release 1.9.2: Caddy bare redir * footgun (code 21) + absolute apply path

VERSION

@@ -1 +1 @@
-1.9.1
+1.9.2

VERSIONS.md

@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.9.2** | 2026-07-19 | **Bugfix:** Caddy bare-path redir footgun — inside `handle` use `redir * /path/ 302` (not `redir /path/ 302`, which becomes `Location: 302` and bare URLs fall through to merchant **code 21**). Snippet + ROOT-APPLY: absolute apply path (`/home/hernani/koopa-caddy/…`, not `~` as root). |
 | **v1.9.1** | 2026-07-19 | **Bugfix:** stale path confusions in repo — sticky `pages_i3` no longer lists mail/mattermost/aptdeploy mon pages; lib.sh/android-test drop `scripts/taler-monitoring/`; monpages/host-agent hints match v1.8 layout; clarify GIT vs GUI vs CLI `*AUTOMATION-NOTES.md` (three files by design). |
 | **v1.9.0** | 2026-07-19 | **monpages content:** ERROR if page missing or markers incomplete — top (sticky-bar/status-bar/generated) + bottom (footer/`taler-mon:bottom`); mid-run (progress <100% / incomplete meta) relaxes bottom only. Surface required on normal GOA runs with meaningful body (not progress-only). HTML emits `taler-mon:top` / `taler-mon:bottom:complete|incomplete`. |
 | **v1.8.0** | 2026-07-19 | **Simplified public pages:** only `/taler-monitoring-surface(+_err)` on `taler.hacktivism.ch` for ecosystem software/versions; **9 landing stacks** each keep `/monitoring(+_err)`. Mail (firefly.gnunet.org + anastasis.taler-systems.com) and Mattermost folded into surface job; separate mail/mattermost mon pages + timers deprecated. **nmap** OS fingerprinting on surface (`SURFACE_NMAP`); **ERROR** when packages are behind (`TALER_PKG_BEHIND=error` default) or OS fingerprint is EOL. |

host-agent/ROOT-APPLY-MONITORING.md

@@ -22,9 +22,17 @@ API). Prepared config is only under **`/home/hernani/koopa-caddy/Caddyfile`**.
 ## One-shot as root (recommended)
 
 ```bash
+# absolute path required: as root, ~ is /root (not /home/hernani)
 sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
+# or already root:
+# /home/hernani/koopa-caddy/apply-monitoring-live.sh
 ```
 
+**Caddy bare-path redir (v1.9.2+):** inside a `handle` block use
+`redir * /path/ 302` — never `redir /path/ 302` alone (Caddy treats the first
+token as matcher and sets `Location: 302`, so bare URLs fall through to the
+merchant API as JSON **code 21**).
+
 That script:
 
 1. `rsync` staging HTML → `/var/www/monitoring-sites/` (incl. surface + aptdeploy)

site-gen/caddy-monitoring-handles.snippet

@@ -11,30 +11,63 @@
 #   }
 # → looks for …/monitoring/monitoring/index.html
 #
+# CRITICAL (v1.9.2): bare-path redir inside handle MUST use matcher `*`:
+#   handle /taler-monitoring-surface {
+#       redir * /taler-monitoring-surface/ 302
+#   }
+# WRONG: `redir /taler-monitoring-surface/ 302` is parsed as
+#   matcher=/taler-monitoring-surface/  to="302"  → Location: 302, merchant code 21
+# (same footgun for /monitoring, aptdeploy, mail, mattermost bare paths).
+#
 # Disk layout:
 #   /var/www/monitoring-sites/{host}/monitoring/index.html
 #   /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html
+#
+# Live apply on koopa (absolute path — ~ as root is /root):
+#   sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
 
 # --- only inside taler.hacktivism.ch { ... } ---
+    handle /taler-monitoring-surface {
+        redir * /taler-monitoring-surface/ 302
+    }
     handle /taler-monitoring-surface* {
         root * /var/www/monitoring-sites/taler.hacktivism.ch
         file_server
     }
+    handle /taler-monitoring-surface_err {
+        redir * /taler-monitoring-surface_err/ 302
+    }
+    handle /taler-monitoring-surface_err* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
+    }
+    handle /taler-monitoring-aptdeploy {
+        redir * /taler-monitoring-aptdeploy/ 302
+    }
     handle /taler-monitoring-aptdeploy* {
         root * /var/www/monitoring-sites/taler.hacktivism.ch
         file_server
     }
-    handle /taler-monitoring-mattermost* {
+    handle /taler-monitoring-aptdeploy_err {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        redir * /taler-monitoring-aptdeploy_err/ 302
-        file_server
     }
-    handle /taler-monitoring-mail* {
+    handle /taler-monitoring-aptdeploy_err* {
         root * /var/www/monitoring-sites/taler.hacktivism.ch
         file_server
     }
 
 # --- bank + exchange + taler (each site block; set root host dir) ---
+    handle /monitoring {
+        redir * /monitoring/ 302
+    }
     handle /monitoring* {
         root * /var/www/monitoring-sites/{host}
         file_server
     }
+    handle /monitoring_err {
+        redir * /monitoring_err/ 302
+    }
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }