Add deployment

infra/prometheus/production/alert-rules.yml

@@ -0,0 +1,71 @@
+# Production alert rules for VigilCare Clinical.
+# Load via Prometheus rule_files / alerting config on the external Prometheus host.
+# Metric names match VigilCareClinicalAPI/Observability/Metrics/ClinicalMetrics.cs.
+
+groups:
+  - name: vigilcare_production
+    rules:
+      - alert: VigilCareApiDown
+        expr: up{job="vigilcare_api_prod"} == 0
+        for: 2m
+        labels:
+          severity: critical
+          service: clinical-api
+        annotations:
+          summary: "VigilCare Clinical API is down"
+          description: "Prometheus cannot scrape vigilcare_api_prod for more than 2 minutes."
+
+      - alert: VigilCareOutboxBacklog
+        expr: outbox_pending_events{job="vigilcare_api_prod"} > 1000
+        for: 5m
+        labels:
+          severity: warning
+          service: clinical-api
+        annotations:
+          summary: "Outbox backlog is growing"
+          description: "outbox_pending_events is {{ $value }} (threshold 1000). Alert delivery to Kafka consumers is delayed."
+
+      - alert: VigilCareKafkaConsumerLag
+        expr: kafka_consumer_lag{job="vigilcare_api_prod"} > 10000
+        for: 10m
+        labels:
+          severity: warning
+          service: clinical-api
+        annotations:
+          summary: "Kafka consumer lag high for {{ $labels.consumer_group }}"
+          description: "consumer_group={{ $labels.consumer_group }} lag={{ $value }} (threshold 10000)."
+
+      # Prefer the blackbox probe job if configured; otherwise treat scrape failure
+      # of the API as covering liveness. This rule fires when the ready probe exists
+      # and reports failure.
+      - alert: VigilCareReadyCheckFailing
+        expr: probe_success{job="vigilcare_api_ready_probe"} == 0
+        for: 3m
+        labels:
+          severity: critical
+          service: clinical-api
+        annotations:
+          summary: "API /health/ready is failing"
+          description: "Blackbox probe of /health/ready has been failing for 3 minutes."
+
+      # GatewayStaleDetectorService marks stale gateways OFFLINE; the collector
+      # exposes them as ward_gateways_offline_gauge (site_code label).
+      - alert: VigilCareGatewayStale
+        expr: sum(ward_gateways_offline_gauge{job="vigilcare_api_prod"}) > 0
+        for: 5m
+        labels:
+          severity: warning
+          service: clinical-api
+        annotations:
+          summary: "One or more ward gateways are offline/degraded"
+          description: "{{ $value }} gateway(s) offline. Stale threshold is GatewayMonitoring:StaleThresholdMinutes (default 10)."
+
+      - alert: VigilCareCriticalAlertsUnacked
+        expr: alerts_unacknowledged_gauge{job="vigilcare_api_prod"} > 0
+        for: 5m
+        labels:
+          severity: critical
+          service: clinical-api
+        annotations:
+          summary: "Unacknowledged CRITICAL alerts"
+          description: "{{ $value }} CRITICAL alert(s) older than 5 minutes with no acknowledgment."

infra/prometheus/production/scrape-vigilcare.yml

@@ -0,0 +1,45 @@
+# Fragment for the *external* production Prometheus.
+# Do NOT merge into infra/prometheus/prometheus.yml — that file is the local-dev stack
+# (scrapes host.docker.internal:5270). Copy or include this under scrape_configs:
+# on the production Prometheus host.
+#
+#   - job_name: vigilcare_api_prod
+#     ...
+#
+# Restrict network access so only Prometheus can reach :5270/metrics —
+# the endpoint is AllowAnonymous by design (ASP.NET FallbackPolicy would
+# otherwise return 401). See docs/ops/production-observability.md.
+
+- job_name: vigilcare_api_prod
+  scrape_interval: 15s
+  metrics_path: /metrics
+  static_configs:
+    - targets: ["vigilcare-host.internal:5270"]
+      labels:
+        environment: production
+        service: clinical-api
+
+- job_name: vigilcare_gateway_prod
+  scrape_interval: 30s
+  metrics_path: /metrics
+  static_configs:
+    - targets: ["vigilcare-host.internal:5081"]
+      labels:
+        environment: production
+        service: ward-gateway
+
+# Optional: probe /health/ready via blackbox_exporter (http_2xx module).
+# Requires a blackbox_exporter job already defined on the Prometheus host.
+# - job_name: vigilcare_api_ready_probe
+#   metrics_path: /probe
+#   params:
+#     module: [http_2xx]
+#   static_configs:
+#     - targets: ["http://vigilcare-host.internal:5270/health/ready"]
+#   relabel_configs:
+#     - source_labels: [__address__]
+#       target_label: __param_target
+#     - source_labels: [__param_target]
+#       target_label: instance
+#     - target_label: __address__
+#       replacement: blackbox-exporter:9115