# /etc/tori/config.toml

[storage]
path = "/var/lib/tori/tori.db"
retention_days = 7

[socket]
path = "/run/tori/tori.sock"

[host]
proc = "/proc"
sys = "/sys"

[docker]
socket = "/var/run/docker.sock"
# track all containers by default
# can be toggled per-container or per-group at runtime via the TUI
# these filters set the initial state:
# include = ["myapp-*"]
# exclude = ["tori-*"]

[collect]
interval = "10s"

[alerts.container_down]
condition = "container.state == 'exited'"
for = "30s"
cooldown = "5m"
notify_cooldown = "5m"
severity = "critical"
actions = ["notify"]

[alerts.high_cpu]
condition = "host.cpu_percent > 90"
for = "2m"
cooldown = "5m"
notify_cooldown = "5m"
severity = "warning"
actions = ["notify"]

[alerts.high_memory]
condition = "host.memory_percent > 85"
for = "1m"
severity = "warning"
actions = ["notify"]

[alerts.disk_space]
condition = "host.disk_percent > 90"
for = "1m"
severity = "critical"
actions = ["notify"]

[alerts.high_load]
condition = "host.load1 > 8"     # tune threshold to your CPU count
for = "5m"
severity = "warning"
actions = ["notify"]

[alerts.high_swap]
condition = "host.swap_percent > 80"
for = "2m"
severity = "warning"
actions = ["notify"]

[alerts.container_memory]
condition = "container.memory_percent > 90"
for = "1m"
severity = "warning"
actions = ["notify"]

[alerts.unhealthy]
condition = "container.health == 'unhealthy'"
for = "30s"
severity = "critical"
actions = ["notify"]

[alerts.restart_loop]
condition = "container.restart_count > 5"
for = "0s"
severity = "critical"
actions = ["notify"]

[alerts.bad_exit]
condition = "container.exit_code != 0"
for = "0s"
severity = "warning"
actions = ["notify"]

# [notify.email]
# enabled = false
# smtp_host = "smtp.example.com"
# smtp_port = 587
# from = "tori@example.com"
# to = ["you@example.com"]
#
# [notify.webhooks]
# enabled = false
# url = "https://hooks.slack.com/services/..."
# headers = { Authorization = "Bearer token" }
# template = '{"text": "{{.Subject}}\n{{.Body}}"}'