feat: add kube-prometheus-stack with telegram alerting

clusters/homelab/monitoring.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: monitoring
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/homelab/monitoring
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/homelab/monitoring/helmrelease.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: ">=60.0.0"
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: monitoring
+  values:
+    grafana:
+      enabled: true
+      adminPassword: "changeme"
+      persistence:
+        enabled: true
+        storageClassName: longhorn
+        size: 1Gi
+    alertmanager:
+      config:
+        global:
+          resolve_timeout: 5m
+        route:
+          group_by: ['alertname']
+          group_wait: 10s
+          group_interval: 10m
+          repeat_interval: 12h
+          receiver: telegram
+        receivers:
+          - name: telegram
+            telegram_configs:
+              - bot_token_file: /etc/alertmanager/secrets/alertmanager-telegram/telegram_bot_token
+                chat_id: 8151406188
+                parse_mode: HTML
+      alertmanagerSpec:
+        secrets:
+          - alertmanager-telegram
+    prometheus:
+      prometheusSpec:
+        retention: 7d
+        storageSpec:
+          volumeClaimTemplate:
+            spec:
+              storageClassName: longhorn
+              accessModes: ["ReadWriteOnce"]
+              resources:
+                requests:
+                  storage: 5Gi

clusters/homelab/monitoring/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: monitoring
+spec:
+  interval: 1h
+  url: https://prometheus-community.github.io/helm-charts

clusters/homelab/monitoring/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - secret.sops.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/homelab/monitoring/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

clusters/homelab/monitoring/secret.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: ENC[AES256_GCM,data:QlE=,iv:Ik4B44f3cOwSp9oFJ7F47Sg3ntXHWB/9n+MmHAAGQuw=,tag:YSaqT6FGoGq2VM6licJeYQ==,type:str]
+kind: ENC[AES256_GCM,data:u58dkRAt,iv:Qmjnr5GW+r4ah9ouY+tCoUOSgZpqDyNaNXmZcpju9ds=,tag:6XBS4AkjLQjB+edE9bbyTw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:ReYceyg4ZOGtP2wTSiwbGrD2F8NP,iv:33/axQuRGND+HmAYviZB45zJOgsMFTIkrha4mT5XUK8=,tag:wye5adlErHrytJaUaBTO+A==,type:str]
+    namespace: ENC[AES256_GCM,data:0zBUyJJ/Elz0HQ==,iv:As7ZH6Tfp4yWhIG+ti4wxVYW4PJIXqcU73vCvdWmSg4=,tag:0ju3gO64NGfbTfUuqJ5tRA==,type:str]
+stringData:
+    telegram_bot_token: ENC[AES256_GCM,data:k6nLP/La1YXF8ABNnDXBiczFoBcgNVMBkn9b+2NtouAtSQhPPNhqO7A0tg6MGA==,iv:nULLyuRiFZSbrbFeyshZDLImUKPenDCFTerXBJaQlyo=,tag:L9+KfbUHNTUTt/fW7nCTLw==,type:str]
+    telegram_chat_id: ENC[AES256_GCM,data:wy56l1rIrit6jQ==,iv:p7T9mT14n09Roxw07hCegjYh/hOfPdJub5sToUGgjTM=,tag:jvqegX7sFFaE9OpsmpPVxQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUThWS1ZycWpBMXNUMFVD
+            bW80THZJZ2RINHhMM1hkUWVzU09XVlFINzNnCnhUMnE5Z09uR09PdEdlNVJ5TkR2
+            dGZSTFFLUmNNWlVjRkMwYjFWcVI3N1kKLS0tIE54RWN5OXdwYzB1ZExCK0tZSS8r
+            a3BRL3grUUFudWpSVjk1UGxmUzNLdHcKNrkVmCy3lJYDyWeiaX1bfJ9sVZTwoBgR
+            UiL4mqWIeuri56L5+J53X96j6mrGGy0L0MQIqbxpcImrtyMxRJO8XQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-16T17:32:23Z"
+    mac: ENC[AES256_GCM,data:M7t1HjRKL2sJqZxd00UAoASCufWSutZyKokMu2M4ZbGbwRNmIT9jI7y3BGxxbx8f/MspPWD0DnvWGvE+Dg6kmYhwoFV8CUQ6ZjfdQQV9dbghgQ++Cki7UfikretokpZa3gkNvmX71v0HV/awSPuTtLTlSwmd2ugjhaySj4SAW80=,iv:5daxNHDyc57ppVYdUOdTAmw3kqQi0NBW2wYXY2j8Lck=,tag:eC6/z0i3bpd59DlavpRSSA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4