taler-monitoring v1.13.12

Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome
as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan);
monpages GOA + FP stage.

site-gen/ROOT-ON-KOOPA.md

@@ -0,0 +1,97 @@
+# Root on koopa (hacktivism monitoring sites)
+
+Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
+**not** put into Taler containers — only host paths + Caddy `handle`.
+
+After host-agent (or optional `meta/site-gen-legacy/generate-monitoring-sites.sh`) + deploy, files live in:
+
+```text
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html
+```
+
+## One-shot as root (preferred)
+
+```bash
+# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
+sudo $APPLY_MONITORING_LIVE
+# same script is versioned in the suite:
+#   host-agent/apply-monitoring-live.sh  → install/sync to $KOOPA_CADDY_DIR/
+```
+
+That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
+Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
+
+## Manual equivalent
+
+```bash
+install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
+rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
+chown -R hernani:caddy /var/www/monitoring-sites
+
+install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
+caddy validate --config /etc/caddy/Caddyfile
+systemctl reload caddy
+systemctl is-active caddy
+```
+
+## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)
+
+Place **before** the catch-all `reverse_proxy`. Canonical copy:
+`site-gen/caddy-monitoring-handles.snippet`.
+
+Disk layout (path on disk matches URL under host root):
+
+```text
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html
+```
+
+```caddy
+    # bare → slash (MUST use redir * /path/ — see footgun below)
+    handle /monitoring {
+        redir * /monitoring/ 302
+    }
+    handle /monitoring* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+    handle /monitoring_err {
+        redir * /monitoring_err/ 302
+    }
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+```
+
+### Caddy redir footgun (merchant code 21)
+
+```caddy
+# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
+handle /monitoring {
+    redir /monitoring/ 302
+}
+
+# RIGHT
+handle /monitoring {
+    redir * /monitoring/ 302
+}
+```
+
+Symptom: `https://…/monitoring` or `…/taler-monitoring-surface` returns merchant
+JSON `{"code":21,…}` while the slash form serves HTML.
+
+## Check
+
+```bash
+curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
+curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
+# bare: expect 302 Location: /taler-monitoring-surface/  — not JSON code 21
+curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/
+```
+
+## Not needed as root
+
+- Running `taler-monitoring` (use **optional outside runner** / laptop)
+- Writing into podman Taler containers