skarbiec alert

Invocation#

skarbiec alert set <id> --field <field>
skarbiec alert status
skarbiec alert test
skarbiec alert unset

Purpose#

Make an unattended maintain or rotation run that fails tell a person in the chat channel they watch, instead of leaving the failure in a log nobody reads.

Required inputs and options#

• set takes the id of an item and the field of it holding a chat webhook address — a Slack, Mattermost or Teams incoming webhook, a Discord webhook — which must be an https:// address; the address is a secret, since anyone holding it can post to the channel. status, test and unset take nothing. POST /v1/operator/alert/set takes id and field, and /status, /test and /unset take nothing; they act on the machine serving the API and are never forwarded.

Output and state effects#

• set reads the address once to check it, then writes the item and field — never the address — to `<vault file>.alert` beside the vault, owner-only and never in the vault document replicas receive, journals alert-set and prints ok, item, field, setting and next. From then on a maintain pass that fails, and a rotation run with a rotation that was not accepted, post one message naming what failed and never a value, as JSON carrying it in text and content; the address reaches curl only on its standard input as curl configuration, never in an argument a process list shows, and each post journals alert-sent. test posts a message saying alerts reach the channel; status prints set, item and field; unset removes the setting and journals alert-unset.

Refusals#

• Anything else exits 2 with the usage, as does set without --field. set refuses an item or field that does not open or is not text, an address that is not https://, and one holding a quote, backslash, space or control character, which no webhook address carries; nothing is written. test and unset refuse a host where no alert is set. A webhook that refuses a post is named with curl's status and the service's answer; maintain and rotation run still fail with their own reasons, adding that the alert could not be posted.

Examples#

pbpaste | skarbiec set ops-webhook --type note # {"schema":"skarbiec.item.v2","kind":"note","fields":{"value":"<the webhook address>"},"context":{}} skarbiec alert set ops-webhook --field value skarbiec alert test skarbiec alert status