feat: P0 backup system (WAL+snapshot+restore+verify), monitoring stack, admin health API

monitoring/alertmanager.yml

@@ -0,0 +1,11 @@
+route:
+  receiver: 'telegram'
+  group_wait: 10s
+  group_interval: 5m
+  repeat_interval: 1h
+
+receivers:
+  - name: 'telegram'
+    webhook_configs:
+      - url: 'http://alertmanager-bridge:8080/alert'
+        send_resolved: true

monitoring/alerts.yml

@@ -0,0 +1,74 @@
+groups:
+  - name: critical
+    rules:
+      - alert: MementoAppDown
+        expr: up{job="memento-app"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Memento app is DOWN"
+
+      - alert: PostgresDown
+        expr: up{job="postgres"} == 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "PostgreSQL is DOWN"
+
+      - alert: RedisDown
+        expr: up{job="redis"} == 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Redis is DOWN"
+
+      - alert: DiskSpaceLow
+        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) < 0.15
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Disk space below 15%"
+
+      - alert: HighMemoryUsage
+        expr: (1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) > 0.90
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Memory usage above 90%"
+
+      - alert: PostgresConnectionsHigh
+        expr: pg_stat_activity_count > 80
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "PostgreSQL connections above 80"
+
+      - alert: PostgresSlowQueries
+        expr: pg_stat_statements_mean_exec_seconds > 5
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "PostgreSQL slow queries detected"
+
+      - alert: HighErrorRate
+        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.05
+        for: 3m
+        labels:
+          severity: warning
+        annotations:
+          summary: "HTTP 5xx error rate above 5%"
+
+      - alert: ContainerRestarted
+        expr: increase(container_restart_count[1h]) > 0
+        for: 1m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Container restarted in the last hour"

monitoring/docker-compose.monitoring.yml

@@ -0,0 +1,119 @@
+services:
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: memento-prometheus
+    restart: unless-stopped
+    volumes:
+      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./monitoring/alerts.yml:/etc/prometheus/alerts.yml:ro
+      - prometheus-data:/prometheus
+    ports:
+      - "9090:9090"
+    networks:
+      - memento-monitoring
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: memento-grafana
+    restart: unless-stopped
+    environment:
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-memento-admin}
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SERVER_ROOT_URL: "${GRAFANA_URL:-http://localhost:3001}"
+    volumes:
+      - grafana-data:/var/lib/grafana
+    ports:
+      - "3001:3000"
+    networks:
+      - memento-monitoring
+
+  alertmanager:
+    image: prom/alertmanager:latest
+    container_name: memento-alertmanager
+    restart: unless-stopped
+    volumes:
+      - ./monitoring/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
+    ports:
+      - "9093:9093"
+    networks:
+      - memento-monitoring
+
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: memento-node-exporter
+    restart: unless-stopped
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - '--path.procfs=/host/proc'
+      - '--path.sysfs=/host/sys'
+      - '--path.rootfs=/rootfs'
+    ports:
+      - "9100:9100"
+    networks:
+      - memento-monitoring
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:latest
+    container_name: memento-postgres-exporter
+    restart: unless-stopped
+    environment:
+      DATA_SOURCE_NAME: "postgresql://${POSTGRES_USER:-memento}:${POSTGRES_PASSWORD}@memento-postgres:5432/${POSTGRES_DB:-memento}?sslmode=disable"
+    ports:
+      - "9187:9187"
+    networks:
+      - memento-monitoring
+      - memento_default
+
+  redis-exporter:
+    image: oliver006/redis_exporter:latest
+    container_name: memento-redis-exporter
+    restart: unless-stopped
+    environment:
+      REDIS_ADDR: "redis://memento-redis:6379"
+    ports:
+      - "9121:9121"
+    networks:
+      - memento-monitoring
+      - memento_default
+
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: memento-cadvisor
+    restart: unless-stopped
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+    ports:
+      - "8080:8080"
+    networks:
+      - memento-monitoring
+
+  alertmanager-bridge:
+    image: alpine:latest
+    container_name: memento-alertmanager-bridge
+    restart: unless-stopped
+    entrypoint: |
+      sh -c '
+        apk add --no-cache curl
+        while true; do
+          echo "Bridge running - configure webhook to forward to Telegram"
+          sleep 3600
+        done
+      '
+    networks:
+      - memento-monitoring
+
+volumes:
+  prometheus-data:
+  grafana-data:
+
+networks:
+  memento-monitoring:
+    driver: bridge
+  memento_default:
+    external: true

monitoring/prometheus.yml

@@ -0,0 +1,33 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+rule_files:
+  - /etc/prometheus/alerts.yml
+
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets: ['alertmanager:9093']
+
+scrape_configs:
+  - job_name: 'memento-app'
+    metrics_path: '/api/metrics'
+    static_configs:
+      - targets: ['memento-note:3000']
+
+  - job_name: 'node-exporter'
+    static_configs:
+      - targets: ['node-exporter:9100']
+
+  - job_name: 'postgres'
+    static_configs:
+      - targets: ['postgres-exporter:9187']
+
+  - job_name: 'redis'
+    static_configs:
+      - targets: ['redis-exporter:9121']
+
+  - job_name: 'cadvisor'
+    static_configs:
+      - targets: ['cadvisor:8080']