# site-gen — HTML converter + Caddy notes

**Product:** **LLM** = **Lightweight Monitoring** (Taler-stack watcher). CLI/tree still `taler-monitoring` / `taler-monitord`.

**Required for host-agent:** `console_to_html.py` (log → sticky HTML).

| File | Role |
|------|------|
| `console_to_html.py` | Convert suite console log → public mon HTML |
| `stack_status_lib.py` | Domain-stack traffic lights + aggregation |
| `taler-monitord` | Daemon: probe stacks → `stack-status.json` (UI detached) |
| `stack_status_html.py` | Render status cards from JSON only |
| `caddy-monitoring-handles.snippet` | Caddy `handle` / bare redir notes |
| `ROOT-ON-KOOPA.md` | Publish staging → `/var/www` (paths from env) |
| `settings.conf.example` | Optional settings for **legacy** multi-host generator |

## Stack status (taler-monitord)

Like `llm-controld`: the daemon collects; the page only reads JSON.

```bash
./site-gen/taler-monitord --once
./site-gen/stack_status_html.py --out /tmp/taler-stack-status.html
# optional: ./site-gen/taler-monitord --interval 20
# local GOA (hacktivism.ch / taler.hacktivism.ch) is included by default;
# skip with --no-include-local or TALER_MONITORD_INCLUDE_LOCAL=0
```

Lights: green ok · blue present · yellow soft · orange hard/recent · red acute · black long · white gone.  
Box colour = weakest member; **muted** if partial; **full** if all members red/black.

**Total score** (header): `N/M green` across stack+service+mail cards. Ratio thresholds (env override):  
1.0 green · ≥0.85 blue · ≥0.60 yellow · ≥0.35 orange · ≥0.01 red · 0 white (gone) / all-black → black.

Stacks with currency `-` in `domains.conf` are **`static_pending`** (e.g. lefrancpaysan.ch: static site, no Taler prod yet). monitord probes the apex as `site` and treats missing bank/exchange/merchant as **blue `no_prod_yet`**, not orange/red. Stage TESTPAYSAN remains a normal Taler stack.

**Bank backend:** exchange `/keys` `payto://` methods decide whether `bank.*` is expected.  
`payto://x-taler-bank/…` → probe bank (libeufin).  
`payto://iban/…` only (EBICS / TOPS CHF) → bank member **blue**, host **`IBAN`**, reason `ebics_iban` (not red).  
Mixed (e.g. regio) still probes bank. Override in `domains.conf`: bank column `-` / `ebics` / `none`.

**Network / SSH:** each stack gets a coarse **zone** (GOA/local, FP stage, TOPS, pixel, firefly, public demo).  
SSH = **TCP:22 banner** (service present), not Magikoopa jump login.  
Zone-mapped SSH targets come **only** from `~/.config/taler-monitoring/env` (`TALER_MONITORD_SSH_TOPS` / `_FP` / `_GOA` / `_TOPS_PROD` via **taler-monitoring-env**); hostnames are **hidden** in the UI when set. Without env, probes use public stack FQDNs. Disable: `TALER_MONITORD_SSH=0`.

**Outside CVEs:** `Server` headers (nginx/apache/caddy + version) → OSV.  
**CRITICAL → red**, **HIGH → orange**. UI: CVE tags **link to osv.dev**; card click opens detail (severity / version / summary). Logos for nginx/apache/caddy. Disable: `TALER_MONITORD_CVE=0`.

**Why Degraded:** each card shows a one-line aggregation (`4× OK, 3× Soft → Degraded`); click opens a dialog with per-member reasons.

**Company / services:** `services-catalog.conf` (ERPnext, MantisBT, company apexes, …). Disable: `TALER_MONITORD_SERVICES=0`.

**Mail:** `mail-catalog.conf` → MX / SPF / DMARC / A+AAAA / rDNS + SMTP/IMAP TCP ports (587 soft).  
**Deliverability** (regular, not every cycle): SMTP `MAIL FROM`/`RCPT TO` smoke to `postmaster@domain` (no DATA).  
Cached under monitord state (`mail-deliverability.json`); default interval **6h**, stale after **30h** → yellow.  
Send/server failures → orange/red (degraded). Env: `TALER_MONITORD_DELIVER=0`, `_INTERVAL_S`, `_STALE_S`, `_FROM`, `_RCPT`.  
Disable plane: `TALER_MONITORD_MAIL=0`; ports only: `TALER_MONITORD_MAIL_PORTS=0`.

**TLS certs + orphans:** cert days-left + SANs. Orphans = **DNS-missing** SANs not covered by monitored hosts; wildcards/siblings skipped.  
HTTP orphans opt-in: `TALER_MONITORD_ORPHAN_HTTP=1`. Disable: `TALER_MONITORD_CERT=0` / `TALER_MONITORD_ORPHAN=0`.

**Port scan (outside-in only):** TCP connect to notable ports on publicly named hosts. No internal firewall maps required.  
Baseline allows 80/443 (+ mail ports on mail-catalog hosts). Anything else open → **suspicious** until listed in `ports-whitelist.conf`.  
Many odd open ports ⇒ worth investigating. Whitelist only silences *known intentional public* opens (e.g. hacktivism **8080** Tor OR, **9200** git-SSH) so they do not turn cards orange.  
Only **hard** findings (DB/RDP/SMB/…) raise card colour; soft stays informational. Disable: `TALER_MONITORD_PORTSCAN=0`.

**Software versions:** per card from Taler `/config` (`build_version`), `Server:` (nginx/apache/caddy), SMTP banner (Postfix).  
Compared to **published** packages on `deb.taler.net` (`TALER_MONITORD_APT_SUITE`, default trixie): current / behind / ahead; chips show `installed → published` when behind.  
**Apps / SPAs:** page section with published WebUI + wallet-cli (+ GNU FTP wallet tarball when listed). Disable: `TALER_MONITORD_PUBLISHED=0`.

**Publish:** Cyon **`hacktivism`**. Defaults (both):  
`…/public_html/stacks/index.html` → **https://hacktivism.ch/stacks/**  
`…/public_html/monitoring.hacktivism.ch/index.html` (addon when DNS ready)  
Override: `TALER_MONITORD_PUBLISH_PATH` or `TALER_MONITORD_PUBLISH_PATHS=a,b`. Off: `TALER_MONITORD_PUBLISH=0`.

**Result index (optional):** bottom of the stacks page lists every probe grouped by traffic-light colour.  
`TALER_MONITORD_RESULT_INDEX=1` (or `colors`) · with concrete command: `=cmd` / `full`, or `=1` plus `TALER_MONITORD_RESULT_INDEX_CMD=1`. Off by default (`=0`).

**Git soft probe:** Git-labelled services run infrequent `git ls-remote` over HTTPS + SSH (cached ~6h). Soft yellow on fail. Disable: `TALER_MONITORD_GIT=0`.

**VeciGate:** `services-catalog.conf` zone `vecigate` (WAN IP) + intentional DNAT ports in `ports-whitelist.conf` (incl. tortuna companion).

**Payability:** `TALER_MONITORD_PAY=1` shows CHF:0 / zero-pay status on matching stacks. Live wallet run only with `TALER_MONITORD_PAY_RUN=1` (interval `TALER_MONITORD_PAY_INTERVAL_S`, default 4h). Domains: `TALER_MONITORD_PAY_DOMAINS`.

**Ansible smoke (opt-in phase):** `./taler-monitoring.sh ansible-smoke` → `check_ansible_smoke.sh` against `TALER_DEPLOYMENT` (`regional-currency-ng/site.yml`). Podman tracks: `ANSIBLE_SMOKE_PODMAN=1` on koopa (else reuse `aptdeploy`).

**Local VCS mirror:** `~/git/www-hacktivism-wiki` rsyncs Cyon → git every **4h**  
(`ch.hacktivism.www-wiki-sync`). Tracks `stacks/` (+ optional addon). No push by default.

**Custom /intro:** only **GOA** (hacktivism) and **FrancPaysan / TESTPAYSAN stage**.  
**Landing stats:** on intro stacks, `…/intro/stats.json` → compact tag.  
**Currency / coins:** from exchange `/config` `currency_specification`.  
**Endpoints:** suite-like paths; soft ≤ yellow. **`/terms` + `/privacy`:** medium → orange **only TOPS prod**.

## Optional / moved

Legacy multi-host generate/deploy and firecuda launchd tooling live under
**`../meta/`** (see `meta/README.md`).

```bash
# normal publish is host-agent on the mon host, not these scripts
../host-agent/run-hacktivism-monitoring.sh   # etc.
```