M44: harden release integrity and assurance

compose.observability.yaml

@@ -15,6 +15,33 @@ services:
     restart: unless-stopped
     networks: [mobilityops]
 
+  alertmanager:
+    image: prom/alertmanager:v0.33.1@sha256:9e082985f56f4c8c9f724e18f2288c6708f472e56a5286b8863d080434ea065d
+    profiles: ["observability"]
+    entrypoint: ["/bin/sh", "-ec"]
+    command:
+      - >-
+        sed -e "s|__WEBHOOK_URL__|$${ALERTMANAGER_WEBHOOK_URL}|g"
+        -e "s|__WEBHOOK_TOKEN__|$${MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN}|g"
+        /etc/alertmanager/template.yml > /tmp/alertmanager.yml
+        && exec /bin/alertmanager --config.file=/tmp/alertmanager.yml
+        --storage.path=/alertmanager
+    environment:
+      ALERTMANAGER_WEBHOOK_URL: ${ALERTMANAGER_WEBHOOK_URL:-https://n8n.itworx.tech/webhook/mobilityops-alerts}
+      MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN: ${MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN:?Set the n8n webhook trigger token}
+    volumes:
+      - ./deploy/observability/alertmanager.yml:/etc/alertmanager/template.yml:ro
+      - mobilityops-alertmanager:/alertmanager
+    ports:
+      - "127.0.0.1:19093:9093"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9093/-/ready"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+    networks: [mobilityops]
+
   grafana:
     image: grafana/grafana:12.2.0@sha256:74144189b38447facf737dfd0f3906e42e0776212bf575dc3334c3609183adf7
     profiles: ["observability"]
@@ -29,10 +56,11 @@ services:
       - mobilityops-grafana:/var/lib/grafana
     ports:
       - "127.0.0.1:13000:3000"
-    depends_on: [prometheus]
+    depends_on: [prometheus, alertmanager]
     restart: unless-stopped
     networks: [mobilityops]
 
 volumes:
   mobilityops-prometheus:
   mobilityops-grafana:
+  mobilityops-alertmanager: