feat(wireguard): add prometheus monitoring, alerts, and grafana dashboard

k8s/wireguard/monitoring.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard-exporter
+  namespace: wireguard
+  labels:
+    app: wireguard
+spec:
+  ports:
+    - name: http-metrics
+      port: 9586
+      targetPort: 9586
+      protocol: TCP
+  selector:
+    app: wireguard
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: wireguard
+  namespace: wireguard
+  labels:
+    release: prometheus-operator
+spec:
+  selector:
+    matchLabels:
+      app: wireguard
+  namespaceSelector:
+    matchNames:
+      - wireguard
+  endpoints:
+    - port: http-metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: wireguard-alerts
+  namespace: wireguard
+  labels:
+    release: prometheus-operator
+spec:
+  groups:
+    - name: wireguard.rules
+      rules:
+        - alert: WireguardExporterDown
+          expr: up{job="wireguard-exporter"} == 0
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard exporter is down"
+            description: "The WireGuard Prometheus exporter is unreachable. The pod may have crashed or is unresponsive."
+        - alert: WireguardInterfaceDown
+          expr: absent(wireguard_sent_bytes_total{interface="wg0"}) == 1
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard interface wg0 is down"
+            description: "The WireGuard interface wg0 is not reporting any statistics. The VPN tunnel might be down or inactive."
+        - alert: WireguardPeerOffline
+          expr: (time() - wireguard_latest_handshake_seconds{interface="wg0"}) > 300
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard peer {{ $labels.friendly_name }} offline"
+            description: "No handshake received for WireGuard peer {{ $labels.friendly_name }} ({{ $labels.public_key }}) on device {{ $labels.interface }} for more than 5 minutes."