maxime.killinger
3d5f3c6299
🚀 Docker Build and Push / build-and-push (push) Successful in 4m46s
Alertmanager notifications were hard to read: the alert name appeared
twice, the instance was repeated between the header and the summary, the
count was restated in the body, and details ran flat with no visual
structure.
They now follow the same grammar as the CrowdSec feed: a title carrying
the counts, then one block per alert made of an identity line
("<icon> <name> (<context>)") and details indented under a tree marker.
Severity moves into the icon (red/orange/blue, green once resolved)
instead of a "[critical]" suffix, which keeps the identity line short
enough to read at a glance on a phone.
CrowdSec Notify
Service de notification intelligent pour CrowdSec qui regroupe les alertes par IP.
Fonctionnalités
- 📊 Regroupe les alertes par IP (évite les doublons)
- 🌍 Affiche le nom complet du pays
- 🔗 Inclut un lien WHOIS pour chaque IP
- 📱 Envoie les notifications via Apprise (Telegram)
Déploiement
L'image Docker est automatiquement construite et poussée sur gitea.killinger.fr/services/crowdsec-notify:latest
Variables d'environnement
| Variable | Description | Défaut |
|---|---|---|
APPRISE_URL |
URL du endpoint Apprise | Requis |
Docker Run
docker run -d \
--name crowdsec-notify \
--restart unless-stopped \
-e APPRISE_URL=http://your-apprise-url/notify/my_alert_config \
-p 5000:5000 \
crowdsec-notify:latest
Configuration CrowdSec
Dans /etc/crowdsec/notifications/http.yaml :
type: http
name: apprise_alert
group_wait: 5m
group_threshold: 10
format: |
{{ . | toJson }}
url: http://crowdsec-notify:5000/crowdsec
method: POST
headers:
Content-Type: application/json
Configuration Alertmanager
Sert aussi de pont entre Alertmanager et Apprise (le webhook_configs d'Alertmanager
n'a pas de templating de payload, il envoie son format natif tel quel).
Dans alertmanager.yml :
receivers:
- name: 'apprise-notifications'
webhook_configs:
- url: 'http://crowdsec-notify:5000/alertmanager'
send_resolved: true
Auteur
Maxime Killinger