apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: prometheus-blackbox-exporter
  namespace: kube-system
spec:
  chart: prometheus-blackbox-exporter
  repo: https://prometheus-community.github.io/helm-charts
  targetNamespace: monitoring
  createNamespace: true
  valuesContent: |-
    config:
      modules:
        proton_smtp_auth:
          prober: tcp
          timeout: 10s
          tcp:
            tls_config:
              insecure_skip_verify: true  # Instructs Blackbox to trust Bridge's local cert
            query_response:
              - expect: "^220"
              - send: "EHLO blackbox\r\n"
              - expect: "^250"
              # --- Remove these 3 lines if Bridge Connection Mode is "None" ---
              - send: "STARTTLS\r\n"
              - expect: "^220"
              - starttls: true
              # ----------------------------------------------------------------
              - send: "EHLO blackbox\r\n"
              - expect: "^250"
              - send: "AUTH PLAIN AG5lc3RAbXluZXN0LmxvdmUAZ0pibVNBamdVaF83ejdUNEg4NGhxdw==\r\n"
              - expect: "^235"
              - send: "QUIT\r\n"
---
apiVersion: monitoring.coreos.com/v1
kind: Probe
metadata:
  name: proton-bridge-smtp-probe
  namespace: monitoring
  labels:
    release: kube-prometheus-stack
spec:
  interval: 1m
  module: proton_smtp_auth
  prober:
    url: prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
  targets:
    staticConfig:
      static:
        - proton-bridge.default.svc.cluster.local:25
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: proton-bridge-alerts
  namespace: monitoring
  labels:
    release: kube-prometheus-stack
spec:
  groups:
    - name: proton-bridge-alerts
      rules:
        - alert: ProtonBridgeAuthFailed
          expr: probe_success{job="probe/monitoring/proton-bridge-smtp-probe"} == 0
          for: 2m
          labels:
            severity: critical
          annotations:
            summary: "Proton Bridge Authentication Failed"
            description: "Bridge is rejecting SMTP credentials on {{ $labels.instance }}. The token has likely expired and outbound email is failing."