groups:
  - name: base-alerts
    rules:
      - alert: InstanceDown
        expr: up == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "{{ $labels.instance }} down"
          description: "{{ $labels.job }} on {{ $labels.instance }} is not responding"

      - alert: NodeExporterDown
        expr: up{job=~"node|revproxy-node"} == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Node exporter down on {{ $labels.instance }}"
          description: "node_exporter is not responding"

      - alert: HighCPU
        expr: (1 - avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]))) > 0.90
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "High CPU on {{ $labels.instance }}"
          description: "CPU usage > 90% for 10m"

      - alert: HighMemory
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) > 0.90
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "High memory on {{ $labels.instance }}"
          description: "Memory usage > 90% for 10m"

      - alert: MemAvailableLow
        expr: (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) < 0.08
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Low available memory on {{ $labels.instance }}"
          description: "MemAvailable < 8%"

      - alert: SwapUsageHigh
        expr: (1 - (node_memory_SwapFree_bytes / node_memory_SwapTotal_bytes)) > 0.30
        for: 15m
        labels:
          severity: warning
        annotations:
          summary: "Swap usage high on {{ $labels.instance }}"
          description: "Swap usage > 30%"

      - alert: DiskFull
        expr: (node_filesystem_avail_bytes{fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay"}) < 0.10
        for: 15m
        labels:
          severity: warning
        annotations:
          summary: "Disk low on {{ $labels.instance }}"
          description: "<10% free on {{ $labels.mountpoint }}"

      - alert: DiskUsageHigh
        expr: (1 - (node_filesystem_avail_bytes{fstype!~"tmpfs|overlay",mountpoint!~"/boot/efi"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay",mountpoint!~"/boot/efi"})) > 0.85
        for: 15m
        labels:
          severity: warning
        annotations:
          summary: "Disk usage >85% on {{ $labels.instance }}"
          description: "{{ $labels.mountpoint }} usage above 85%"

      - alert: DiskUsageCritical
        expr: (1 - (node_filesystem_avail_bytes{fstype!~"tmpfs|overlay",mountpoint!~"/boot/efi"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay",mountpoint!~"/boot/efi"})) > 0.95
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Disk usage >95% on {{ $labels.instance }}"
          description: "{{ $labels.mountpoint }} usage above 95%"

      - alert: DockerContainerDown
        expr: time() - container_last_seen > 120
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "Container down"
          description: "A container has not been seen for >2m"

      - alert: HttpEndpointDown
        expr: probe_success{job="blackbox-http"} == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "HTTP endpoint down: {{ $labels.instance }}"
          description: "Blackbox probe failed"

      - alert: HttpEndpoint5xx
        expr: probe_success{job="blackbox-5xx"} == 1
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "HTTP 5xx detected: {{ $labels.instance }}"
          description: "Endpoint returned 5xx"