taler-monitoring v1.13.12

Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome
as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan);
monpages GOA + FP stage.

site-gen/README.md

@@ -0,0 +1,20 @@
+# site-gen — HTML converter + Caddy notes
+
+**Required for host-agent:** `console_to_html.py` (log → sticky HTML).
+
+| File | Role |
+|------|------|
+| `console_to_html.py` | Convert suite console log → public mon HTML |
+| `caddy-monitoring-handles.snippet` | Caddy `handle` / bare redir notes |
+| `ROOT-ON-KOOPA.md` | Publish staging → `/var/www` (paths from env) |
+| `settings.conf.example` | Optional settings for **legacy** multi-host generator |
+
+## Optional / moved
+
+Legacy multi-host generate/deploy and firecuda launchd tooling live under
+**`../meta/`** (see `meta/README.md`).
+
+```bash
+# normal publish is host-agent on the mon host, not these scripts
+../host-agent/run-hacktivism-monitoring.sh   # etc.
+```

site-gen/ROOT-ON-KOOPA.md

@@ -0,0 +1,97 @@
+# Root on koopa (hacktivism monitoring sites)
+
+Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
+**not** put into Taler containers — only host paths + Caddy `handle`.
+
+After host-agent (or optional `meta/site-gen-legacy/generate-monitoring-sites.sh`) + deploy, files live in:
+
+```text
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
+$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html
+```
+
+## One-shot as root (preferred)
+
+```bash
+# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
+sudo $APPLY_MONITORING_LIVE
+# same script is versioned in the suite:
+#   host-agent/apply-monitoring-live.sh  → install/sync to $KOOPA_CADDY_DIR/
+```
+
+That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
+Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
+
+## Manual equivalent
+
+```bash
+install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
+rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
+chown -R hernani:caddy /var/www/monitoring-sites
+
+install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
+caddy validate --config /etc/caddy/Caddyfile
+systemctl reload caddy
+systemctl is-active caddy
+```
+
+## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)
+
+Place **before** the catch-all `reverse_proxy`. Canonical copy:
+`site-gen/caddy-monitoring-handles.snippet`.
+
+Disk layout (path on disk matches URL under host root):
+
+```text
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html
+```
+
+```caddy
+    # bare → slash (MUST use redir * /path/ — see footgun below)
+    handle /monitoring {
+        redir * /monitoring/ 302
+    }
+    handle /monitoring* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+    handle /monitoring_err {
+        redir * /monitoring_err/ 302
+    }
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+```
+
+### Caddy redir footgun (merchant code 21)
+
+```caddy
+# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
+handle /monitoring {
+    redir /monitoring/ 302
+}
+
+# RIGHT
+handle /monitoring {
+    redir * /monitoring/ 302
+}
+```
+
+Symptom: `https://…/monitoring` or `…/taler-monitoring-surface` returns merchant
+JSON `{"code":21,…}` while the slash form serves HTML.
+
+## Check
+
+```bash
+curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
+curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
+# bare: expect 302 Location: /taler-monitoring-surface/  — not JSON code 21
+curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/
+```
+
+## Not needed as root
+
+- Running `taler-monitoring` (use **optional outside runner** / laptop)
+- Writing into podman Taler containers

site-gen/caddy-monitoring-handles.snippet

@@ -0,0 +1,72 @@
+# Host Caddy (root service). Place BEFORE catch-all reverse_proxy in each site block.
+#
+# CRITICAL: bare paths (no trailing slash) must redirect to slash, or the request
+# falls through to merchant/bank/exchange API → Taler JSON code 21.
+#
+# CORRECT (site-level named matcher — preferred):
+#   @mon_bare path /monitoring /monitoring_err \
+#       /taler-monitoring-surface /taler-monitoring-surface_err \
+#       /taler-monitoring-aptdeploy /taler-monitoring-aptdeploy_err
+#   redir @mon_bare {path}/ 302
+#
+# ALSO OK inside handle (matcher must be `*`):
+#   handle /taler-monitoring-surface {
+#       redir * /taler-monitoring-surface/ 302
+#   }
+#
+# WRONG (Caddy footgun — causes merchant code 21 on bare URLs):
+#   redir /taler-monitoring-surface/ 302
+# → parsed as matcher=/taler-monitoring-surface/  to="302"
+# → Location: 302, or no-op then fallthrough to reverse_proxy
+#
+# root must be the *host directory* (…/monitoring-sites/{host}), and the
+# file_server matcher a path *prefix* (`/monitoring*`), so
+# /monitoring/index.html maps to {root}/monitoring/index.html.
+#
+# Disk layout:
+#   /var/www/monitoring-sites/{host}/monitoring/index.html
+#   /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html
+#
+# Live apply on koopa (absolute path — ~ as root is /root):
+#   sudo ${APPLY_MONITORING_LIVE}
+# Runtime-only (no sudo; hernani admin API):
+#   curl -g -X POST http://[::1]:2019/load -H 'Content-Type: text/caddyfile' \
+#     --data-binary @${KOOPA_CADDY_DIR}/Caddyfile
+
+# --- only inside taler.hacktivism.ch { ... } ---
+    @mon_bare path /monitoring /monitoring_err \
+        /taler-monitoring-surface /taler-monitoring-surface_err \
+        /taler-monitoring-aptdeploy /taler-monitoring-aptdeploy_err \
+        /taler-monitoring-mail /taler-monitoring-mail_err \
+        /taler-monitoring-mattermost /taler-monitoring-mattermost_err
+    redir @mon_bare {path}/ 302
+
+    handle /taler-monitoring-surface_err* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
+    }
+    handle /taler-monitoring-surface* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
+    }
+    handle /taler-monitoring-aptdeploy_err* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
+    }
+    handle /taler-monitoring-aptdeploy* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
+    }
+
+# --- bank + exchange + taler (each site block; set root host dir) ---
+    @mon_bare path /monitoring /monitoring_err
+    redir @mon_bare {path}/ 302
+
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+    handle /monitoring* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }

site-gen/settings.conf.example

@@ -0,0 +1,55 @@
+# monitoring site-gen — non-secret settings (safe as example)
+# Copy:  cp settings.conf.example settings.conf
+# Never put passwords/tokens here.
+
+# On an outside runner the suite runs *locally* (RUNNER_SSH empty). From a laptop you
+# can set RUNNER_SSH=<outside-runner-ssh-alias> to drive a one-off remote run instead.
+RUNNER_SSH=
+RUNNER_SSH_FALLBACKS=
+RUNNER_REMOTE_WORKDIR=/tmp/taler-monitoring-site-gen
+MONITORING_ROOT=..
+
+# Outside-only: never SSH into bank/exchange/merchant containers
+SKIP_SSH=1
+
+# Deploy staging on koopa (host Caddy later — root copies to /var/www)
+DEPLOY_SSH=  # set SSH host for deploy
+DEPLOY_SSH_FALLBACKS=koopa
+# Static files for Caddy file_server (created per hostname)
+DEPLOY_WWW_ROOT=  # e.g. /var/www/monitoring-sites
+DEPLOY_SUDO=sudo
+CADDY_CONFIG=/etc/caddy/Caddyfile
+CADDY_MIRROR_REL=configs/caddy/Caddyfile
+# Working tree on deploy host for apply (optional)
+KOOPA_CADDY_DIR=  # absolute path to Caddy tree on mon host
+
+# Source link for HTML footer (Forgejo)
+SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
+SOURCE_COMMIT_URL_TMPL={repo}/src/commit/{commit}
+SOURCE_SUITE_PATH=.
+
+CONTINUE_ON_ERROR=1
+PHASES_ERR=urls versions
+PHASES_OK=urls versions
+SKIP_E2E=1
+
+# Local work dir for logs + HTML
+WORK_ROOT=/tmp/taler-monitoring-sites-work
+
+# Sites: hostname|domain_profile  (9 fronts)
+# Start with hacktivism; stage + prod LFP follow
+SITES="
+bank.hacktivism.ch|hacktivism.ch
+exchange.hacktivism.ch|hacktivism.ch
+taler.hacktivism.ch|hacktivism.ch
+stage.bank.lefrancpaysan.ch|stage.lefrancpaysan.ch
+stage.exchange.lefrancpaysan.ch|stage.lefrancpaysan.ch
+stage.monnaie.lefrancpaysan.ch|stage.lefrancpaysan.ch
+bank.lefrancpaysan.ch|lefrancpaysan.ch
+exchange.lefrancpaysan.ch|lefrancpaysan.ch
+monnaie.lefrancpaysan.ch|lefrancpaysan.ch
+"
+
+# Only process this subset (space-separated hostnames). Empty = all SITES.
+# Example for first deploy: ONLY_HOSTS=bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch
+ONLY_HOSTS=