIN_SET:-0}"
 export WITHDRAW_AMT PAY_AMT CREDIT_AMT MERCHANT_INSTANCE
@@ -578,9 +585,15 @@ fi
 printf 'target domain=%s\n' "${TALER_DOMAIN}"
 printf '  ui_lang  %s\n' "${TALER_MON_LANG:-en}"
 printf '  locale   %s\n' "${TALER_MON_LOCALE:-${TALER_DOMAIN_LOCALE:-?}}"
-printf '  bank     %s\n' "$BANK_PUBLIC"
+if [ "${TALER_BANK_BACKEND:-}" = "ebics" ] || [ -z "${BANK_PUBLIC:-}" ]; then
+  printf '  bank     IBAN (EBICS — no public bank.*)\n'
+else
+  printf '  bank     %s\n' "${BANK_PUBLIC}"
+fi
 printf '  exchange %s\n' "$EXCHANGE_PUBLIC"
 printf '  merchant %s\n' "$MERCHANT_PUBLIC"
+printf '  wire     backend=%s CHECK_BANK=%s\n' \
+  "${TALER_BANK_BACKEND:-?}" "${CHECK_BANK:-1}"
 printf '  currency expect=%s\n' "${EXPECT_CURRENCY:-any}"
 printf '  phases   %s\n' "${PHASES[*]}"
 printf '  flags    LOCAL_STACK=%s SKIP_SSH=%s INSIDE_PODMAN=%s INSIDE_MODE=%s\n' \
@@ -652,6 +665,7 @@ while [ "$_phase_idx" -lt "$_n_phases" ]; do
       ;;
     auth401)  run_phase auth401  "$ROOT/check_auth401.sh"  || ec=1 ;;
     aptdeploy|apt-deploy|apt_src) run_phase aptdeploy "$ROOT/check_apt_deploy.sh" || ec=1 ;;
+    ansible-smoke|ansible_smoke) run_phase ansible-smoke "$ROOT/check_ansible_smoke.sh" || ec=1 ;;
     surface|ecosystem) run_phase surface "$ROOT/check_surface.sh" || ec=1 ;;
     mattermost) run_phase mattermost "$ROOT/check_mattermost.sh" || ec=1 ;;
     mail) run_phase mail "$ROOT/check_mail.sh" || ec=1 ;;