Skip to main content

max / makenotwork

5.3 KB · 186 lines History Blame Raw
1 [serve]
2 interval_secs = 300
3 prune_days = 30
4 listen = "0.0.0.0:9100"
5 peer_heartbeat_secs = 60
6 route_check_interval_secs = 300
7 dashboard = false
8 # api_token loaded from POM_API_TOKEN env var
9
10 [instance]
11 name = "hetzner"
12
13 [targets.mnw]
14 label = "Makenotwork Production"
15 expected_routes = ["/", "/discover", "/login", "/docs"]
16
17 [[targets.mnw.dns]]
18 name = "makenot.work"
19 record_type = "A"
20 expected = []
21
22 [[targets.mnw.dns]]
23 name = "forums.makenot.work"
24 record_type = "A"
25 expected = []
26
27 [[targets.mnw.dns]]
28 name = "git.makenot.work"
29 record_type = "A"
30 expected = []
31
32 [[targets.mnw.cors]]
33 url = "https://fsn1.your-objectstorage.com/makenotwork-files/cors-probe"
34 origin = "https://makenot.work"
35 method = "PUT"
36
37 [targets.mnw.whois]
38 domain = "makenot.work"
39 warn_days = 30
40
41 [targets.mnw.health]
42 url = "https://makenot.work/api/health"
43 timeout_secs = 10
44
45 [targets.mnw.health.expect]
46 status_code = 200
47 json_fields = { "status" = "operational", "checks.database" = "true" }
48
49 [targets.mnw.health.trending]
50 baseline_window_hours = 168
51 spike_threshold = 2.0
52
53 [targets.mnw.tls]
54 host = "makenot.work"
55
56 [targets.mnw.tests]
57 # Present in prod's live /etc/pom/pom.toml and previously missing here, which
58 # made this file unsafe to deploy: installing it would have silently dropped the
59 # remote CI check from prod. Keep the two in step.
60 ssh = "max@100.106.221.39"
61 command = "/home/max/staging/run-ci.sh"
62 timeout_secs = 600
63 staleness_days = 7
64
65 [targets.mnw.backups]
66 # Where the backups actually are, verified on prod 2026-07-29: the nightly job
67 # writes /var/lib/mnw/backups/makenotwork/makenotwork-<date>.sql.gz. This said
68 # /opt/makenotwork/backups, a path that does not exist on that host, so the
69 # check reported the target degraded for a directory it could not find while the
70 # real backups went unwatched. The app lives at /opt/mnw/current, not
71 # /opt/makenotwork; the old path looks like a pre-rename leftover.
72 #
73 # pom matches files by the "<database>-" or "<database>_" prefix inside this
74 # directory, so the directory is the per-database one, not its parent.
75 directory = "/var/lib/mnw/backups/makenotwork"
76 databases = ["makenotwork"]
77 max_age_hours = 25
78 interval_secs = 3600
79
80 [targets.mnw.scan_pipeline]
81 # Polls /admin/uploads/health.json for queue depth, stuck-scan count,
82 # held backlog, and per-layer error rates. Thresholds per
83 # scan-pipeline-audit.md ยง 6. Localhost on the makenotwork port to
84 # skip the Caddy + Cloudflare path (internal-only signal).
85 base_url = "http://127.0.0.1:3000"
86 interval_secs = 300
87 timeout_secs = 10
88
89 [targets.mnw.synckit_fleet]
90 # Which SyncKit SDK versions are actually syncing. SyncKit is client-side
91 # only, so there is no deployed version to poll; the server aggregates the
92 # version off each sync request's User-Agent and this reads that. Authed
93 # with alerts.alerts_ingest_token, so the check does not spawn without one.
94 # Informational: an old version in the field never degrades the target, only
95 # a readout PoM cannot take does. Localhost for the same reason as above.
96 base_url = "http://127.0.0.1:3000"
97 window_days = 30
98 interval_secs = 3600
99 timeout_secs = 10
100
101 [targets.mnw-cli]
102 label = "MNW CLI SSH Server"
103
104 [[targets.mnw-cli.dns]]
105 name = "cli.makenot.work"
106 record_type = "A"
107 expected = []
108
109 [targets.mnw-cli.ssh_banner]
110 host = "127.0.0.1"
111 port = 22
112 timeout_secs = 5
113
114 [targets.mt]
115 label = "Multithreaded Forum"
116 expected_routes = ["/"]
117
118 [targets.mt.health]
119 url = "http://127.0.0.1:3400/api/health"
120 timeout_secs = 5
121
122 [targets.mt.health.expect]
123 status_code = 200
124 json_fields = { "status" = "operational", "database" = "true" }
125
126 [targets.mt.tls]
127 host = "forums.makenot.work"
128
129 [targets.mt.tests]
130 ssh = "max@100.106.221.39"
131 command = "cd /home/max/staging/multithreaded && cargo test --workspace 2>&1"
132 timeout_secs = 300
133 staleness_days = 7
134
135 [targets.htpy]
136 label = "htpy.app"
137
138 [[targets.htpy.dns]]
139 name = "htpy.app"
140 record_type = "A"
141 expected = []
142
143 [targets.htpy.whois]
144 domain = "htpy.app"
145 warn_days = 30
146
147 [targets.htpy.health]
148 # htpy-web moved twice and this URL followed neither move: it listens on 3200,
149 # not 8080, and /archive/<name> now 308s to /viewer/<name>. Checking the old
150 # address failed on connect, so the target has been reading "unreachable" with an
151 # open incident since 2026-03-29 while htpy.app itself served fine. Verified
152 # 2026-07-29: this returns 200 with "htpy" in the body from fw13, astra and
153 # hetzner, and 3200 is in the tailnet ACL's inter-server port list.
154 url = "http://100.99.153.68:3200/viewer/S_2"
155 timeout_secs = 10
156
157 [targets.htpy.health.expect]
158 status_code = 200
159 body_contains = "htpy"
160
161 [targets.htpy.tls]
162 host = "htpy.app"
163
164 [peers.astra]
165 address = "100.106.221.39:9100"
166 on_missing = "alert"
167 # token = "<astra's POM_API_TOKEN value>"
168
169 [peers.macbook]
170 address = "100.100.246.136:9100"
171 on_missing = "log"
172 # token = "<macbook's POM_API_TOKEN value>"
173
174 [alerts]
175 # postmark_token loaded from POM_POSTMARK_TOKEN env var
176 to = "pom-alerts@makenot.work"
177
178 # MNW operator-log sink: also pushes alerts to POST {mnw_url}/api/internal/alerts.
179 # Enable once ALERTS_INGEST_TOKEN is set in MNW prod .env AND the endpoint is
180 # reachable from this host. Confirm reachability first: /api/internal may be
181 # restricted at the public edge, in which case use the tailnet URL instead of
182 # the public one below. The token loads from POM_ALERTS_INGEST_TOKEN env var
183 # (never commit it here). Both mnw_url and the token must be present, else the
184 # sink stays disabled.
185 # mnw_url = "https://makenot.work"
186