Ilia Denisov
55f6176538
Grafana: GF_SMTP from the shared relay (STARTTLS host:port) + alerting provisioning (contact point → SERVICE_EMAIL, route-all policy, and rules for scrape-target down, gateway internal-error rate + p99 latency, host mem/disk/cpu, postgres connections, and TLS cert < 20 days). All rules noDataState=OK so an absent metric never false-alerts. blackbox_exporter probes the edge caddy's TLS (probe_ssl_earliest_cert_expiry) — effective on prod (caddy terminates TLS; contour caddy is HTTP-only so the metric is absent). Wires the new env through compose (backend admin From/To, Grafana SMTP), ci.yaml (TEST_), prod-deploy (PROD_ + env.sh), .env.example and the README var table.
15 lines
614 B
YAML
15 lines
614 B
YAML
# blackbox_exporter probe modules. tls_cert opens a verified TLS connection to the edge
|
|
# caddy so Prometheus can read probe_ssl_earliest_cert_expiry — the signal behind the
|
|
# certificate-renewal-failure alert. The SNI is the production public host, whose cert the
|
|
# edge caddy serves once it does its own ACME; on the test contour caddy is HTTP-only
|
|
# (behind the host caddy), so the probe finds nothing on :443 and the cert metric is absent.
|
|
modules:
|
|
tls_cert:
|
|
prober: tcp
|
|
timeout: 5s
|
|
tcp:
|
|
tls: true
|
|
tls_config:
|
|
server_name: erudit-game.ru
|
|
insecure_skip_verify: false
|