alertmanager.yml

# Alertmanager routing — ancore mainnet
# Assumes Prometheus + Alertmanager. Adapt metric names to actual instrumentation.
# Secrets injected via environment variables. Never hardcode credentials.
# Set PAGERDUTY_ROUTING_KEY and SLACK_WEBHOOK_URL in deployment environment.

global:
  resolve_timeout: 5m

route:
  receiver: slack-default
  group_by: ['alertname', 'job', 'severity']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h

  routes:
    - match:
        severity: critical
      receiver: pagerduty-critical
      repeat_interval: 1h
      continue: true

    - match:
        escalation: pagerduty
      receiver: pagerduty-critical
      continue: true

    - match:
        escalation: slack
      receiver: slack-default

receivers:
  - name: pagerduty-critical
    pagerduty_configs:
      - routing_key: '${PAGERDUTY_ROUTING_KEY}'
        severity: '{{ if eq .CommonLabels.severity "critical" }}critical{{ else }}warning{{ end }}'
        description: '{{ .CommonAnnotations.summary }}'
        details:
          runbook:   '{{ (index .Alerts 0).Annotations.runbook_url }}'
          dashboard: '{{ (index .Alerts 0).Annotations.dashboard_url }}'
          service:   '{{ .CommonLabels.job }}'

  - name: slack-default
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel: '#ancore-alerts'
        send_resolved: true
        title: '[{{ .Status | toUpper }}{{ if eq .Status "firing" }} 🔥{{ else }} ✅{{ end }}] {{ .CommonAnnotations.summary }}'
        text: |
          {{ range .Alerts }}
          *Severity:* {{ .Labels.severity }}
          *Description:* {{ .Annotations.description }}
          *Runbook:* {{ .Annotations.runbook_url }}
          {{ if .Annotations.dashboard_url }}*Dashboard:* {{ .Annotations.dashboard_url }}{{ end }}
          {{ end }}

inhibit_rules:
  # Suppress warning-level alerts when a critical alert fires for the same job
  - source_match:
      severity: critical
    target_match:
      severity: warning
    equal: ['alertname', 'job']