groups:
  - name: proxy_health
    interval: 30s
    rules:
      - alert: ExternalProxyDown
        expr: proxy_health_status{path="wan"} == 0
        for: 3m
        labels:
          severity: critical
        annotations:
          summary: "External proxy unreachable via WAN"
          description: "vanlint-com-nginx is unreachable from the internet (WAN path). Both :80 and :443 are down. All externally-facing services are offline."

      - alert: ExternalProxyDegraded
        expr: proxy_health_status{path="wan"} == 1
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "External proxy WAN path degraded -- HTTP up but HTTPS canary down"
          description: "HTTP (:80) responds but HTTPS canary (:443) fails. Proxy chain may be misconfigured or upstream target unreachable."

      - alert: ExternalProxyTailscaleDown
        expr: proxy_health_status{path="tailscale"} == 0
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "External proxy unreachable via Tailscale"
          description: "vanlint-com-nginx is unreachable via Tailscale VPN. The host may be down or Tailscale disconnected."

      - alert: ExternalProxySlowResponse
        expr: proxy_probe_response_time_seconds{port="443"} > 5
        for: 5m
        labels:
          severity: medium
        annotations:
          summary: "External proxy HTTPS response slow ({{ $value }}s)"
          description: "HTTPS canary probe via {{ $labels.path }} path taking > 5 seconds. Check proxy host resources and upstream targets."
