groups:
  - name: network_services
    interval: 30s
    rules:
      - alert: ExporterEndpointDown
        expr: up{job="custom-exporters"} == 0
        for: 3m
        labels:
          severity: critical
        annotations:
          summary: "Metrics exporter endpoint is down -- all infrastructure metrics unavailable"
          description: "The custom-exporters scrape target is down. All infrastructure metrics (PVE, NAS, PBS, OPNsense, Docker) are unavailable. Check the exporter container on claude-internal-tools."

      - alert: OPNsenseWANDown
        expr: opnsense_gateway_status{gateway=~".*WAN.*"} == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "OPNsense WAN gateway is offline (internet down)"
          description: "WAN gateway {{ $labels.gateway }} has been offline for more than 2 minutes. Internet connectivity is lost."

      - alert: OPNsenseGatewayHighRTT
        expr: opnsense_gateway_rtt_milliseconds > 100
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "Gateway {{ $labels.gateway }} RTT > 100ms"
          description: "Gateway {{ $labels.gateway }} round-trip time at {{ $value }}ms for more than 5 minutes. Check for network congestion or ISP issues."

      - alert: OPNsenseHighPacketLoss
        expr: opnsense_gateway_loss_percent > 5
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "Gateway {{ $labels.gateway }} packet loss > 5%"
          description: "Gateway {{ $labels.gateway }} experiencing {{ $value }}% packet loss. Check ISP status and physical connections."

      - alert: TailscalePeersReduced
        expr: >
          opnsense_tailscale_peers_online
          < (opnsense_tailscale_peers_total * 0.5)
          and opnsense_tailscale_peers_total > 0
        for: 10m
        labels:
          severity: high
        annotations:
          summary: "Tailscale peers reduced -- {{ $value }} online vs expected"
          description: "Only {{ $value }} of {{ with query `opnsense_tailscale_peers_total` }}{{ . | first | value }}{{ end }} Tailscale peers are online. More than 50% of peers are offline."

      - alert: TailscaleCriticalPeerDown
        expr: opnsense_tailscale_peer_status{peer=~"network-vm|opnsense|vanlint-com-nginx"} == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Critical Tailscale peer {{ $labels.peer }} is offline"
          description: "Infrastructure peer {{ $labels.peer }} has been offline for more than 5 minutes. This peer is required for core network/proxy services."

      - alert: TailscaleHighPeerDown
        expr: opnsense_tailscale_peer_status{peer=~"homeassistant-parents|parents-proxmox"} == 0
        for: 10m
        labels:
          severity: high
        annotations:
          summary: "Tailscale peer {{ $labels.peer }} is offline"
          description: "Tailscale peer {{ $labels.peer }} has been offline for more than 10 minutes."

      - alert: TailscalePeerDown
        expr: opnsense_tailscale_peer_status{peer!~"network-vm|localhost|vanlint-com-nginx|homeassistant-parents|parents-proxmox"} == 0
        for: 30m
        labels:
          severity: info
        annotations:
          summary: "Tailscale peer {{ $labels.peer }} is offline"
          description: "Tailscale peer {{ $labels.peer }} has been offline for more than 30 minutes."

      - alert: TailscaleNoPeers
        expr: opnsense_tailscale_peers_total == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Tailscale has no peers -- VPN may be down"
          description: "Tailscale reports zero peers. The Tailscale service on OPNsense may have stopped or lost connectivity to the coordination server."

      - alert: OPNsenseInterfaceDown
        expr: opnsense_interface_status == 0
        for: 5m
        labels:
          severity: high
        annotations:
          summary: "OPNsense interface {{ $labels.interface }} is down"
          description: "Network interface {{ $labels.interface }} has been down for more than 5 minutes."

      - alert: OPNsenseInterfaceErrors
        expr: rate(opnsense_interface_errors_total[5m]) > 10
        for: 5m
        labels:
          severity: medium
        annotations:
          summary: "OPNsense interface {{ $labels.interface }} errors ({{ $labels.direction }})"
          description: "Interface {{ $labels.interface }} is experiencing more than 10 errors/sec (direction: {{ $labels.direction }}). Check physical connection and cable."
