# taler-monitoring — host package dependencies

## koopa (openSUSE Tumbleweed, user `hernani`)

### Required (host-agent / GOA primary: `urls inside versions`)

| Binary | Package (zypper) | Role |
|--------|------------------|------|
| `bash` | (base) | runner |
| `curl` | `curl` | HTTPS/API probes + **monpages** FQDN checks |
| `nmap` | `nmap` | **surface** OS/service fingerprint (`SURFACE_NMAP=1`, v1.8.0+; OS detect may need root) |
| `python3` | `python313-base` (provides `/usr/bin/python3`) | JSON, HTML site-gen, metrics |
| `podman` | `podman` | **inside**: `podman exec` into taler-hacktivism* |
| `git` | `git` | pin commit SHA in monitoring HTML footer |
| `rsync` | `rsync` | optional: deploy/sync suite |
| `timeout` / `mktemp` / `getent` | coreutils / glibc | helpers |

**Status on koopa (2026-07-18):** all of the above present; rootless podman owns GOA containers.

### Recommended (full `urls` QR group)

| Binary | Package | Role |
|--------|---------|------|
| `qrencode` | **`qrencode`** | encode taler:// / payto:// → PNG |
| `zbarimg` | **`zbar`** | decode PNG; exact payload match |

Without these, QR checks **WARN** and skip encode/decode (`apt install` messages in code are Debian-oriented; on Tumbleweed use zypper).

```bash
# as root on koopa
zypper refresh
zypper in qrencode zbar
# verify as hernani:
command -v qrencode zbarimg
```

### Optional (not needed for host-agent default)

| Binary / tool | When |
|---------------|------|
| `jq` | nice-to-have; suite uses python3 for JSON |
| `dig` / `bind-utils` | debug DNS; not required for default phases |
| `ssh` | only for access mode **ssh** (laptop → `KOOPA_SSH` / stage `INSIDE_SSH`); not needed for **host-podman** |
| `node` + `taler-wallet-cli` (.mjs) | **e2e** / ladder only (+ secrets) |
| **`taler-helper-sqlite3` on PATH** | **required for e2e** — wallet-core spawns it for withdraw accept-uri / pay; missing → ENOENT mid-ladder. Put next to wallet bindir (`~/.local/bin` on stagepaysan) |
| `timeout` (coreutils) | preferred hard wall for `wcli` (suite falls back to perl only if missing) |
| `secrets.env` / admin passwords | e2e only — never system packages |

**Preflight (agents / ops):** before trusting e2e on a host, smoke on the **same PATH** mon uses (`run-host-report` / systemd user): `command -v node taler-helper-sqlite3`, `node "$WALLET_CLI" --version`, short temp-DB `balance`. Do not wait for a full mon run to discover ENOENT.

### systemd user (no extra packages)

- `systemd` user session + **`loginctl enable-linger hernani`** (already **Linger=yes** on koopa)
- Units: `host-agent/*.service|path|timer`

### Caddy HTML publish (separate from monitoring run)

- Host Caddy already installed (root service).
- Writing `/var/www/monitoring-sites`: either root `rsync` or directory owned/writable by `hernani` (you set this up).

---

## outside-runner (macOS, outside-only timer)

| Need | Notes |
|------|--------|
| `bash`, `curl`, `python3`, `rsync`, `git` (optional) | usually Homebrew / Xcode CLT |
| **No** `podman` | phases are `urls versions` only (`SKIP_SSH=1`) |
| `qrencode` / `zbarimg` | optional for QR; `brew install qrencode zbar` if desired |

---

## Franc Paysan stage host (stagepaysan)

FP stage (`stagepaysan` via SSH alias `francpaysan-stage-user`): curl, python3, podman if inside, qrencode/zbar for full urls; suite at `~/src/taler-monitoring`.

**e2e on stagepaysan** also needs user-local:

| Path | Role |
|------|------|
| `~/.local/bin/node` | Node for wallet-cli |
| `~/.local/bin/taler-wallet-cli.mjs` (or `WALLET_CLI=`) | wallet CLI |
| `~/.local/bin/taler-helper-sqlite3` | **required** — accept-uri / coins |
| `~/francpaysan-secrets/stage/*` | bank admin + merchant token (layout like laptop `francpaysan-secrets`) |

Host-agent PATH already puts `$HOME/.local/bin` first; still smoke-test under that PATH.