From 7e7299f170095921740828a1f4b3f07ef972055a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= <hernani+clementine@vecirex.net>
Date: Sat, 18 Jul 2026 18:55:08 +0200
Subject: [PATCH] release 1.3.2: suite paths only ~/src/taler-monitoring

---
 README.md                                     |  4 +-
 VERSION                                       |  2 +-
 VERSIONS.md                                   |  3 +-
 host-agent/README.md                          |  4 +-
 .../ensure-apt-deploy-test-containers.sh      | 21 ++++-----
 host-agent/francpaysan.env.example            | 27 +++++++++++
 host-agent/hacktivism.env.example             | 26 ++++++++++
 host-agent/install-host-agent.sh              | 47 +++++++++----------
 host-agent/run-host-report.sh                 |  2 +-
 host-agent/stagepaysan.env.example            | 30 ++++++++++++
 host-agent/taler-monitoring-hacktivism.path   |  6 +--
 site-gen/README.md                            |  2 +-
 site-gen/ROOT-ON-KOOPA.md                     |  4 +-
 13 files changed, 125 insertions(+), 53 deletions(-)
 create mode 100644 host-agent/francpaysan.env.example
 create mode 100644 host-agent/hacktivism.env.example
 create mode 100644 host-agent/stagepaysan.env.example

diff --git a/README.md b/README.md
index ae0c02a..0f08a91 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Standalone repository: https://git.hacktivism.ch/hernani/taler-monitoring (tag **v1.0**).
 
-Formerly: `koopa-admin-log/scripts/taler-monitoring/`.
+Standalone suite (formerly under host ops log). Canonical path: `~/src/taler-monitoring`.
 
 # taler-monitoring
 
@@ -38,7 +38,7 @@ End of each phase: totals + list of **BLOCKERS** and **ERRORS** (ids included).
 
 ## Secrets (local GOA e2e)
 
-**Do not commit passwords.** Canonical trees: `~/src/koopa/koopa-admin-log` +
+**Do not commit passwords.** Suite tree: `~/src/taler-monitoring` · host ops (optional):
 sibling `~/src/koopa/koopa-admin-secrets`.
 
 ### Local file (recommended on laptop)
diff --git a/VERSION b/VERSION
index 6261a05..d5e98f7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.3.1
\ No newline at end of file
+1.3.2
\ No newline at end of file
diff --git a/VERSIONS.md b/VERSIONS.md
index 0ca9809..8a58906 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -5,6 +5,7 @@ Release history for the standalone **taler-monitoring** suite
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.3.2** | 2026-07-18 | **Bugfix:** drop remaining `koopa-admin-log` suite paths — host-agent/install, path unit, aptdeploy dedupe use **only** `~/src/taler-monitoring`. Reinstall systemd units. |
 | **v1.4.0** | *planned* | **L10n** for user-facing outputs that need localization: **fr-CH** (FrancPaysan, Suisse romande) and **de-CH** (hacktivism / Taler CH German). Not implemented yet — after **1.3.x**. |
 | **v1.3.1** | 2026-07-18 | **Bugfix:** silent skip when `DEPLOY_WWW_ROOT` not writable left public pages missing (merchant JSON code 21). **monpages** phase + host-agent post-check: verify monitoring HTML via **FQDN** (`https://<host>/monitoring/` etc.). |
 | **v1.3** | 2026-07-18 | Sticky bar shows **suite version** and links to the Forgejo **tag** (`…/src/tag/vX.Y.Z`). (supersedes tag name **v1.3.0**) |
@@ -52,5 +53,5 @@ sudo ~/koopa-caddy/apply-monitoring-live.sh
 
 ```bash
 git clone https://git.hacktivism.ch/hernani/taler-monitoring.git ~/src/taler-monitoring
-cd ~/src/taler-monitoring && git checkout v1.3.1
+cd ~/src/taler-monitoring && git checkout v1.3.2
 ```
diff --git a/host-agent/README.md b/host-agent/README.md
index 0664f28..9382487 100644
--- a/host-agent/README.md
+++ b/host-agent/README.md
@@ -89,7 +89,7 @@ Caddy (host root) can serve that tree at `/monitoring` — you configure Caddy.
 Every host-agent / aptdeploy run:
 
 1. **`update-suite.sh`**: `git fetch` + **`SUITE_UPDATE_MODE=reset`** (default) → `origin/main`  
-   into `SUITE_DIR` (prefer `~/src/koopa-admin-log`).
+   into `SUITE_DIR` (prefer `~/src/taler-monitoring`).
 2. **Re-exec** host-agent scripts from that tree so the running code matches `COMMIT_URL`.
 3. Local overrides only in **`~/.config/taler-monitoring/env`** — never overwritten by git.
 4. HTML footer = exact commit:  
@@ -120,7 +120,7 @@ Units:
 
 | Unit | Role |
 |------|------|
-| `taler-monitoring-hacktivism.path` | fires on software stamp + landing/caddy config changes |
+| `taler-monitoring-hacktivism.path` | fires on software stamp (`touch-software-stamp.sh`) |
 | `taler-monitoring-hacktivism.timer` | every **4h** fallback |
 | `taler-monitoring-hacktivism.service` | oneshot → `/monitoring*` (urls inside versions) |
 | `taler-monitoring-surface.timer` | every **1h** |
diff --git a/host-agent/ensure-apt-deploy-test-containers.sh b/host-agent/ensure-apt-deploy-test-containers.sh
index 75fa3e4..980c0e0 100755
--- a/host-agent/ensure-apt-deploy-test-containers.sh
+++ b/host-agent/ensure-apt-deploy-test-containers.sh
@@ -72,13 +72,14 @@ cleanup_legacy() {
   done < <("$PODMAN_BIN" images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -E 'localhost/koopa-taler-.*-test-apt' || true)
 }
 
-# Prefer single suite tree: if both ~/src/koopa-admin-log and ~/koopa-admin-log are
-# full git clones, keep the newer (by HEAD commit time) and replace the older with a symlink.
+# Prefer single suite tree: ~/src/taler-monitoring vs ~/taler-monitoring
+# (legacy koopa-admin-log paths are not used). Keep the newer git clone; symlink the other.
 dedupe_suite_repos() {
-  local a="$HOME/src/koopa-admin-log" b="$HOME/koopa-admin-log"
+  local a="$HOME/src/taler-monitoring" b="$HOME/taler-monitoring"
   local ta tb
   [ "${APT_DEPLOY_DEDUPE_REPOS:-1}" = "1" ] || return 0
-  if [ -d "$a/.git" ] && [ -d "$b/.git" ] && [ ! -L "$a" ] && [ ! -L "$b" ]; then
+  if [ -d "$a/.git" ] && [ -d "$b/.git" ] && [ ! -L "$a" ] && [ ! -L "$b" ] \
+    && [ "$(readlink -f "$a" 2>/dev/null || echo "$a")" != "$(readlink -f "$b" 2>/dev/null || echo "$b")" ]; then
     ta=$(git -C "$a" log -1 --format=%ct 2>/dev/null || echo 0)
     tb=$(git -C "$b" log -1 --format=%ct 2>/dev/null || echo 0)
     echo "======== dedupe suite repos (both are git clones) ========"
@@ -94,17 +95,11 @@ dedupe_suite_repos() {
       mkdir -p "$(dirname "$a")"
       ln -sfn "$b" "$a"
     fi
-  elif [ -d "$a/scripts/taler-monitoring" ] && [ -d "$b/scripts/taler-monitoring" ] \
-    && [ ! -d "$a/.git" ] && [ -d "$b/.git" ] && [ ! -L "$a" ]; then
-    echo "remove non-git tree $a · symlink → $b"
-    rm -rf "$a"
+  elif [ -d "$a/.git" ] && [ ! -e "$b" ]; then
+    ln -sfn "$a" "$b"
+  elif [ -d "$b/.git" ] && [ ! -e "$a" ]; then
     mkdir -p "$(dirname "$a")"
     ln -sfn "$b" "$a"
-  elif [ -d "$b/scripts/taler-monitoring" ] && [ -d "$a/scripts/taler-monitoring" ] \
-    && [ ! -d "$b/.git" ] && [ -d "$a/.git" ] && [ ! -L "$b" ]; then
-    echo "remove non-git tree $b · symlink → $a"
-    rm -rf "$b"
-    ln -sfn "$a" "$b"
   fi
 }
 
diff --git a/host-agent/francpaysan.env.example b/host-agent/francpaysan.env.example
new file mode 100644
index 0000000..2f5019d
--- /dev/null
+++ b/host-agent/francpaysan.env.example
@@ -0,0 +1,27 @@
+# Copy to:  ~/.config/taler-monitoring/env  (user francpaysan)
+# Never inside the git tree — update-suite never overwrites this file.
+#
+# Shared reporting generation (run-host-report.sh / run-fp-prod-monitoring.sh):
+#   RUN_TIMEOUT, line-buffered log, always HTML, commit link on git.hacktivism.ch
+
+TALER_DOMAIN=lefrancpaysan.ch
+INSIDE_PODMAN=1
+INSIDE_MODE=local-podman
+LOCAL_STACK=0
+CONTINUE_ON_ERROR=1
+PHASES="urls inside versions"
+RUN_TIMEOUT=600
+
+HTML_OUT=$HOME/monitoring-sites-staging
+MON_HOSTS="bank.lefrancpaysan.ch exchange.lefrancpaysan.ch monnaie.lefrancpaysan.ch"
+
+SUITE_DIR=$HOME/src/taler-monitoring
+SUITE_GIT_URL=https://git.hacktivism.ch/hernani/taler-monitoring.git
+SUITE_GIT_REF=main
+SUITE_UPDATE_MODE=reset
+SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
+
+# DEPLOY_WWW_ROOT=/var/www/monitoring-sites
+
+# UI language for console + HTML sticky bar (en|fr)
+TALER_MON_LANG=fr
diff --git a/host-agent/hacktivism.env.example b/host-agent/hacktivism.env.example
new file mode 100644
index 0000000..ebdcb8f
--- /dev/null
+++ b/host-agent/hacktivism.env.example
@@ -0,0 +1,26 @@
+# Copy to:  ~/.config/taler-monitoring/env  (user hernani on koopa)
+# Shared reporting generation: RUN_TIMEOUT, line-buffered log, always HTML.
+
+TALER_DOMAIN=hacktivism.ch
+INSIDE_PODMAN=1
+INSIDE_MODE=local-podman
+LOCAL_STACK=1
+CONTINUE_ON_ERROR=1
+PHASES="urls inside versions"
+# aptdeploy HTML: run-aptdeploy-monitoring.sh → /taler-monitoring-aptdeploy*
+RUN_TIMEOUT=600
+# APT_DEPLOY_ENSURE=1
+# APT_DEPLOY_SKIP=0
+
+HTML_OUT=$HOME/monitoring-sites-staging
+MON_HOSTS="bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch"
+
+SUITE_DIR=$HOME/src/taler-monitoring
+SUITE_GIT_URL=https://git.hacktivism.ch/hernani/taler-monitoring.git
+SUITE_GIT_REF=main
+SUITE_UPDATE_MODE=reset
+SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
+
+DEPLOY_WWW_ROOT=/var/www/monitoring-sites
+
+TALER_MON_LANG=en
diff --git a/host-agent/install-host-agent.sh b/host-agent/install-host-agent.sh
index 5b64cf2..5fe9e21 100755
--- a/host-agent/install-host-agent.sh
+++ b/host-agent/install-host-agent.sh
@@ -6,16 +6,19 @@
 #   # or from laptop:
 #   ./install-host-agent.sh --remote koopa-external
 #
+# Suite tree is ONLY ~/src/taler-monitoring (standalone repo). No koopa-admin-log.
+#
 set -euo pipefail
 ROOT=$(cd "$(dirname "$0")" && pwd)
 REMOTE="${1:-}"
 [ "${1:-}" = "--remote" ] && REMOTE="${2:-koopa-external}"
 
+SUITE_URL="${SUITE_GIT_URL:-https://git.hacktivism.ch/hernani/taler-monitoring.git}"
+
 install_local() {
   local mon home_unit
   mon=$(cd "$ROOT/.." && pwd)
-  # Prefer ~/koopa-admin-log on live host
-  if [ -d "$HOME/src/taler-monitoring" ]; then
+  if [ -d "$HOME/src/taler-monitoring/.git" ] || [ -d "$HOME/src/taler-monitoring" ]; then
     mon="$HOME/src/taler-monitoring"
   fi
   home_unit="$HOME/.config/systemd/user"
@@ -31,30 +34,27 @@ install_local() {
     echo "created ~/.config/taler-monitoring/env"
   fi
 
-  # Prefer a real git clone for update-suite.sh
-  if [ ! -d "$HOME/src/koopa-admin-log/.git" ] && [ ! -d "$HOME/koopa-admin-log/.git" ]; then
-    if [ -d "$HOME/src/taler-monitoring" ] && [ ! -d "$HOME/koopa-admin-log/.git" ]; then
-      echo "note: $HOME/koopa-admin-log has no .git — update-suite will clone to ~/src/koopa-admin-log"
+  # Ensure suite git clone at canonical path
+  if [ ! -d "$HOME/src/taler-monitoring/.git" ]; then
+    if [ -d "$mon/.git" ] && [ "$mon" != "$HOME/src/taler-monitoring" ]; then
+      mkdir -p "$HOME/src"
+      ln -sfn "$mon" "$HOME/src/taler-monitoring"
+      echo "symlink $HOME/src/taler-monitoring → $mon"
+    else
+      echo "clone $SUITE_URL → $HOME/src/taler-monitoring"
+      git clone "$SUITE_URL" "$HOME/src/taler-monitoring" \
+        || echo "WARN: clone failed (auth/network) — using tree at $mon if present"
     fi
-    git clone https://git.hacktivism.ch/hernani/taler-monitoring.git "$HOME/src/koopa-admin-log" 2>/dev/null \
-      || echo "WARN: clone failed (auth/network) — will use existing tree if any"
   fi
+  mon="$HOME/src/taler-monitoring"
+  # Convenience link (update-suite.sh also creates this)
+  ln -sfn "$mon" "$HOME/taler-monitoring" 2>/dev/null || true
 
   # Ensure suite is executable
   chmod +x "$mon"/taler-monitoring.sh "$mon"/check_*.sh 2>/dev/null || true
   chmod +x "$mon/host-agent"/*.sh 2>/dev/null || true
   chmod +x "$mon/site-gen"/*.sh "$mon/site-gen/console_to_html.py" 2>/dev/null || true
 
-  # Units reference %h/koopa-admin-log — prefer git clone or symlink
-  if [ -d "$HOME/src/koopa-admin-log/.git" ] && [ ! -e "$HOME/koopa-admin-log" ]; then
-    ln -sfn "$HOME/src/koopa-admin-log" "$HOME/koopa-admin-log"
-    echo "symlink $HOME/koopa-admin-log → $HOME/src/koopa-admin-log"
-  elif [ ! -e "$HOME/koopa-admin-log" ]; then
-    admin_root=$(cd "$mon/../.." && pwd)
-    ln -sfn "$admin_root" "$HOME/koopa-admin-log"
-    echo "symlink $HOME/koopa-admin-log → $admin_root"
-  fi
-
   install -m 644 "$ROOT/taler-monitoring-hacktivism.service" "$home_unit/"
   install -m 644 "$ROOT/taler-monitoring-hacktivism.path" "$home_unit/"
   install -m 644 "$ROOT/taler-monitoring-hacktivism.timer" "$home_unit/"
@@ -63,7 +63,6 @@ install_local() {
   install -m 644 "$ROOT/taler-monitoring-aptdeploy.service" "$home_unit/"
   install -m 644 "$ROOT/taler-monitoring-aptdeploy.timer" "$home_unit/"
 
-  # Fix ExecStart if install path differs (units use %h/koopa-admin-log)
   systemctl --user daemon-reload
   systemctl --user enable --now taler-monitoring-hacktivism.path
   systemctl --user enable --now taler-monitoring-hacktivism.timer
@@ -82,6 +81,7 @@ install_local() {
   systemctl --user status taler-monitoring-aptdeploy.timer --no-pager -l | head -12
   systemctl --user list-timers --all | grep taler-monitoring || true
   echo "OK host-agent (hacktivism 4h + surface 1h + aptdeploy 4h)"
+  echo "suite: $mon"
   echo "manual: systemctl --user start taler-monitoring-hacktivism.service"
   echo "manual surface: systemctl --user start taler-monitoring-surface.service"
   echo "manual aptdeploy: systemctl --user start taler-monitoring-aptdeploy.service"
@@ -90,16 +90,13 @@ install_local() {
 
 if [ -n "$REMOTE" ] && [ "$REMOTE" != "--remote" ]; then
   echo "install on $REMOTE …"
+  # ROOT = …/taler-monitoring/host-agent → suite root is parent
   rsync -az --delete \
     --exclude secrets.env \
     --exclude 'android-test/artifacts' \
-    "$ROOT/../../" \
+    --exclude '.git' \
+    "$ROOT/../" \
     "${REMOTE}:src/taler-monitoring/"
-  # ensure full tree for %h/koopa-admin-log if missing configs etc.
-  ssh -o BatchMode=yes -o ConnectTimeout=20 "$REMOTE" \
-    'test -d $HOME/koopa-admin-log || git clone https://git.hacktivism.ch/hernani/taler-monitoring.git $HOME/koopa-admin-log 2>/dev/null || true'
-  rsync -az "$ROOT/" "${REMOTE}:src/taler-monitoring/host-agent/"
-  rsync -az "$ROOT/../site-gen/" "${REMOTE}:src/taler-monitoring/site-gen/" 2>/dev/null || true
   ssh -o BatchMode=yes "$REMOTE" \
     'bash $HOME/src/taler-monitoring/host-agent/install-host-agent.sh'
 else
diff --git a/host-agent/run-host-report.sh b/host-agent/run-host-report.sh
index 57aa6cf..389cd4c 100755
--- a/host-agent/run-host-report.sh
+++ b/host-agent/run-host-report.sh
@@ -213,7 +213,7 @@ else
   echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT"
 fi
 # Always restore host-agent + site-gen from pre-reset snapshot when present
-# (systemd ExecStart points at koopa-admin-log which may be the reset suite tree).
+# (systemd ExecStart points at ~/src/taler-monitoring; overlay may lag Forgejo).
 if [ -d "$OVERLAY_DIR/host-agent" ]; then
   mkdir -p "$SUITE_MON/host-agent" 2>/dev/null || true
   rsync -a "$OVERLAY_DIR/host-agent/" "$SUITE_MON/host-agent/" 2>/dev/null || true
diff --git a/host-agent/stagepaysan.env.example b/host-agent/stagepaysan.env.example
new file mode 100644
index 0000000..e91d54e
--- /dev/null
+++ b/host-agent/stagepaysan.env.example
@@ -0,0 +1,30 @@
+# Copy to:  ~/.config/taler-monitoring/env  (user stagepaysan)
+# Never inside the git tree — update-suite never overwrites this file.
+#
+# Shared reporting generation (run-host-report.sh / run-fp-stage-monitoring.sh):
+#   RUN_TIMEOUT, line-buffered log, always HTML, commit link on git.hacktivism.ch
+
+TALER_DOMAIN=stage.lefrancpaysan.ch
+INSIDE_PODMAN=1
+INSIDE_MODE=local-podman
+INSIDE_PROFILE=stage-lfp
+LOCAL_STACK=0
+CONTINUE_ON_ERROR=1
+PHASES="urls inside versions"
+RUN_TIMEOUT=600
+
+HTML_OUT=$HOME/monitoring-sites-staging
+MON_HOSTS="stage.bank.lefrancpaysan.ch stage.exchange.lefrancpaysan.ch stage.monnaie.lefrancpaysan.ch"
+
+# Git clone of taler-monitoring (repo root, not …/taler-monitoring (repo root))
+SUITE_DIR=$HOME/src/taler-monitoring
+SUITE_GIT_URL=https://git.hacktivism.ch/hernani/taler-monitoring.git
+SUITE_GIT_REF=main
+SUITE_UPDATE_MODE=reset
+SOURCE_REPO_WEB=https://git.hacktivism.ch/hernani/taler-monitoring
+
+# Optional public docroot if this user can write it
+# DEPLOY_WWW_ROOT=/var/www/monitoring-sites
+
+# UI language for console + HTML sticky bar (en|fr)
+TALER_MON_LANG=fr
diff --git a/host-agent/taler-monitoring-hacktivism.path b/host-agent/taler-monitoring-hacktivism.path
index d1318fd..f585abf 100644
--- a/host-agent/taler-monitoring-hacktivism.path
+++ b/host-agent/taler-monitoring-hacktivism.path
@@ -4,13 +4,9 @@ Documentation=file:%h/src/taler-monitoring/host-agent/README.md
 
 [Path]
 # Explicit stamp after package/image upgrades (touch-software-stamp.sh)
+# Landing/caddy ops live outside this suite (host admin-log) — touch the stamp there.
 PathChanged=%h/.local/state/taler-hacktivism-monitoring/software.stamp
 PathModified=%h/.local/state/taler-hacktivism-monitoring/software.stamp
-# Landing + caddy config in admin-log (when checked out under ~)
-PathChanged=%h/koopa-admin-log/configs/bank-landing
-PathChanged=%h/koopa-admin-log/configs/exchange-landing
-PathChanged=%h/koopa-admin-log/configs/merchant-landing
-PathChanged=%h/koopa-admin-log/configs/caddy
 # Debounce: wait for quiet period before firing
 TriggerLimitIntervalSec=120
 TriggerLimitBurst=3
diff --git a/site-gen/README.md b/site-gen/README.md
index 8d51e10..482fa58 100644
--- a/site-gen/README.md
+++ b/site-gen/README.md
@@ -65,7 +65,7 @@ Then on koopa **as root**: see **[ROOT-ON-KOOPA.md](./ROOT-ON-KOOPA.md)**.
 | `/monitoring_err/` | always: full console log + error list on top (CONTINUE_ON_ERROR run) |
 | `/monitoring/` | **clean** full log if last strict run exit 0; else **stub** linking to `/monitoring_err/` |
 
-Footer links **Forgejo commit** of the admin-log tree used for that run.
+Footer links **Forgejo commit** of the **taler-monitoring** suite used for that run.
 
 ## Layout
 
diff --git a/site-gen/ROOT-ON-KOOPA.md b/site-gen/ROOT-ON-KOOPA.md
index 604b997..306b044 100644
--- a/site-gen/ROOT-ON-KOOPA.md
+++ b/site-gen/ROOT-ON-KOOPA.md
@@ -21,11 +21,11 @@ install -d -o caddy -g caddy -m 755 /var/www/monitoring-sites
 rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
 chown -R caddy:caddy /var/www/monitoring-sites
 
-# 2) Caddyfile — merge handles from admin-log mirror, then:
+# 2) Caddyfile — from ~/koopa-caddy (host ops), then:
 #    (either edit /etc/caddy/Caddyfile by hand using snippet below,
 #     or copy full mirror after review)
 #
-#    install -m 644 /home/hernani/koopa-admin-log/configs/caddy/Caddyfile /etc/caddy/Caddyfile
+#    install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
 #    # or: ~/koopa-caddy/apply.sh  after syncing Caddyfile into ~/koopa-caddy/
 
 caddy validate --config /etc/caddy/Caddyfile