# Root on koopa (hacktivism monitoring sites)

Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
**not** put into Taler containers — only host paths + Caddy `handle`.

After `generate-monitoring-sites.sh` + `deploy-monitoring-sites.sh` (as hernani),
files live in:

```text
/home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
/home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html
```

## One-shot as root (copy + Caddy)

```bash
# on koopa (koopa-external), as root:

# 1) web root
install -d -o caddy -g caddy -m 755 /var/www/monitoring-sites
rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
chown -R caddy:caddy /var/www/monitoring-sites

# 2) Caddyfile — merge handles from admin-log mirror, then:
#    (either edit /etc/caddy/Caddyfile by hand using snippet below,
#     or copy full mirror after review)
#
#    install -m 644 /home/hernani/koopa-admin-log/configs/caddy/Caddyfile /etc/caddy/Caddyfile
#    # or: ~/koopa-caddy/apply.sh  after syncing Caddyfile into ~/koopa-caddy/

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
systemctl is-active caddy
```

## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)

Place **before** the catch-all `reverse_proxy` (same idea as `/intro*`):

```caddy
    # Public taler-monitoring console HTML (static; host only)
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/{host}
        rewrite * /monitoring_err{uri}
        # uri is /monitoring_err or /monitoring_err/ → serve directory index
        file_server
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }
```

Simpler layout (recommended): path on disk matches URL under host root:

```text
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html
```

```caddy
    handle_path /monitoring_err/* {
        root * /var/www/monitoring-sites/{host}/monitoring_err
        file_server
    }
    handle /monitoring_err {
        redir /monitoring_err/ 302
    }
    handle_path /monitoring/* {
        root * /var/www/monitoring-sites/{host}/monitoring
        file_server
    }
    handle /monitoring {
        redir /monitoring/ 302
    }
```

Canonical snippet is also in `caddy-monitoring-handles.snippet` and applied
in `configs/caddy/Caddyfile` for the three GOA hosts.

## Check

```bash
curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring_err/
curl -sS https://bank.hacktivism.ch/monitoring_err/ | head
```

## Not needed as root

- Running `taler-monitoring` (use **firecuda-external** / laptop)
- Writing into podman Taler containers