groups:
  - name: cron_integrity
    interval: 60s
    rules:
      - alert: CronEntryMissing
        expr: cron_entry_present == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Crontab entry missing: {{ $labels.job }} on {{ $labels.host }}"
          description: >-
            Expected crontab entry '{{ $labels.job }}' is missing from
            {{ $labels.host }}. This may indicate the crontab was wiped
            or corrupted. Verify with: ssh {{ $labels.host }} crontab -l

      - alert: CronAllEntriesMissing
        expr: cron_entries_found_total == 0 and cron_entries_expected_total > 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "All crontab entries missing on {{ $labels.host }}"
          description: >-
            All expected crontab entries are missing from {{ $labels.host }}.
            The crontab was likely wiped. Restore immediately.
