| 1 |
[serve] |
| 2 |
interval_secs = 300 |
| 3 |
prune_days = 30 |
| 4 |
listen = "0.0.0.0:9100" |
| 5 |
peer_heartbeat_secs = 60 |
| 6 |
route_check_interval_secs = 300 |
| 7 |
dashboard = false |
| 8 |
# api_token loaded from POM_API_TOKEN env var |
| 9 |
|
| 10 |
[instance] |
| 11 |
name = "hetzner" |
| 12 |
|
| 13 |
[targets.mnw] |
| 14 |
label = "Makenotwork Production" |
| 15 |
expected_routes = ["/", "/discover", "/login", "/docs"] |
| 16 |
|
| 17 |
[[targets.mnw.dns]] |
| 18 |
name = "makenot.work" |
| 19 |
record_type = "A" |
| 20 |
expected = [] |
| 21 |
|
| 22 |
[[targets.mnw.dns]] |
| 23 |
name = "forums.makenot.work" |
| 24 |
record_type = "A" |
| 25 |
expected = [] |
| 26 |
|
| 27 |
[[targets.mnw.dns]] |
| 28 |
name = "git.makenot.work" |
| 29 |
record_type = "A" |
| 30 |
expected = [] |
| 31 |
|
| 32 |
[[targets.mnw.cors]] |
| 33 |
url = "https://fsn1.your-objectstorage.com/makenotwork-files/cors-probe" |
| 34 |
origin = "https://makenot.work" |
| 35 |
method = "PUT" |
| 36 |
|
| 37 |
[targets.mnw.whois] |
| 38 |
domain = "makenot.work" |
| 39 |
warn_days = 30 |
| 40 |
|
| 41 |
[targets.mnw.health] |
| 42 |
url = "https://makenot.work/api/health" |
| 43 |
timeout_secs = 10 |
| 44 |
|
| 45 |
[targets.mnw.health.expect] |
| 46 |
status_code = 200 |
| 47 |
json_fields = { "status" = "operational", "checks.database" = "true" } |
| 48 |
|
| 49 |
[targets.mnw.health.trending] |
| 50 |
baseline_window_hours = 168 |
| 51 |
spike_threshold = 2.0 |
| 52 |
|
| 53 |
[targets.mnw.tls] |
| 54 |
host = "makenot.work" |
| 55 |
|
| 56 |
[targets.mnw.tests] |
| 57 |
# Present in prod's live /etc/pom/pom.toml and previously missing here, which |
| 58 |
# made this file unsafe to deploy: installing it would have silently dropped the |
| 59 |
# remote CI check from prod. Keep the two in step. |
| 60 |
ssh = "max@100.106.221.39" |
| 61 |
command = "/home/max/staging/run-ci.sh" |
| 62 |
timeout_secs = 600 |
| 63 |
staleness_days = 7 |
| 64 |
|
| 65 |
[targets.mnw.backups] |
| 66 |
# Where the backups actually are, verified on prod 2026-07-29: the nightly job |
| 67 |
# writes /var/lib/mnw/backups/makenotwork/makenotwork-<date>.sql.gz. This said |
| 68 |
# /opt/makenotwork/backups, a path that does not exist on that host, so the |
| 69 |
# check reported the target degraded for a directory it could not find while the |
| 70 |
# real backups went unwatched. The app lives at /opt/mnw/current, not |
| 71 |
# /opt/makenotwork; the old path looks like a pre-rename leftover. |
| 72 |
# |
| 73 |
# pom matches files by the "<database>-" or "<database>_" prefix inside this |
| 74 |
# directory, so the directory is the per-database one, not its parent. |
| 75 |
directory = "/var/lib/mnw/backups/makenotwork" |
| 76 |
databases = ["makenotwork"] |
| 77 |
max_age_hours = 25 |
| 78 |
interval_secs = 3600 |
| 79 |
|
| 80 |
[targets.mnw.scan_pipeline] |
| 81 |
# Polls /admin/uploads/health.json for queue depth, stuck-scan count, |
| 82 |
# held backlog, and per-layer error rates. Thresholds per |
| 83 |
# scan-pipeline-audit.md ยง 6. Localhost on the makenotwork port to |
| 84 |
# skip the Caddy + Cloudflare path (internal-only signal). |
| 85 |
base_url = "http://127.0.0.1:3000" |
| 86 |
interval_secs = 300 |
| 87 |
timeout_secs = 10 |
| 88 |
|
| 89 |
[targets.mnw.synckit_fleet] |
| 90 |
# Which SyncKit SDK versions are actually syncing. SyncKit is client-side |
| 91 |
# only, so there is no deployed version to poll; the server aggregates the |
| 92 |
# version off each sync request's User-Agent and this reads that. Authed |
| 93 |
# with alerts.alerts_ingest_token, so the check does not spawn without one. |
| 94 |
# Informational: an old version in the field never degrades the target, only |
| 95 |
# a readout PoM cannot take does. Localhost for the same reason as above. |
| 96 |
base_url = "http://127.0.0.1:3000" |
| 97 |
window_days = 30 |
| 98 |
interval_secs = 3600 |
| 99 |
timeout_secs = 10 |
| 100 |
|
| 101 |
[targets.mnw-cli] |
| 102 |
label = "MNW CLI SSH Server" |
| 103 |
|
| 104 |
[[targets.mnw-cli.dns]] |
| 105 |
name = "cli.makenot.work" |
| 106 |
record_type = "A" |
| 107 |
expected = [] |
| 108 |
|
| 109 |
[targets.mnw-cli.ssh_banner] |
| 110 |
host = "127.0.0.1" |
| 111 |
port = 22 |
| 112 |
timeout_secs = 5 |
| 113 |
|
| 114 |
[targets.mt] |
| 115 |
label = "Multithreaded Forum" |
| 116 |
expected_routes = ["/"] |
| 117 |
|
| 118 |
[targets.mt.health] |
| 119 |
url = "http://127.0.0.1:3400/api/health" |
| 120 |
timeout_secs = 5 |
| 121 |
|
| 122 |
[targets.mt.health.expect] |
| 123 |
status_code = 200 |
| 124 |
json_fields = { "status" = "operational", "database" = "true" } |
| 125 |
|
| 126 |
[targets.mt.tls] |
| 127 |
host = "forums.makenot.work" |
| 128 |
|
| 129 |
[targets.mt.tests] |
| 130 |
ssh = "max@100.106.221.39" |
| 131 |
command = "cd /home/max/staging/multithreaded && cargo test --workspace 2>&1" |
| 132 |
timeout_secs = 300 |
| 133 |
staleness_days = 7 |
| 134 |
|
| 135 |
[targets.htpy] |
| 136 |
label = "htpy.app" |
| 137 |
|
| 138 |
[[targets.htpy.dns]] |
| 139 |
name = "htpy.app" |
| 140 |
record_type = "A" |
| 141 |
expected = [] |
| 142 |
|
| 143 |
[targets.htpy.whois] |
| 144 |
domain = "htpy.app" |
| 145 |
warn_days = 30 |
| 146 |
|
| 147 |
[targets.htpy.health] |
| 148 |
# htpy-web moved twice and this URL followed neither move: it listens on 3200, |
| 149 |
# not 8080, and /archive/<name> now 308s to /viewer/<name>. Checking the old |
| 150 |
# address failed on connect, so the target has been reading "unreachable" with an |
| 151 |
# open incident since 2026-03-29 while htpy.app itself served fine. Verified |
| 152 |
# 2026-07-29: this returns 200 with "htpy" in the body from fw13, astra and |
| 153 |
# hetzner, and 3200 is in the tailnet ACL's inter-server port list. |
| 154 |
url = "http://100.99.153.68:3200/viewer/S_2" |
| 155 |
timeout_secs = 10 |
| 156 |
|
| 157 |
[targets.htpy.health.expect] |
| 158 |
status_code = 200 |
| 159 |
body_contains = "htpy" |
| 160 |
|
| 161 |
[targets.htpy.tls] |
| 162 |
host = "htpy.app" |
| 163 |
|
| 164 |
[peers.astra] |
| 165 |
address = "100.106.221.39:9100" |
| 166 |
on_missing = "alert" |
| 167 |
# token = "<astra's POM_API_TOKEN value>" |
| 168 |
|
| 169 |
[peers.macbook] |
| 170 |
address = "100.100.246.136:9100" |
| 171 |
on_missing = "log" |
| 172 |
# token = "<macbook's POM_API_TOKEN value>" |
| 173 |
|
| 174 |
[alerts] |
| 175 |
# postmark_token loaded from POM_POSTMARK_TOKEN env var |
| 176 |
to = "pom-alerts@makenot.work" |
| 177 |
|
| 178 |
# MNW operator-log sink: also pushes alerts to POST {mnw_url}/api/internal/alerts. |
| 179 |
# Enable once ALERTS_INGEST_TOKEN is set in MNW prod .env AND the endpoint is |
| 180 |
# reachable from this host. Confirm reachability first: /api/internal may be |
| 181 |
# restricted at the public edge, in which case use the tailnet URL instead of |
| 182 |
# the public one below. The token loads from POM_ALERTS_INGEST_TOKEN env var |
| 183 |
# (never commit it here). Both mnw_url and the token must be present, else the |
| 184 |
# sink stays disabled. |
| 185 |
# mnw_url = "https://makenot.work" |
| 186 |
|