taler-monitoring v1.0: standalone suite

site-gen/ROOT-ON-KOOPA.md

@@ -0,0 +1,92 @@
+# Root on koopa (hacktivism monitoring sites)
+
+Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
+**not** put into Taler containers — only host paths + Caddy `handle`.
+
+After `generate-monitoring-sites.sh` + `deploy-monitoring-sites.sh` (as hernani),
+files live in:
+
+```text
+/home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
+/home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html
+```
+
+## One-shot as root (copy + Caddy)
+
+```bash
+# on koopa (koopa-external), as root:
+
+# 1) web root
+install -d -o caddy -g caddy -m 755 /var/www/monitoring-sites
+rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
+chown -R caddy:caddy /var/www/monitoring-sites
+
+# 2) Caddyfile — merge handles from admin-log mirror, then:
+#    (either edit /etc/caddy/Caddyfile by hand using snippet below,
+#     or copy full mirror after review)
+#
+#    install -m 644 /home/hernani/koopa-admin-log/configs/caddy/Caddyfile /etc/caddy/Caddyfile
+#    # or: ~/koopa-caddy/apply.sh  after syncing Caddyfile into ~/koopa-caddy/
+
+caddy validate --config /etc/caddy/Caddyfile
+systemctl reload caddy
+systemctl is-active caddy
+```
+
+## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)
+
+Place **before** the catch-all `reverse_proxy` (same idea as `/intro*`):
+
+```caddy
+    # Public taler-monitoring console HTML (static; host only)
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        rewrite * /monitoring_err{uri}
+        # uri is /monitoring_err or /monitoring_err/ → serve directory index
+        file_server
+    }
+    handle /monitoring* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+```
+
+Simpler layout (recommended): path on disk matches URL under host root:
+
+```text
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
+/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html
+```
+
+```caddy
+    handle_path /monitoring_err/* {
+        root * /var/www/monitoring-sites/{host}/monitoring_err
+        file_server
+    }
+    handle /monitoring_err {
+        redir /monitoring_err/ 302
+    }
+    handle_path /monitoring/* {
+        root * /var/www/monitoring-sites/{host}/monitoring
+        file_server
+    }
+    handle /monitoring {
+        redir /monitoring/ 302
+    }
+```
+
+Canonical snippet is also in `caddy-monitoring-handles.snippet` and applied
+in `configs/caddy/Caddyfile` for the three GOA hosts.
+
+## Check
+
+```bash
+curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
+curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring_err/
+curl -sS https://bank.hacktivism.ch/monitoring_err/ | head
+```
+
+## Not needed as root
+
+- Running `taler-monitoring` (use **firecuda-external** / laptop)
+- Writing into podman Taler containers