alertloop.example.yaml

# AlertLoop example configuration — the only configuration file, for the binary
# and both Compose profiles:  alertloop --config alertloop.yaml all
#
# A value written as exactly ${VAR} or ${VAR:-default} is taken from the
# environment at startup; an unset or empty ${VAR} without a default stops
# startup. Substituted text is data, not YAML.
# ${VAR:-} in a non-string field keeps the built-in default; in a flow list
# write it quoted: ["${VAR}"].
# Under Compose only the variables docker-compose.yml passes are set; write
# any other value into this file directly.
# Every key AlertLoop reads is shown below; an unknown key stops startup.

# HTTP listen address for the API, the admin console and Swagger. Loopback:
# reach it through a reverse proxy. The Docker image sets ALERTLOOP_ADDR=:8080.
addr: ${ALERTLOOP_ADDR:-127.0.0.1:8080}

# Signs in to /admin and grants full API access. No fallback: an unset token
# stops startup. Generate one with: openssl rand -hex 32
admin_token: ${ALERTLOOP_ADMIN_TOKEN}

# The address people open AlertLoop at, without /admin. With it, every
# notification links to its event in the console; omitted, there are no links.
# public_url: "https://alerts.example.com"

# API keys with a scope: ingest (POST /v1/events), read (queries), full
# (everything; the default). Optional — put in keys of your own.
# api_keys:
#   - key: ${ALERTLOOP_INGEST_KEY}
#     scope: ingest
#     sources: [web-01]   # only events with this source; omitted: every source
#   - key: ${ALERTLOOP_READ_KEY}
#     scope: read

# Days to keep events; the worker prunes older ones.
retention_days: 30

# Send a recovery notice to the channels that received the alert when an
# incident is resolved. Set false for a receiver that opens a ticket per message.
notify_on_resolve: true

# Logs always go to stdout; `file` adds a copy on disk.
log:
  level: "info"     # debug | info | warn | error
  format: "text"    # text | json

  # Log file path; empty means stdout only. Writable by the process (uid 10001
  # in Docker); rotate it with logrotate — see OPERATIONS.md.
  file: ${ALERTLOOP_LOG_FILE:-}

# In-process rate limiting.
rate_limit:
  enabled: true
  per_ip_per_second: 20    # requests per second per client IP (IPv6: per /64)
  per_ip_burst: 40
  ingest_per_second: 100   # overall event ingestion cap for the process
  ingest_burst: 200

  # Behind a reverse proxy, list its addresses: without it every client shares
  # the proxy's rate-limit bucket. Only these proxies' X-Forwarded-For is used.
  # trusted_proxies:
  #   - "127.0.0.1"          # nginx or Caddy on this host
  #   - "10.0.0.0/8"         # a load balancer range

database:
  # "sqlite" or "postgres"; inferred from dsn if empty.
  driver: ${ALERTLOOP_DB_DRIVER:-sqlite}
  # SQLite: a file path or ":memory:". PostgreSQL, either form:
  #   "host=HOST port=5432 user=USER dbname=alertloop sslmode=disable password=PASS"
  #   "postgres://USER:PASS@HOST:5432/alertloop?sslmode=disable"
  dsn: ${ALERTLOOP_DB_DSN:-alertloop.db}

worker:
  concurrency: 2
  poll_interval: 2s
  max_attempts: 5      # tries before a delivery is dead-lettered
  base_backoff: 30s    # first retry delay; doubles each attempt
  max_backoff: 30m     # cap on the retry delay

# Delivery channels are optional; with none, events are stored and not sent.
# Each type is a list; every channel needs a unique name.
channels:
  # email:
  #   - name: dev-email
  #     host: "smtp.example.com"
  #     port: 587
  #     username: "alerts@example.com"
  #     password: "app-password"
  #     from: "alerts@example.com"
  #     to: ["ops@example.com"]
  #     starttls: true   # require STARTTLS on a plaintext port (e.g. 587)
  #     tls: false       # implicit TLS / SMTPS (e.g. port 465)
  #     timeout: 10s     # per-delivery timeout
  #     fallback: dev-telegram   # gets this channel's alerts that dead-letter, once
  #
  # telegram:
  #   - name: dev-telegram
  #     bot_token: "123456:ABC-DEF"   # from @BotFather, written here as is
  #     chat_id: "-1001234567890"
  #     # Proxy for this channel: http, https, socks5 or socks5h (not MTProto).
  #     # proxy: "socks5://user:pass@127.0.0.1:1080"
  #     # Or a trusted Bot API mirror instead of a proxy.
  #     # api_base: "https://tg-mirror.example.com"
  #     timeout: 10s     # per-delivery timeout
  #     fallback: dev-email      # another channel's name, not this one
  #
  #   - name: customer-telegram
  #     bot_token: "123456:ABC-DEF"
  #     chat_id: "-1009876543210"
  #
  # webhook:
  #   - name: siem
  #     url: "https://example.com/alertloop-hook"
  #     secret: "shared-webhook-secret"   # HMAC-SHA256 key for X-AlertLoop-Signature
  #     timeout: 10s     # per-delivery timeout
  #     fallback: dev-email
  #
  # # The url of slack, teams and discord channels is a secret: it lets anyone post.
  # slack:             # also Mattermost and Rocket.Chat incoming webhooks
  #   - name: ops-slack
  #     url: "https://hooks.slack.com/services/T000/B000/XXXX"
  #     timeout: 10s
  #     fallback: dev-email
  #
  # teams:             # Workflows: "Send webhook alerts to a channel"
  #   - name: ops-teams
  #     url: "https://prod-00.westeurope.logic.azure.com/workflows/ID/triggers/manual/paths/invoke?sig=SIG"
  #     timeout: 10s
  #     fallback: dev-email
  #
  # discord:
  #   - name: ops-discord
  #     url: "https://discord.com/api/webhooks/ID/TOKEN"
  #     timeout: 10s
  #     fallback: dev-email
  #
  # ntfy:
  #   - name: ops-phone
  #     server: "https://ntfy.sh"     # the default; or your own server
  #     topic: "alertloop-ops-4f9c2e"  # on ntfy.sh the topic name is the password
  #     token: "tk_XXXX"               # optional access token...
  #     # username: "alertloop"        # ...or a login, not both
  #     # password: "secret"
  #     timeout: 10s
  #     fallback: dev-email
  #
  # pushover:
  #   - name: ops-pager
  #     token: "APP_TOKEN"     # application API token
  #     user_key: "USER_KEY"   # user or group key
  #     timeout: 10s
  #     fallback: dev-email

# Routing is optional; without it every event goes to every channel. With it,
# an event goes to the channels of the FIRST matching rule.
# routing:
#   rules:
#     - name: silence-healthchecks
#       match:
#         source: [healthcheck]
#       channels: []            # stored, never delivered
#
#     - name: incidents-to-dev
#       match:
#         type: [incident]      # values in one field are OR-ed...
#         min_severity: warning # ...and different fields are AND-ed
#       channels: [dev-telegram, dev-email]
#
#     - name: page-on-critical
#       match:
#         severity: [critical]  # exact levels, unlike min_severity
#       channels: [dev-telegram]
#
#     - name: orders-to-customer
#       match:
#         type: [business_event]
#         category: ["order.*"] # only a trailing "*" is supported
#       channels: [customer-telegram]
#
#   # Events matching no rule; omitted, they go nowhere (logged at warn).
#   default: [dev-telegram]