Root on koopa (hacktivism monitoring sites)

Host Caddy runs as root/systemd (caddy user). Static monitoring HTML is not put into Taler containers — only host paths + Caddy handle.

After host-agent / generate-monitoring-sites.sh + deploy (as hernani), files live in:

/home/hernani/monitoring-sites-staging/<hostname>/monitoring/index.html
/home/hernani/monitoring-sites-staging/<hostname>/monitoring_err/index.html

One-shot as root (preferred)

# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh
# same script is versioned in the suite:
#   host-agent/apply-monitoring-live.sh  → install/sync to /home/hernani/koopa-caddy/

That rsyncs staging → /var/www/monitoring-sites, installs the prepared Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).

Manual equivalent

install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
rsync -a --delete /home/hernani/monitoring-sites-staging/ /var/www/monitoring-sites/
chown -R hernani:caddy /var/www/monitoring-sites

install -m 644 /home/hernani/koopa-caddy/Caddyfile /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
systemctl is-active caddy

Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)

Place before the catch-all reverse_proxy. Canonical copy: site-gen/caddy-monitoring-handles.snippet.

Disk layout (path on disk matches URL under host root):

/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html

    # bare → slash (MUST use redir * /path/ — see footgun below)
    handle /monitoring {
        redir * /monitoring/ 302
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }
    handle /monitoring_err {
        redir * /monitoring_err/ 302
    }
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }

Caddy redir footgun (merchant code 21)

# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
handle /monitoring {
    redir /monitoring/ 302
}

# RIGHT
handle /monitoring {
    redir * /monitoring/ 302
}

Symptom: https://…/monitoring or …/taler-monitoring-surface returns merchant JSON {"code":21,…} while the slash form serves HTML.

Check

curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
# bare: expect 302 Location: /taler-monitoring-surface/  — not JSON code 21
curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/

Not needed as root

Running taler-monitoring (use optional outside runner / laptop)
Writing into podman Taler containers

2.9 KiB Raw Blame History