mrcharles
b9bc032d2b
Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned), single Go binary + postgresql only. Native generic OIDC wired from the platform provider (GOALERT_OIDC_*), data-encryption key persisted, optional first-admin basic auth. grind-stack verified: full migration chain, serving, origin canonicalization correct. 18th package; category table reconciled to the 46-app set.
45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# GoAlert — Cloudron Package
|
|
|
|
[GoAlert](https://github.com/target/goalert) v0.34.1 — Target's open-source
|
|
on-call alerting: escalation chains, schedules and rotations, notification
|
|
rules (Slack, Twilio SMS/voice, VictorOps, ...), heartbeats, status
|
|
dashboards. A **single Go binary** with PostgreSQL as its only store —
|
|
packaged as an official-image wrapper around `goalert/goalert`
|
|
(digest-pinned), the cleanest Cloudron shape in this workspace.
|
|
|
|
## Authentication (auth gate: ✅ OIDC preferred)
|
|
|
|
Generic OpenID Connect is first-class in core (`config/config.go` OIDC
|
|
struct on go-oidc — any compliant issuer). `start.sh` wires it from the
|
|
Cloudron platform provider:
|
|
|
|
| GoAlert env | Source |
|
|
|-------------|--------|
|
|
| `GOALERT_OIDC_ENABLE=true` | fixed |
|
|
| `GOALERT_OIDC_ISSUER_URL` | `CLOUDRON_OIDC_ISSUER` |
|
|
| `GOALERT_OIDC_CLIENT_ID` | `CLOUDRON_OIDC_CLIENT_ID` |
|
|
| `GOALERT_OIDC_CLIENT_SECRET` | `CLOUDRON_OIDC_CLIENT_SECRET` |
|
|
| `GOALERT_OIDC_NEWUSERS=true` | overridable (`GOALERT_OIDC_NEWUSERS`) |
|
|
|
|
- SSO redirect: `https://<app-domain>/api/v2/identity/providers/oidc/callback`
|
|
- OIDC-registered users are created **without** privileges. First admin:
|
|
set `GOALERT_ADMIN_USER` + `GOALERT_ADMIN_PASS` app env vars once —
|
|
start.sh exposes them as basic auth — log in, promote your SSO account,
|
|
then unset them (README + `.env.example`).
|
|
|
|
## Runtime layout
|
|
|
|
| Concern | How |
|
|
|---------|-----|
|
|
| Database | Cloudron `postgresql` addon; migrations run automatically at startup |
|
|
| Encryption key | `GOALERT_DATA_ENCRYPTION_KEY` generated once, persisted in `/app/data` (rotating loses provider credentials) |
|
|
| Public URL | `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN` |
|
|
| Notifications | All outbound (Slack/Twilio/webhooks) — no inbound ports beyond 8081 |
|
|
| Storage | `/app/data` (localstorage) — key + future runtime files |
|
|
|
|
## Notes
|
|
|
|
- Version upgrades: bump tag+digest in the Dockerfile, rebuild —
|
|
migrations run on first boot.
|
|
- Package pattern + verification: repo `JOURNAL.md`, GoAlert section.
|