7.1 KiB
site-gen — HTML converter + Caddy notes
Product: LLM = Lightweight Monitoring (Taler-stack watcher). CLI/tree still taler-monitoring / taler-monitord.
Required for host-agent: console_to_html.py (log → sticky HTML).
| File | Role |
|---|---|
console_to_html.py |
Convert suite console log → public mon HTML |
stack_status_lib.py |
Domain-stack traffic lights + aggregation |
taler-monitord |
Daemon: probe stacks → stack-status.json (UI detached) |
stack_status_html.py |
Render status cards from JSON only |
caddy-monitoring-handles.snippet |
Caddy handle / bare redir notes |
ROOT-ON-KOOPA.md |
Publish staging → /var/www (paths from env) |
settings.conf.example |
Optional settings for legacy multi-host generator |
Stack status (taler-monitord)
Like llm-controld: the daemon collects; the page only reads JSON.
./site-gen/taler-monitord --once
./site-gen/stack_status_html.py --out /tmp/taler-stack-status.html
# optional: ./site-gen/taler-monitord --interval 20
# local GOA (hacktivism.ch / taler.hacktivism.ch) is included by default;
# skip with --no-include-local or TALER_MONITORD_INCLUDE_LOCAL=0
Lights: green ok · blue present · yellow soft · orange hard/recent · red acute · black long · white gone.
Box colour = weakest member; muted if partial; full if all members red/black.
Total score (header): N/M green across stack+service+mail cards. Ratio thresholds (env override):
1.0 green · ≥0.85 blue · ≥0.60 yellow · ≥0.35 orange · ≥0.01 red · 0 white (gone) / all-black → black.
Stacks with currency - in domains.conf are static_pending (e.g. lefrancpaysan.ch: static site, no Taler prod yet). monitord probes the apex as site and treats missing bank/exchange/merchant as blue no_prod_yet, not orange/red. Stage TESTPAYSAN remains a normal Taler stack.
Bank backend: exchange /keys payto:// methods decide whether bank.* is expected.
payto://x-taler-bank/… → probe bank (libeufin).
payto://iban/… only (EBICS / TOPS CHF) → bank member blue, host IBAN, reason ebics_iban (not red).
Mixed (e.g. regio) still probes bank. Override in domains.conf: bank column - / ebics / none.
Network / SSH: each stack gets a coarse zone (GOA/local, FP stage, TOPS, pixel, firefly, public demo).
SSH = TCP:22 banner (service present), not Magikoopa jump login.
Zone-mapped SSH targets come only from ~/.config/taler-monitoring/env (TALER_MONITORD_SSH_TOPS / _FP / _GOA / _TOPS_PROD via taler-monitoring-env); hostnames are hidden in the UI when set. Without env, probes use public stack FQDNs. Disable: TALER_MONITORD_SSH=0.
Outside CVEs: Server headers (nginx/apache/caddy + version) → OSV.
CRITICAL → red, HIGH → orange. UI: CVE tags link to osv.dev; card click opens detail (severity / version / summary). Logos for nginx/apache/caddy. Disable: TALER_MONITORD_CVE=0.
Why Degraded: each card shows a one-line aggregation (4× OK, 3× Soft → Degraded); click opens a dialog with per-member reasons.
Company / services: services-catalog.conf (ERPnext, MantisBT, company apexes, …). Disable: TALER_MONITORD_SERVICES=0.
Mail: mail-catalog.conf → MX / SPF / DMARC / A+AAAA / rDNS + SMTP/IMAP TCP ports (587 soft).
Deliverability (regular, not every cycle): SMTP MAIL FROM/RCPT TO smoke to postmaster@domain (no DATA).
Cached under monitord state (mail-deliverability.json); default interval 6h, stale after 30h → yellow.
Send/server failures → orange/red (degraded). Env: TALER_MONITORD_DELIVER=0, _INTERVAL_S, _STALE_S, _FROM, _RCPT.
Disable plane: TALER_MONITORD_MAIL=0; ports only: TALER_MONITORD_MAIL_PORTS=0.
TLS certs + orphans: cert days-left + SANs. Orphans = DNS-missing SANs not covered by monitored hosts; wildcards/siblings skipped.
HTTP orphans opt-in: TALER_MONITORD_ORPHAN_HTTP=1. Disable: TALER_MONITORD_CERT=0 / TALER_MONITORD_ORPHAN=0.
Port scan (outside-in only): TCP connect to notable ports on publicly named hosts. No internal firewall maps required.
Baseline allows 80/443 (+ mail ports on mail-catalog hosts). Anything else open → suspicious until listed in ports-whitelist.conf.
Many odd open ports ⇒ worth investigating. Whitelist only silences known intentional public opens (e.g. hacktivism 8080 Tor OR, 9200 git-SSH) so they do not turn cards orange.
Only hard findings (DB/RDP/SMB/…) raise card colour; soft stays informational. Disable: TALER_MONITORD_PORTSCAN=0.
Software versions: per card from Taler /config (build_version), Server: (nginx/apache/caddy), SMTP banner (Postfix).
Compared to published packages on deb.taler.net (TALER_MONITORD_APT_SUITE, default trixie): current / behind / ahead; chips show installed → published when behind.
Apps / SPAs: page section with published WebUI + wallet-cli (+ GNU FTP wallet tarball when listed). Disable: TALER_MONITORD_PUBLISHED=0.
Publish: Cyon hacktivism. Defaults (both):
…/public_html/stacks/index.html → https://hacktivism.ch/stacks/
…/public_html/monitoring.hacktivism.ch/index.html (addon when DNS ready)
Override: TALER_MONITORD_PUBLISH_PATH or TALER_MONITORD_PUBLISH_PATHS=a,b. Off: TALER_MONITORD_PUBLISH=0.
Result index (optional): bottom of the stacks page lists every probe grouped by traffic-light colour.
TALER_MONITORD_RESULT_INDEX=1 (or colors) · with concrete command: =cmd / full, or =1 plus TALER_MONITORD_RESULT_INDEX_CMD=1. Off by default (=0).
Git soft probe: Git-labelled services run infrequent git ls-remote over HTTPS + SSH (cached ~6h). Soft yellow on fail. Disable: TALER_MONITORD_GIT=0.
VeciGate: services-catalog.conf zone vecigate (WAN IP) + intentional DNAT ports in ports-whitelist.conf (incl. tortuna companion).
Payability: TALER_MONITORD_PAY=1 shows CHF:0 / zero-pay status on matching stacks. Live wallet run only with TALER_MONITORD_PAY_RUN=1 (interval TALER_MONITORD_PAY_INTERVAL_S, default 4h). Domains: TALER_MONITORD_PAY_DOMAINS.
Ansible smoke (opt-in phase): ./taler-monitoring.sh ansible-smoke → check_ansible_smoke.sh against TALER_DEPLOYMENT (regional-currency-ng/site.yml). Podman tracks: ANSIBLE_SMOKE_PODMAN=1 on koopa (else reuse aptdeploy).
Local VCS mirror: ~/git/www-hacktivism-wiki rsyncs Cyon → git every 4h
(ch.hacktivism.www-wiki-sync). Tracks stacks/ (+ optional addon). No push by default.
Custom /intro: only GOA (hacktivism) and FrancPaysan / TESTPAYSAN stage.
Landing stats: on intro stacks, …/intro/stats.json → compact tag.
Currency / coins: from exchange /config currency_specification.
Endpoints: suite-like paths; soft ≤ yellow. /terms + /privacy: medium → orange only TOPS prod.
Optional / moved
Legacy multi-host generate/deploy and firecuda launchd tooling live under
../meta/ (see meta/README.md).
# normal publish is host-agent on the mon host, not these scripts
../host-agent/run-hacktivism-monitoring.sh # etc.