From 530385b19dafedf42a4e321fb02f87af8b19819a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sun, 19 Jul 2026 01:08:18 +0200 Subject: [PATCH 1/3] release 1.9.2: Caddy bare redir * footgun (code 21) + absolute apply path --- VERSION | 2 +- VERSIONS.md | 1 + host-agent/ROOT-APPLY-MONITORING.md | 8 +++++ site-gen/caddy-monitoring-handles.snippet | 41 ++++++++++++++++++++--- 4 files changed, 47 insertions(+), 5 deletions(-) diff --git a/VERSION b/VERSION index 9ab8337..8fdcf38 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.9.1 +1.9.2 diff --git a/VERSIONS.md b/VERSIONS.md index e2047f8..0128c61 100644 --- a/VERSIONS.md +++ b/VERSIONS.md @@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre | Tag | Date (UTC) | Notes | |-----|------------|--------| +| **v1.9.2** | 2026-07-19 | **Bugfix:** Caddy bare-path redir footgun — inside `handle` use `redir * /path/ 302` (not `redir /path/ 302`, which becomes `Location: 302` and bare URLs fall through to merchant **code 21**). Snippet + ROOT-APPLY: absolute apply path (`/home/hernani/koopa-caddy/…`, not `~` as root). | | **v1.9.1** | 2026-07-19 | **Bugfix:** stale path confusions in repo — sticky `pages_i3` no longer lists mail/mattermost/aptdeploy mon pages; lib.sh/android-test drop `scripts/taler-monitoring/`; monpages/host-agent hints match v1.8 layout; clarify GIT vs GUI vs CLI `*AUTOMATION-NOTES.md` (three files by design). | | **v1.9.0** | 2026-07-19 | **monpages content:** ERROR if page missing or markers incomplete — top (sticky-bar/status-bar/generated) + bottom (footer/`taler-mon:bottom`); mid-run (progress <100% / incomplete meta) relaxes bottom only. Surface required on normal GOA runs with meaningful body (not progress-only). HTML emits `taler-mon:top` / `taler-mon:bottom:complete|incomplete`. | | **v1.8.0** | 2026-07-19 | **Simplified public pages:** only `/taler-monitoring-surface(+_err)` on `taler.hacktivism.ch` for ecosystem software/versions; **9 landing stacks** each keep `/monitoring(+_err)`. Mail (firefly.gnunet.org + anastasis.taler-systems.com) and Mattermost folded into surface job; separate mail/mattermost mon pages + timers deprecated. **nmap** OS fingerprinting on surface (`SURFACE_NMAP`); **ERROR** when packages are behind (`TALER_PKG_BEHIND=error` default) or OS fingerprint is EOL. | diff --git a/host-agent/ROOT-APPLY-MONITORING.md b/host-agent/ROOT-APPLY-MONITORING.md index 78a161c..0103f69 100644 --- a/host-agent/ROOT-APPLY-MONITORING.md +++ b/host-agent/ROOT-APPLY-MONITORING.md @@ -22,9 +22,17 @@ API). Prepared config is only under **`/home/hernani/koopa-caddy/Caddyfile`**. ## One-shot as root (recommended) ```bash +# absolute path required: as root, ~ is /root (not /home/hernani) sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh +# or already root: +# /home/hernani/koopa-caddy/apply-monitoring-live.sh ``` +**Caddy bare-path redir (v1.9.2+):** inside a `handle` block use +`redir * /path/ 302` — never `redir /path/ 302` alone (Caddy treats the first +token as matcher and sets `Location: 302`, so bare URLs fall through to the +merchant API as JSON **code 21**). + That script: 1. `rsync` staging HTML → `/var/www/monitoring-sites/` (incl. surface + aptdeploy) diff --git a/site-gen/caddy-monitoring-handles.snippet b/site-gen/caddy-monitoring-handles.snippet index b88655b..f0b1a3a 100644 --- a/site-gen/caddy-monitoring-handles.snippet +++ b/site-gen/caddy-monitoring-handles.snippet @@ -11,30 +11,63 @@ # } # → looks for …/monitoring/monitoring/index.html # +# CRITICAL (v1.9.2): bare-path redir inside handle MUST use matcher `*`: +# handle /taler-monitoring-surface { +# redir * /taler-monitoring-surface/ 302 +# } +# WRONG: `redir /taler-monitoring-surface/ 302` is parsed as +# matcher=/taler-monitoring-surface/ to="302" → Location: 302, merchant code 21 +# (same footgun for /monitoring, aptdeploy, mail, mattermost bare paths). +# # Disk layout: # /var/www/monitoring-sites/{host}/monitoring/index.html # /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-*/index.html +# +# Live apply on koopa (absolute path — ~ as root is /root): +# sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh # --- only inside taler.hacktivism.ch { ... } --- + handle /taler-monitoring-surface { + redir * /taler-monitoring-surface/ 302 + } handle /taler-monitoring-surface* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } + handle /taler-monitoring-surface_err { + redir * /taler-monitoring-surface_err/ 302 + } + handle /taler-monitoring-surface_err* { + root * /var/www/monitoring-sites/taler.hacktivism.ch + file_server + } + handle /taler-monitoring-aptdeploy { + redir * /taler-monitoring-aptdeploy/ 302 + } handle /taler-monitoring-aptdeploy* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } - handle /taler-monitoring-mattermost* { - root * /var/www/monitoring-sites/taler.hacktivism.ch - file_server + handle /taler-monitoring-aptdeploy_err { + redir * /taler-monitoring-aptdeploy_err/ 302 } - handle /taler-monitoring-mail* { + handle /taler-monitoring-aptdeploy_err* { root * /var/www/monitoring-sites/taler.hacktivism.ch file_server } # --- bank + exchange + taler (each site block; set root host dir) --- + handle /monitoring { + redir * /monitoring/ 302 + } handle /monitoring* { root * /var/www/monitoring-sites/{host} file_server } + handle /monitoring_err { + redir * /monitoring_err/ 302 + } + handle /monitoring_err* { + root * /var/www/monitoring-sites/{host} + file_server + } From ea95fb3d8dd082e5df1098354299f4b317322bb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sun, 19 Jul 2026 01:09:52 +0200 Subject: [PATCH 2/3] release 1.9.3: monpages code 21 always ERROR; suite apply script + absolute paths --- README.md | 2 +- VERSION | 2 +- VERSIONS.md | 1 + check_monitoring_pages.sh | 20 +++---- host-agent/apply-monitoring-live.sh | 91 +++++++++++++++++++++++++++++ host-agent/run-host-report.sh | 6 +- site-gen/ROOT-ON-KOOPA.md | 91 +++++++++++++++-------------- 7 files changed, 154 insertions(+), 59 deletions(-) create mode 100755 host-agent/apply-monitoring-live.sh diff --git a/README.md b/README.md index 18e9d9a..f1fd040 100644 --- a/README.md +++ b/README.md @@ -414,7 +414,7 @@ Soft mode only with `MONPAGES_REQUIRE_PUBLIC=0` (escape hatch). ./taler-monitoring.sh -d lefrancpaysan.ch monpages ``` -If pages are missing publicly: `sudo ~/koopa-caddy/apply-monitoring-live.sh` on koopa +If pages are missing publicly: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh` on koopa (FP: Infomaniak vhost for `/monitoring*`). ## Version on monitoring pages (v1.3+ / sticky bar) diff --git a/VERSION b/VERSION index 8fdcf38..77fee73 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.9.2 +1.9.3 diff --git a/VERSIONS.md b/VERSIONS.md index 0128c61..253f9b3 100644 --- a/VERSIONS.md +++ b/VERSIONS.md @@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre | Tag | Date (UTC) | Notes | |-----|------------|--------| +| **v1.9.3** | 2026-07-19 | **Bugfix (suite):** monpages merchant **code 21** always ERROR (bare no longer soft-WARN); apply hints use absolute `/home/hernani/koopa-caddy/…`; ship `host-agent/apply-monitoring-live.sh` (smoke array, bare check); fix ROOT-ON-KOOPA wrong `redir /path/ 302` examples. | | **v1.9.2** | 2026-07-19 | **Bugfix:** Caddy bare-path redir footgun — inside `handle` use `redir * /path/ 302` (not `redir /path/ 302`, which becomes `Location: 302` and bare URLs fall through to merchant **code 21**). Snippet + ROOT-APPLY: absolute apply path (`/home/hernani/koopa-caddy/…`, not `~` as root). | | **v1.9.1** | 2026-07-19 | **Bugfix:** stale path confusions in repo — sticky `pages_i3` no longer lists mail/mattermost/aptdeploy mon pages; lib.sh/android-test drop `scripts/taler-monitoring/`; monpages/host-agent hints match v1.8 layout; clarify GIT vs GUI vs CLI `*AUTOMATION-NOTES.md` (three files by design). | | **v1.9.0** | 2026-07-19 | **monpages content:** ERROR if page missing or markers incomplete — top (sticky-bar/status-bar/generated) + bottom (footer/`taler-mon:bottom`); mid-run (progress <100% / incomplete meta) relaxes bottom only. Surface required on normal GOA runs with meaningful body (not progress-only). HTML emits `taler-mon:top` / `taler-mon:bottom:complete|incomplete`. | diff --git a/check_monitoring_pages.sh b/check_monitoring_pages.sh index 06001dd..0f7b740 100755 --- a/check_monitoring_pages.sh +++ b/check_monitoring_pages.sh @@ -380,14 +380,10 @@ check_one() { fi if grep -qE '"code"[[:space:]]*:[[:space:]]*21' "$body" 2>/dev/null \ || grep -qiE 'There is no endpoint defined for the URL' "$body" 2>/dev/null; then - if [ "$soft" = "1" ]; then - warn "public mon page bare URL" \ - "$url -> HTTP $code code 21 (prefer trailing slash; set MONPAGES_BARE_STRICT=1 to ERROR)" - rm -f "$body" - return 0 - fi + # Merchant code 21 is always ERROR (even bare): slash-only soft mode used to hide + # Caddy redir footgun (redir /path/ 302 → Location:302). Bare must 302/200 HTML. _mon_fail_or_soft "public mon page missing" \ - "$url -> HTTP $code merchant/API JSON code 21 (publish HTML + reverse-proxy handle /monitoring*)" || { rm -f "$body"; return 1; } + "$url -> HTTP $code merchant/API JSON code 21 (Caddy handle/redir; use redir * /path/ 302 inside handle; apply: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)" || { rm -f "$body"; return 1; } rm -f "$body" return 0 fi @@ -447,10 +443,11 @@ while IFS= read -r line; do URLS+=("$line") done < <(build_urls | sort -u) -# Bare URLs without trailing slash: optional soft check (default on). -# Many reverse proxies only redirect /monitoring → /monitoring/; bare may hit the app (code 21). +# Bare URLs without trailing slash: checked by default. +# Merchant JSON code 21 is always ERROR (Caddy/proxy not serving mon path). +# Other bare failures: WARN unless MONPAGES_BARE_STRICT=1 (then ERROR). # MONPAGES_CHECK_BARE=0 → skip bare entirely -# MONPAGES_BARE_STRICT=1 → bare failures are ERROR (default: WARN if slash form exists) +# MONPAGES_BARE_STRICT=1 → non-21 bare failures are ERROR too if [ "${MONPAGES_CHECK_BARE:-1}" = "1" ]; then _extra=() for u in "${URLS[@]}"; do @@ -486,7 +483,8 @@ done if [ "$ec" -ne 0 ]; then echo " hint: public monitoring HTML not served (404 / merchant code 21)" echo " publish staging HTML + configure reverse-proxy/Caddy handle for mon paths" - echo " (on koopa: sudo ~/koopa-caddy/apply-monitoring-live.sh)" + echo " (on koopa: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh)" + echo " bare code 21: Caddy redir inside handle must be: redir * /path/ 302 (not redir /path/ 302)" if [ "$_fam" = "fp" ]; then echo " FP: only FP mon hosts are checked — wire Infomaniak vhost for /monitoring*" fi diff --git a/host-agent/apply-monitoring-live.sh b/host-agent/apply-monitoring-live.sh new file mode 100755 index 0000000..c073050 --- /dev/null +++ b/host-agent/apply-monitoring-live.sh @@ -0,0 +1,91 @@ +#!/usr/bin/env bash +# ONE-SHOT as root: publish monitoring HTML + enable Caddy handles +# +# Suite copy (taler-monitoring host-agent). Live install path on koopa: +# /home/hernani/koopa-caddy/apply-monitoring-live.sh +# Prefer absolute path ( ~ expands to /root when already root ): +# sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh +# /home/hernani/koopa-caddy/apply-monitoring-live.sh # if already root +# +# After editing here: rsync to koopa ~/koopa-caddy/ before root apply. +set -euo pipefail +if [[ "$(id -u)" -ne 0 ]]; then + exec sudo -E "$0" "$@" +fi + +STAGING=/home/hernani/monitoring-sites-staging +WWW=/var/www/monitoring-sites +SRC=/home/hernani/koopa-caddy/Caddyfile +DST=/etc/caddy/Caddyfile + +if [[ ! -f "$SRC" ]]; then + echo "ERROR: missing Caddyfile source: $SRC" >&2 + exit 1 +fi +if [[ ! -d "$STAGING" ]]; then + echo "ERROR: missing staging HTML: $STAGING" >&2 + exit 1 +fi + +echo "== 1) HTML staging → www ==" +mkdir -p "$WWW" +rsync -a --delete "$STAGING/" "$WWW/" +# allow hernani to update future runs without root +chown -R hernani:caddy "$WWW" +chmod -R g+rwX "$WWW" +find "$WWW" -type d -exec chmod g+s {} \; +# ACL default if available +if command -v setfacl >/dev/null 2>&1; then + setfacl -R -m u:hernani:rwx,g:caddy:rwx "$WWW" || true + setfacl -R -d -m u:hernani:rwx,g:caddy:rwx "$WWW" || true +fi +ls -la "$WWW" "$WWW/taler.hacktivism.ch" || true + +echo "== 2) Caddyfile (backup + install) ==" +ts=$(date +%Y%m%d-%H%M%S) +cp -a "$DST" "/etc/caddy/Caddyfile.bak-monitoring-${ts}" +cp -a "$SRC" "$DST" +chown root:caddy "$DST" 2>/dev/null || chown root:root "$DST" +chmod 644 "$DST" +caddy validate --config "$DST" +systemctl reload caddy +systemctl is-active caddy + +echo "== 3) smoke ==" +# bash: every continued line except the last must end with \ +urls=( + https://taler.hacktivism.ch/monitoring/ + https://bank.hacktivism.ch/monitoring/ + https://exchange.hacktivism.ch/monitoring/ + https://taler.hacktivism.ch/taler-monitoring-surface + https://taler.hacktivism.ch/taler-monitoring-surface/ + https://taler.hacktivism.ch/taler-monitoring-surface_err/ + https://taler.hacktivism.ch/taler-monitoring-aptdeploy/ + https://taler.hacktivism.ch/taler-monitoring-aptdeploy_err/ +) +smoke_fail=0 +for url in "${urls[@]}"; do + code=$(curl -sS -o /tmp/monchk -w '%{http_code}' -L --max-redirs 3 -m 12 "$url" || echo ERR) + ct=$(file -b /tmp/monchk 2>/dev/null | head -c 40) + echo " $code $url ($ct)" + if grep -qE '"code":[[:space:]]*21' /tmp/monchk 2>/dev/null; then + echo " STILL merchant JSON code 21 — Caddy handles not active?" + smoke_fail=1 + fi +done +# bare path must redirect (or land on HTML), not merchant JSON +bare_code=$(curl -sS -o /tmp/monbare -w '%{http_code}' --max-redirs 0 -m 12 \ + https://taler.hacktivism.ch/taler-monitoring-surface || echo ERR) +if grep -qE '"code":[[:space:]]*21' /tmp/monbare 2>/dev/null; then + echo "ERROR: bare /taler-monitoring-surface still merchant code 21 (HTTP $bare_code)" >&2 + smoke_fail=1 +elif [[ "$bare_code" != "302" && "$bare_code" != "301" && "$bare_code" != "200" ]]; then + echo "WARN: bare /taler-monitoring-surface HTTP $bare_code (want 302/301/200 HTML)" >&2 +fi +echo " bare_no_follow=$bare_code https://taler.hacktivism.ch/taler-monitoring-surface" + +if [[ "$smoke_fail" -ne 0 ]]; then + echo "ERROR: smoke failed" >&2 + exit 1 +fi +echo "OK apply-monitoring-live done" diff --git a/host-agent/run-host-report.sh b/host-agent/run-host-report.sh index f5ea6ce..5fa79e6 100755 --- a/host-agent/run-host-report.sh +++ b/host-agent/run-host-report.sh @@ -401,11 +401,11 @@ if [ -n "$DEPLOY_WWW" ]; then elif [ -e "$DEPLOY_WWW" ]; then echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW exists but is not writable by $(id -un)" >&2 echo " public FQDN pages will stay missing/stale — fix ownership or run:" >&2 - echo " sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2 + echo " sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2 ec=1 else echo "ERROR: DEPLOY_WWW_ROOT=$DEPLOY_WWW missing — public pages not published" >&2 - echo " create tree + Caddy handles: sudo ~/koopa-caddy/apply-monitoring-live.sh" >&2 + echo " create tree + Caddy handles: sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh" >&2 ec=1 fi else @@ -437,7 +437,7 @@ if [ "$_monpages_failed" = "1" ]; then { echo "" echo "ERROR monpages: public FQDN monitoring HTML missing or merchant JSON code 21" - echo "ERROR monpages: fix with sudo ~/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)" + echo "ERROR monpages: fix with sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh (www + Caddy handles)" } >>"$LOG" for host in $MON_HOSTS; do htmlify_host "$host" diff --git a/site-gen/ROOT-ON-KOOPA.md b/site-gen/ROOT-ON-KOOPA.md index 607d369..8a862d1 100644 --- a/site-gen/ROOT-ON-KOOPA.md +++ b/site-gen/ROOT-ON-KOOPA.md @@ -3,31 +3,33 @@ Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is **not** put into Taler containers — only host paths + Caddy `handle`. -After `generate-monitoring-sites.sh` + `deploy-monitoring-sites.sh` (as hernani), -files live in: +After host-agent / `generate-monitoring-sites.sh` + deploy (as hernani), files live in: ```text /home/hernani/monitoring-sites-staging//monitoring/index.html /home/hernani/monitoring-sites-staging//monitoring_err/index.html ``` -## One-shot as root (copy + Caddy) +## One-shot as root (preferred) ```bash -# on koopa (koopa-external), as root: +# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…) +sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh +# same script is versioned in the suite: +# host-agent/apply-monitoring-live.sh → install/sync to /home/hernani/koopa-caddy/ +``` -# 1) web root -install -d -o caddy -g caddy -m 755 /var/www/monitoring-sites +That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared +Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface). + +## Manual equivalent + +```bash +install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/ -chown -R caddy:caddy /var/www/monitoring-sites - -# 2) Caddyfile — from ~/koopa-caddy (host ops), then: -# (either edit /etc/caddy/Caddyfile by hand using snippet below, -# or copy full mirror after review) -# -# install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile -# # or: ~/koopa-caddy/apply.sh after syncing Caddyfile into ~/koopa-caddy/ +chown -R hernani:caddy /var/www/monitoring-sites +install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile caddy validate --config /etc/caddy/Caddyfile systemctl reload caddy systemctl is-active caddy @@ -35,23 +37,10 @@ systemctl is-active caddy ## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block) -Place **before** the catch-all `reverse_proxy` (same idea as `/intro*`): +Place **before** the catch-all `reverse_proxy`. Canonical copy: +`site-gen/caddy-monitoring-handles.snippet`. -```caddy - # Public taler-monitoring console HTML (static; host only) - handle /monitoring_err* { - root * /var/www/monitoring-sites/{host} - rewrite * /monitoring_err{uri} - # uri is /monitoring_err or /monitoring_err/ → serve directory index - file_server - } - handle /monitoring* { - root * /var/www/monitoring-sites/{host} - file_server - } -``` - -Simpler layout (recommended): path on disk matches URL under host root: +Disk layout (path on disk matches URL under host root): ```text /var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html @@ -59,34 +48,50 @@ Simpler layout (recommended): path on disk matches URL under host root: ``` ```caddy - handle_path /monitoring_err/* { - root * /var/www/monitoring-sites/{host}/monitoring_err + # bare → slash (MUST use redir * /path/ — see footgun below) + handle /monitoring { + redir * /monitoring/ 302 + } + handle /monitoring* { + root * /var/www/monitoring-sites/{host} file_server } handle /monitoring_err { - redir /monitoring_err/ 302 + redir * /monitoring_err/ 302 } - handle_path /monitoring/* { - root * /var/www/monitoring-sites/{host}/monitoring + handle /monitoring_err* { + root * /var/www/monitoring-sites/{host} file_server } - handle /monitoring { - redir /monitoring/ 302 - } ``` -Canonical snippet is also in `caddy-monitoring-handles.snippet` and applied -in `configs/caddy/Caddyfile` for the three GOA hosts. +### Caddy redir footgun (merchant code 21) + +```caddy +# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302 +handle /monitoring { + redir /monitoring/ 302 +} + +# RIGHT +handle /monitoring { + redir * /monitoring/ 302 +} +``` + +Symptom: `https://…/monitoring` or `…/taler-monitoring-surface` returns merchant +JSON `{"code":21,…}` while the slash form serves HTML. ## Check ```bash curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/ -curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring_err/ -curl -sS https://bank.hacktivism.ch/monitoring_err/ | head +curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15 +# bare: expect 302 Location: /taler-monitoring-surface/ — not JSON code 21 +curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/ ``` ## Not needed as root -- Running `taler-monitoring` (use **optional outside runner** (SSH alias via `FIRECUDA_SSH`) / laptop) +- Running `taler-monitoring` (use **optional outside runner** / laptop) - Writing into podman Taler containers From 229ef9383e2d948809519d99307ef6e5be2868b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Sun, 19 Jul 2026 01:16:07 +0200 Subject: [PATCH 3/3] release 1.9.4: restore aptdeploy mon pages in GOA inventory --- VERSION | 2 +- VERSIONS.md | 1 + check_monitoring_pages.sh | 26 +++++++++++++++----------- host-agent/run-surface-monitoring.sh | 6 ++++-- site-gen/console_to_html.py | 4 ++-- 5 files changed, 23 insertions(+), 16 deletions(-) diff --git a/VERSION b/VERSION index 77fee73..d615fd0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.9.3 +1.9.4 diff --git a/VERSIONS.md b/VERSIONS.md index 253f9b3..4a9b77a 100644 --- a/VERSIONS.md +++ b/VERSIONS.md @@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre | Tag | Date (UTC) | Notes | |-----|------------|--------| +| **v1.9.4** | 2026-07-19 | **Fix:** restore **taler-monitoring-aptdeploy(+_err)** as first-class GOA mon page (catalog + monpages path allow + surface docs). Mail/mattermost stay folded into surface. | | **v1.9.3** | 2026-07-19 | **Bugfix (suite):** monpages merchant **code 21** always ERROR (bare no longer soft-WARN); apply hints use absolute `/home/hernani/koopa-caddy/…`; ship `host-agent/apply-monitoring-live.sh` (smoke array, bare check); fix ROOT-ON-KOOPA wrong `redir /path/ 302` examples. | | **v1.9.2** | 2026-07-19 | **Bugfix:** Caddy bare-path redir footgun — inside `handle` use `redir * /path/ 302` (not `redir /path/ 302`, which becomes `Location: 302` and bare URLs fall through to merchant **code 21**). Snippet + ROOT-APPLY: absolute apply path (`/home/hernani/koopa-caddy/…`, not `~` as root). | | **v1.9.1** | 2026-07-19 | **Bugfix:** stale path confusions in repo — sticky `pages_i3` no longer lists mail/mattermost/aptdeploy mon pages; lib.sh/android-test drop `scripts/taler-monitoring/`; monpages/host-agent hints match v1.8 layout; clarify GIT vs GUI vs CLI `*AUTOMATION-NOTES.md` (three files by design). | diff --git a/check_monitoring_pages.sh b/check_monitoring_pages.sh index 0f7b740..35b7314 100755 --- a/check_monitoring_pages.sh +++ b/check_monitoring_pages.sh @@ -99,16 +99,17 @@ _host_allowed() { esac } -# Public page layout (v1.8.0+ simplified): +# Public page layout (v1.9.4+): # • 9 landing stacks → /monitoring/ (+ /monitoring_err/ when present) -# • ecosystem software/versions inventory → only -# https://taler.hacktivism.ch/taler-monitoring-surface/ -# https://taler.hacktivism.ch/taler-monitoring-surface_err/ -# Legacy /taler-monitoring-{mail,mattermost,aptdeploy}* are NOT first-class pages. +# • ecosystem software/versions → taler.hacktivism.ch/taler-monitoring-surface(+_err)/ +# • apt-src deploy tests → taler.hacktivism.ch/taler-monitoring-aptdeploy(+_err)/ +# Legacy /taler-monitoring-{mail,mattermost}* stay folded into surface (no first-class pages). _path_allowed() { case "$1" in - monitoring|monitoring_err|taler-monitoring-surface|taler-monitoring-surface_err) return 0 ;; + monitoring|monitoring_err|\ + taler-monitoring-surface|taler-monitoring-surface_err|\ + taler-monitoring-aptdeploy|taler-monitoring-aptdeploy_err) return 0 ;; *) return 1 ;; esac } @@ -147,8 +148,9 @@ _catalog_urls() { for h in bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch; do printf 'https://%s/monitoring/\n' "$h" done - # ecosystem surface only (versions / software found in Taler universe) + # ecosystem surface (versions / software) + apt-src deploy mon page printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n' + printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n' ;; fp) for h in $MON_HOSTS; do @@ -158,12 +160,13 @@ _catalog_urls() { done ;; all|nine) - # optional: all nine landings + surface + # optional: all nine landings + surface + aptdeploy while IFS= read -r h; do [ -n "$h" ] || continue printf 'https://%s/monitoring/\n' "$h" done < <(_landing_nine) printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n' + printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n' ;; esac } @@ -192,15 +195,16 @@ build_urls() { case "$inv" in job) _job_urls - # v1.9.0: normal GOA runs always require surface page (content-checked) + # GOA: always require surface + aptdeploy pages (content-checked) if [ "$fam" = "goa" ]; then printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n' + printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n' fi ;; full|auto|*) # Always include this job’s paths (host-agent post-check). _job_urls - # Stack inventory: GOA = landings + surface; FP = only FP mon hosts. + # Stack inventory: GOA = landings + surface + aptdeploy; FP = only FP mon hosts. if [ "$fam" = "goa" ] || [ "$fam" = "fp" ]; then _catalog_urls "$fam" # On-disk discovery (err pages only exist after failed runs; extras welcome) @@ -489,7 +493,7 @@ if [ "$ec" -ne 0 ]; then echo " FP: only FP mon hosts are checked — wire Infomaniak vhost for /monitoring*" fi if [ "$_fam" = "goa" ]; then - echo " GOA: bank/exchange/taler /monitoring/ + taler-monitoring-surface (v1.8+ layout)" + echo " GOA: bank/exchange/taler /monitoring/ + surface + aptdeploy (v1.9.4+ layout)" fi # Staging vs public diagnosis (host-agent sets MONPAGES_STAGING_BASE / HTML_OUT) _stg="${MONPAGES_STAGING_BASE:-${HTML_OUT:-${HTML_BASE:-$HOME/monitoring-sites-staging}}}" diff --git a/host-agent/run-surface-monitoring.sh b/host-agent/run-surface-monitoring.sh index f760565..04fbc02 100755 --- a/host-agent/run-surface-monitoring.sh +++ b/host-agent/run-surface-monitoring.sh @@ -5,9 +5,11 @@ # https://taler.hacktivism.ch/taler-monitoring-surface/ # https://taler.hacktivism.ch/taler-monitoring-surface_err/ # -# This single page covers remote ecosystem inventory: host/port probes, nmap OS +# This page covers remote ecosystem inventory: host/port probes, nmap OS # fingerprint, Mattermost, mail (firefly + anastasis), package/version signals. -# There are NO separate public pages for mail / mattermost / aptdeploy. +# There are NO separate public pages for mail / mattermost (folded here). +# Apt-src deploy tests keep their own page + timer: +# run-aptdeploy-monitoring.sh → /taler-monitoring-aptdeploy(+_err)/ # # Landing-stack reports stay on each of the 9 fronts as /monitoring(/_err). # diff --git a/site-gen/console_to_html.py b/site-gen/console_to_html.py index 867f17f..f708d31 100755 --- a/site-gen/console_to_html.py +++ b/site-gen/console_to_html.py @@ -69,7 +69,7 @@ def ui(lang: str, key: str, **kwargs) -> str: "pages_summary": "Public sticky-bar reports · phase monpages · part of taler-monitoring", "pages_i1": "These HTML reports are generated by taler-monitoring (site-gen/console_to_html.py + host-agent)", "pages_i2": "Landing stacks (9): /monitoring(+_err)/ on bank/exchange/merchant fronts (GOA + FP stage + FP prod)", - "pages_i3": "Ecosystem page only: https://taler.hacktivism.ch/taler-monitoring-surface(+_err)/ — no separate mail/mattermost mon pages", + "pages_i3": "GOA: /monitoring/ on bank+exchange+taler; surface + aptdeploy on taler.hacktivism.ch — mail/mattermost folded into surface", "pages_i4": "Phase monpages: outside-in check (existence + top/bottom content markers; not merchant JSON code 21)", "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; reverse-proxy must serve /monitoring* and /taler-monitoring-surface*", "pages_i6": "This page host: {host} · path label: {label}", @@ -141,7 +141,7 @@ def ui(lang: str, key: str, **kwargs) -> str: "pages_summary": "Rapports publics sticky-bar · phase monpages · partie de taler-monitoring", "pages_i1": "Ces rapports HTML sont générés par taler-monitoring (site-gen/console_to_html.py + host-agent)", "pages_i2": "Piles landing (9) : /monitoring(+_err)/ sur bank/exchange/merchant (GOA + FP stage + FP prod)", - "pages_i3": "Page écosystème seule : https://taler.hacktivism.ch/taler-monitoring-surface(+_err)/ — pas de pages mail/mattermost séparées", + "pages_i3": "GOA : /monitoring/ bank+exchange+taler ; surface + aptdeploy sur taler.hacktivism.ch — mail/mattermost dans surface", "pages_i4": "Phase monpages : existence + marqueurs haut/bas (pas JSON merchant code 21)", "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; le reverse-proxy sert /monitoring* et /taler-monitoring-surface*", "pages_i6": "Hôte de cette page : {host} · libellé : {label}",