feat: LLM stack status monitord catalogs and HTML
This commit is contained in:
Hernâni Marques
parent
6200a4d031
commit
666dca1f0d
7 changed files with 6943 additions and 0 deletions
|
|
@ -1,14 +1,97 @@
|
|||
# site-gen — HTML converter + Caddy notes
|
||||
|
||||
**Product:** **LLM** = **Lightweight Monitoring** (Taler-stack watcher). CLI/tree still `taler-monitoring` / `taler-monitord`.
|
||||
|
||||
**Required for host-agent:** `console_to_html.py` (log → sticky HTML).
|
||||
|
||||
| File | Role |
|
||||
|------|------|
|
||||
| `console_to_html.py` | Convert suite console log → public mon HTML |
|
||||
| `stack_status_lib.py` | Domain-stack traffic lights + aggregation |
|
||||
| `taler-monitord` | Daemon: probe stacks → `stack-status.json` (UI detached) |
|
||||
| `stack_status_html.py` | Render status cards from JSON only |
|
||||
| `caddy-monitoring-handles.snippet` | Caddy `handle` / bare redir notes |
|
||||
| `ROOT-ON-KOOPA.md` | Publish staging → `/var/www` (paths from env) |
|
||||
| `settings.conf.example` | Optional settings for **legacy** multi-host generator |
|
||||
|
||||
## Stack status (taler-monitord)
|
||||
|
||||
Like `llm-controld`: the daemon collects; the page only reads JSON.
|
||||
|
||||
```bash
|
||||
./site-gen/taler-monitord --once
|
||||
./site-gen/stack_status_html.py --out /tmp/taler-stack-status.html
|
||||
# optional: ./site-gen/taler-monitord --interval 20
|
||||
# local GOA (hacktivism.ch / taler.hacktivism.ch) is included by default;
|
||||
# skip with --no-include-local or TALER_MONITORD_INCLUDE_LOCAL=0
|
||||
```
|
||||
|
||||
Lights: green ok · blue present · yellow soft · orange hard/recent · red acute · black long · white gone.
|
||||
Box colour = weakest member; **muted** if partial; **full** if all members red/black.
|
||||
|
||||
**Total score** (header): `N/M green` across stack+service+mail cards. Ratio thresholds (env override):
|
||||
1.0 green · ≥0.85 blue · ≥0.60 yellow · ≥0.35 orange · ≥0.01 red · 0 white (gone) / all-black → black.
|
||||
|
||||
Stacks with currency `-` in `domains.conf` are **`static_pending`** (e.g. lefrancpaysan.ch: static site, no Taler prod yet). monitord probes the apex as `site` and treats missing bank/exchange/merchant as **blue `no_prod_yet`**, not orange/red. Stage TESTPAYSAN remains a normal Taler stack.
|
||||
|
||||
**Bank backend:** exchange `/keys` `payto://` methods decide whether `bank.*` is expected.
|
||||
`payto://x-taler-bank/…` → probe bank (libeufin).
|
||||
`payto://iban/…` only (EBICS / TOPS CHF) → bank member **blue**, host **`IBAN`**, reason `ebics_iban` (not red).
|
||||
Mixed (e.g. regio) still probes bank. Override in `domains.conf`: bank column `-` / `ebics` / `none`.
|
||||
|
||||
**Network / SSH:** each stack gets a coarse **zone** (GOA/local, FP stage, TOPS, pixel, firefly, public demo).
|
||||
SSH = **TCP:22 banner** (service present), not Magikoopa jump login.
|
||||
Zone-mapped SSH targets come **only** from `~/.config/taler-monitoring/env` (`TALER_MONITORD_SSH_TOPS` / `_FP` / `_GOA` / `_TOPS_PROD` via **taler-monitoring-env**); hostnames are **hidden** in the UI when set. Without env, probes use public stack FQDNs. Disable: `TALER_MONITORD_SSH=0`.
|
||||
|
||||
**Outside CVEs:** `Server` headers (nginx/apache/caddy + version) → OSV.
|
||||
**CRITICAL → red**, **HIGH → orange**. UI: CVE tags **link to osv.dev**; card click opens detail (severity / version / summary). Logos for nginx/apache/caddy. Disable: `TALER_MONITORD_CVE=0`.
|
||||
|
||||
**Why Degraded:** each card shows a one-line aggregation (`4× OK, 3× Soft → Degraded`); click opens a dialog with per-member reasons.
|
||||
|
||||
**Company / services:** `services-catalog.conf` (ERPnext, MantisBT, company apexes, …). Disable: `TALER_MONITORD_SERVICES=0`.
|
||||
|
||||
**Mail:** `mail-catalog.conf` → MX / SPF / DMARC / A+AAAA / rDNS + SMTP/IMAP TCP ports (587 soft).
|
||||
**Deliverability** (regular, not every cycle): SMTP `MAIL FROM`/`RCPT TO` smoke to `postmaster@domain` (no DATA).
|
||||
Cached under monitord state (`mail-deliverability.json`); default interval **6h**, stale after **30h** → yellow.
|
||||
Send/server failures → orange/red (degraded). Env: `TALER_MONITORD_DELIVER=0`, `_INTERVAL_S`, `_STALE_S`, `_FROM`, `_RCPT`.
|
||||
Disable plane: `TALER_MONITORD_MAIL=0`; ports only: `TALER_MONITORD_MAIL_PORTS=0`.
|
||||
|
||||
**TLS certs + orphans:** cert days-left + SANs. Orphans = **DNS-missing** SANs not covered by monitored hosts; wildcards/siblings skipped.
|
||||
HTTP orphans opt-in: `TALER_MONITORD_ORPHAN_HTTP=1`. Disable: `TALER_MONITORD_CERT=0` / `TALER_MONITORD_ORPHAN=0`.
|
||||
|
||||
**Port scan (outside-in only):** TCP connect to notable ports on publicly named hosts. No internal firewall maps required.
|
||||
Baseline allows 80/443 (+ mail ports on mail-catalog hosts). Anything else open → **suspicious** until listed in `ports-whitelist.conf`.
|
||||
Many odd open ports ⇒ worth investigating. Whitelist only silences *known intentional public* opens (e.g. hacktivism **8080** Tor OR, **9200** git-SSH) so they do not turn cards orange.
|
||||
Only **hard** findings (DB/RDP/SMB/…) raise card colour; soft stays informational. Disable: `TALER_MONITORD_PORTSCAN=0`.
|
||||
|
||||
**Software versions:** per card from Taler `/config` (`build_version`), `Server:` (nginx/apache/caddy), SMTP banner (Postfix).
|
||||
Compared to **published** packages on `deb.taler.net` (`TALER_MONITORD_APT_SUITE`, default trixie): current / behind / ahead; chips show `installed → published` when behind.
|
||||
**Apps / SPAs:** page section with published WebUI + wallet-cli (+ GNU FTP wallet tarball when listed). Disable: `TALER_MONITORD_PUBLISHED=0`.
|
||||
|
||||
**Publish:** Cyon **`hacktivism`**. Defaults (both):
|
||||
`…/public_html/stacks/index.html` → **https://hacktivism.ch/stacks/**
|
||||
`…/public_html/monitoring.hacktivism.ch/index.html` (addon when DNS ready)
|
||||
Override: `TALER_MONITORD_PUBLISH_PATH` or `TALER_MONITORD_PUBLISH_PATHS=a,b`. Off: `TALER_MONITORD_PUBLISH=0`.
|
||||
|
||||
**Result index (optional):** bottom of the stacks page lists every probe grouped by traffic-light colour.
|
||||
`TALER_MONITORD_RESULT_INDEX=1` (or `colors`) · with concrete command: `=cmd` / `full`, or `=1` plus `TALER_MONITORD_RESULT_INDEX_CMD=1`. Off by default (`=0`).
|
||||
|
||||
**Git soft probe:** Git-labelled services run infrequent `git ls-remote` over HTTPS + SSH (cached ~6h). Soft yellow on fail. Disable: `TALER_MONITORD_GIT=0`.
|
||||
|
||||
**VeciGate:** `services-catalog.conf` zone `vecigate` (WAN IP) + intentional DNAT ports in `ports-whitelist.conf` (incl. tortuna companion).
|
||||
|
||||
**Payability:** `TALER_MONITORD_PAY=1` shows CHF:0 / zero-pay status on matching stacks. Live wallet run only with `TALER_MONITORD_PAY_RUN=1` (interval `TALER_MONITORD_PAY_INTERVAL_S`, default 4h). Domains: `TALER_MONITORD_PAY_DOMAINS`.
|
||||
|
||||
**Ansible smoke (opt-in phase):** `./taler-monitoring.sh ansible-smoke` → `check_ansible_smoke.sh` against `TALER_DEPLOYMENT` (`regional-currency-ng/site.yml`). Podman tracks: `ANSIBLE_SMOKE_PODMAN=1` on koopa (else reuse `aptdeploy`).
|
||||
|
||||
**Local VCS mirror:** `~/git/www-hacktivism-wiki` rsyncs Cyon → git every **4h**
|
||||
(`ch.hacktivism.www-wiki-sync`). Tracks `stacks/` (+ optional addon). No push by default.
|
||||
|
||||
**Custom /intro:** only **GOA** (hacktivism) and **FrancPaysan / TESTPAYSAN stage**.
|
||||
**Landing stats:** on intro stacks, `…/intro/stats.json` → compact tag.
|
||||
**Currency / coins:** from exchange `/config` `currency_specification`.
|
||||
**Endpoints:** suite-like paths; soft ≤ yellow. **`/terms` + `/privacy`:** medium → orange **only TOPS prod**.
|
||||
|
||||
## Optional / moved
|
||||
|
||||
Legacy multi-host generate/deploy and firecuda launchd tooling live under
|
||||
|
|
|
|||
Reference in a new issue