New Grimoire

Gremlin-Grimoire/Workflows/Kuma-Triage.md

@@ -0,0 +1,63 @@
+---
+title: Kuma Alert Triage Workflow
+description: Uptime Kuma webhook → Ollama analysis → ntfy alert
+published: true
+date: 2026-04-12T00:00:00.000Z
+tags: gremlin, n8n, kuma, alerts
+editor: markdown
+dateCreated: 2026-04-12T00:00:00.000Z
+---
+
+# Kuma Alert Triage Workflow
+
+**Status:** ✅ Live and confirmed working
+
+Triggered by Uptime Kuma webhook on service DOWN or RECOVERED events. DOWN events are analyzed by `llama3.2:3b` before alerting. RECOVERED events skip AI and send a simple notification.
+
+---
+
+## Webhook URL
+
+```
+https://n8n.netgrimoire.com/webhook/gremlin-kuma-alert
+```
+
+Configure in Uptime Kuma: Settings → Notifications → Webhook → apply to all monitors.
+
+---
+
+## Flow
+
+```
+Kuma Webhook
+  ├── DOWN path:
+  │     → Parse payload (service name, URL, error)
+  │     → Ollama (llama3.2:3b): triage prompt
+  │     → ntfy gremlin-alerts (urgent priority) with AI analysis
+  │
+  └── RECOVERED path:
+        → ntfy gremlin-alerts (normal priority, no AI call)
+```
+
+---
+
+## Why Two Paths
+
+AI triage is only useful for DOWN events — there's nothing to analyze on a recovery. Skipping Ollama on RECOVERED keeps notification latency near-instant for good news.
+
+---
+
+## ntfy Output Format
+
+DOWN alert includes:
+- Service name and URL
+- Kuma error message
+- Ollama's triage assessment (probable cause, suggested first step)
+
+RECOVERED alert is a simple one-liner.
+
+---
+
+## Parked: Doc Generation Workflows
+
+Two additional doc generation workflows were built but are currently inactive. CPU-only `llama3.2:3b` output barely exceeds reformatting the source compose file — not useful enough to commit. Will be revisited when GPU support is added to the Gremlin stack.