Alertmanager notifications were hard to read: the alert name appeared
twice, the instance was repeated between the header and the summary, the
count was restated in the body, and details ran flat with no visual
structure.
They now follow the same grammar as the CrowdSec feed: a title carrying
the counts, then one block per alert made of an identity line
("<icon> <name> (<context>)") and details indented under a tree marker.
Severity moves into the icon (red/orange/blue, green once resolved)
instead of a "[critical]" suffix, which keeps the identity line short
enough to read at a glance on a phone.
CrowdSec's notification-http plugin serializes alerts with lowercase
keys (source/ip/cn/scenario), not the PascalCase (Source/IP/Cn/Scenario)
this code was reading. Every lookup silently fell through to its
default value, so every notification showed 'unknown' regardless of
the real IP, country or scenario. Confirmed by capturing a real payload.
The token is stored as an instance-level Actions Variable
(Site Administration > Actions > Variables), not a Secret. secrets.WATCHTOWER_TOKEN
always resolved to empty, so the watchtower trigger request carried
no Authorization value and was rejected (401 Invalid token attempt).
Reuses the same notification path as /crowdsec: formats the
Alertmanager webhook payload (firing/resolved, severity, instance,
summary/description) and forwards it to APPRISE_URL as {title, body}.
- Use a set to collect scenarios for each IP address to prevent duplicate entries (e.g., multiple 'http-probing' lists).
- Sort scenarios alphabetically for consistent notification output.
- Improve notification readability by grouping repetitive alerts.
maxime.killinger