stack.basicstack.de/apps/stalwart/stalwart-monitoring.yaml

---
# PrometheusRule for Stalwart alerting
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: stalwart-alerts
  namespace: mail
  labels:
    app: stalwart
    prometheus: kube-prometheus-stack
    release: kube-prometheus-stack
spec:
  groups:
  - name: stalwart.rules
    interval: 30s
    rules:
    # Pod availability alert
    - alert: StalwartPodDown
      expr: kube_pod_status_phase{namespace="mail", pod=~"stalwart-.*", phase!="Running"} == 1
      for: 5m
      labels:
        severity: critical
        component: mail
      annotations:
        summary: "Stalwart mail server pod is down"
        description: "Stalwart pod {{ $labels.pod }} in namespace {{ $labels.namespace }} has been down for more than 5 minutes."

    # Container restart alert
    - alert: StalwartContainerRestarting
      expr: rate(kube_pod_container_status_restarts_total{namespace="mail", pod=~"stalwart-.*"}[15m]) > 0
      for: 5m
      labels:
        severity: warning
        component: mail
      annotations:
        summary: "Stalwart container is restarting"
        description: "Stalwart container in pod {{ $labels.pod }} has restarted {{ $value }} times in the last 15 minutes."

    # Memory usage alert
    - alert: StalwartHighMemoryUsage
      expr: |
        (container_memory_working_set_bytes{namespace="mail", pod=~"stalwart-.*", container="stalwart"}
        / container_spec_memory_limit_bytes{namespace="mail", pod=~"stalwart-.*", container="stalwart"}) > 0.85
      for: 10m
      labels:
        severity: warning
        component: mail
      annotations:
        summary: "Stalwart memory usage is high"
        description: "Stalwart container {{ $labels.pod }} is using {{ $value | humanizePercentage }} of its memory limit."

    # CPU usage alert
    - alert: StalwartHighCPUUsage
      expr: |
        (rate(container_cpu_usage_seconds_total{namespace="mail", pod=~"stalwart-.*", container="stalwart"}[5m])
        / container_spec_cpu_quota{namespace="mail", pod=~"stalwart-.*", container="stalwart"}
        * container_spec_cpu_period{namespace="mail", pod=~"stalwart-.*", container="stalwart"}) > 0.85
      for: 10m
      labels:
        severity: warning
        component: mail
      annotations:
        summary: "Stalwart CPU usage is high"
        description: "Stalwart container {{ $labels.pod }} is using {{ $value | humanizePercentage }} of its CPU limit."

    # Disk usage alert for PVC
    - alert: StalwartDiskSpaceLow
      expr: |
        (kubelet_volume_stats_used_bytes{namespace="mail", persistentvolumeclaim="stalwart-data"}
        / kubelet_volume_stats_capacity_bytes{namespace="mail", persistentvolumeclaim="stalwart-data"}) > 0.75
      for: 5m
      labels:
        severity: warning
        component: mail
      annotations:
        summary: "Stalwart disk space is running low"
        description: "Stalwart PVC stalwart-data is {{ $value | humanizePercentage }} full. Consider expanding the volume."

    - alert: StalwartDiskSpaceCritical
      expr: |
        (kubelet_volume_stats_used_bytes{namespace="mail", persistentvolumeclaim="stalwart-data"}
        / kubelet_volume_stats_capacity_bytes{namespace="mail", persistentvolumeclaim="stalwart-data"}) > 0.90
      for: 5m
      labels:
        severity: critical
        component: mail
      annotations:
        summary: "Stalwart disk space is critically low"
        description: "Stalwart PVC stalwart-data is {{ $value | humanizePercentage }} full. Immediate action required!"

    # PVC availability alert
    - alert: StalwartPVCNotBound
      expr: kube_persistentvolumeclaim_status_phase{namespace="mail", persistentvolumeclaim="stalwart-data", phase!="Bound"} == 1
      for: 5m
      labels:
        severity: critical
        component: mail
      annotations:
        summary: "Stalwart PVC is not bound"
        description: "Stalwart PVC stalwart-data is in {{ $labels.phase }} state. Mail data may be unavailable."