groups:
  - name: freeipa_alerts
    rules:
      # 1. FreeIPA 节点宕机 / node_exporter 挂了
      - alert: FreeIPA_Node_Down
        expr: up{job=~"freeipa|ipa"} == 0
        for: 30s
        labels:
          severity: critical
        annotations:
          summary: "FreeIPA 节点失联"
          description: "节点 {{ $labels.instance }} node-exporter 掉线超过30秒，主机不可达"

      # 2. FreeIPA 核心综合服务异常（krb5kdc/httpd/ipa-custodia/pki-tomcatd）
      - alert: FreeIPA_Service_Down
        expr: sum by(instance,name) (node_systemd_unit_state{name=~"krb5kdc.service|httpd.service|ipa-custodia.service|pki-tomcatd@.*.service",state="active"}) != 1
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "FreeIPA 核心服务异常停止"
          description: "节点 {{ $labels.instance }} 服务 {{ $labels.name }} 未处于运行状态"

      # 3. Kerberos KDC 认证服务异常
      - alert: FreeIPA_Kerberos_Down
        expr: sum by(instance,name) (node_systemd_unit_state{name="krb5kdc.service",state="active"}) != 1
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Kerberos KDC 认证服务异常"
          description: "krb5kdc.service 停止，域用户无法完成Kerberos认证登录"

      # 4. FreeIPA Web 管理界面 httpd 服务异常
      - alert: FreeIPA_HTTP_Down
        expr: sum by(instance,name) (node_systemd_unit_state{name="httpd.service",state="active"}) != 1
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "FreeIPA Web 管理界面服务异常"
          description: "httpd.service 已停止，无法访问IPA网页管理端"

      # 5. PKI 证书签发服务 pki-tomcatd 异常
      - alert: FreeIPA_PKI_Tomcat_Down
        expr: sum by(instance,name) (node_systemd_unit_state{name=~"pki-tomcatd@.*.service",state="active"}) != 1
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "FreeIPA PKI 证书服务异常"
          description: "pki-tomcatd 证书签发服务停止，新证书无法申请下发"

      # 6. 专属监控 dirsrv@ADVANTEST-COM.service 389 LDAP目录服务停机
      - alert: DirsrvServiceDown
        expr: sum by(instance,name) (node_systemd_unit_state{name="dirsrv@ADVANTEST-COM.service",state="active"}) != 1
        for: 30s
        labels:
          severity: critical
          service: dirsrv-ADVANTEST
        annotations:
          summary: "389 LDAP目录服务已停止"
          description: "主机{{ $labels.instance }} dirsrv@ADVANTEST-COM.service 非运行状态，LDAP查询/认证失效，请立即检查"

      # 7. LDAP 端口 389/636 探测不通
      - alert: FreeIPA_LDAP_Port_Down
        expr: probe_tcp_port{target=~".*:389|.*:636"} == 0
        for: 30s
        labels:
          severity: critical
        annotations:
          summary: "LDAP 端口连通性异常"
          description: "无法TCP连接 {{ $labels.target }}，防火墙/服务异常"

      # 8. Kerberos 88端口探测不通
      - alert: FreeIPA_KRB5_Port_Down
        expr: probe_tcp_port{target=~".*:88"} == 0
        for: 30s
        labels:
          severity: critical
        annotations:
          summary: "Kerberos 88端口不通"
          description: "目标 {{ $labels.target }} TCP88端口无法访问，Kerberos认证阻断"

      # 9. 证书剩余 <30天 预警
      - alert: FreeIPA_Certificate_Will_Expire
        expr: ipa_cert_expiry_hours < 720
        for: 1m
        labels:
          severity: warning
        annotations:
          summary: "FreeIPA 证书即将过期（剩余<30天）"
          description: "证书 {{ $labels.cert }} 有效期剩余不足30天，请规划续期"

      # 10. 证书剩余 <7天 紧急告警
      - alert: FreeIPA_Certificate_Will_Expire_Critical
        expr: ipa_cert_expiry_hours < 168
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "FreeIPA 证书即将过期！紧急处理"
          description: "证书 {{ $labels.cert }} 有效期剩余不足7天，逾期会导致域认证全部失效"

      # 11. 内存使用率超过85%
      - alert: FreeIPA_High_Memory_Usage
        expr: 100 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes * 100) > 85
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "FreeIPA主机内存使用率过高"
          description: "{{ $labels.instance }} 内存使用率 > 85%，存在OOM风险"

      # 12. CPU使用率超过90%
      - alert: FreeIPA_High_CPU_Usage
        expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[2m])) * 100) > 90
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "FreeIPA主机CPU使用率过高"
          description: "{{ $labels.instance }} CPU持续占用高于90%，业务响应缓慢"

      # 13. 根分区磁盘使用率超85%
      - alert: FreeIPA_High_Disk_Usage
        expr: 100 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes * 100) > 85
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "主机根分区磁盘使用率过高"
          description: "{{ $labels.instance }} / 分区磁盘占用 > 85%，请清理日志/扩容"