From 9d8ee9f03168ffbfee3ede955a58a5d82e02cab2 Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Mon, 27 Jul 2026 09:49:10 -0400
Subject: [PATCH] Fix missing proton monitor config

---
 .../proton-bridge/proton-bridge-monitor.yaml  | 44 +++++++++++++++++--
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/services/proton-bridge/proton-bridge-monitor.yaml b/services/proton-bridge/proton-bridge-monitor.yaml
index acea099..9f11579 100644
--- a/services/proton-bridge/proton-bridge-monitor.yaml
+++ b/services/proton-bridge/proton-bridge-monitor.yaml
@@ -15,6 +15,8 @@ spec:
           prober: tcp
           timeout: 10s
           tcp:
+            tls_config:
+              insecure_skip_verify: true  # Instructs Blackbox to trust Bridge's local cert
             query_response:
               - expect: "^220"
               - send: "EHLO blackbox\r\n"
@@ -26,7 +28,43 @@ spec:
               # ----------------------------------------------------------------
               - send: "EHLO blackbox\r\n"
               - expect: "^250"
-              # Insert your generated Base64 string below
-              - send: "AUTH PLAIN \AG5lc3RAbXluZXN0LmxvdmUAZ0pibVNBamdVaF83ejdUNEg4NGhxdw==r\n"
-              - expect: "^235" # 235 = Auth successful. Any 5xx error fails the probe.
+              - send: "AUTH PLAIN AG5lc3RAbXluZXN0LmxvdmUAZ0pibVNBamdVaF83ejdUNEg4NGhxdw==\r\n"
+              - expect: "^235"
               - send: "QUIT\r\n"
+---
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: proton-bridge-smtp-probe
+  namespace: monitoring
+  labels:
+    release: kube-prometheus-stack
+spec:
+  interval: 1m
+  module: proton_smtp_auth
+  prober:
+    url: prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
+  targets:
+    staticConfig:
+      static:
+        - proton-bridge.default.svc.cluster.local:25
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: proton-bridge-alerts
+  namespace: monitoring
+  labels:
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: proton-bridge-alerts
+      rules:
+        - alert: ProtonBridgeAuthFailed
+          expr: probe_success{job="probe/monitoring/proton-bridge-smtp-probe"} == 0
+          for: 2m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Proton Bridge Authentication Failed"
+            description: "Bridge is rejecting SMTP credentials on {{ $labels.instance }}. The token has likely expired and outbound email is failing."