103 lines
7.1 KiB
Markdown
103 lines
7.1 KiB
Markdown
# site-gen — HTML converter + Caddy notes
|
||
|
||
**Product:** **LLM** = **Lightweight Monitoring** (Taler-stack watcher). CLI/tree still `taler-monitoring` / `taler-monitord`.
|
||
|
||
**Required for host-agent:** `console_to_html.py` (log → sticky HTML).
|
||
|
||
| File | Role |
|
||
|------|------|
|
||
| `console_to_html.py` | Convert suite console log → public mon HTML |
|
||
| `stack_status_lib.py` | Domain-stack traffic lights + aggregation |
|
||
| `taler-monitord` | Daemon: probe stacks → `stack-status.json` (UI detached) |
|
||
| `stack_status_html.py` | Render status cards from JSON only |
|
||
| `caddy-monitoring-handles.snippet` | Caddy `handle` / bare redir notes |
|
||
| `ROOT-ON-KOOPA.md` | Publish staging → `/var/www` (paths from env) |
|
||
| `settings.conf.example` | Optional settings for **legacy** multi-host generator |
|
||
|
||
## Stack status (taler-monitord)
|
||
|
||
Like `llm-controld`: the daemon collects; the page only reads JSON.
|
||
|
||
```bash
|
||
./site-gen/taler-monitord --once
|
||
./site-gen/stack_status_html.py --out /tmp/taler-stack-status.html
|
||
# optional: ./site-gen/taler-monitord --interval 20
|
||
# local GOA (hacktivism.ch / taler.hacktivism.ch) is included by default;
|
||
# skip with --no-include-local or TALER_MONITORD_INCLUDE_LOCAL=0
|
||
```
|
||
|
||
Lights: green ok · blue present · yellow soft · orange hard/recent · red acute · black long · white gone.
|
||
Box colour = weakest member; **muted** if partial; **full** if all members red/black.
|
||
|
||
**Total score** (header): `N/M green` across stack+service+mail cards. Ratio thresholds (env override):
|
||
1.0 green · ≥0.85 blue · ≥0.60 yellow · ≥0.35 orange · ≥0.01 red · 0 white (gone) / all-black → black.
|
||
|
||
Stacks with currency `-` in `domains.conf` are **`static_pending`** (e.g. lefrancpaysan.ch: static site, no Taler prod yet). monitord probes the apex as `site` and treats missing bank/exchange/merchant as **blue `no_prod_yet`**, not orange/red. Stage TESTPAYSAN remains a normal Taler stack.
|
||
|
||
**Bank backend:** exchange `/keys` `payto://` methods decide whether `bank.*` is expected.
|
||
`payto://x-taler-bank/…` → probe bank (libeufin).
|
||
`payto://iban/…` only (EBICS / TOPS CHF) → bank member **blue**, host **`IBAN`**, reason `ebics_iban` (not red).
|
||
Mixed (e.g. regio) still probes bank. Override in `domains.conf`: bank column `-` / `ebics` / `none`.
|
||
|
||
**Network / SSH:** each stack gets a coarse **zone** (GOA/local, FP stage, TOPS, pixel, firefly, public demo).
|
||
SSH = **TCP:22 banner** (service present), not Magikoopa jump login.
|
||
Zone-mapped SSH targets come **only** from `~/.config/taler-monitoring/env` (`TALER_MONITORD_SSH_TOPS` / `_FP` / `_GOA` / `_TOPS_PROD` via **taler-monitoring-env**); hostnames are **hidden** in the UI when set. Without env, probes use public stack FQDNs. Disable: `TALER_MONITORD_SSH=0`.
|
||
|
||
**Outside CVEs:** `Server` headers (nginx/apache/caddy + version) → OSV.
|
||
**CRITICAL → red**, **HIGH → orange**. UI: CVE tags **link to osv.dev**; card click opens detail (severity / version / summary). Logos for nginx/apache/caddy. Disable: `TALER_MONITORD_CVE=0`.
|
||
|
||
**Why Degraded:** each card shows a one-line aggregation (`4× OK, 3× Soft → Degraded`); click opens a dialog with per-member reasons.
|
||
|
||
**Company / services:** `services-catalog.conf` (ERPnext, MantisBT, company apexes, …). Disable: `TALER_MONITORD_SERVICES=0`.
|
||
|
||
**Mail:** `mail-catalog.conf` → MX / SPF / DMARC / A+AAAA / rDNS + SMTP/IMAP TCP ports (587 soft).
|
||
**Deliverability** (regular, not every cycle): SMTP `MAIL FROM`/`RCPT TO` smoke to `postmaster@domain` (no DATA).
|
||
Cached under monitord state (`mail-deliverability.json`); default interval **6h**, stale after **30h** → yellow.
|
||
Send/server failures → orange/red (degraded). Env: `TALER_MONITORD_DELIVER=0`, `_INTERVAL_S`, `_STALE_S`, `_FROM`, `_RCPT`.
|
||
Disable plane: `TALER_MONITORD_MAIL=0`; ports only: `TALER_MONITORD_MAIL_PORTS=0`.
|
||
|
||
**TLS certs + orphans:** cert days-left + SANs. Orphans = **DNS-missing** SANs not covered by monitored hosts; wildcards/siblings skipped.
|
||
HTTP orphans opt-in: `TALER_MONITORD_ORPHAN_HTTP=1`. Disable: `TALER_MONITORD_CERT=0` / `TALER_MONITORD_ORPHAN=0`.
|
||
|
||
**Port scan (outside-in only):** TCP connect to notable ports on publicly named hosts. No internal firewall maps required.
|
||
Baseline allows 80/443 (+ mail ports on mail-catalog hosts). Anything else open → **suspicious** until listed in `ports-whitelist.conf`.
|
||
Many odd open ports ⇒ worth investigating. Whitelist only silences *known intentional public* opens (e.g. hacktivism **8080** Tor OR, **9200** git-SSH) so they do not turn cards orange.
|
||
Only **hard** findings (DB/RDP/SMB/…) raise card colour; soft stays informational. Disable: `TALER_MONITORD_PORTSCAN=0`.
|
||
|
||
**Software versions:** per card from Taler `/config` (`build_version`), `Server:` (nginx/apache/caddy), SMTP banner (Postfix).
|
||
Compared to **published** packages on `deb.taler.net` (`TALER_MONITORD_APT_SUITE`, default trixie): current / behind / ahead; chips show `installed → published` when behind.
|
||
**Apps / SPAs:** page section with published WebUI + wallet-cli (+ GNU FTP wallet tarball when listed). Disable: `TALER_MONITORD_PUBLISHED=0`.
|
||
|
||
**Publish:** Cyon **`hacktivism`**. Defaults (both):
|
||
`…/public_html/stacks/index.html` → **https://hacktivism.ch/stacks/**
|
||
`…/public_html/monitoring.hacktivism.ch/index.html` (addon when DNS ready)
|
||
Override: `TALER_MONITORD_PUBLISH_PATH` or `TALER_MONITORD_PUBLISH_PATHS=a,b`. Off: `TALER_MONITORD_PUBLISH=0`.
|
||
|
||
**Result index (optional):** bottom of the stacks page lists every probe grouped by traffic-light colour.
|
||
`TALER_MONITORD_RESULT_INDEX=1` (or `colors`) · with concrete command: `=cmd` / `full`, or `=1` plus `TALER_MONITORD_RESULT_INDEX_CMD=1`. Off by default (`=0`).
|
||
|
||
**Git soft probe:** Git-labelled services run infrequent `git ls-remote` over HTTPS + SSH (cached ~6h). Soft yellow on fail. Disable: `TALER_MONITORD_GIT=0`.
|
||
|
||
**VeciGate:** `services-catalog.conf` zone `vecigate` (WAN IP) + intentional DNAT ports in `ports-whitelist.conf` (incl. tortuna companion).
|
||
|
||
**Payability:** `TALER_MONITORD_PAY=1` shows CHF:0 / zero-pay status on matching stacks. Live wallet run only with `TALER_MONITORD_PAY_RUN=1` (interval `TALER_MONITORD_PAY_INTERVAL_S`, default 4h). Domains: `TALER_MONITORD_PAY_DOMAINS`.
|
||
|
||
**Ansible smoke (opt-in phase):** `./taler-monitoring.sh ansible-smoke` → `check_ansible_smoke.sh` against `TALER_DEPLOYMENT` (`regional-currency-ng/site.yml`). Podman tracks: `ANSIBLE_SMOKE_PODMAN=1` on koopa (else reuse `aptdeploy`).
|
||
|
||
**Local VCS mirror:** `~/git/www-hacktivism-wiki` rsyncs Cyon → git every **4h**
|
||
(`ch.hacktivism.www-wiki-sync`). Tracks `stacks/` (+ optional addon). No push by default.
|
||
|
||
**Custom /intro:** only **GOA** (hacktivism) and **FrancPaysan / TESTPAYSAN stage**.
|
||
**Landing stats:** on intro stacks, `…/intro/stats.json` → compact tag.
|
||
**Currency / coins:** from exchange `/config` `currency_specification`.
|
||
**Endpoints:** suite-like paths; soft ≤ yellow. **`/terms` + `/privacy`:** medium → orange **only TOPS prod**.
|
||
|
||
## Optional / moved
|
||
|
||
Legacy multi-host generate/deploy and firecuda launchd tooling live under
|
||
**`../meta/`** (see `meta/README.md`).
|
||
|
||
```bash
|
||
# normal publish is host-agent on the mon host, not these scripts
|
||
../host-agent/run-hacktivism-monitoring.sh # etc.
|
||
```
|