Implement Monlet MVP stack and UI updates

docs/ops/deployment-checklist.md

@@ -0,0 +1,57 @@
+# First deployment checklist
+
+A pragmatic list for the first production-ish Monlet stand-up. Adjust per environment.
+
+## 1. Secrets
+
+- [ ] Generate `MONLET_AUTH_TOKEN` (`openssl rand -hex 32`) and store it in your secret manager.
+- [ ] Generate a PostgreSQL password and store it in your secret manager.
+- [ ] Decide which notifier channels you want and gather their credentials (Telegram bot token + chat id, webhook URL, Alertmanager URL).
+
+## 2. Database
+
+- [ ] Provision PostgreSQL 16+.
+- [ ] Create `monlet` database and role with `CREATE`/`USAGE` on the schema.
+- [ ] Set `MONLET_DATABASE_URL=postgresql+asyncpg://...`.
+- [ ] Run `alembic upgrade head` from a one-shot container or the server image.
+- [ ] Verify `\dt` shows `agents, checks, events, incidents, notification_outbox`.
+
+## 3. Server
+
+- [ ] Set env vars per `server/.env.example` (see also `server/README.md`).
+- [ ] Start container; verify `GET /api/v1/health` and `/api/v1/ready` return 200.
+- [ ] Verify `/metrics` exposes `monlet_server_*`.
+- [ ] Confirm an authenticated `GET /api/v1/agents` returns `{ items: [], next_cursor: null }`.
+- [ ] Confirm logs show no unredacted token/cookie material.
+
+## 4. Agent (per host)
+
+- [ ] Install binary (see `agent/systemd/`).
+- [ ] Render `config.toml` from `agent/config.example.toml` with hostname or explicit `agent_id`, and `[server].token`.
+- [ ] Start under systemd; verify a heartbeat reaches the server (`GET /api/v1/agents`).
+- [ ] Run one configured check and verify a row appears in `/api/v1/checks` and an event in `/api/v1/events/query`.
+
+## 5. Notifications
+
+- [ ] Enable at least one notifier in server env (`MONLET_NOTIFIER_*`).
+- [ ] Force a `critical` event from one agent and confirm an outbox row reaches `sent` (`GET /api/v1/notifiers/outbox`).
+- [ ] Resolve the check and confirm a `resolved` outbox row is emitted.
+
+## 6. Web UI
+
+- [ ] Set `MONLET_API_BASE_URL` and `MONLET_API_TOKEN` for the web container.
+- [ ] Browse `/`, `/agents`, `/checks`, `/incidents`, `/events`, `/outbox`.
+- [ ] Verify the web image does not log the token (`docker logs` greps clean).
+
+## 7. Observability (optional)
+
+- [ ] Add Monlet server to your Prometheus scrape config (`deploy/prometheus/prometheus.yml`).
+- [ ] Import `deploy/grafana/dashboards/monlet-overview.json` for the starter dashboard.
+- [ ] If using Alertmanager as a notifier, point `MONLET_NOTIFIER_ALERTMANAGER_URL` at it.
+
+## 8. Operational
+
+- [ ] Schedule database backups (`docs/ops/backup-restore.md`).
+- [ ] Document token rotation owner and cadence (`docs/ops/token-rotation.md`).
+- [ ] Add `monlet_server_open_incidents` and `monlet_server_agents{status="dead"}` to your dashboards.
+- [ ] Decide an `events` retention policy.