apiVersion: v1
kind: Service
metadata:
  name: wireguard-exporter
  namespace: wireguard
  labels:
    app: wireguard
spec:
  ports:
    - name: http-metrics
      port: 9586
      targetPort: 9586
      protocol: TCP
  selector:
    app: wireguard
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: wireguard
  namespace: wireguard
  labels:
    release: prometheus-operator
spec:
  selector:
    matchLabels:
      app: wireguard
  namespaceSelector:
    matchNames:
      - wireguard
  endpoints:
    - port: http-metrics
      path: /metrics
      interval: 30s
      scrapeTimeout: 10s
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: wireguard-alerts
  namespace: wireguard
  labels:
    release: prometheus-operator
spec:
  groups:
    - name: wireguard.rules
      rules:
        - alert: WireguardExporterDown
          expr: up{job="wireguard-exporter"} == 0
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "WireGuard exporter is down"
            description: "The WireGuard Prometheus exporter is unreachable. The pod may have crashed or is unresponsive."
        - alert: WireguardInterfaceDown
          expr: absent(wireguard_sent_bytes_total{interface="wg0"}) == 1
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "WireGuard interface wg0 is down"
            description: "The WireGuard interface wg0 is not reporting any statistics. The VPN tunnel might be down or inactive."
        - alert: WireguardPeerOffline
          expr: (time() - wireguard_latest_handshake_seconds{interface="wg0"}) > 300
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "WireGuard peer {{ $labels.friendly_name }} offline"
            description: "No handshake received for WireGuard peer {{ $labels.friendly_name }} ({{ $labels.public_key }}) on device {{ $labels.interface }} for more than 5 minutes."