release 1.10.8: only three mon URL families (no /taler-monitoring page)

README.md

@@ -16,21 +16,25 @@ Repo: https://git.hacktivism.ch/hernani/taler-monitoring · tree: `~/src/taler-m
 Version: `./taler-monitoring.sh --ver` (or `--version` / `-V`)
 
 
-## Monitoring pages — simplified overview (v1.8.0+)
+## Monitoring pages — public URL families (only these three)
 
-Public HTML is **not** an external addon. Layout is intentionally small:
+**`taler-monitoring` is the suite name (git / CLI), not a public URL path.**  
+There is **no** mon page at `/taler-monitoring` or `/taler-monitoring/`.
 
-| Kind | Where | Purpose |
-|------|--------|---------|
-| **Landing-stack report** | `https://{host}/monitoring/` and `/monitoring_err/` | Per **landing** front (9 stacks): GOA bank/exchange/taler · FP stage bank/exchange/monnaie · FP prod bank/exchange/monnaie |
-| **Ecosystem surface** | **only** `https://taler.hacktivism.ch/taler-monitoring-surface/` and `…/taler-monitoring-surface_err/` | Software/versions found in the Taler universe (ports, nmap OS fingerprint, Mattermost, mail firefly+anastasis, package signals) |
+Exactly **three** first-class public path families (each must work **bare and with trailing slash**; reverse-proxy should `redir` bare → slash). Error companions use `…_err` when the last run failed:
 
-There are **no** first-class public pages for `/taler-monitoring-mail*`, `/taler-monitoring-mattermost*`, or similar — those checks run **inside the surface job** and appear on the surface page.
+| Family | Paths (bare + slash) | Where | Purpose |
+|--------|----------------------|--------|---------|
+| **monitoring** | `/monitoring` · `/monitoring/` · optional `/monitoring_err` · `/monitoring_err/` | Per **landing** host (GOA bank/exchange/taler · FP · mytops stage, …) | Stack report for that host |
+| **taler-monitoring-surface** | `/taler-monitoring-surface` · `/…/` · optional `…_err` | **only** `taler.hacktivism.ch` | Ecosystem surface (ports, nmap, mail, mattermost, versions) |
+| **taler-monitoring-aptdeploy** | `/taler-monitoring-aptdeploy` · `/…/` · optional `…_err` | **only** `taler.hacktivism.ch` | apt-src merchant deploy tests (podman on koopa) |
+
+**Not** public mon pages: `/taler-monitoring-mail*`, `/taler-monitoring-mattermost*`, bare `/taler-monitoring` — mail/mm are folded into **surface**.
 
 Related:
 
-- **Phase `monpages`:** obligatory **ERROR** if a page is missing, not suite HTML, or **content markers fail** (v1.9.0): top (`sticky-bar` / `taler-mon:top` / generated) and bottom (`footer` / `taler-mon:bottom:complete`). Mid-run pages (progress <100% or `incomplete` meta) may skip bottom ERROR. Body must contain real checks — progress bars alone → ERROR. On GOA, `/taler-monitoring-surface/` is always required.
-- **Publish:** staging `~/monitoring-sites-staging` → `DEPLOY_WWW_ROOT` + reverse-proxy handles.
+- **Phase `monpages`:** obligatory **ERROR** if a listed page is missing, bootstrap stub, not suite HTML, or **content markers fail**. Bare paths that fall through to merchant **code 21** are ERROR (not “OK because slash works”).
+- **Publish:** staging `~/monitoring-sites-staging` → `DEPLOY_WWW_ROOT` + reverse-proxy handles for **only** the three families above.
 
 ```bash
 ./taler-monitoring.sh monpages

VERSION

@@ -1 +1 @@
-1.10.7
+1.10.8

VERSIONS.md

@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.10.8** | 2026-07-19 | **Docs/clarity:** only three public mon URL families (`/monitoring`, `/taler-monitoring-surface`, `/taler-monitoring-aptdeploy`) each bare+slash(+_err); suite name ≠ path; no `/taler-monitoring` page. |
 | **v1.10.7** | 2026-07-19 | **Bugfix:** stop always-rsync of **stale suite-overlay** over Forgejo tip (broke stage sticky / new site-gen). Overlay only when suite missing phases. |
 | **v1.10.6** | 2026-07-19 | **Fix:** stage mon HTML quality — suite update out of public log; filter git noise; stage-specific sticky (not GOA); `CHECK_BANK=0` / `MERCHANT_REQUIRED` for mytops stage scope. |
 | **v1.10.5** | 2026-07-19 | **Fix:** aptdeploy monpages **job-only** (own `/taler-monitoring-aptdeploy*`); full GOA mon inventory + bare URL checks stay on **hacktivism** general run — no bank/exchange/surface monpages noise on aptdeploy HTML. |

check_monitoring_pages.sh

@@ -99,17 +99,19 @@ _host_allowed() {
   esac
 }
 
-# Public page layout (v1.9.4+):
-#   • 9 landing stacks → /monitoring/ (+ /monitoring_err/ when present)
-#   • ecosystem software/versions → taler.hacktivism.ch/taler-monitoring-surface(+_err)/
-#   • apt-src deploy tests → taler.hacktivism.ch/taler-monitoring-aptdeploy(+_err)/
-# Legacy /taler-monitoring-{mail,mattermost}* stay folded into surface (no first-class pages).
+# Public mon URL families (suite name "taler-monitoring" ≠ a public path):
+#   1) /monitoring(+_err)           — landing hosts (bare + slash)
+#   2) /taler-monitoring-surface(+_err)  — taler.hacktivism.ch only
+#   3) /taler-monitoring-aptdeploy(+_err) — taler.hacktivism.ch only
+# No /taler-monitoring page. No /taler-monitoring-mail|mattermost pages.
 
 _path_allowed() {
   case "$1" in
     monitoring|monitoring_err|\
     taler-monitoring-surface|taler-monitoring-surface_err|\
     taler-monitoring-aptdeploy|taler-monitoring-aptdeploy_err) return 0 ;;
+    # explicit deny (never invent a mon page here)
+    taler-monitoring|taler-monitoring-mail|taler-monitoring-mattermost) return 1 ;;
     *) return 1 ;;
   esac
 }

host-agent/ROOT-APPLY-MONITORING.md

@@ -40,13 +40,16 @@ That script:
 3. Installs prepared Caddyfile → `/etc/caddy/Caddyfile`, validates, reloads Caddy
 4. Smoke-curls all monitoring URLs (must **not** be JSON `code:21`)
 
-## Paths
+## Paths (only three families — suite name ≠ URL)
 
-| Path | Host | Source timer |
-|------|------|----------------|
-| `/monitoring/` + `/monitoring_err/` | bank + exchange + taler | `taler-monitoring-hacktivism.timer` (4h) |
-| `/taler-monitoring-surface/` + `/_err/` | **taler.hacktivism.ch only** | `taler-monitoring-surface.timer` (1h) |
-| `/taler-monitoring-aptdeploy/` + `/_err/` | **taler.hacktivism.ch only** | `taler-monitoring-aptdeploy.timer` (4h) |
+There is **no** public page `/taler-monitoring`. Each family needs **bare and slash**
+(`redir * /path/ 302` inside Caddy `handle`):
+
+| Family | Paths | Host | Source timer |
+|--------|-------|------|----------------|
+| **monitoring** | `/monitoring` · `/monitoring/` · `/monitoring_err` · `/monitoring_err/` | bank + exchange + taler (and other landings) | `taler-monitoring-hacktivism.timer` (4h) |
+| **taler-monitoring-surface** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-surface.timer` (1h) |
+| **taler-monitoring-aptdeploy** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-aptdeploy.timer` (4h) |
 
 HTML is generated as **hernani** into  
 `/home/hernani/monitoring-sites-staging/`.

site-gen/console_to_html.py

@@ -70,11 +70,11 @@ def ui(lang: str, key: str, **kwargs) -> str:
         "stack_i_phases": "Log header phases= {phases}",
         "pages_title": "Monitoring pages (suite HTML)",
         "pages_summary": "Public sticky-bar reports · phase monpages · part of taler-monitoring",
-        "pages_i1": "These HTML reports are generated by taler-monitoring (site-gen/console_to_html.py + host-agent)",
-        "pages_i2": "Landing stacks (9): /monitoring(+_err)/ on bank/exchange/merchant fronts (GOA + FP stage + FP prod)",
-        "pages_i3": "GOA: /monitoring/ on bank+exchange+taler; surface + aptdeploy on taler.hacktivism.ch — mail/mattermost folded into surface",
-        "pages_i4": "Phase monpages: outside-in check (existence + top/bottom content markers; not merchant JSON code 21)",
-        "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; reverse-proxy must serve /monitoring* and /taler-monitoring-surface*",
+        "pages_i1": "Suite name taler-monitoring ≠ URL. Only three public families (bare + slash each):",
+        "pages_i2": "1) /monitoring(+_err) on landing hosts · 2) /taler-monitoring-surface(+_err) · 3) /taler-monitoring-aptdeploy(+_err) on taler.hacktivism.ch",
+        "pages_i3": "No /taler-monitoring page; no /taler-monitoring-mail|mattermost (folded into surface)",
+        "pages_i4": "monpages: existence + content markers; bare → slash redir (not merchant code 21)",
+        "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; reverse-proxy handles only those three families",
         "pages_i6": "This page host: {host} · path label: {label}",
         "stage_title": "mytops stage monitoring · {host}",
         "stage_summary": "betel only · CHF stage stack · not lifeline/prod · not GOA",
@@ -152,11 +152,11 @@ def ui(lang: str, key: str, **kwargs) -> str:
         "stack_i_phases": "En-tête de journal phases= {phases}",
                 "pages_title": "Pages de monitoring (HTML de la suite)",
         "pages_summary": "Rapports publics sticky-bar · phase monpages · partie de taler-monitoring",
-        "pages_i1": "Ces rapports HTML sont générés par taler-monitoring (site-gen/console_to_html.py + host-agent)",
-        "pages_i2": "Piles landing (9) : /monitoring(+_err)/ sur bank/exchange/merchant (GOA + FP stage + FP prod)",
-        "pages_i3": "GOA : /monitoring/ bank+exchange+taler ; surface + aptdeploy sur taler.hacktivism.ch — mail/mattermost dans surface",
-        "pages_i4": "Phase monpages : existence + marqueurs haut/bas (pas JSON merchant code 21)",
-        "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; le reverse-proxy sert /monitoring* et /taler-monitoring-surface*",
+        "pages_i1": "Nom de suite taler-monitoring ≠ URL. Trois familles publiques seulement (sans et avec /) :",
+        "pages_i2": "1) /monitoring(+_err) · 2) /taler-monitoring-surface(+_err) · 3) /taler-monitoring-aptdeploy(+_err) sur taler.hacktivism.ch",
+        "pages_i3": "Pas de page /taler-monitoring ; pas de /taler-monitoring-mail|mattermost (dans surface)",
+        "pages_i4": "monpages : existence + marqueurs ; bare → slash (pas code 21 merchant)",
+        "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; reverse-proxy seulement ces trois familles",
         "stage_title": "Surveillance mytops stage · {host}",
         "stage_summary": "betel uniquement · pile CHF stage · pas lifeline/prod · pas GOA",
         "stage_i1": "Hôte : betel (stage). HTML mon : stage.my.taler-ops.ch + stage.taler-ops.ch /monitoring/",