release 1.8.0: simplified mon pages + surface nmap + mail hosts

Public layout: only taler-monitoring-surface(+_err) for ecosystem
software/versions; nine landing stacks keep /monitoring(+_err).
Fold mail (firefly.gnunet.org, anastasis.taler-systems.com) and
mattermost into the surface job; deprecate separate mon pages/timers.
nmap OS fingerprinting; package-behind defaults to ERROR.

README.md

@@ -6,34 +6,31 @@ Checks for **GNU Taler** stacks (bank, exchange, merchant; optional surface inve
 |------|------|
 | **Outside-only** | Public HTTPS from anywhere — no SSH, no host-agent. Phases such as `urls`, `monpages`, `surface`, … |
 | **Inside / local** | Where you operate the stack: podman/SSH (`inside`, `versions`, `e2e`, `ladder`, …) |
-| **Host-agent + HTML** | Optional: timers run the suite and publish sticky-bar HTML under `…/monitoring/` (and surface/aptdeploy paths) |
+| **Host-agent + HTML** | Optional: timers run the suite and publish sticky-bar HTML (see simplified page layout below) |
 
 Outside-only example: `./taler-monitoring.sh -d demo.taler.net urls`  
-Mattermost chat: `./taler-monitoring.sh mattermost` (default `https://mattermost.taler.net`)  
-Mail (firefly/pixel): `./taler-monitoring.sh mail`  
+Surface (ecosystem + mail + mattermost + versions): `./taler-monitoring.sh surface mattermost mail versions`  
 Full local GOA example: `./taler-monitoring.sh -d hacktivism.ch urls inside versions`
 
 Repo: https://git.hacktivism.ch/hernani/taler-monitoring · tree: `~/src/taler-monitoring`  
 Version: `./taler-monitoring.sh --ver` (or `--version` / `-V`)
 
 
-## Monitoring pages (part of the suite)
+## Monitoring pages — simplified overview (v1.8.0+)
 
-The **public HTML reports** are not an external addon — they are a first-class part of **taler-monitoring**:
+Public HTML is **not** an external addon. Layout is intentionally small:
 
-| Kind | Public path(s) | Produced by |
-|------|----------------|-------------|
-| Stack host report | `https://{bank,exchange,merchant}/monitoring/` | host-agent + `site-gen/console_to_html.py` |
-| Surface inventory | `https://taler.hacktivism.ch/taler-monitoring-surface/` | `run-surface-monitoring.sh` |
-| apt-src deploy tests | `https://taler.hacktivism.ch/taler-monitoring-aptdeploy/` | `run-aptdeploy-monitoring.sh` |
-| Mattermost | `https://taler.hacktivism.ch/taler-monitoring-mattermost/` | `run-mattermost-monitoring.sh` |
-| Mail (MX/SMTP/IMAP) | `https://taler.hacktivism.ch/taler-monitoring-mail/` | `run-mail-monitoring.sh` |
+| Kind | Where | Purpose |
+|------|--------|---------|
+| **Landing-stack report** | `https://{host}/monitoring/` and `/monitoring_err/` | Per **landing** front (9 stacks): GOA bank/exchange/taler · FP stage bank/exchange/monnaie · FP prod bank/exchange/monnaie |
+| **Ecosystem surface** | **only** `https://taler.hacktivism.ch/taler-monitoring-surface/` and `…/taler-monitoring-surface_err/` | Software/versions found in the Taler universe (ports, nmap OS fingerprint, Mattermost, mail firefly+anastasis, package signals) |
+
+There are **no** first-class public pages for `/taler-monitoring-mail*`, `/taler-monitoring-mattermost*`, or similar — those checks run **inside the surface job** and appear on the surface page.
 
 Related:
 
-- **Phase `monpages`:** obligatory outside-in check that public mon HTML is live (sticky-bar), not merchant JSON code 21 — GOA full inventory, FP only FP hosts.
-- **Sticky “What this monitors”:** each page lists its checks **and** a dedicated block *Monitoring pages themselves (suite)*.
-- **Publish:** staging `~/monitoring-sites-staging` → `DEPLOY_WWW_ROOT` + Caddy handles (`site-gen/caddy-monitoring-handles.snippet`, v1.7.2+).
+- **Phase `monpages`:** obligatory ERROR if expected pages are missing (not merchant JSON code 21).
+- **Publish:** staging `~/monitoring-sites-staging` → `DEPLOY_WWW_ROOT` + reverse-proxy handles.
 
 ```bash
 ./taler-monitoring.sh monpages
@@ -401,21 +398,20 @@ LADDER_LOAD=0 ./taler-monitoring.sh ladder
 Default **English**. Select language with `--lang en|fr` or `TALER_MON_LANG`.
 FrancPaysan stacks auto-select **French** (`*lefrancpaysan*`). See `VERSIONS.md` and `i18n.sh`.
 
-## Public monitoring pages via FQDN (v1.3.1+ / obligatory v1.7.6+)
+## Public monitoring pages via FQDN (v1.3.1+ / obligatory v1.7.6+ / layout v1.8.0+)
 
-Phase **`monpages`** is **obligatory**: missing or non-suite HTML is **ERROR**
-(not merchant JSON code 21, not 404). Soft mode only with
-`MONPAGES_REQUIRE_PUBLIC=0` (escape hatch).
+Phase **`monpages`** is **obligatory**: missing or non-suite HTML is **ERROR**.
+Soft mode only with `MONPAGES_REQUIRE_PUBLIC=0` (escape hatch).
 
-| Stack | What is checked |
-|-------|-----------------|
-| **GOA / hacktivism** | Full suite inventory: `bank`/`exchange`/`taler` `/monitoring/` plus `/taler-monitoring-{surface,aptdeploy,mattermost,mail}/` and any extra pages found under staging/`DEPLOY_WWW_ROOT` |
-| **FrancPaysan** | Only that stack’s mon hosts (`bank`/`exchange`/`monnaie` · stage variants) — never GOA URLs |
+| Stack | What monpages expects (v1.8.0) |
+|-------|--------------------------------|
+| **GOA** | `bank`/`exchange`/`taler` `/monitoring/` + `taler.hacktivism.ch/taler-monitoring-surface/` |
+| **FrancPaysan** | That stack’s three mon hosts `/monitoring/` only |
+| **Nine landings (model)** | Each of the 9 landing fronts has `/monitoring` + `/monitoring_err` (when a failed run exists) |
 
 ```bash
 ./taler-monitoring.sh -d hacktivism.ch monpages
 ./taler-monitoring.sh -d lefrancpaysan.ch monpages
-# host-agent runs monpages by default and again after HTML publish
 ```
 
 If pages are missing publicly: `sudo ~/koopa-caddy/apply-monitoring-live.sh` on koopa