Niklas Ye
f344bb707b
Each alert carries a generatorURL pointing at the Prometheus rule that fired it. The server now parses that link, queries the same Prometheus for the rule's expression and draws it under the alert, with the current value beside it. The browser never talks to Prometheus, so the CSP stays at connect-src 'self'. The URL comes out of a webhook payload, so whoever holds an integration key chooses it. Querying it is therefore opt-in and bounded by an allowlist, TERDUT_PROMETHEUS_ALLOWED_HOSTS (names, "*" as one label, a leading "**" as several, IPs, CIDRs). The check runs on the address the dialer is about to use, a name that resolves to loopback or link-local is refused even when it matches, and redirects and proxy variables are ignored. A worker takes a snapshot when an incident opens and another when it closes, so the graph outlives Prometheus' retention. It finds its work in the database rather than being triggered from the webhook, so ingestion is untouched and a restart loses nothing. While an incident is open the metrics endpoint also queries live, cached for 15 seconds. The rule expression keeps its threshold, so Prometheus returns data only while the alert condition holds; "no data" for the current value means the condition cleared. Stripping the threshold needs a PromQL parser and is left out. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
Terminal Duty documentation
The README is the short tour. These pages hold the detail.
Running it
- Deployment: Docker, the Helm chart, the database, backups, and the operator.
- Configuration: environment variables and settings.
- Single sign-on: OIDC, group mapping, the terminal device flow.
Using it
- The web UI: sessions, the Team and Admin tabs.
- Alertmanager configuration: routes, integration keys and webhooks.
- Alerts and incidents: correlation, lifecycle, on-call assignment, stale-alert expiry.
- Notifications: channels and providers, ntfy pages, and acknowledging from them.
- Escalation: ladders, repeats and the fallback.
- Dead man's switches: noticing that alerts stopped arriving.
Integrating and contributing
- API reference: every endpoint, authentication and error shape.
- Service accounts: non-human credentials for automation.
- Development and releasing: tests, the CI gate, the release pipeline.