release 1.3.1: monpages FQDN check + fix silent deploy skip

host-agent/ROOT-APPLY-MONITORING.md

@@ -1,5 +1,11 @@
 # Root: make monitoring pages live on koopa (GOA)
 
+## Detection (v1.3.1+)
+
+Suite phase **`monpages`** and the host-agent **post-check** curl each public
+FQDN (`https://taler.hacktivism.ch/monitoring/` …). Merchant JSON **code 21**
+or non-HTML is an **ERROR** until this apply is done.
+
 ## Symptom if not applied
 
 Public URLs return **merchant/bank JSON** like:

host-agent/run-aptdeploy-monitoring.sh

@@ -21,7 +21,7 @@ export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 # four containers + checks; allow long wall
 export RUN_TIMEOUT="${RUN_TIMEOUT:-1800}"
 # dedicated job: always aptdeploy only
-export PHASES=aptdeploy
+export PHASES="${PHASES:-aptdeploy monpages}"
 # Only merchant public front — not bank/exchange
 export MON_HOSTS="${MON_HOSTS:-taler.hacktivism.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"

host-agent/run-fp-prod-monitoring.sh

@@ -16,7 +16,7 @@ export INSIDE_MODE="${INSIDE_MODE:-local-podman}"
 export LOCAL_STACK="${LOCAL_STACK:-0}"
 export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 export RUN_TIMEOUT="${RUN_TIMEOUT:-600}"
-export PHASES="${PHASES:-urls inside versions}"
+export PHASES="${PHASES:-urls inside versions monpages}"
 export MON_HOSTS="${MON_HOSTS:-bank.lefrancpaysan.ch exchange.lefrancpaysan.ch monnaie.lefrancpaysan.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
 export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"

host-agent/run-fp-stage-monitoring.sh

@@ -17,7 +17,7 @@ export INSIDE_PROFILE="${INSIDE_PROFILE:-stage-lfp}"
 export LOCAL_STACK="${LOCAL_STACK:-0}"
 export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 export RUN_TIMEOUT="${RUN_TIMEOUT:-600}"
-export PHASES="${PHASES:-urls inside versions}"
+export PHASES="${PHASES:-urls inside versions monpages}"
 export MON_HOSTS="${MON_HOSTS:-stage.bank.lefrancpaysan.ch stage.exchange.lefrancpaysan.ch stage.monnaie.lefrancpaysan.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
 export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"

host-agent/run-hacktivism-monitoring.sh

@@ -18,7 +18,7 @@ export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 export RUN_TIMEOUT="${RUN_TIMEOUT:-600}"
 # stack checks only — aptdeploy has its own HTML path + timer:
 #   run-aptdeploy-monitoring.sh → /taler-monitoring-aptdeploy* (taler.hacktivism.ch)
-export PHASES="${PHASES:-urls inside versions}"
+export PHASES="${PHASES:-urls inside versions monpages}"
 export MON_HOSTS="${MON_HOSTS:-bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
 export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"

host-agent/run-host-report.sh

@@ -7,7 +7,8 @@
 #   2) line-buffered run log (written continuously)
 #   3) RUN_TIMEOUT wall clock for taler-monitoring.sh (default 600s)
 #   4) always write HTML (first run / empty staging too) + Forgejo commit link
-#   5) optional rsync to DEPLOY_WWW_ROOT if writable
+#   5) rsync to DEPLOY_WWW_ROOT (ERROR if not writable — v1.3.1)
+#   6) monpages post-check: public FQDN must serve monitoring HTML
 #
 # Configure via env file (not in git):
 #   ${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/env
@@ -88,7 +89,7 @@ elif [ -n "${TALER_MON_LANG:-}" ]; then
 fi
 export TALER_MON_LANG
 
-PHASES="${PHASES:-urls inside versions}"
+PHASES="${PHASES:-urls inside versions monpages}"
 HTML_BASE="${HTML_OUT:-$HOME/monitoring-sites-staging}"
 MON_HOSTS="${MON_HOSTS:-}"
 SUITE_PATH="${SOURCE_SUITE_PATH:-.}"
@@ -386,9 +387,37 @@ for host in $MON_HOSTS; do
   htmlify_host "$host"
 done
 
-if [ -n "$DEPLOY_WWW" ] && [ -w "$DEPLOY_WWW" ] 2>/dev/null; then
-  rsync -a --delete "$HTML_BASE/" "$DEPLOY_WWW/" && \
-    echo "synced → $DEPLOY_WWW/"
+# Publish to live web root when possible (v1.3.1: never silent-skip)
+if [ -n "$DEPLOY_WWW" ]; then
+  if [ -w "$DEPLOY_WWW" ] 2>/dev/null; then
+    if rsync -a --delete "$HTML_BASE/" "$DEPLOY_WWW/"; then
+      echo "synced → $DEPLOY_WWW/"
+    else
+      echo "ERROR: rsync to DEPLOY_WWW_ROOT=$DEPLOY_WWW failed" >&2
+      ec=1
+    fi
+  elif [ -e "$DEPLOY_WWW" ]; then
+    echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW exists but is not writable by $(id -un)" >&2
+    echo "       public FQDN pages will stay missing/stale — fix ownership or run:" >&2
+    echo "       sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2
+    ec=1
+  else
+    echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW missing — public pages not published" >&2
+    echo "       create tree + Caddy handles: sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2
+    ec=1
+  fi
+else
+  echo "WARN: DEPLOY_WWW_ROOT empty — skipping live publish (staging only: $HTML_BASE)" >&2
+fi
+
+# Post-publish: verify this job's pages via FQDN (same paths as monpages phase)
+if [ "${MONPAGES_POSTCHECK:-1}" = "1" ] && [ -x "$ROOT/check_monitoring_pages.sh" ]; then
+  echo "--- monpages post-check (public FQDN) ---"
+  export MON_HOSTS HTML_URL_OK HTML_URL_ERR TALER_DOMAIN
+  if ! bash "$ROOT/check_monitoring_pages.sh"; then
+    echo "ERROR: public monitoring page(s) missing or not suite HTML via FQDN" >&2
+    ec=1
+  fi
 fi
 
 ls -1t "$LOG_DIR"/run-*.log 2>/dev/null | tail -n +30 | xargs rm -f 2>/dev/null || true

host-agent/run-surface-monitoring.sh

@@ -19,7 +19,7 @@ export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 # many hosts; allow up to 45 min wall (phase also has RUN_TIMEOUT)
 export RUN_TIMEOUT="${RUN_TIMEOUT:-2400}"
 # dedicated job: always surface only (never inherit PHASES from shared env)
-export PHASES=surface
+export PHASES="${PHASES:-surface monpages}"
 # Only merchant public front — not bank/exchange
 export MON_HOSTS="${MON_HOSTS:-taler.hacktivism.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"