Frank
f73fd43027
169.254.1.2 is not a local address on this host (netavark runs its bridges in aardvark-dns' netns), so the relay cannot bind it — and a loopback bind refuses container traffic. Probe-socket proof: a host socket on 192.168.0.143:18094 answers the container's 169.254.1.2:18094 dial while the LAN IP refuses from the container. The relay binds 192.168.0.143:18093 and the deployer installs an iptables INPUT pair (ACCEPT 10.89.0.0/16, DROP rest) so the unauthenticated endpoint stays off the LAN.
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
# Alertmanager configuration for the homelab.
|
|
# Deployed to /opt/alertmanager/config/alertmanager.yml on Dankclaw.
|
|
#
|
|
# The one delivery path is Signal. The webhook lands on the host-side
|
|
# signal-relay (a systemd user unit listening on 192.168.0.143:18093, the
|
|
# host LAN IP — the address the container's host.containers.internal dial
|
|
# lands on), which
|
|
# formats the group and hands it to signal-cli under Frank's existing
|
|
# account. There is deliberately no second receiver: a duplicate channel is
|
|
# how an alert starts arriving twice and getting muted everywhere.
|
|
#
|
|
# From this container the host's loopback is reachable only as
|
|
# host.containers.internal (169.254.1.2): netavark DNATs published ports
|
|
# only, so the host's LAN IP and the podman gateway are both refused for an
|
|
# unpublished port — the same quirk that 502'd the hermes upstream in the
|
|
# Caddyfile on 2026-09-16.
|
|
global:
|
|
resolve_timeout: 5m
|
|
|
|
route:
|
|
receiver: signal
|
|
group_by: ['alertname']
|
|
group_wait: 30s
|
|
group_interval: 5m
|
|
repeat_interval: 4h
|
|
|
|
receivers:
|
|
- name: signal
|
|
webhook_configs:
|
|
- url: http://host.containers.internal:18093/alertmanager
|