98341e3603
The notification policy and contact points live in `infrastructure/grafana/provisioning/alerting/alerts.yml`, so UI-created contact points can't be attached to provisioned alerts. Provision the Pushover integration instead. Rather than add a second contact point and do the fan-out in the notification tree (Grafana's tree only fires one receiver per match without duplication workarounds), put both email + pushover under a single `default` contact point. Every alert now fans out to both. Secrets go to SOPS `secrets.infra.env`. The Grafana container reads `PUSHOVER_API_TOKEN` and `PUSHOVER_USER_KEY_ULLRICH` from env; the provisioning YAML references them via `$VAR` and Grafana substitutes at startup, so no secret lands in git. Priority 1 on firing (bypass quiet hours), 0 on resolve. User can tweak in the YAML later. Post-deploy: delete the UI-created "Pushover Ullrich" contact point in Grafana to avoid a duplicate. It's unused (no policy references it) but shows up in the contact-point list. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
17 lines
2.8 KiB
Bash
17 lines
2.8 KiB
Bash
#ENC[AES256_GCM,data:JvvZXUiIkpPVV/11ClLHHjghySNGUl7Y6LYgetLwZem2Y4nLRT8O/puqPaoUErBtFadZvv3jHYg0GYNGdjs=,iv:qEqWxBu2lIj6eF1QdHwzbtilEKAWvkPX+/ej1Mz33tA=,tag:RKhE8NJ0CCP6VSInIm43MA==,type:comment]
|
|
#ENC[AES256_GCM,data:IYPyc8spVmPQu+QmC8xHM2B250LuaVe/Co8jGqqu/dYsUGrN4MMUT9S3xsFrzu+qbmZFoiWuFRwvKnpkv83JP+Oiab7TNEJkU16lRmTAvw==,iv:tbsQLbSMbJCCOqlZZCTxsC9+0FJWXIoX7VuxXGhcV/8=,tag:SSBO6GlROMsUS/fIJELZ8g==,type:comment]
|
|
GF_AUTH_GITHUB_CLIENT_ID=ENC[AES256_GCM,data:htq48rFOLrBxXoHeQMDXS0cM3Hs=,iv:8w5H6sMr8zXqFGFSaCeiSEfZhR4ETN4ypUzHNxcvNN4=,tag:qkdBnizdOxOQ87JzGxwy1g==,type:str]
|
|
GF_AUTH_GITHUB_CLIENT_SECRET=ENC[AES256_GCM,data:tTkVsYmNgLKxbv8QVyHR52RAJNmX9L//8W/hfXK2jSvkkODNIQ7Y8A==,iv:QN7AhtS0iv4WQtwmetp8KYXbiOJpHC4lhKVxgpljng4=,tag:0c+zp4h7X/ibQHY/vebp8g==,type:str]
|
|
GRAFANA_DB_PASSWORD=ENC[AES256_GCM,data:aPA1BvrPUsUOwWZClrQfbdlUqOS5OpmSME7h9/m1DC0=,iv:fTpP7czGHZGUdbGE8lDVN61iQ/XyWQ9yt0B8jArjTs4=,tag:GGHgXehE6H1SSQq/P23nzw==,type:str]
|
|
GRAFANA_SERVICE_TOKEN=ENC[AES256_GCM,data:en8+/UsM/wy7Y3Ae9N0p7WgQsq+PlHdNdHeoya3qw3jLVHuB+bF6ZXqoliDmuw==,iv:UKXgtPTtvKRnG9/pHFGU0LniGB7d+RlS4x5KpF/kvZA=,tag:m1sz/9l+HRIfTENagCmeeg==,type:str]
|
|
GF_SMTP_HOST=ENC[AES256_GCM,data:rfGovWBsyxZsQ6sSv20/Sui0Pcww,iv:t4dlQXafGVYcE62udWGSwVcl/puz4yr52xLhczytsGw=,tag:TZvQpsdxJI4F9YPbiwOAhA==,type:str]
|
|
GF_SMTP_USER=ENC[AES256_GCM,data:R80opLVhdfTz9eK+jw5Enni5,iv:4lS+qDLIYBb3Pm6e70lOOLQQzWNGasI8xU8IMjSE8Tc=,tag:VJTSK+r7rMgFZvCtFLFruw==,type:str]
|
|
GF_SMTP_PASSWORD=ENC[AES256_GCM,data:GUREzRWoUpRKicl0hyRsGQ==,iv:Yv64LhLcJ/aDW+0zMcrlgFDMTxuIfSS8BZmp3TYAcvU=,tag:OEReZeEgxqbblGgUp2E6iw==,type:str]
|
|
PUSHOVER_API_TOKEN=ENC[AES256_GCM,data:Q3WyEbN1lZpwt4gK92kyLlNaCYkMUe+Fx1OHxEvD,iv:wRtn2YCAhMdBI/m4cDd1AhRp0G3eN8i870msO2TJhLc=,tag:98RMeJM3myxDZvyLbP2YKg==,type:str]
|
|
PUSHOVER_USER_KEY_ULLRICH=ENC[AES256_GCM,data:Hkc9KpZVHyJyr1MfGaG3PUiJagpkkAWbHUjEopQ0,iv:iVhIb/kpa+eo0qOBqCtyli/lEnzPrXTN+rMHyhyCq2Q=,tag:zWX99z4jIc/eNCSCykGSwQ==,type:str]
|
|
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwOFVLYi9VYlRQdWwzK0g3\nNmRwemxjeU5zYWhPRzIxbzJWc0E2cXNYN2xRClVYUlkxWnIreUhtZ044dkhBeFBk\ncW9YZi9RN1E0Qjg4cVp4T2ZPaGR4WEUKLS0tIGFxQTV2blhzSmUvT2ljeFN2blVj\na3l1NGc5dEtZYkNJZG1GYlo2YXM3OVEKd1UVotkdkOqaA23UeEJckItDV7HU72uO\nH7Nza9clHgQwXqwYFFxBBAPRiVo/aX+J+jXELNp2fA/Wt/66SjrBig==\n-----END AGE ENCRYPTED FILE-----\n
|
|
sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
|
|
sops_lastmodified=2026-04-24T17:04:54Z
|
|
sops_mac=ENC[AES256_GCM,data:zlgyPMPgTw8w6kWjWhbsSy9BmhydUDz9PPUO/X1hx/ABczG5gwcoMQ14Dv6z/FT+uFlNxauWlRkOIaOujlaDLd/zqOAodhG4gqELPsq0swVFxVZbdvY2R8EL4eOYPq7vKBUFrXm2M8NS9Su43tXkZcbm3g7bRNTz4Zm0NQjobCw=,iv:wSY8/Advd7gJ8QnXsyk1YWCjAtRQ7m1BRxGe0LDtAmM=,tag:yfFD0HO9iRU10TubqRFoVg==,type:str]
|
|
sops_unencrypted_suffix=_unencrypted
|
|
sops_version=3.12.2
|