// The config demo.jaque.sh runs, published so the demo is auditable
// methodology rather than a screenshot: every target below is an endpoint
// its owner publishes for public consumption -- open DNS resolvers, status
// APIs, and the demo's own stack.
//
// It must validate under -config-profile demo, which is what keeps a
// public instance from becoming someone's crawler: no command or legacy
// checks, no file or exec sinks, at most 25 hosts and 10 services each,
// and no interval under 30s.
//
// demo-host is the parent of every external host on purpose. The box runs
// the checks, so if it loses its uplink all nine targets fail at once;
// declaring the parent turns that into one alert about the box instead of
// nine about the internet.

hosts: {
	"demo-host": {
		address: "127.0.0.1"
		check: {type: "tcp", address: "127.0.0.1:8080", check_interval: "30s"}
		services: {
			ui: check: {type: "http", url: "http://127.0.0.1:8080/", check_interval: "30s"}
			edge: check: {type: "tcp", address: "edge:80", check_interval: "30s"}
			clickhouse: check: {type: "tcp", address: "clickhouse:8123", check_interval: "30s"}
		}
	}

	"cloudflare-dns": {
		address: "1.1.1.1"
		parents: ["demo-host"]
		check: {type: "tcp", address: "1.1.1.1:53"}
		services: {
			resolve: check: {type: "dns", server: "1.1.1.1:53", name: "cloudflare.com"}
			doh: check: {type: "http", url: "https://1.1.1.1/"}
			cert: check: {type: "tls", address: "1.1.1.1:853"}
		}
	}

	"google-dns": {
		address: "8.8.8.8"
		parents: ["demo-host"]
		check: {type: "tcp", address: "8.8.8.8:53"}
		services: {
			resolve: check: {type: "dns", server: "8.8.8.8:53", name: "google.com"}
			doh: check: {type: "http", url: "https://dns.google/resolve?name=example.com&type=A"}
		}
	}

	quad9: {
		address: "9.9.9.9"
		parents: ["demo-host"]
		check: {type: "tcp", address: "9.9.9.9:53"}
		services: {
			resolve: check: {type: "dns", server: "9.9.9.9:53", name: "quad9.net"}
		}
	}

	github: {
		address: "github.com"
		parents: ["demo-host"]
		check: {type: "tcp", address: "github.com:443"}
		services: {
			// Atlassian Statuspage's documented public JSON endpoint.
			status: check: {type: "http", url: "https://www.githubstatus.com/api/v2/status.json"}
			cert: check:   {type: "tls", address: "github.com:443"}
			api: check:    {type: "http", url: "https://api.github.com/zen"}
		}
	}

	gitlab: {
		address: "gitlab.com"
		parents: ["demo-host"]
		check: {type: "tcp", address: "gitlab.com:443"}
		services: {
			status: check: {type: "http", url: "https://status.gitlab.com/api/v2/status.json"}
			cert: check:   {type: "tls", address: "gitlab.com:443"}
		}
	}

	cloudflare: {
		address: "www.cloudflarestatus.com"
		parents: ["demo-host"]
		check: {type: "tcp", address: "www.cloudflarestatus.com:443"}
		services: {
			status: check: {type: "http", url: "https://www.cloudflarestatus.com/api/v2/status.json"}
		}
	}

	wikipedia: {
		address: "en.wikipedia.org"
		parents: ["demo-host"]
		check: {type: "tcp", address: "en.wikipedia.org:443"}
		services: {
			cert: check: {type: "tls", address: "en.wikipedia.org:443"}
			api: check:  {type: "http", url: "https://en.wikipedia.org/api/rest_v1/"}
		}
	}

	debian: {
		address: "deb.debian.org"
		parents: ["demo-host"]
		check: {type: "tcp", address: "deb.debian.org:443"}
		services: {
			// The release file every apt client fetches; a mirror that
			// stops serving it is the outage a Debian user would feel.
			release: check: {type: "http", url: "https://deb.debian.org/debian/dists/stable/Release"}
			cert: check:    {type: "tls", address: "deb.debian.org:443"}
		}
	}
}

// The perfdata every check above emits, written to the demo's own
// ClickHouse and read back by the object-detail graphs. Both point at the
// same ephemeral container, wiped by reset.sh.
sinks: metrics: {
	type: "clickhouse"
	url:  "clickhouse://jaque:jaque@clickhouse:9000/jaque"
}

datasources: metrics: {
	type: "clickhouse"
	url:  "clickhouse://jaque:jaque@clickhouse:9000/jaque"
}

ui: datasource: "metrics"