Initial VPS operations handbook

ansible/roles/email_alert/templates/alert-dispatch.sh.j2

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Sends sanitized health results through the host's locally provisioned SMTP
+# credentials. The config is intentionally excluded from Ansible/Git.
+set -uo pipefail
+config='{{ email_alert_config_path }}'
+result='/var/lib/vps-health/latest.json'
+state='{{ email_alert_state_path }}'
+[[ -r "$config" && -r "$result" ]] || exit 0
+# shellcheck source=/dev/null
+source "$config"
+: "${SMTP_URL:?missing SMTP_URL in server-side alert config}"
+: "${ALERT_TO:?missing ALERT_TO in server-side alert config}"
+status="$(python3 -c 'import json; print(json.load(open("'"$result"'"))["status"])')"
+fingerprint="$(sha256sum "$result" | cut -d' ' -f1)"
+previous="$(cat "$state" 2>/dev/null || true)"
+now="$(date +%s)"
+last_time="${previous%%:*}"; last_fp="${previous#*:}"
+if [[ "$status" =~ ^(critical|unknown)$ ]] && [[ "$fingerprint" != "$last_fp" || $((now-${last_time:-0})) -ge {{ email_alert_repeat_hours }}*3600 ]]; then
+  subject="[${status}] VPS health $(hostname -f 2>/dev/null || hostname)"
+  curl --fail --silent --show-error --url "$SMTP_URL" --mail-rcpt "$ALERT_TO" --upload-file <(printf 'To: %s\nSubject: %s\nContent-Type: application/json\n\n%s\n' "$ALERT_TO" "$subject" "$(cat "$result")")
+  printf '%s:%s\n' "$now" "$fingerprint" > "$state"
+elif [[ "$status" =~ ^(ok|warning)$ ]]; then
+  subject="[${status}] daily VPS health $(hostname -f 2>/dev/null || hostname)"
+  curl --fail --silent --show-error --url "$SMTP_URL" --mail-rcpt "$ALERT_TO" --upload-file <(printf 'To: %s\nSubject: %s\nContent-Type: application/json\n\n%s\n' "$ALERT_TO" "$subject" "$(cat "$result")")
+fi

ansible/roles/email_alert/templates/alerting.conf.j2

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPost=/usr/local/lib/vps-health/alert-dispatch