Let a TerdutServer turn on metrics from the alerts' Prometheus

terdut-server v0.49.0 graphs the metric behind each alert on the incident
page, but only queries hosts listed in TERDUT_PROMETHEUS_ALLOWED_HOSTS,
because the URL comes out of a webhook payload. An install this operator
creates had no way to set it short of spec.pod.extraEnv.

spec.prometheus takes allowedHosts, preroll and timeout and maps them to
TERDUT_PROMETHEUS_ALLOWED_HOSTS, _PREROLL and _TIMEOUT. Nothing is emitted
unless allowedHosts is non-empty, so existing TerdutServers get the same
Deployment as before, and unset durations are left to the server's defaults.
There is no CRD default for the host: which Prometheus to trust is the
deployer's call, not something this operator should assume.

The CRD in config/ is regenerated and the chart's copy carries the same
schema; the chart's optional TerdutServer passes the block through.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/terdutserver_controller_test.go

@@ -112,6 +112,7 @@ var _ = Describe("TerdutServer Controller", func() {
 			Expect(env["TERDUT_DB_DSN"].Value).To(Equal(testDSN))
 			Expect(env["TERDUT_OPERATOR_MODE"].Value).To(Equal("true"))
 			Expect(env).NotTo(HaveKey("TERDUT_DEADMAN_MATCHERS"), "dead man's switches are per team now")
+			Expect(env).NotTo(HaveKey("TERDUT_PROMETHEUS_ALLOWED_HOSTS"), "metrics stay off unless spec.prometheus asks")
 
 			var svc corev1.Service
 			Expect(k8sClient.Get(ctx, objKey, &svc)).To(Succeed())
@@ -252,6 +253,36 @@ var _ = Describe("TerdutServer Controller", func() {
 		})
 	})
 
+	Describe("spec.prometheus", func() {
+		It("passes the allowlist and tuning to the server as env vars", func(ctx SpecContext) {
+			spec := dsnSpec()
+			spec.Prometheus = terdutv1alpha1.PrometheusSpec{
+				AllowedHosts: []string{"kube-prometheus-stack-prometheus.kube-prometheus-stack:9090", "*.monitoring.svc"},
+				Preroll:      "2h",
+				Timeout:      "5s",
+			}
+			createServer(ctx, spec)
+			reconcileOnce(ctx)
+
+			env := envOf(ctx)
+			Expect(env["TERDUT_PROMETHEUS_ALLOWED_HOSTS"].Value).To(Equal("kube-prometheus-stack-prometheus.kube-prometheus-stack:9090,*.monitoring.svc"))
+			Expect(env["TERDUT_PROMETHEUS_PREROLL"].Value).To(Equal("2h"))
+			Expect(env["TERDUT_PROMETHEUS_TIMEOUT"].Value).To(Equal("5s"))
+		})
+
+		It("leaves the tuning to the server's defaults when only hosts are given", func(ctx SpecContext) {
+			spec := dsnSpec()
+			spec.Prometheus = terdutv1alpha1.PrometheusSpec{AllowedHosts: []string{"prometheus.monitoring.svc"}}
+			createServer(ctx, spec)
+			reconcileOnce(ctx)
+
+			env := envOf(ctx)
+			Expect(env).To(HaveKey("TERDUT_PROMETHEUS_ALLOWED_HOSTS"))
+			Expect(env).NotTo(HaveKey("TERDUT_PROMETHEUS_PREROLL"))
+			Expect(env).NotTo(HaveKey("TERDUT_PROMETHEUS_TIMEOUT"))
+		})
+	})
+
 	Describe("spec.pod", func() {
 		It("wires pod-level customization onto the right spot on the Deployment", func(ctx SpecContext) {
 			spec := dsnSpec()

internal/controller/terdutserver_deployment.go

@@ -216,6 +216,16 @@ func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.
 		}
 	}
 
+	if prom := srv.Spec.Prometheus; len(prom.AllowedHosts) > 0 {
+		env = append(env, corev1.EnvVar{Name: "TERDUT_PROMETHEUS_ALLOWED_HOSTS", Value: strings.Join(prom.AllowedHosts, ",")})
+		if prom.Preroll != "" {
+			env = append(env, corev1.EnvVar{Name: "TERDUT_PROMETHEUS_PREROLL", Value: prom.Preroll})
+		}
+		if prom.Timeout != "" {
+			env = append(env, corev1.EnvVar{Name: "TERDUT_PROMETHEUS_TIMEOUT", Value: prom.Timeout})
+		}
+	}
+
 	publicURL := fmt.Sprintf("https://%s", srv.Spec.Networking.Hostname)
 	env = append(env,
 		corev1.EnvVar{Name: "TERDUT_PUBLIC_URL", Value: publicURL},