11 changed files with 78 additions and 222 deletions
--- a/README.md
+++ b/README.md
@ -414,7 +414,7 @@ Soft mode only with `MONPAGES_REQUIRE_PUBLIC=0` (escape hatch).
 ./taler-monitoring.sh -d lefrancpaysan.ch monpages
 ```

-If pages are missing publicly: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh` on koopa
+If pages are missing publicly: `sudo ~/koopa-caddy/apply-monitoring-live.sh` on koopa
 (FP: Infomaniak vhost for `/monitoring*`).

 ## Version on monitoring pages (v1.3+ / sticky bar)
--- a/2
+++ b/2
@ -1 +1 @@
-1.9.4
+1.9.1
--- a/VERSIONS.md
+++ b/VERSIONS.md
@ -17,9 +17,6 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre

 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
-| **v1.9.4** | 2026-07-19 | **Fix:** restore **taler-monitoring-aptdeploy(+_err)** as first-class GOA mon page (catalog + monpages path allow + surface docs). Mail/mattermost stay folded into surface. |
-| **v1.9.3** | 2026-07-19 | **Bugfix (suite):** monpages merchant **code 21** always ERROR (bare no longer soft-WARN); apply hints use absolute `/home/hernani/koopa-caddy/…`; ship `host-agent/apply-monitoring-live.sh` (smoke array, bare check); fix ROOT-ON-KOOPA wrong `redir /path/ 302` examples. |
-| **v1.9.2** | 2026-07-19 | **Bugfix:** Caddy bare-path redir footgun — inside `handle` use `redir * /path/ 302` (not `redir /path/ 302`, which becomes `Location: 302` and bare URLs fall through to merchant **code 21**). Snippet + ROOT-APPLY: absolute apply path (`/home/hernani/koopa-caddy/…`, not `~` as root). |
 | **v1.9.1** | 2026-07-19 | **Bugfix:** stale path confusions in repo — sticky `pages_i3` no longer lists mail/mattermost/aptdeploy mon pages; lib.sh/android-test drop `scripts/taler-monitoring/`; monpages/host-agent hints match v1.8 layout; clarify GIT vs GUI vs CLI `*AUTOMATION-NOTES.md` (three files by design). |
 | **v1.9.0** | 2026-07-19 | **monpages content:** ERROR if page missing or markers incomplete — top (sticky-bar/status-bar/generated) + bottom (footer/`taler-mon:bottom`); mid-run (progress &lt;100% / incomplete meta) relaxes bottom only. Surface required on normal GOA runs with meaningful body (not progress-only). HTML emits `taler-mon:top` / `taler-mon:bottom:complete|incomplete`. |
 | **v1.8.0** | 2026-07-19 | **Simplified public pages:** only `/taler-monitoring-surface(+_err)` on `taler.hacktivism.ch` for ecosystem software/versions; **9 landing stacks** each keep `/monitoring(+_err)`. Mail (firefly.gnunet.org + anastasis.taler-systems.com) and Mattermost folded into surface job; separate mail/mattermost mon pages + timers deprecated. **nmap** OS fingerprinting on surface (`SURFACE_NMAP`); **ERROR** when packages are behind (`TALER_PKG_BEHIND=error` default) or OS fingerprint is EOL. |
--- a/check_monitoring_pages.sh
+++ b/check_monitoring_pages.sh
@ -99,17 +99,16 @@ _host_allowed() {
  esac
 }

-# Public page layout (v1.9.4+):
+# Public page layout (v1.8.0+ simplified):
 #   • 9 landing stacks → /monitoring/ (+ /monitoring_err/ when present)
-#   • ecosystem software/versions → taler.hacktivism.ch/taler-monitoring-surface(+_err)/
-#   • apt-src deploy tests → taler.hacktivism.ch/taler-monitoring-aptdeploy(+_err)/
-# Legacy /taler-monitoring-{mail,mattermost}* stay folded into surface (no first-class pages).
+#   • ecosystem software/versions inventory → only
+#       https://taler.hacktivism.ch/taler-monitoring-surface/
+#       https://taler.hacktivism.ch/taler-monitoring-surface_err/
+# Legacy /taler-monitoring-{mail,mattermost,aptdeploy}* are NOT first-class pages.

 _path_allowed() {
  case "$1" in
-    monitoring|monitoring_err|\
-    taler-monitoring-surface|taler-monitoring-surface_err|\
-    taler-monitoring-aptdeploy|taler-monitoring-aptdeploy_err) return 0 ;;
+    monitoring|monitoring_err|taler-monitoring-surface|taler-monitoring-surface_err) return 0 ;;
    *) return 1 ;;
  esac
 }
@ -148,9 +147,8 @@ _catalog_urls() {
      for h in bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch; do
        printf 'https://%s/monitoring/\n' "$h"
      done
-      # ecosystem surface (versions / software) + apt-src deploy mon page
+      # ecosystem surface only (versions / software found in Taler universe)
      printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n'
-      printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n'
      ;;
    fp)
      for h in $MON_HOSTS; do
@ -160,13 +158,12 @@ _catalog_urls() {
      done
      ;;
    all|nine)
-      # optional: all nine landings + surface + aptdeploy
+      # optional: all nine landings + surface
      while IFS= read -r h; do
        [ -n "$h" ] || continue
        printf 'https://%s/monitoring/\n' "$h"
      done < <(_landing_nine)
      printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n'
-      printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n'
      ;;
  esac
 }
@ -195,16 +192,15 @@ build_urls() {
    case "$inv" in
      job)
        _job_urls
-        # GOA: always require surface + aptdeploy pages (content-checked)
+        # v1.9.0: normal GOA runs always require surface page (content-checked)
        if [ "$fam" = "goa" ]; then
          printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n'
-          printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n'
        fi
        ;;
      full|auto|*)
        # Always include this job’s paths (host-agent post-check).
        _job_urls
-        # Stack inventory: GOA = landings + surface + aptdeploy; FP = only FP mon hosts.
+        # Stack inventory: GOA = landings + surface; FP = only FP mon hosts.
        if [ "$fam" = "goa" ] || [ "$fam" = "fp" ]; then
          _catalog_urls "$fam"
          # On-disk discovery (err pages only exist after failed runs; extras welcome)
@ -384,10 +380,14 @@ check_one() {
  fi
  if grep -qE '"code"[[:space:]]*:[[:space:]]*21' "$body" 2>/dev/null \
    || grep -qiE 'There is no endpoint defined for the URL' "$body" 2>/dev/null; then
-    # Merchant code 21 is always ERROR (even bare): slash-only soft mode used to hide
-    # Caddy redir footgun (redir /path/ 302 → Location:302). Bare must 302/200 HTML.
+    if [ "$soft" = "1" ]; then
+      warn "public mon page bare URL" \
+        "$url -> HTTP $code code 21 (prefer trailing slash; set MONPAGES_BARE_STRICT=1 to ERROR)"
+      rm -f "$body"
+      return 0
+    fi
    _mon_fail_or_soft "public mon page missing" \
-      "$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle; apply: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)" || { rm -f "$body"; return 1; }
+      "$url -> HTTP $code merchant/API JSON code 21 (publish HTML + reverse-proxy handle /monitoring*)" || { rm -f "$body"; return 1; }
    rm -f "$body"
    return 0
  fi
@ -447,11 +447,10 @@ while IFS= read -r line; do
  URLS+=("$line")
 done < <(build_urls | sort -u)

-# Bare URLs without trailing slash: checked by default.
-# Merchant JSON code 21 is always ERROR (Caddy/proxy not serving mon path).
-# Other bare failures: WARN unless MONPAGES_BARE_STRICT=1 (then ERROR).
+# Bare URLs without trailing slash: optional soft check (default on).
+# Many reverse proxies only redirect /monitoring → /monitoring/; bare may hit the app (code 21).
 # MONPAGES_CHECK_BARE=0  → skip bare entirely
-# MONPAGES_BARE_STRICT=1 → non-21 bare failures are ERROR too
+# MONPAGES_BARE_STRICT=1 → bare failures are ERROR (default: WARN if slash form exists)
 if [ "${MONPAGES_CHECK_BARE:-1}" = "1" ]; then
  _extra=()
  for u in "${URLS[@]}"; do
@ -487,13 +486,12 @@ done
 if [ "$ec" -ne 0 ]; then
  echo "  hint: public monitoring HTML not served (404 / merchant code 21)"
  echo "        publish staging HTML + configure reverse-proxy/Caddy handle for mon paths"
-  echo "        (on koopa: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)"
-  echo "        bare code 21: Caddy redir inside handle must be: redir * /path/ 302 (not redir /path/ 302)"
+  echo "        (on koopa: sudo ~/koopa-caddy/apply-monitoring-live.sh)"
  if [ "$_fam" = "fp" ]; then
    echo "        FP: only FP mon hosts are checked — wire Infomaniak vhost for /monitoring*"
  fi
  if [ "$_fam" = "goa" ]; then
-    echo "        GOA: bank/exchange/taler /monitoring/ + surface + aptdeploy (v1.9.4+ layout)"
+    echo "        GOA: bank/exchange/taler /monitoring/ + taler-monitoring-surface (v1.8+ layout)"
  fi
  # Staging vs public diagnosis (host-agent sets MONPAGES_STAGING_BASE / HTML_OUT)
  _stg="${MONPAGES_STAGING_BASE:-${HTML_OUT:-${HTML_BASE:-$HOME/monitoring-sites-staging}}}"
--- a/host-agent/ROOT-APPLY-MONITORING.md
+++ b/host-agent/ROOT-APPLY-MONITORING.md
@ -22,17 +22,9 @@ API). Prepared config is only under **`/home/hernani/koopa-caddy/Caddyfile`**.
 ## One-shot as root (recommended)

 ```bash
-# absolute path required: as root, ~ is /root (not /home/hernani)
 sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
-# or already root:
-# /home/hernani/koopa-caddy/apply-monitoring-live.sh
 ```

-**Caddy bare-path redir (v1.9.2+):** inside a `handle` block use
-`redir * /path/ 302` — never `redir /path/ 302` alone (Caddy treats the first
-token as matcher and sets `Location: 302`, so bare URLs fall through to the
-merchant API as JSON **code 21**).
-
 That script:

 1. `rsync` staging HTML → `/var/www/monitoring-sites/` (incl. surface + aptdeploy)
--- a/host-agent/apply-monitoring-live.sh
+++ b/host-agent/apply-monitoring-live.sh
@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-# ONE-SHOT as root: publish monitoring HTML + enable Caddy handles
-#
-# Suite copy (taler-monitoring host-agent). Live install path on koopa:
-#   /home/hernani/koopa-caddy/apply-monitoring-live.sh
-# Prefer absolute path ( ~ expands to /root when already root ):
-#   sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
-#   /home/hernani/koopa-caddy/apply-monitoring-live.sh   # if already root
-#
-# After editing here: rsync to koopa ~/koopa-caddy/ before root apply.
-set -euo pipefail
-if [[ "$(id -u)" -ne 0 ]]; then
-  exec sudo -E "$0" "$@"
-fi
-
-STAGING=/home/hernani/monitoring-sites-staging
-WWW=/var/www/monitoring-sites
-SRC=/home/hernani/koopa-caddy/Caddyfile
-DST=/etc/caddy/Caddyfile
-
-if [[ ! -f "$SRC" ]]; then
-  echo "ERROR: missing Caddyfile source: $SRC" >&2
-  exit 1
-fi
-if [[ ! -d "$STAGING" ]]; then
-  echo "ERROR: missing staging HTML: $STAGING" >&2
-  exit 1
-fi
-
-echo "== 1) HTML staging → www =="
-mkdir -p "$WWW"
-rsync -a --delete "$STAGING/" "$WWW/"
-# allow hernani to update future runs without root
-chown -R hernani:caddy "$WWW"
-chmod -R g+rwX "$WWW"
-find "$WWW" -type d -exec chmod g+s {} \;
-# ACL default if available
-if command -v setfacl >/dev/null 2>&1; then
-  setfacl -R -m u:hernani:rwx,g:caddy:rwx "$WWW" || true
-  setfacl -R -d -m u:hernani:rwx,g:caddy:rwx "$WWW" || true
-fi
-ls -la "$WWW" "$WWW/taler.hacktivism.ch" || true
-
-echo "== 2) Caddyfile (backup + install) =="
-ts=$(date +%Y%m%d-%H%M%S)
-cp -a "$DST" "/etc/caddy/Caddyfile.bak-monitoring-${ts}"
-cp -a "$SRC" "$DST"
-chown root:caddy "$DST" 2>/dev/null || chown root:root "$DST"
-chmod 644 "$DST"
-caddy validate --config "$DST"
-systemctl reload caddy
-systemctl is-active caddy
-
-echo "== 3) smoke =="
-# bash: every continued line except the last must end with \
-urls=(
-  https://taler.hacktivism.ch/monitoring/
-  https://bank.hacktivism.ch/monitoring/
-  https://exchange.hacktivism.ch/monitoring/
-  https://taler.hacktivism.ch/taler-monitoring-surface
-  https://taler.hacktivism.ch/taler-monitoring-surface/
-  https://taler.hacktivism.ch/taler-monitoring-surface_err/
-  https://taler.hacktivism.ch/taler-monitoring-aptdeploy/
-  https://taler.hacktivism.ch/taler-monitoring-aptdeploy_err/
-)
-smoke_fail=0
-for url in "${urls[@]}"; do
-  code=$(curl -sS -o /tmp/monchk -w '%{http_code}' -L --max-redirs 3 -m 12 "$url" || echo ERR)
-  ct=$(file -b /tmp/monchk 2>/dev/null | head -c 40)
-  echo "  $code  $url  ($ct)"
-  if grep -qE '"code":[[:space:]]*21' /tmp/monchk 2>/dev/null; then
-    echo "    STILL merchant JSON code 21 — Caddy handles not active?"
-    smoke_fail=1
-  fi
-done
-# bare path must redirect (or land on HTML), not merchant JSON
-bare_code=$(curl -sS -o /tmp/monbare -w '%{http_code}' --max-redirs 0 -m 12 \
-  https://taler.hacktivism.ch/taler-monitoring-surface || echo ERR)
-if grep -qE '"code":[[:space:]]*21' /tmp/monbare 2>/dev/null; then
-  echo "ERROR: bare /taler-monitoring-surface still merchant code 21 (HTTP $bare_code)" >&2
-  smoke_fail=1
-elif [[ "$bare_code" != "302" && "$bare_code" != "301" && "$bare_code" != "200" ]]; then
-  echo "WARN: bare /taler-monitoring-surface HTTP $bare_code (want 302/301/200 HTML)" >&2
-fi
-echo "  bare_no_follow=$bare_code  https://taler.hacktivism.ch/taler-monitoring-surface"
-
-if [[ "$smoke_fail" -ne 0 ]]; then
-  echo "ERROR: smoke failed" >&2
-  exit 1
-fi
-echo "OK apply-monitoring-live done"
--- a/host-agent/run-host-report.sh
+++ b/host-agent/run-host-report.sh
@ -401,11 +401,11 @@ if [ -n "$DEPLOY_WWW" ]; then
  elif [ -e "$DEPLOY_WWW" ]; then
    echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW exists but is not writable by $(id -un)" >&2
    echo "       public FQDN pages will stay missing/stale — fix ownership or run:" >&2
-    echo "       sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
+    echo "       sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2
    ec=1
  else
    echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW missing — public pages not published" >&2
-    echo "       create tree + Caddy handles: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2
+    echo "       create tree + Caddy handles: sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2
    ec=1
  fi
 else
@ -437,7 +437,7 @@ if [ "$_monpages_failed" = "1" ]; then
  {
    echo ""
    echo "ERROR monpages: public FQDN monitoring HTML missing or merchant JSON code 21"
-    echo "ERROR monpages: fix with sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)"
+    echo "ERROR monpages: fix with sudo ~/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)"
  } >>"$LOG"
  for host in $MON_HOSTS; do
    htmlify_host "$host"
--- a/host-agent/run-surface-monitoring.sh
+++ b/host-agent/run-surface-monitoring.sh
@ -5,11 +5,9 @@
 #   https://taler.hacktivism.ch/taler-monitoring-surface/
 #   https://taler.hacktivism.ch/taler-monitoring-surface_err/
 #
-# This page covers remote ecosystem inventory: host/port probes, nmap OS
+# This single page covers remote ecosystem inventory: host/port probes, nmap OS
 # fingerprint, Mattermost, mail (firefly + anastasis), package/version signals.
-# There are NO separate public pages for mail / mattermost (folded here).
-# Apt-src deploy tests keep their own page + timer:
-#   run-aptdeploy-monitoring.sh → /taler-monitoring-aptdeploy(+_err)/
+# There are NO separate public pages for mail / mattermost / aptdeploy.
 #
 # Landing-stack reports stay on each of the 9 fronts as /monitoring(/_err).
 #
--- a/site-gen/ROOT-ON-KOOPA.md
+++ b/site-gen/ROOT-ON-KOOPA.md
@ -3,33 +3,31 @@
 Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
 **not** put into Taler containers — only host paths + Caddy `handle`.

-After host-agent / `generate-monitoring-sites.sh` + deploy (as hernani), files live in:
+After `generate-monitoring-sites.sh` + `deploy-monitoring-sites.sh` (as hernani),
+files live in:

 ```text
 /home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
 /home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html
 ```

-## One-shot as root (preferred)
+## One-shot as root (copy + Caddy)

 ```bash
-# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
-sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
-# same script is versioned in the suite:
-#   host-agent/apply-monitoring-live.sh  → install/sync to /home/hernani/koopa-caddy/
-```
+# on koopa (koopa-external), as root:

-That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
-Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
-
-## Manual equivalent
-
-```bash
-install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
+# 1) web root
+install -d -o caddy -g caddy -m 755 /var/www/monitoring-sites
 rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
-chown -R hernani:caddy /var/www/monitoring-sites
+chown -R caddy:caddy /var/www/monitoring-sites
+
+# 2) Caddyfile — from ~/koopa-caddy (host ops), then:
+#    (either edit /etc/caddy/Caddyfile by hand using snippet below,
+#     or copy full mirror after review)
+#
+#    install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
+#    # or: ~/koopa-caddy/apply.sh  after syncing Caddyfile into ~/koopa-caddy/

-install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
 caddy validate --config /etc/caddy/Caddyfile
 systemctl reload caddy
 systemctl is-active caddy
@ -37,10 +35,23 @@ systemctl is-active caddy

 ## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)

-Place **before** the catch-all `reverse_proxy`. Canonical copy:
-`site-gen/caddy-monitoring-handles.snippet`.
+Place **before** the catch-all `reverse_proxy` (same idea as `/intro*`):

-Disk layout (path on disk matches URL under host root):
+```caddy
+    # Public taler-monitoring console HTML (static; host only)
+    handle /monitoring_err* {
+        root * /var/www/monitoring-sites/{host}
+        rewrite * /monitoring_err{uri}
+        # uri is /monitoring_err or /monitoring_err/ → serve directory index
+        file_server
+    }
+    handle /monitoring* {
+        root * /var/www/monitoring-sites/{host}
+        file_server
+    }
+```
+
+Simpler layout (recommended): path on disk matches URL under host root:

 ```text
 /var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
@ -48,50 +59,34 @@ Disk layout (path on disk matches URL under host root):
 ```

 ```caddy
-    # bare → slash (MUST use redir * /path/ — see footgun below)
-    handle /monitoring {
-        redir * /monitoring/ 302
-    }
-    handle /monitoring* {
-        root * /var/www/monitoring-sites/{host}
+    handle_path /monitoring_err/* {
+        root * /var/www/monitoring-sites/{host}/monitoring_err
        file_server
    }
    handle /monitoring_err {
-        redir * /monitoring_err/ 302
+        redir /monitoring_err/ 302
    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/{host}
+    handle_path /monitoring/* {
+        root * /var/www/monitoring-sites/{host}/monitoring
        file_server
    }
-```
-
-### Caddy redir footgun (merchant code 21)
-
-```caddy
-# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
-handle /monitoring {
+    handle /monitoring {
        redir /monitoring/ 302
-}
-
-# RIGHT
-handle /monitoring {
-    redir * /monitoring/ 302
-}
+    }
 ```

-Symptom: `https://…/monitoring` or `…/taler-monitoring-surface` returns merchant
-JSON `{"code":21,…}` while the slash form serves HTML.
+Canonical snippet is also in `caddy-monitoring-handles.snippet` and applied
+in `configs/caddy/Caddyfile` for the three GOA hosts.

 ## Check

 ```bash
 curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
-curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
-# bare: expect 302 Location: /taler-monitoring-surface/  — not JSON code 21
-curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/
+curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring_err/
+curl -sS https://bank.hacktivism.ch/monitoring_err/ | head
 ```

 ## Not needed as root

- Running `taler-monitoring` (use **optional outside runner** / laptop)
+- Running `taler-monitoring` (use **optional outside runner** (SSH alias via `FIRECUDA_SSH`) / laptop)
 - Writing into podman Taler containers
--- a/site-gen/caddy-monitoring-handles.snippet
+++ b/site-gen/caddy-monitoring-handles.snippet
@ -11,63 +11,30 @@
 #   }
 # → looks for …/monitoring/monitoring/index.html
 #
-# CRITICAL (v1.9.2): bare-path redir inside handle MUST use matcher `*`:
-#   handle /taler-monitoring-surface {
-#       redir * /taler-monitoring-surface/ 302
-#   }
-# WRONG: `redir /taler-monitoring-surface/ 302` is parsed as
-#   matcher=/taler-monitoring-surface/  to="302"  → Location: 302, merchant code 21
-# (same footgun for /monitoring, aptdeploy, mail, mattermost bare paths).
-#
 # Disk layout:
 #   /var/www/monitoring-sites/{host}/monitoring/index.html
 #   /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html
-#
-# Live apply on koopa (absolute path — ~ as root is /root):
-#   sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh

 # --- only inside taler.hacktivism.ch { ... } ---
-    handle /taler-monitoring-surface {
-        redir * /taler-monitoring-surface/ 302
-    }
    handle /taler-monitoring-surface* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
-    handle /taler-monitoring-surface_err {
-        redir * /taler-monitoring-surface_err/ 302
-    }
-    handle /taler-monitoring-surface_err* {
-        root * /var/www/monitoring-sites/taler.hacktivism.ch
-        file_server
-    }
-    handle /taler-monitoring-aptdeploy {
-        redir * /taler-monitoring-aptdeploy/ 302
-    }
    handle /taler-monitoring-aptdeploy* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }
-    handle /taler-monitoring-aptdeploy_err {
-        redir * /taler-monitoring-aptdeploy_err/ 302
+    handle /taler-monitoring-mattermost* {
+        root * /var/www/monitoring-sites/taler.hacktivism.ch
+        file_server
    }
-    handle /taler-monitoring-aptdeploy_err* {
+    handle /taler-monitoring-mail* {
        root * /var/www/monitoring-sites/taler.hacktivism.ch
        file_server
    }

 # --- bank + exchange + taler (each site block; set root host dir) ---
-    handle /monitoring {
-        redir * /monitoring/ 302
-    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }
-    handle /monitoring_err {
-        redir * /monitoring_err/ 302
-    }
-    handle /monitoring_err* {
-        root * /var/www/monitoring-sites/{host}
-        file_server
-    }
--- a/site-gen/console_to_html.py
+++ b/site-gen/console_to_html.py
@ -69,7 +69,7 @@ def ui(lang: str, key: str, **kwargs) -> str:
        "pages_summary": "Public sticky-bar reports · phase monpages · part of taler-monitoring",
        "pages_i1": "These HTML reports are generated by taler-monitoring (site-gen/console_to_html.py + host-agent)",
        "pages_i2": "Landing stacks (9): /monitoring(+_err)/ on bank/exchange/merchant fronts (GOA + FP stage + FP prod)",
-        "pages_i3": "GOA: /monitoring/ on bank+exchange+taler; surface + aptdeploy on taler.hacktivism.ch — mail/mattermost folded into surface",
+        "pages_i3": "Ecosystem page only: https://taler.hacktivism.ch/taler-monitoring-surface(+_err)/ — no separate mail/mattermost mon pages",
        "pages_i4": "Phase monpages: outside-in check (existence + top/bottom content markers; not merchant JSON code 21)",
        "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; reverse-proxy must serve /monitoring* and /taler-monitoring-surface*",
        "pages_i6": "This page host: {host} · path label: {label}",
@ -141,7 +141,7 @@ def ui(lang: str, key: str, **kwargs) -> str:
        "pages_summary": "Rapports publics sticky-bar · phase monpages · partie de taler-monitoring",
        "pages_i1": "Ces rapports HTML sont générés par taler-monitoring (site-gen/console_to_html.py + host-agent)",
        "pages_i2": "Piles landing (9) : /monitoring(+_err)/ sur bank/exchange/merchant (GOA + FP stage + FP prod)",
-        "pages_i3": "GOA : /monitoring/ bank+exchange+taler ; surface + aptdeploy sur taler.hacktivism.ch — mail/mattermost dans surface",
+        "pages_i3": "Page écosystème seule : https://taler.hacktivism.ch/taler-monitoring-surface(+_err)/ — pas de pages mail/mattermost séparées",
        "pages_i4": "Phase monpages : existence + marqueurs haut/bas (pas JSON merchant code 21)",
        "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; le reverse-proxy sert /monitoring* et /taler-monitoring-surface*",
        "pages_i6": "Hôte de cette page : {host} · libellé : {label}",
 @ -1 +1 @@
 .9.4
 .9.1