[fredkanwai]

Summary

Improve monitoring coverage and harden docker-compose configuration

What was solved

#92 — Add alerts for pod restarts, certificate expiry and frontend availability

Extend the Prometheus monitoring config with blackbox_exporter probes for the public URL and TLS certificate expiry, add kube-state-metrics based pod restart/CrashLoopBackOff alerts, and add a Postgres database size alert. Changes are confined to monitoring/prometheus.yml (scrape configs for blackbox and kube-state-metrics) and monitoring/alert-rules.yml (new alert rules), matching the issue's stated scope.

Addressed:

• Changed: monitoring/alert-rules.yml, monitoring/prometheus.yml
• Add blackbox_exporter probe scrape configs in monitoring/prometheus.yml for the public URL (HTTP availability) and TLS certificate expiry
• Add alert rules in monitoring/alert-rules.yml for frontend/public URL downtime and certificate expiry based on blackbox probe metrics
• Add kube-state-metrics restart alerts (e.g. CrashLoopBackOff / container restart count) in monitoring/alert-rules.yml

#93 — prometheus.yml labels local compose metrics as environment=production

Update monitoring/prometheus.yml so external_labels.environment is no longer hard-coded to production; make it configurable via environment variable expansion with a local default suitable for docker-compose, while preserving production behavior when explicitly set.

Addressed:

• Changed: monitoring/prometheus.yml, docker-compose.yml, .env.example
• Change external_labels.environment in monitoring/prometheus.yml to be configurable (env expansion) or default to local for compose
• Keep production deployments able to set environment=production explicitly
• Limit changes to monitoring/prometheus.yml (and only if strictly necessary, related compose/env wiring)

#94 — docker-compose.yml uses ${PWD} for the Dockerfile path

Fix docker-compose.yml so the backend build no longer relies on the shell-specific ${PWD} variable for the Dockerfile path. Use a path relative to the build context (or additional_contexts) so compose works when invoked with -f from another directory and on Windows shells where PWD is unset.

Addressed:

• Changed: docker-compose.yml
• Replace dockerfile: ${PWD}/backend/Dockerfile with a path relative to the build context (e.g. dockerfile: Dockerfile with context: ./backend) or use additional_contexts
• Ensure the compose file resolves correctly when run with -f from a different working directory
• Ensure it works on Windows shells where PWD is unset

#95 — Bind Postgres and monitoring ports to localhost in compose

Update docker-compose.yml so Postgres, Prometheus, and Alertmanager published ports bind to 127.0.0.1 by default using ${PORT} interpolation, preventing exposure on all interfaces while preserving existing service configuration.

Addressed:

• Changed: docker-compose.yml
• Modify docker-compose.yml only (primary scope).
• Change Postgres port mapping to 127.0.0.1:${POSTGRES_PORT:-5432}:5432 (or equivalent ${PORT} pattern).
• Change Prometheus port mapping to 127.0.0.1:${PROMETHEUS_PORT:-9090}:9090.

Changes

• monitoring/alert-rules.yml (modify)
• monitoring/prometheus.yml (modify)
• docker-compose.yml (modify)
• .env.example (modify)

Approach

1. Add alerts for pod restarts, certificate expiry and frontend availability #92 — Add alerts for pod restarts, certificate expiry and frontend availability (Changed: monitoring/alert-rules.yml, monitoring/prometheus.yml)
2. prometheus.yml labels local compose metrics as environment=production #93 — prometheus.yml labels local compose metrics as environment=production (Changed: monitoring/prometheus.yml, docker-compose.yml, .env.example)
3. docker-compose.yml uses ${PWD} for the Dockerfile path #94 — docker-compose.yml uses ${PWD} for the Dockerfile path (Changed: docker-compose.yml)
4. Bind Postgres and monitoring ports to localhost in compose #95 — Bind Postgres and monitoring ports to localhost in compose (Changed: docker-compose.yml)

Issues

Closes #92
Closes #93
Closes #94
Closes #95

[drips-wave]

@fredkanwai Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits