31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
---
|
||
title: Alert Routing
|
||
description: How security alerts flow through Netgrimoire
|
||
published: true
|
||
date: 2026-04-12T00:00:00.000Z
|
||
tags: ward, alerts, ntfy
|
||
editor: markdown
|
||
dateCreated: 2026-04-12T00:00:00.000Z
|
||
---
|
||
|
||
# Alert Routing
|
||
|
||
All Netgrimoire alerts route through self-hosted ntfy at `ntfy.netgrimoire.com`.
|
||
|
||
## ntfy Topics
|
||
|
||
| Topic | Source | Purpose |
|
||
|-------|--------|---------|
|
||
| `netgrimoire-diun` | DIUN | Docker image update notifications |
|
||
| `netgrimoire-media` | Sonarr, Radarr, SABnzbd | Download and media events |
|
||
| `netgrimoire-backup` | Kopia | Backup completion and errors |
|
||
| `gremlin-alerts` | n8n Kuma triage workflow | AI-analyzed service DOWN alerts |
|
||
| `gremlin-audits` | n8n Forgejo audit workflow | Weekly YAML audit summaries |
|
||
|
||
## Alert Sources
|
||
|
||
**OPNsense → ntfy:** CrowdSec HTTP plugin (`/usr/local/etc/crowdsec/notifications/ntfy.yaml`) + Monit script (`/usr/local/bin/ntfy-alert.sh`). See [OPNsense Alerts](/Ward-Grimoire/Notifications/OPNsense-Alerts).
|
||
|
||
**Uptime Kuma → Gremlin → ntfy:** Kuma webhook fires on DOWN/RECOVERED → n8n triage workflow → Ollama analysis (DOWN path only) → ntfy `gremlin-alerts`. See [Gremlin Kuma Triage](/Gremlin-Grimoire/Workflows/Kuma-Triage).
|
||
|
||
**DIUN → ntfy:** Docker image update watcher. Schedule: every 6 hours. Priority must be integer (1–5), not string `"default"`.
|