# GoAlert — Cloudron Package

[GoAlert](https://github.com/target/goalert) v0.34.1 — Target's open-source
on-call alerting: escalation chains, schedules and rotations, notification
rules (Slack, Twilio SMS/voice, VictorOps, ...), heartbeats, status
dashboards. A **single Go binary** with PostgreSQL as its only store —
packaged as an official-image wrapper around `goalert/goalert`
(digest-pinned), the cleanest Cloudron shape in this workspace.

## Authentication (auth gate: ✅ OIDC preferred)

Generic OpenID Connect is first-class in core (`config/config.go` OIDC
struct on go-oidc — any compliant issuer). `start.sh` wires it from the
Cloudron platform provider:

| GoAlert env | Source |
|-------------|--------|
| `GOALERT_OIDC_ENABLE=true` | fixed |
| `GOALERT_OIDC_ISSUER_URL` | `CLOUDRON_OIDC_ISSUER` |
| `GOALERT_OIDC_CLIENT_ID` | `CLOUDRON_OIDC_CLIENT_ID` |
| `GOALERT_OIDC_CLIENT_SECRET` | `CLOUDRON_OIDC_CLIENT_SECRET` |
| `GOALERT_OIDC_NEWUSERS=true` | overridable (`GOALERT_OIDC_NEWUSERS`) |

- SSO redirect: `https://<app-domain>/api/v2/identity/providers/oidc/callback`
- OIDC-registered users are created **without** privileges. First admin:
  set `GOALERT_ADMIN_USER` + `GOALERT_ADMIN_PASS` app env vars once —
  start.sh exposes them as basic auth — log in, promote your SSO account,
  then unset them (README + `.env.example`).

## Runtime layout

| Concern | How |
|---------|-----|
| Database | Cloudron `postgresql` addon; migrations run automatically at startup |
| Encryption key | `GOALERT_DATA_ENCRYPTION_KEY` generated once, persisted in `/app/data` (rotating loses provider credentials) |
| Public URL | `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN` |
| Notifications | All outbound (Slack/Twilio/webhooks) — no inbound ports beyond 8081 |
| Storage | `/app/data` (localstorage) — key + future runtime files |

## Notes

- Version upgrades: bump tag+digest in the Dockerfile, rebuild —
  migrations run on first boot.
- Package pattern + verification: repo `JOURNAL.md`, GoAlert section.