Hernâni Marques 5a5431bfa9

Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome
as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan);
monpages GOA + FP stage.

2026-07-19 04:22:10 +02:00

3 KiB

Raw Blame History

Root on koopa (hacktivism monitoring sites)

Host Caddy runs as root/systemd (caddy user). Static monitoring HTML is not put into Taler containers — only host paths + Caddy handle.

After host-agent (or optional meta/site-gen-legacy/generate-monitoring-sites.sh) + deploy, files live in:

$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring/index.html
$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/<hostname>/monitoring_err/index.html

One-shot as root (preferred)

# absolute path — as root, ~ is /root (script not found under ~/koopa-caddy/…)
sudo $APPLY_MONITORING_LIVE
# same script is versioned in the suite:
#   host-agent/apply-monitoring-live.sh  → install/sync to $KOOPA_CADDY_DIR/

That rsyncs staging → /var/www/monitoring-sites, installs the prepared Caddyfile, reloads Caddy, and smokes mon URLs (including bare surface).

Manual equivalent

install -d -o hernani -g caddy -m 755 /var/www/monitoring-sites
rsync -a --delete $DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/ /var/www/monitoring-sites/
chown -R hernani:caddy /var/www/monitoring-sites

install -m 644 $KOOPA_CADDY_DIR/Caddyfile /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
systemctl is-active caddy

Snippet per hacktivism site (inside each `*.hacktivism.ch { }` block)

Place before the catch-all reverse_proxy. Canonical copy: site-gen/caddy-monitoring-handles.snippet.

Disk layout (path on disk matches URL under host root):

/var/www/monitoring-sites/bank.hacktivism.ch/monitoring/index.html
/var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err/index.html

    # bare → slash (MUST use redir * /path/ — see footgun below)
    handle /monitoring {
        redir * /monitoring/ 302
    }
    handle /monitoring* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }
    handle /monitoring_err {
        redir * /monitoring_err/ 302
    }
    handle /monitoring_err* {
        root * /var/www/monitoring-sites/{host}
        file_server
    }

Caddy redir footgun (merchant code 21)

# WRONG — parsed as matcher=/monitoring/ to="302" → Location: 302
handle /monitoring {
    redir /monitoring/ 302
}

# RIGHT
handle /monitoring {
    redir * /monitoring/ 302
}

Symptom: https://…/monitoring or …/taler-monitoring-surface returns merchant JSON {"code":21,…} while the slash form serves HTML.

Check

curl -sS -o /dev/null -w '%{http_code}\n' https://bank.hacktivism.ch/monitoring/
curl -sS -D- -o /dev/null https://taler.hacktivism.ch/taler-monitoring-surface | head -15
# bare: expect 302 Location: /taler-monitoring-surface/  — not JSON code 21
curl -sS -o /dev/null -w '%{http_code}\n' https://taler.hacktivism.ch/taler-monitoring-surface/

Not needed as root

Running taler-monitoring (use optional outside runner / laptop)
Writing into podman Taler containers

3 KiB Raw Blame History