Skip to main content

max / makenotwork

Answer the alert-sink reachability question in the deploy configs /api/internal is 404 at the public edge by design (caddy's @internal matcher), so the MNW sink addresses the app port directly: localhost on hetzner, the tailnet address from astra. Both measured today. WAM stays commented out on hetzner: the deployed binary predates require_auth, so a token-sending client would be pointed at a server that ignores tokens.
Author: Max Johnson <me@maxj.phd> · 2026-08-15 21:12 UTC
Signed with PGP, not checked
Commit: 849c3370c55fbd6574e01aaf3bedafda8caa9a26
Parent: a95480c
2 files changed, +26 insertions, -7 deletions
M pom/deploy/pom-astra.toml +10
@@ -165,3 +165,13 @@
165 165 [alerts]
166 166 # postmark_token loaded from POM_POSTMARK_TOKEN env var
167 167 to = "pom-alerts@makenot.work"
168 +
169 + # MNW operator-log sink: also pushes alerts to POST {mnw_url}/api/internal/alerts.
170 + # Caddy answers 404 to /api/internal/* on the public edge, so this addresses the
171 + # app port over the tailnet instead (measured 2026-08-15 from astra: 401 without
172 + # a token, so the route is reachable and only auth is missing).
173 + #
174 + # Inert until POM_ALERTS_INGEST_TOKEN is added to /etc/pom/env here, holding the
175 + # same value as ALERTS_INGEST_TOKEN in MNW prod's /etc/mnw/makenotwork.env. The
176 + # sink no-ops when either half is missing, so this line alone changes nothing.
177 + mnw_url = "http://100.120.174.96:3000"
M pom/deploy/pom-hetzner.toml +16 -7
@@ -191,10 +191,19 @@
191 191 to = "pom-alerts@makenot.work"
192 192
193 193 # MNW operator-log sink: also pushes alerts to POST {mnw_url}/api/internal/alerts.
194 - # Enable once ALERTS_INGEST_TOKEN is set in MNW prod .env AND the endpoint is
195 - # reachable from this host. Confirm reachability first: /api/internal may be
196 - # restricted at the public edge, in which case use the tailnet URL instead of
197 - # the public one below. The token loads from POM_ALERTS_INGEST_TOKEN env var
198 - # (never commit it here). Both mnw_url and the token must be present, else the
199 - # sink stays disabled.
200 - # mnw_url = "https://makenot.work"
194 + # The token loads from POM_ALERTS_INGEST_TOKEN and must match ALERTS_INGEST_TOKEN
195 + # in /etc/mnw/makenotwork.env; both mnw_url and the token must be present, else
196 + # the sink stays disabled.
197 + #
198 + # Not the public URL. Caddy answers 404 to /api/internal/* by design (see the
199 + # @internal matcher in the Caddyfile), so the sink has to address the app port
200 + # directly. Measured 2026-08-15: POST https://makenot.work/api/internal/alerts
201 + # is 404, POST http://127.0.0.1:3000/api/internal/alerts is 401 without a token.
202 + mnw_url = "http://127.0.0.1:3000"
203 +
204 + # WAM ticket sink: failure alerts become tickets instead of email. WAM listens on
205 + # this host, and its token loads from POM_WAM_TOKEN, which must match the WAM
206 + # node's token. Leave wam_url unset until the deployed WAM actually requires
207 + # auth: the binary at /opt/wam/wam is an April build that predates the
208 + # require_auth middleware, so it accepts unauthenticated writes.
209 + # wam_url = "http://127.0.0.1:7890"