Gjallar/gjallar.example.yaml at master · brvier/Gjallar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# Gjallar example configuration.
# Copy to gjallar.yaml, adapt, then run: ./gjallar -config gjallar.yaml

listen: ":8080"          # web UI bind address
database: "gjallar.db"   # SQLite file
retention: 720h          # prune check results older than this (30 days)
site_title: "Gjallar Status"

# Any value may reference an environment variable with ${VAR} syntax —
# handy for secrets: pass: "${FREEMOBILE_KEY}". A bare $ is left alone.
# Startup fails if a referenced variable is undefined.

# Defaults applied to any monitor that omits the field.
defaults:
  interval: 60s
  timeout: 10s
  failure_threshold: 3   # consecutive failures before a DOWN alert fires
  realert: 1h            # remind while still down (omit or 0 = single DOWN alert)
  alerts: [ops-telegram]

# Named notifiers, referenced by monitors via `alerts: [...]`.
# Default type is a shoutrrr URL — supports telegram, smtp, discord, slack,
# ntfy, gotify, pushover, generic webhooks and more.
# See https://shoutrrr.nickfedor.com/services/overview/
alerts:
  ops-telegram:
    url: "telegram://TOKEN@telegram?chats=123456789"
  ops-mail:
    url: "smtp://user:password@mail.example.com:587/?from=gjallar@example.com&to=ops@example.com"
  ntfy:
    url: "ntfy://ntfy.sh/my-gjallar-topic"
  sms-boss:                # French Free Mobile SMS API
    type: freemobile
    user: "12345678"       # your Free Mobile login
    pass: "AbCdEfGh1234"   # the API key from your subscriber area
  signal-ops:              # signal-cli-rest-api gateway (POST /v2/send)
    type: signal
    url: "https://signal-api.example.com/v2/send"
    number: "+33600000000"              # sender registered on the gateway
    recipients: ["+33611111111", "+33622222222"]
    # If the gateway is protected, set ONE of:
    # token: "${SIGNAL_TOKEN}"          # Bearer token
    # user: "gjallar"                   # or HTTP Basic
    # pass: "${SIGNAL_PASS}"

monitors:
  # --- HTTP/HTTPS: status code, body regex, TLS certificate expiry ---
  - name: website
    group: "Public"    # optional: monitors sharing a group are shown together
    # enabled: false   # optional: list it on the page as DISABLED, never check it
    type: http
    url: "https://example.com/api/health"
    method: GET                       # default GET
    headers:
      Authorization: "Bearer xyz"
    expect_status: 200                # assert exact status code (omit = any 2xx)
    body_regex: '"status"\s*:\s*"ok"' # response body must match
    cert_expiry_warn: 336h            # fail if TLS cert expires within 14 days (omit = disabled)
    interval: 30s
    timeout: 5s
    alerts: [ops-telegram, sms-boss]

  # --- PostgreSQL: rule applied to first column of first row ---
  - name: main-db
    type: postgres
    dsn: "postgres://monitor:secret@db1:5432/app?sslmode=disable"
    query: "SELECT count(*) FROM jobs WHERE status = 'stuck'"
    rule: "== 0"
    # rules: "> N", ">= N", "< N", "<= N", "== x", "!= x", "~ regex", "rows > 0"

  # --- Oracle (pure Go driver, no client install needed) ---
  - name: erp-oracle
    type: oracle
    dsn: "oracle://monitor:secret@erp-host:1521/ORCLPDB1"
    query: "SELECT status FROM v$instance"
    rule: "~ OPEN"

  # --- Rule on row count instead of first value ---
  - name: heartbeats
    type: postgres
    dsn: "postgres://monitor:secret@db1:5432/app"
    query: "SELECT id FROM heartbeats WHERE ts > now() - interval '5 minutes'"
    rule: "rows > 0"

  # --- ICMP ping ---
  - name: gateway
    type: ping
    host: "192.168.1.1"
    count: 3            # packets per check; fails if all are lost
    privileged: false   # false = unprivileged ICMP; may need:
                        #   sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
                        # true = raw sockets; needs root or:
                        #   sudo setcap cap_net_raw+ep ./gjallar
    interval: 15s
    timeout: 5s

  # --- Redis: connect + optional AUTH + PING ---
  - name: cache
    type: redis
    host: "10.0.0.5"
    port: 6379            # default 6379
    password: "${REDIS_PASSWORD}"   # omit if no AUTH

  # --- Elasticsearch index freshness: hours since max(timestamp_field) ---
  - name: es-broadcasts
    type: elasticsearch
    url: "http://es-host:9200"
    index: "broadcasts"
    timestamp_field: "start_date"
    rule: "< 3"           # alert if the newest document is more than 3h old

  # --- Prometheus metrics: rule must hold for every matching series ---
  - name: node1-disk
    type: prometheus
    url: "http://node1:9100/metrics"
    metric: "node_filesystem_avail_bytes"
    labels: { mountpoint: "/" }   # optional exact-match label selectors
    rule: "> 5e9"
    alerts: [ops-mail]