# Prometheus alert rules
# Aut-O — T-12 Monitoring Stack

groups:
  - name: system
    rules:
      # CPU
      - alert: HighCPUUsage
        expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High CPU usage on {{ $labels.instance }}"
          description: "CPU usage is above 80% for 5 minutes (current: {{ $value | printf \"%.1f\" }}%)."

      - alert: CriticalCPUUsage
        expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[2m])) * 100) > 95
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Critical CPU usage on {{ $labels.instance }}"
          description: "CPU usage is above 95% for 2 minutes (current: {{ $value | printf \"%.1f\" }}%)."

      # Memory
      - alert: HighMemoryUsage
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 85
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High memory usage on {{ $labels.instance }}"
          description: "Memory usage is above 85% for 5 minutes (current: {{ $value | printf \"%.1f\" }}%)."

      # Disk
      - alert: DiskSpaceLow
        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 20
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Low disk space on {{ $labels.instance }}"
          description: "Less than 20% disk space remaining on / (current: {{ $value | printf \"%.1f\" }}% free)."

      - alert: DiskSpaceCritical
        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) * 100 < 10
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Critical disk space on {{ $labels.instance }}"
          description: "Less than 10% disk space remaining on / (current: {{ $value | printf \"%.1f\" }}% free)."

  - name: services
    rules:
      # Service availability
      - alert: ServiceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Service {{ $labels.job }} is down"
          description: "{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 1 minute."

  - name: application
    rules:
      # HTTP error rate (requires app to expose http_requests_total with status code labels)
      - alert: HighErrorRate
        expr: |
          (
            sum by (instance) (rate(http_requests_total{status=~"5.."}[5m]))
            /
            sum by (instance) (rate(http_requests_total[5m]))
          ) * 100 > 5
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High HTTP error rate on {{ $labels.instance }}"
          description: "More than 5% of requests are returning 5xx status codes (current: {{ $value | printf \"%.1f\" }}%)."

      # Response latency (requires app to expose http_request_duration_seconds histogram)
      - alert: SlowResponses
        expr: histogram_quantile(0.95, sum by (le, instance) (rate(http_request_duration_seconds_bucket[5m]))) > 2
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Slow responses on {{ $labels.instance }}"
          description: "95th percentile response time is above 2 seconds (current: {{ $value | printf \"%.2f\" }}s)."

  - name: ssl
    rules:
      # SSL certificate expiry (requires blackbox_exporter or app-level metric)
      - alert: SSLCertExpiringSoon
        expr: (probe_ssl_earliest_cert_expiry - time()) / 86400 < 30
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "SSL certificate expiring soon for {{ $labels.instance }}"
          description: "SSL certificate will expire in {{ $value | printf \"%.0f\" }} days."
