anomonitor 0.6.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 6598d41498f36ba18da8391e8dff7dd940532ca218cbe5240357d496ed24c71a
+  data.tar.gz: 5064d81305a4c871b0ccaa1d6ab398c316ff09fc5a7ea6511ceb771f584c15c6
+SHA512:
+  metadata.gz: 16534086abd65a8fb0e1888440e96dc1b4aafd146743489e05bc854c38b09f4a388e3458a14fa4b228a9c842a522259334c165c253d578d75b9b2d55101a4eca
+  data.tar.gz: eef964fa8914f22ff0a0fc031423f3a0a2fd3c5be6064018bedf07a39fb10dff28afb513175bd18a3edd08eb90f95e7188a44e3223e9a9d335b18cb22d57cac4

data/CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+## 0.6.1
+
+- CI: allow `sqlite3 >= 2.1` for Rails 8; matrix Rails 7.1 / 7.2 / 8.0
+
+## 0.6.0
+
+- Mutes / snoozes (`anomonitor_mutes` + `/mutes` UI + `c.mute(...)`)
+- Anomaly digest mode (`c.digest_interval`) → `anomaly.digest` webhook batch
+- Alert `match:` filters (e.g. per-queue Sidekiq: `match: { queue: true }`)
+- Manual resolve emits `anomaly.acked` (auto-clear still `anomaly.resolved`)
+- Notifier rate limit (`c.notifier_rate_limit`)
+- Jobs browser expandable detail (args / handler / error)
+- Overview tenant filter + by-tenant summary
+- SchemaDrift collector tests + engine route surface tests
+- RubyGems release notes (`RELEASE.md`) + gemspec MFA metadata
+
+## 0.5.0
+
+- Manual resolve/ack and reopen on anomaly detail (sticky silence until clear)
+- Retry failed webhooks from UI and `rails anomonitor:retry_webhooks`
+- Full schema-drift `items_list` in tags (detail page shows all items)
+- Boot config warnings (`ConfigurationValidator`)
+- Jobs browser search (`q`) by job class/name
+- Metrics export: `/anomonitor/metrics.json` and `/anomonitor/metrics.prom`
+- Poll advisory/file lock (`c.poll_lock`, default on) + cooperative thread stop
+- Spike baselines sample more candidates before tag filter
+- Dedupe Solid Queue / status-table metrics (single `queue_depth`)
+- Remove unused `ApplicationJob`
+
+## 0.4.1
+
+- Pluggable `c.notifier` (callable / `#deliver` / array) + `Anomonitor::Notifiers.payload` for host transports like `Webhook::Broadcast`
+
+## 0.4.0
+
+- Absolute webhook dashboard URLs via `dashboard_base_url` / `ANOMONITOR_DASHBOARD_BASE_URL`
+- Sticky schema drift: `anomaly.resolved` webhook when drift clears; anomalies UI open/resolved filter
+- Fingerprint full item sets (`items_digest`) so changes beyond the first 25 still re-alert
+- Jobs browser: Delayed Job / table `pending` matches collectors (`run_at <= now`); hide `locked` for status-style tables
+- Dashboard auth hook (`c.authenticate`) + docs / SECURITY note
+- Default install alerts for `failed` and `latency`
+- `schema_drift_interval` (default 15m) so drift polls less often than queue metrics
+- Prune old anomalies with `retention_days` (keep open schema-drift rows)
+- GitHub Actions CI (`rake test` on Ruby 3.1–3.3)
+
+## 0.3.2
+
+- Schema drift alerts are sticky: notify once, stay silent until the drift clears or the item set changes (no 15‑minute re-alerts)
+- Anomalies gain `resolved_at` for sticky resolution
+- Jobs browser: honor `queue` filter for custom tables and Delayed Job
+
+## 0.3.1
+
+- Update slack text ```"<#{dashboard}|Open anomaly>" -> "<#{dashboard}>"```
+
+## 0.3.0
+
+- Jobs dashboard: collector health cards + read-only live job browser for Sidekiq, Delayed Job, Solid Queue, and custom tables
+
+## 0.2.3
+
+- Wrap long metric/anomaly tag lines so tables stay within the viewport
+
+## 0.2.2
+
+- Stop auto-appending engine migrations (use `rails anomonitor:install:migrations`) so Apartment hosts can own public-only copies without duplicate migration names
+
+## 0.2.1
+
+- Support Rails `>= 6.1` (migrations use `ActiveRecord::Migration[6.1]`)
+- Dashboard cron mode UI (mode/schedule/last run from samples)
+
+## 0.2.0
+
+- Multi-tenancy: `tenants`, `exclude_tenants`, `tenant_switch` (Apartment-aware by default)
+- Per-tenant Delayed Job metrics when tenants are configured
+- Schema drift collector (`missing_tables` / `extra_tables` / `missing_columns` / `extra_columns`)
+- Configurable `schema_drift_exclude` globs
+- Custom tables: `style: :delayed_job` and optional `tenant:` for per-tenant index tables
+- Tenant-aware cooldown keys, spike baselines, and Slack webhook text
+- `poll_mode` `:thread` (default) or `:cron` — cron uses `rails anomonitor:poll`
+
+## 0.1.0
+
+- Initial release: Sidekiq, Delayed Job, Solid Queue, and custom table collectors
+- Threshold and growth-spike detection with cooldown
+- Webhook notifier
+- Mountable dashboard (overview, anomalies, metrics)

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright flori-s
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,275 @@
+# Anomonitor
+
+Rails engine gem that watches **Sidekiq**, **Delayed Job**, **Solid Queue**, and **custom job tables** for anomalies — threshold breaches, growth spikes, and **schema drift** — then notifies via **webhook** and shows an ops **dashboard**.
+
+<img width="1512" height="836" alt="anomonitor" src="https://github.com/user-attachments/assets/62938225-02a7-4e5c-8baf-d8ec24658a79" />
+
+## Install
+
+```ruby
+# Gemfile
+gem "anomonitor", github: "flori-s/anomonitor"
+```
+
+Requires **Ruby >= 3.0** and **Rails >= 6.1**.
+
+```bash
+bundle install
+rails generate anomonitor:install
+rails anomonitor:install:migrations
+rails db:migrate
+```
+
+Mount the engine:
+
+```ruby
+# config/routes.rb
+mount Anomonitor::Engine => "/anomonitor"
+```
+
+## Configure
+
+`config/initializers/anomonitor.rb`:
+
+```ruby
+Anomonitor.configure do |c|
+  c.webhook_url = ENV.fetch("ANOMONITOR_WEBHOOK_URL")
+  c.dashboard_base_url = ENV["ANOMONITOR_DASHBOARD_BASE_URL"] # e.g. "https://ops.example.com"
+  c.poll_interval = 60
+  c.cooldown = 15 * 60
+  c.retention_days = 7
+  c.schema_drift_interval = 15 * 60
+
+  c.collectors.sidekiq = true
+  c.collectors.delayed_job = true
+  c.collectors.solid_queue = true
+
+  c.alert :queue_depth, max: 1_000
+  c.alert :failed, max: 50
+  c.alert :latency, max: 120
+  c.alert :growth_spike, window: 5 * 60, multiplier: 3.0
+end
+```
+
+Per-queue Sidekiq (tagged `queue_depth` / `latency` points):
+
+```ruby
+c.alert :queue_depth, max: 250, match: { queue: true }
+c.alert :latency, max: 60, match: { queue: "mailers" }
+```
+
+`match` values: `true` = tag present, `nil`/`false` = tag absent, string = exact.
+
+### Mutes
+
+```ruby
+Anomonitor.config.mute(metric: "extra_tables", tenant: "acme", duration: 24.hours, reason: "migration")
+```
+
+Or use `/anomonitor/mutes` in the dashboard.
+
+### Digests
+
+```ruby
+c.digest_interval = 3600       # batch detections into anomaly.digest
+c.notifier_rate_limit = 30     # max delivers per minute
+```
+
+### Dashboard auth
+
+The engine is **open by default**. Protect it:
+
+```ruby
+Anomonitor.configure do |c|
+  c.authenticate = -> {
+    authenticate_or_request_with_http_basic("Anomonitor") do |user, pass|
+      ActiveSupport::SecurityUtils.secure_compare(user, ENV.fetch("ANOMONITOR_USER")) &&
+        ActiveSupport::SecurityUtils.secure_compare(pass, ENV.fetch("ANOMONITOR_PASSWORD"))
+    end
+  }
+end
+```
+
+Or reuse host auth:
+
+```ruby
+c.authenticate = -> { redirect_to main_app.root_path unless current_user&.admin? }
+```
+
+You can also constrain the mount in routes (`authenticate :user, ->(u) { u.admin? } do ... end`).
+
+### Multi-tenancy + schema drift
+
+For Apartment / schema-per-tenant apps, set `tenants` so Delayed Job is collected **per tenant** and enable schema drift (**PostgreSQL** / `information_schema`):
+
+```ruby
+Anomonitor.configure do |c|
+  c.tenants = -> { CustomerTenant.pluck(:name) }
+  c.exclude_tenants = %w[public]
+  # optional — defaults to Apartment::Tenant.switch when Apartment is loaded
+  c.tenant_switch = ->(name, &block) { Apartment::Tenant.switch(name, &block) }
+
+  c.collectors.delayed_job = true
+  c.collectors.schema_drift = true
+  c.schema_drift_interval = 15 * 60 # heavier than queue polls; default 15m
+  c.schema_drift_exclude = %w[
+    schema_migrations
+    ar_internal_metadata
+    anomonitor_*
+    a*
+    conv_*
+  ]
+
+  c.alert :queue_depth, max: 1_000
+  c.alert :missing_tables, max: 0
+  c.alert :extra_tables, max: 0
+  c.alert :missing_columns, max: 0
+  c.alert :extra_columns, max: 0
+end
+```
+
+`schema_drift_exclude` accepts exact names or `File.fnmatch` globs (`a*` matches all a-prefixed tables; `a_*` only matches `a_…`).
+
+Schema drift webhooks are **sticky**: one `anomaly.detected` per tenant/metric/item-set, silence until clear or the set changes, then `anomaly.resolved` when it clears. Queue threshold and growth alerts still use `c.cooldown` (default 15 minutes).
+
+### Custom tables
+
+Status-based queues:
+
+```ruby
+c.table :customer_jobs do |t|
+  t.model = "Job"
+  t.timestamp = :created_at
+  t.status = :status
+  t.active = %w[pending running]
+end
+```
+
+Cross-tenant Delayed Job index (host provides an AR model, e.g. `SuppJob` → `public.supp_jobs`):
+
+```ruby
+c.table :supp_jobs do |t|
+  t.model = "SuppJob"
+  t.style = :delayed_job   # failed_at / locked_at / run_at / locked_by
+  t.tenant = :tenant       # emit per-tenant metrics
+end
+```
+
+### Webhooks
+
+Built-in: set `ANOMONITOR_WEBHOOK_URL`. Set `ANOMONITOR_DASHBOARD_BASE_URL` (or `c.dashboard_base_url`) so Slack/JSON links are absolute.
+
+**Custom notifier** (e.g. your app’s `Webhook::Broadcast` proxy) — replaces the built-in HTTP client:
+
+```ruby
+Anomonitor.configure do |c|
+  c.notifier = ->(anomaly, event:) {
+    Webhook::Broadcast.new(
+      urls: [{ url: ENV.fetch("ANOMONITOR_DEST_URL"), headers: [
+        { name: "Content-Type", value: "application/json" }
+      ] }],
+      message: Anomonitor::Notifiers.payload(anomaly, event: event)
+    ).call
+  }
+end
+```
+
+Callables may return `true`/`false`, or a Hash with `:accepted` (Broadcast’s return value). Objects with `#deliver(anomaly, event:)` also work; pass an Array to fan out to several notifiers.
+
+Slack Incoming Webhooks (`hooks.slack.com`) get a formatted `text` payload when using the built-in notifier. Other built-in URLs receive JSON:
+
+```json
+{
+  "gem": "anomonitor",
+  "event": "anomaly.detected",
+  "severity": "high",
+  "rule": "growth_spike",
+  "source": "delayed_job",
+  "metric": "queue_depth",
+  "value": 4200,
+  "threshold": 1000,
+  "sampled_at": "2026-08-07T09:00:00Z",
+  "resolved_at": null,
+  "dashboard_url": "https://ops.example.com/anomonitor/anomalies/123",
+  "tags": { "tenant": "acme" }
+}
+```
+
+Events: `anomaly.detected` and `anomaly.resolved` (sticky schema drift clear).
+
+## Polling: thread vs cron
+
+Anomonitor can collect on a background thread **or** via an external scheduler.
+
+| `poll_mode` | Behavior |
+|---|---|
+| `:thread` (default) | Starts an in-process poller after boot (`poll_interval` seconds). Avoid with multi-worker Puma/Unicorn unless only one worker should run it. Prefer `:cron` in multi-worker setups. |
+| `:cron` | No background thread. Schedule `rails anomonitor:poll` yourself. |
+
+```ruby
+# In-process (default)
+c.poll_mode = :thread
+
+# Cron / systemd / Kubernetes CronJob / whenever
+c.poll_mode = :cron
+```
+
+Cron examples:
+
+```cron
+* * * * * cd /app && bin/rails anomonitor:poll
+```
+
+```ruby
+# config/schedule.rb (whenever)
+every 1.minute do
+  rake "anomonitor:poll"
+end
+```
+
+`c.auto_start = false` is still supported and is equivalent to `poll_mode = :cron`.
+
+Samples and resolved anomalies older than `retention_days` are pruned (open schema-drift rows are kept until resolved).
+
+## Dashboard
+
+Open `/anomonitor` for:
+
+- Current metric cards and mini history bars
+- **Jobs** — per-collector health plus a read-only live job browser (filter by source, status, tenant, queue, search; expandable detail)
+- Open anomalies (filter open / resolved / all) + resolve/ack, reopen, retry webhook
+- **Mutes** — snooze by metric/rule/source/tenant
+- Overview tenant filter
+- Poller health (last run, collector status)
+
+### Metrics export
+
+- JSON: `/anomonitor/metrics.json`
+- Prometheus text: `/anomonitor/metrics.prom`
+
+### Retry failed webhooks
+
+```bash
+rails anomonitor:retry_webhooks
+```
+
+`c.poll_lock = true` (default) skips overlapping ticks via Postgres advisory lock or a tmp file lock. Prefer `poll_mode = :cron` in multi-worker setups.
+
+## Manual poll
+
+```bash
+rails anomonitor:poll
+```
+
+With Apartment, the rake task switches to the first `exclude_tenants` entry (default `public`) before collecting.
+
+## Development
+
+```bash
+bundle install
+bundle exec rake test
+```
+
+## License
+
+MIT

data/RELEASE.md

@@ -0,0 +1,32 @@
+# Releasing Anomonitor
+
+## Version bump
+
+1. Update `lib/anomonitor/version.rb`
+2. Add a section to `CHANGELOG.md`
+3. Commit and tag: `git tag v0.6.1 && git push origin v0.6.1`
+
+## RubyGems
+
+Requires owner credentials on rubygems.org for the `anomonitor` gem.
+
+```bash
+gem build anomonitor.gemspec
+gem push anomonitor-0.6.1.gem
+```
+
+Or:
+
+```bash
+bundle exec rake release
+```
+
+(if a `release` task is configured via bundler gem tasks)
+
+## GitHub-only installs
+
+Until published, hosts can use:
+
+```ruby
+gem "anomonitor", github: "flori-s/anomonitor", tag: "v0.6.1"
+```

data/Rakefile

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "rake"
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.libs << "lib"
+  t.test_files = FileList["test/**/*_test.rb"]
+  t.warning = false
+end
+
+task default: :test

data/SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.6.x   | :white_check_mark: |
+| 0.5.x   | :white_check_mark: |
+| 0.4.x   | :white_check_mark: |
+| 0.3.x   | :white_check_mark: |
+| < 0.3   | :x:                |
+
+## Dashboard access
+
+The Anomonitor engine is **not authenticated by default**. If you mount it on a publicly reachable host, set `c.authenticate` in the initializer (HTTP basic or your app’s admin check). See the README.
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities privately. Do **not** open a public issue.
+
+- Prefer GitHub Security Advisories for [flori-s/anomonitor](https://github.com/flori-s/anomonitor/security/advisories/new) if available
+- Or email the maintainer via the contact listed in the gemspec / GitHub profile
+
+You can expect an initial response within **7 days**. If the report is accepted, we will work on a fix and coordinate disclosure. If declined, we will explain why.

data/app/assets/config/anomonitor_manifest.js

@@ -0,0 +1 @@
+//= link_directory ../stylesheets/anomonitor .css