Kevin Adametz
d884eb7482
- GlitchTip über die Sentry-SDKs; Datenschutzfilter (nur User-ID, keine
Request-Bodys, Tokens aus URL/Query/Referer, E-Mails aus Meldungen).
Browser-SDK erst beim ersten Fehler nachgeladen.
- ReportErrorSignals: tote interne Links (404 mit eigenem Referrer), 403/429
für Angemeldete, 419 als gedrosselte Warnung.
- /health (Bearer-Token): DB, Cache, Queue-Rückstau, Scheduler-Herzschlag,
Plattenplatz → 200/503; Scheduler und Plattenplatz auch im Systemstatus.
- OperationalAlert zusätzlich per ntfy (JSON-POST), unabhängig von der Mail.
- Verlauf: login_failed (Grund unbekannt/kein Passwort/falsch),
login_lockout, two_factor_failed; IP nur als gekürzter HMAC.
- Umami: Kundenbereich mit eigenem Schalter und identify('user-<id>'),
nie im Admin/bei Impersonation; Query-Filter auch auf den Webseiten
(signierte Links gingen bisher an Umami).
- queue:prune-failed nach 30 Tagen.
- Versionsnummer: config('app.version') aus APP_VERSION oder Datei RELEASE
(git describe --tags), in GlitchTip, /health, Systemstatus, artisan about.
Plan: dev/betrieb/monitoring-plan.md (Entscheidungen M1–M9).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
102 lines
3.8 KiB
PHP
102 lines
3.8 KiB
PHP
<?php
|
|
|
|
use App\Services\Admin\AdminSystemHealth;
|
|
use App\Services\Monitoring\HealthProbe;
|
|
use Illuminate\Support\Facades\DB;
|
|
|
|
/**
|
|
* Tiefer Health-Check und Scheduler-Herzschlag (Monitoring-Plan 1.4, 1.5).
|
|
*/
|
|
beforeEach(function () {
|
|
config()->set('monitoring.health.token', 'geheimes-monitor-token');
|
|
config()->set('monitoring.health.disk_min_free_percent', 0);
|
|
config()->set('queue.default', 'database');
|
|
});
|
|
|
|
function healthHeaders(): array
|
|
{
|
|
return ['Authorization' => 'Bearer geheimes-monitor-token'];
|
|
}
|
|
|
|
test('the endpoint does not exist without a configured token or with a wrong one', function () {
|
|
app(HealthProbe::class)->recordHeartbeat();
|
|
|
|
$this->get('/health', healthHeaders())->assertOk();
|
|
|
|
$this->get('/health', ['Authorization' => 'Bearer falsch'])->assertNotFound();
|
|
$this->get('/health')->assertNotFound();
|
|
|
|
config()->set('monitoring.health.token', null);
|
|
$this->get('/health', healthHeaders())->assertNotFound();
|
|
});
|
|
|
|
test('a healthy system answers 200 with every check', function () {
|
|
config()->set('app.version', 'v1.1.0');
|
|
$this->artisan('monitoring:heartbeat')->assertSuccessful();
|
|
|
|
$this->get('/health?token=geheimes-monitor-token')
|
|
->assertOk()
|
|
->assertHeader('Cache-Control', 'no-store, private')
|
|
->assertJsonPath('status', 'ok')
|
|
->assertJsonPath('version', 'v1.1.0')
|
|
->assertJsonPath('checks.database.status', 'ok')
|
|
->assertJsonPath('checks.cache.status', 'ok')
|
|
->assertJsonPath('checks.queue.status', 'ok')
|
|
->assertJsonPath('checks.scheduler.status', 'ok')
|
|
->assertJsonStructure(['checks' => ['disk' => ['status', 'detail']]]);
|
|
});
|
|
|
|
test('a missing or stale heartbeat makes the endpoint fail', function () {
|
|
$this->get('/health', healthHeaders())
|
|
->assertStatus(503)
|
|
->assertJsonPath('checks.scheduler.status', 'critical');
|
|
|
|
app(HealthProbe::class)->recordHeartbeat();
|
|
|
|
$this->travel(4)->minutes();
|
|
$this->get('/health', healthHeaders())->assertOk()->assertJsonPath('checks.scheduler.status', 'warn');
|
|
|
|
$this->travel(7)->minutes();
|
|
$this->get('/health', healthHeaders())->assertStatus(503)->assertJsonPath('checks.scheduler.status', 'critical');
|
|
});
|
|
|
|
test('a queue backlog older than five minutes makes the endpoint fail', function () {
|
|
app(HealthProbe::class)->recordHeartbeat();
|
|
|
|
DB::table('jobs')->insert([
|
|
'queue' => 'default',
|
|
'payload' => '{}',
|
|
'attempts' => 0,
|
|
'reserved_at' => null,
|
|
'available_at' => now()->subMinutes(6)->getTimestamp(),
|
|
'created_at' => now()->subMinutes(6)->getTimestamp(),
|
|
]);
|
|
|
|
$this->get('/health', healthHeaders())
|
|
->assertStatus(503)
|
|
->assertJsonPath('checks.queue.status', 'critical');
|
|
});
|
|
|
|
test('the endpoint answers on every brand domain and skips basic auth', function (string $domainKey) {
|
|
config()->set('auth.basic.enabled', true);
|
|
config()->set('auth.basic.user', 'staging');
|
|
config()->set('auth.basic.password', 'staging');
|
|
app(HealthProbe::class)->recordHeartbeat();
|
|
|
|
$this->get('http://'.config($domainKey).'/health', healthHeaders())
|
|
->assertOk()
|
|
->assertJsonPath('status', 'ok');
|
|
})->with(['domains.domain_portal', 'domains.domain_presseecho', 'domains.domain_businessportal']);
|
|
|
|
test('the admin system health shows scheduler and disk', function () {
|
|
$checks = collect(app(AdminSystemHealth::class)->snapshot()['checks'])->keyBy('key');
|
|
|
|
expect($checks->get('scheduler')['status'])->toBe('critical')
|
|
->and($checks->get('scheduler')['detail'])->toContain('Noch kein Herzschlag')
|
|
->and($checks)->toHaveKey('disk');
|
|
|
|
app(HealthProbe::class)->recordHeartbeat();
|
|
|
|
$checks = collect(app(AdminSystemHealth::class)->snapshot()['checks'])->keyBy('key');
|
|
expect($checks->get('scheduler')['status'])->toBe('ok');
|
|
});
|