5a5431bfa9
Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan); monpages GOA + FP stage.
97 lines
3 KiB
Markdown
97 lines
3 KiB
Markdown
# Root on koopa (hacktivism monitoring sites)
|
|
|
|
Host Caddy runs as **root/systemd** (`caddy` user). Static monitoring HTML is
|
|
**not** put into Taler containers — only host paths + Caddy `handle`.
|
|
|
|
After host-agent (or optional `meta/site-gen-legacy/generate-monitoring-sites.sh`) + deploy, files live in:
|
|
|
|
```text
|
|
$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
|
|
$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html
|
|
```
|
|
|
|
## One-shot as root (preferred)
|
|
|
|
```bash
|
|
# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
|
|
sudo $APPLY_MONITORING_LIVE
|
|
# same script is versioned in the suite:
|
|
# host-agent/apply-monitoring-live.sh → install/sync to $KOOPA_CADDY_DIR/
|
|
```
|
|
|
|
That rsyncs staging → `/var/www/monitoring-sites`, installs the prepared
|
|
Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).
|
|
|
|
## Manual equivalent
|
|
|
|
```bash
|
|
install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
|
|
rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
|
|
chown -R hernani:caddy /var/www/monitoring-sites
|
|
|
|
install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
|
|
caddy validate --config /etc/caddy/Caddyfile
|
|
systemctl reload caddy
|
|
systemctl is-active caddy
|
|
```
|
|
|
|
## Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)
|
|
|
|
Place **before** the catch-all `reverse_proxy`. Canonical copy:
|
|
`site-gen/caddy-monitoring-handles.snippet`.
|
|
|
|
Disk layout (path on disk matches URL under host root):
|
|
|
|
```text
|
|
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
|
|
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html
|
|
```
|
|
|
|
```caddy
|
|
# bare → slash (MUST use redir * /path/ — see footgun below)
|
|
handle /monitoring {
|
|
redir * /monitoring/ 302
|
|
}
|
|
handle /monitoring* {
|
|
root * /var/www/monitoring-sites/{host}
|
|
file_server
|
|
}
|
|
handle /monitoring_err {
|
|
redir * /monitoring_err/ 302
|
|
}
|
|
handle /monitoring_err* {
|
|
root * /var/www/monitoring-sites/{host}
|
|
file_server
|
|
}
|
|
```
|
|
|
|
### Caddy redir footgun (merchant code 21)
|
|
|
|
```caddy
|
|
# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
|
|
handle /monitoring {
|
|
redir /monitoring/ 302
|
|
}
|
|
|
|
# RIGHT
|
|
handle /monitoring {
|
|
redir * /monitoring/ 302
|
|
}
|
|
```
|
|
|
|
Symptom: `https://…/monitoring` or `…/taler-monitoring-surface` returns merchant
|
|
JSON `{"code":21,…}` while the slash form serves HTML.
|
|
|
|
## Check
|
|
|
|
```bash
|
|
curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
|
|
curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
|
|
# bare: expect 302 Location: /taler-monitoring-surface/ — not JSON code 21
|
|
curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/
|
|
```
|
|
|
|
## Not needed as root
|
|
|
|
- Running `taler-monitoring` (use **optional outside runner** / laptop)
|
|
- Writing into podman Taler containers
|