---
# ServiceMonitor for Stalwart application metrics
# Requires prometheus-operator to be installed
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: stalwart-metrics
  namespace: stalwart
  labels:
    app: stalwart
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      app: stalwart
  endpoints:
  - port: http
    interval: 30s
    path: /metrics
    scheme: http
---
# Blackbox exporter probe for external health check
# Tests the full service path from outside the cluster
apiVersion: v1
kind: Service
metadata:
  name: stalwart-external-probe
  namespace: stalwart
  labels:
    app: stalwart-probe
spec:
  type: ClusterIP
  clusterIP: None  # Headless service for probe
  selector:
    app: stalwart-probe-dummy  # No pods, just for ServiceMonitor
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: stalwart-blackbox-external
  namespace: stalwart
  labels:
    app: stalwart
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      app: stalwart-probe
  endpoints:
  - port: http
    interval: 60s
    scrapeTimeout: 30s
    path: /probe
    params:
      module: [http_2xx]
      target: ['https://mail.basicstack.de/']
    relabelings:
    - sourceLabels: [__address__]
      targetLabel: __param_target
    - sourceLabels: [__param_target]
      targetLabel: instance
    - targetLabel: __address__
      replacement: prometheus-blackbox-exporter.observability.svc.cluster.local:9115
---
# PrometheusRule for alerting on Stalwart failures
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: stalwart-alerts
  namespace: stalwart
  labels:
    app: stalwart
    release: kube-prometheus-stack
spec:
  groups:
  - name: stalwart.rules
    interval: 30s
    rules:
    - alert: StalwartDown
      expr: up{job="stalwart-metrics"} == 0
      for: 2m
      labels:
        severity: critical
        service: stalwart
        component: mail
      annotations:
        summary: "Stalwart mail service is down"
        description: "Stalwart pod in namespace {{ $labels.namespace }} has been unreachable for more than 2 minutes."

    - alert: StalwartExternalProbeFailure
      expr: probe_success{job="stalwart-blackbox-external"} == 0
      for: 5m
      labels:
        severity: critical
        service: stalwart
        component: external-access
      annotations:
        summary: "Stalwart external endpoint unreachable"
        description: "External probe to {{ $labels.instance }} has failed for more than 5 minutes. Users cannot access mail service."

    - alert: StalwartHighResponseTime
      expr: probe_http_duration_seconds{job="stalwart-blackbox-external"} > 5
      for: 5m
      labels:
        severity: warning
        service: stalwart
        component: performance
      annotations:
        summary: "Stalwart responding slowly"
        description: "Stalwart response time to {{ $labels.instance }} is {{ $value }}s (threshold: 5s)."

    - alert: StalwartPodRestarting
      expr: rate(kube_pod_container_status_restarts_total{namespace="stalwart",pod=~"stalwart-.*"}[15m]) > 0
      for: 5m
      labels:
        severity: warning
        service: stalwart
        component: stability
      annotations:
        summary: "Stalwart pod restarting"
        description: "Stalwart pod {{ $labels.pod }} has restarted {{ $value }} times in the last 15 minutes."

    - alert: StalwartBackupFailing
      expr: kube_job_status_failed{namespace="stalwart",job_name=~"stalwart-backup-.*"} > 0
      for: 1h
      labels:
        severity: warning
        service: stalwart
        component: backup
      annotations:
        summary: "Stalwart backup job failing"
        description: "Backup job {{ $labels.job_name }} has failed. Investigate backup configuration."