feat(kuma-config): declarative public status pages (#43)

* feat(kuma-config): declarative public status pages

statusPages in kuma.yaml creates/reconciles Kuma status pages over the
same Socket.IO API (getStatusPage/addStatusPage/saveStatusPage —
identical signatures in 2.3.2 and 2.5.0). Page layout is authoritative;
undeclared pages are untouched. Declares /status/zfnd with the seeder
and web-page monitors (prober excluded).

* feat(kuma-config): adopt existing Ecosystem Dashboard status page

Prod already has /status/dashboard (created manually, missing the
Z.CASH monitor); declare it instead of adding a second page so its URL
and the Entry Page wiring survive.

* fix(kuma-config): only treat Kuma's not-found as a missing status page

Rethrow other getStatusPage errors instead of proceeding to create, and
honor the round-trip contract for showTags/showCertificateExpiry when
the YAML omits them.

Author: andres-pcg

kuma-config/README.md

@@ -88,6 +88,18 @@ To operate it, the `prod` GitHub environment provides these non-secret
 Secrets read from Secret Manager (never GitHub): `UPTIME_KUMA_ADMIN_PASSWORD`,
 `SLACK_WEBHOOK_URL`.
 
+## Status pages
+
+`statusPages:` declares public, no-login views served at `/status/<slug>`
+(e.g. `https://status.zfnd.org/status/zfnd`). Unlike monitors, a page's layout
+is **authoritative**: on apply, its groups/monitors are replaced by the declared
+list. Pages not declared in the file are never touched. Monitors are referenced
+by name; unknown names are skipped with a warning (e.g. the prober before it
+exists in that instance).
+
+The `/dashboard` admin UI always requires login — publishing a status page is
+the supported way to expose state publicly, and only the monitors you list.
+
 ## Adding channels later
 
 Add another entry under `notifications:` (e.g. PagerDuty/email) with its own

kuma-config/apply.js

@@ -244,6 +244,7 @@ async function main() {
     }
 
     // 4. Monitors
+    const monitorIds = {}; // name -> id, for status page wiring below
     for (const m of cfg.monitors || []) {
         // Skip monitors whose ${VAR} placeholders weren't resolved (e.g. the
         // prober monitor before PROBER_BASE_URL is set) so we never create a
@@ -304,6 +305,7 @@ async function main() {
             monitorID = res.monitorID;
             log(`created monitor "${m.name}" (id=${monitorID})`);
         }
+        monitorIds[m.name] = monitorID;
 
         if (DRY_RUN) continue;
 
@@ -323,6 +325,67 @@ async function main() {
         }
     }
 
+    // 5. Status pages (public, no-login views at /status/<slug>). Unlike the
+    // monitor reconcile, a page's layout is authoritative: saveStatusPage
+    // replaces its groups/monitors with the declared list. Pages not declared
+    // here are never touched. Events verified against 2.3.2 and 2.5.0:
+    // getStatusPage / addStatusPage / saveStatusPage have identical signatures.
+    for (const sp of cfg.statusPages || []) {
+        // Kuma answers a missing slug with the literal "No slug?"; anything
+        // else (auth, transport) is a real failure and must abort the apply.
+        const existing = await emit("getStatusPage", sp.slug).catch((e) => {
+            if (e.message === "No slug?") return null;
+            throw e;
+        });
+        if (DRY_RUN) {
+            log(
+                `[dry-run] ${existing ? "reconcile" : "create"} status page "${sp.slug}" (${(sp.groups || []).length} groups)`,
+            );
+            continue;
+        }
+        if (!existing) {
+            await emit("addStatusPage", sp.title, sp.slug);
+            log(`created status page "${sp.slug}"`);
+        }
+        const full = (await emit("getStatusPage", sp.slug)).config;
+        const groupList = (sp.groups || []).map((g) => ({
+            name: g.name,
+            monitorList: (g.monitors || [])
+                .filter((name) => {
+                    if (monitorIds[name] == null) {
+                        log(
+                            `  ! status page "${sp.slug}": unknown monitor "${name}" — skip`,
+                        );
+                        return false;
+                    }
+                    return true;
+                })
+                .map((name) => ({ id: monitorIds[name] })),
+        }));
+        // Round-trip the stored config so undeclared fields survive; icon goes
+        // through the imgDataUrl param (non-data: values are stored verbatim).
+        await emit(
+            "saveStatusPage",
+            sp.slug,
+            {
+                ...full,
+                slug: sp.slug,
+                title: sp.title,
+                description: sp.description ?? full.description ?? null,
+                theme: sp.theme || full.theme || "auto",
+                showTags: sp.showTags ?? full.showTags ?? false,
+                showPoweredBy: sp.showPoweredBy ?? full.showPoweredBy ?? false,
+                showCertificateExpiry:
+                    sp.showCertificateExpiry ??
+                    full.showCertificateExpiry ??
+                    false,
+            },
+            full.icon || "",
+            groupList,
+        );
+        log(`reconciled status page "${sp.slug}" (${groupList.length} groups)`);
+    }
+
     log(DRY_RUN ? "dry-run complete" : "apply complete");
     socket.close();
 }

kuma-config/kuma.yaml

@@ -161,4 +161,29 @@ monitors:
     expiryNotification: true
     notifications: [Slack]
     tags:
-      - { name: Org, value: ZFND }
+      - { name: Org, value: ZFND }
+
+# Public status pages, served without login at /status/<slug>. A page's layout
+# is authoritative: on apply, its groups/monitors are replaced by what is
+# declared here (pages not listed are never touched). The prober monitor is
+# intentionally not exposed — it's an internal signal.
+# Adopts the pre-existing "Ecosystem Dashboard" page (slug `dashboard`) rather
+# than creating a second one, so its URL and the Entry Page wiring survive.
+statusPages:
+  - slug: dashboard
+    title: Ecosystem Dashboard
+    description: Live status of Zcash Foundation public services and DNS seeders.
+    showTags: true
+    showCertificateExpiry: true
+    groups:
+      - name: Seeders
+        monitors:
+          - ZFND Mainnet
+          - ZFND Testnet
+          - ZODL Mainnet
+          - ZODL Testnet
+          - Str4d Mainnet
+      - name: Web Pages
+        monitors:
+          - ZFND Web Page
+          - Z.CASH Web Page