====== Nastavitev opozarjanja ======

<WRAP round info>
**Kompleksnost:** Nizka-Srednja \\
**Trajanje:** 30-60 minut nastavitve \\
**Cilj:** Proaktivno obveščanje ob težavah s PKI
</WRAP>

Konfiguracija opozarjanja za PKI nadzor z različnimi kanali za obveščanje.

----

===== Arhitektura =====

<mermaid>
flowchart LR
    subgraph TRIGGER["SPROŽILEC"]
        T1[Prometheus opozorilo]
        T2[Grafana opozorilo]
        T3[Skripta po meri]
    end

    subgraph ROUTE["USMERJANJE"]
        R[Alertmanager]
    end

    subgraph NOTIFY["OBVEŠČANJE"]
        N1[E-pošta]
        N2[Slack]
        N3[MS Teams]
        N4[PagerDuty]
        N5[OpsGenie]
    end

    T1 --> R
    T2 --> R
    T3 --> R
    R --> N1 & N2 & N3 & N4 & N5

    style R fill:#fff3e0
    style N4 fill:#e8f5e9
</mermaid>

----

===== Kategorije opozoril =====

| Kategorija | Primeri | Resnost | Odziv |
|------------|---------|---------|-------|
| **Kritično** | Certifikat potekel, CA nedostopen | P1 | Takoj |
| **Opozorilo** | Certifikat < 7 dni, CRL < 24h | P2 | 4h |
| **Info** | Certifikat < 30 dni | P3 | Naslednji delovni dan |

----

===== Prometheus Alertmanager =====

==== Namestitev ====

<code bash>
# Prenos Alertmanager
wget https://github.com/prometheus/alertmanager/releases/download/v0.27.0/alertmanager-0.27.0.linux-amd64.tar.gz
tar xzf alertmanager-*.tar.gz
sudo mv alertmanager-*/alertmanager /usr/local/bin/
sudo mv alertmanager-*/amtool /usr/local/bin/
</code>

==== Konfiguracija ====

<code yaml>
# /etc/alertmanager/alertmanager.yml
global:
  resolve_timeout: 5m
  smtp_smarthost: 'smtp.example.com:587'
  smtp_from: 'alertmanager@example.com'
  smtp_auth_username: 'alertmanager'
  smtp_auth_password: 'secret'

route:
  receiver: 'default'
  group_by: ['alertname', 'severity']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h

  routes:
    # Kritična PKI opozorila → PagerDuty + E-pošta
    - match:
        severity: critical
        job: pki
      receiver: 'pki-critical'
      repeat_interval: 15m

    # Opozorila → E-pošta + Slack
    - match:
        severity: warning
        job: pki
      receiver: 'pki-warning'
      repeat_interval: 4h

    # Info → samo Slack
    - match:
        severity: info
        job: pki
      receiver: 'pki-info'
      repeat_interval: 24h

receivers:
  - name: 'default'
    email_configs:
      - to: 'ops@example.com'

  - name: 'pki-critical'
    email_configs:
      - to: 'pki-team@example.com'
        send_resolved: true
    pagerduty_configs:
      - service_key: '<PAGERDUTY_SERVICE_KEY>'
        severity: critical
    slack_configs:
      - api_url: '<SLACK_WEBHOOK_URL>'
        channel: '#pki-alerts'
        title: 'PKI KRITIČNO: {{ .GroupLabels.alertname }}'
        text: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'

  - name: 'pki-warning'
    email_configs:
      - to: 'pki-team@example.com'
    slack_configs:
      - api_url: '<SLACK_WEBHOOK_URL>'
        channel: '#pki-alerts'
        title: 'PKI opozorilo: {{ .GroupLabels.alertname }}'

  - name: 'pki-info'
    slack_configs:
      - api_url: '<SLACK_WEBHOOK_URL>'
        channel: '#pki-info'
        title: 'PKI info: {{ .GroupLabels.alertname }}'

inhibit_rules:
  # Zadrži opozorila ko je kritično aktivno
  - source_match:
      severity: 'critical'
    target_match:
      severity: 'warning'
    equal: ['alertname']
</code>

==== Systemd storitev ====

<code ini>
# /etc/systemd/system/alertmanager.service
[Unit]
Description=Prometheus Alertmanager
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/alertmanager \
    --config.file=/etc/alertmanager/alertmanager.yml \
    --storage.path=/var/lib/alertmanager
Restart=always

[Install]
WantedBy=multi-user.target
</code>

----

===== Microsoft Teams =====

<code yaml>
# Alertmanager Teams Webhook
receivers:
  - name: 'pki-teams'
    webhook_configs:
      - url: 'https://outlook.office.com/webhook/...'
        send_resolved: true
        http_config:
          bearer_token: ''
</code>

**Predloga Teams Message Card:**

<code json>
{
  "@type": "MessageCard",
  "@context": "http://schema.org/extensions",
  "themeColor": "{{ if eq .Status \"firing\" }}FF0000{{ else }}00FF00{{ end }}",
  "summary": "PKI opozorilo: {{ .GroupLabels.alertname }}",
  "sections": [{
    "activityTitle": "{{ .GroupLabels.alertname }}",
    "activitySubtitle": "{{ .Status | toUpper }}",
    "facts": [
      {{ range .Alerts }}
      {
        "name": "{{ .Labels.instance }}",
        "value": "{{ .Annotations.summary }}"
      },
      {{ end }}
    ],
    "markdown": true
  }],
  "potentialAction": [{
    "@type": "OpenUri",
    "name": "Odpri navodila",
    "targets": [{
      "os": "default",
      "uri": "{{ (index .Alerts 0).Annotations.runbook_url }}"
    }]
  }]
}
</code>

----

===== Slack =====

<code yaml>
# Alertmanager Slack konfiguracija
receivers:
  - name: 'pki-slack'
    slack_configs:
      - api_url: 'https://hooks.slack.com/services/xxx/yyy/zzz'
        channel: '#pki-alerts'
        username: 'PKI-Alertmanager'
        icon_emoji: ':lock:'
        send_resolved: true
        title: '{{ template "slack.title" . }}'
        text: '{{ template "slack.text" . }}'
        actions:
          - type: button
            text: 'Navodila'
            url: '{{ (index .Alerts 0).Annotations.runbook_url }}'
          - type: button
            text: 'Nadzorna plošča'
            url: 'https://grafana.example.com/d/pki'
</code>

----

===== PagerDuty =====

<code yaml>
# Alertmanager PagerDuty integracija
receivers:
  - name: 'pki-pagerduty'
    pagerduty_configs:
      - service_key: '<INTEGRATION_KEY>'
        severity: '{{ if eq .GroupLabels.severity "critical" }}critical{{ else }}warning{{ end }}'
        description: '{{ .GroupLabels.alertname }}: {{ .CommonAnnotations.summary }}'
        details:
          firing: '{{ template "pagerduty.firing" . }}'
          num_firing: '{{ .Alerts.Firing | len }}'
          num_resolved: '{{ .Alerts.Resolved | len }}'
</code>

----

===== E-poštne predloge =====

<code yaml>
# /etc/alertmanager/templates/email.tmpl
{{ define "email.subject" }}
[{{ .Status | toUpper }}] PKI opozorilo: {{ .GroupLabels.alertname }}
{{ end }}

{{ define "email.html" }}
<!DOCTYPE html>
<html>
<head>
  <style>
    .critical { background-color: #ffebee; border-left: 4px solid #f44336; }
    .warning { background-color: #fff3e0; border-left: 4px solid #ff9800; }
    .resolved { background-color: #e8f5e9; border-left: 4px solid #4caf50; }
  </style>
</head>
<body>
  <h2>PKI opozorilo: {{ .GroupLabels.alertname }}</h2>
  <p>Status: <strong>{{ .Status | toUpper }}</strong></p>

  {{ range .Alerts }}
  <div class="{{ .Labels.severity }}">
    <h3>{{ .Labels.instance }}</h3>
    <p><strong>Povzetek:</strong> {{ .Annotations.summary }}</p>
    <p><strong>Opis:</strong> {{ .Annotations.description }}</p>
    {{ if .Annotations.runbook_url }}
    <p><a href="{{ .Annotations.runbook_url }}">Odpri navodila</a></p>
    {{ end }}
  </div>
  {{ end }}

  <hr>
  <p>
    <a href="https://grafana.example.com/d/pki">Nadzorna plošča</a> |
    <a href="https://alertmanager.example.com">Alertmanager</a>
  </p>
</body>
</html>
{{ end }}
</code>

----

===== Pravila opozoril s povezavami na navodila =====

<code yaml>
# /etc/prometheus/rules/pki-alerts.yml
groups:
  - name: pki-alerts
    rules:
      - alert: CertificateExpiringSoon
        expr: x509_cert_not_after - time() < 7 * 86400
        for: 1h
        labels:
          severity: warning
          team: pki
        annotations:
          summary: "Certifikat {{ $labels.filepath }} poteče v < 7 dneh"
          description: "Preostali čas: {{ $value | humanizeDuration }}"
          runbook_url: "https://wiki.example.com/pki/runbook/zertifikat-erneuern"

      - alert: CertificateExpired
        expr: x509_cert_not_after - time() < 0
        labels:
          severity: critical
          team: pki
        annotations:
          summary: "KRITIČNO: Certifikat {{ $labels.filepath }} je POTEKEL"
          runbook_url: "https://wiki.example.com/pki/runbook/zertifikat-ausstellen"

      - alert: CANotReachable
        expr: up{job="ca"} == 0
        for: 2m
        labels:
          severity: critical
          team: pki
        annotations:
          summary: "CA strežnik ni dosegljiv"
          runbook_url: "https://wiki.example.com/pki/runbook/ca-troubleshooting"
</code>

----

===== Grafana opozarjanje (alternativa) =====

<code yaml>
# Grafana pravilo opozorila (UI ali Provisioning)
apiVersion: 1
groups:
  - orgId: 1
    name: PKI Alerts
    folder: PKI
    interval: 1m
    rules:
      - uid: cert-expiry-warning
        title: Certificate Expiring Soon
        condition: B
        data:
          - refId: A
            relativeTimeRange:
              from: 600
              to: 0
            datasourceUid: prometheus
            model:
              expr: x509_cert_not_after - time() < 7 * 86400
          - refId: B
            datasourceUid: '-100'
            model:
              conditions:
                - evaluator:
                    params: [0]
                    type: gt
                  operator:
                    type: and
                  query:
                    params: [A]
                  reducer:
                    type: count
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: Certifikat kmalu poteče
</code>

----

===== Test in validacija =====

<code bash>
# Preverjanje konfiguracije Alertmanager
amtool check-config /etc/alertmanager/alertmanager.yml

# Pošiljanje testnega opozorila
amtool alert add alertname=TestAlert severity=warning instance=test \
    --alertmanager.url=http://localhost:9093

# Prikaz aktivnih opozoril
amtool alert --alertmanager.url=http://localhost:9093

# Ustvarjanje utišanja (npr. za vzdrževanje)
amtool silence add alertname=CertificateExpiringSoon \
    --alertmanager.url=http://localhost:9093 \
    --comment="Načrtovano vzdrževanje" \
    --duration=2h
</code>

----

===== Kontrolni seznam =====

| # | Kontrolna točka | |
|---|-----------------|---|
| 1 | Alertmanager nameščen | |
| 2 | Usmerjanje konfigurirano | |
| 3 | E-poštni prejemnik | |
| 4 | Slack/Teams Webhook | |
| 5 | PagerDuty integracija | |
| 6 | Pravila opozoril definirana | |
| 7 | Povezave na navodila vstavljene | |
| 8 | Testno opozorilo poslano | |

----

===== Povezana dokumentacija =====

  * [[.:ablauf-monitoring|Nadzor izteka]] – Zbiranje metrik
  * [[..:tagesgeschaeft:start|Vsakodnevno poslovanje]] – Navodila
  * [[.:audit-logging|Revizijsko beleženje]] – Beleženje dogodkov

----

<< [[.:audit-logging|← Revizijsko beleženje]] | [[..:start|→ Scenariji za operaterje]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>alerting prometheus alertmanager slack teams pagerduty operator}}