##############################################################
# GMLM Platform — Alertmanager Configuration
# Routes Prometheus alerts to Slack, email, PagerDuty
##############################################################

global:
  resolve_timeout: 5m
  smtp_smarthost:  '${SMTP_HOST}:587'
  smtp_from:       'alerts@${DOMAIN}'
  smtp_auth_username: '${SMTP_USERNAME}'
  smtp_auth_password: '${SMTP_PASSWORD}'

# ── Routing ─────────────────────────────────────────────────
route:
  group_by:          ['alertname', 'deployment']
  group_wait:        30s     # Wait before sending first notification (group multiple alerts)
  group_interval:    5m      # Wait before sending more notifications for the same group
  repeat_interval:   4h      # Resend unresolved alerts every 4 hours
  receiver:          slack-warnings

  routes:
    # Critical alerts → Slack #alerts-critical + PagerDuty + email
    - match:
        severity: critical
      receiver:          critical-channel
      group_wait:        0s   # Send critical alerts immediately
      repeat_interval:   1h   # Repeat every hour until resolved

    # Alerts with page=true → PagerDuty on-call escalation
    - match:
        page: "true"
      receiver: pagerduty

    # Security alerts → separate channel
    - match_re:
        alertname: 'SSL.*|Security.*'
      receiver: security-channel

# ── Receivers ────────────────────────────────────────────────
receivers:

  - name: slack-warnings
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel:  '#gmlm-alerts'
        title:    '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
        text: |
          *Severity:* {{ .CommonLabels.severity }}
          *Deployment:* {{ .CommonLabels.deployment }}
          {{ range .Alerts }}
          • {{ .Annotations.description }}
          {{ if .Annotations.runbook }}  📖 <{{ .Annotations.runbook }}|Runbook>{{ end }}
          {{ end }}
        color: |
          {{ if eq .Status "firing" }}
            {{ if eq .CommonLabels.severity "critical" }}danger{{ else }}warning{{ end }}
          {{ else }}good{{ end }}
        send_resolved: true

  - name: critical-channel
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel:  '#gmlm-critical'
        title:    '🚨 CRITICAL: {{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
        color:    danger
        send_resolved: true
    email_configs:
      - to:       '${ADMIN_EMAIL}'
        subject:  '[CRITICAL] GMLM Alert: {{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
        html:     '{{ template "email.default.html" . }}'
        send_resolved: true

  - name: pagerduty
    pagerduty_configs:
      - service_key: '${PAGERDUTY_SERVICE_KEY}'
        description: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
        severity:    critical

  - name: security-channel
    slack_configs:
      - api_url: '${SLACK_WEBHOOK_URL}'
        channel:  '#gmlm-security'
        title:    '🔒 Security Alert: {{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
        color:    warning

# ── Inhibition rules ────────────────────────────────────────
# Suppress lower-severity alerts when a higher-severity one is firing
# for the same service (prevents alert spam during outages)
inhibit_rules:
  - source_match:
      severity: critical
    target_match:
      severity: warning
    equal: ['deployment', 'instance']
