Automation (Node-RED + Home Assistant)

The webhook bus

Every alert source converges on Node-RED:

Source	Configure	Endpoint
Alertmanager	already wired (receiver `nodered-bus`)	`POST /alert/alertmanager`
Uptime Kuma	add a “Webhook” notification	`POST /alert/kuma`
Grafana alerting	contact point → webhook	`POST /alert/grafana`
Wazuh	integration script or via Graylog output	`POST /alert/wazuh`

Import automation/nodered-starter-flow.json (menu → Import). It gives you: two HTTP-in endpoints, per-source normalization to a common shape (source, status, name, host, severity, summary), a 10-minute cross-tool dedup keyed on name|host|status, and a severity switch with debug stubs where remediation actions go.

Secure Node-RED first: it has the Docker socket mounted (that’s how auto-restart works), so enable adminAuth in the editor settings before building flows.

Auto-remediation patterns

Service auto-restart: install node-red-contrib-dockerode in the editor (palette manager), point it at /var/run/docker.sock, wire the critical branch: if name == "ScrapeTargetDown" and the target maps to a container, restart it; re-notify only if the alert re-fires within 15 minutes (escalation-on-reconfirmation).
Smart-plug power cycle: for hung devices, call your plug’s API (Tasmota/Shelly HTTP, or via Home Assistant switch.turn_off/on) from an HTTP-request node, with a cooldown guard in flow context so it can’t loop.
Keep every remediation idempotent and rate-limited — an action that fires unbounded is worse than the outage.

Home Assistant

Uptime Kuma integration: HACS/core integration; authenticate with the Kuma API key. Exposes each monitor as a binary sensor — usable in HA automations (e.g. announce when the NAS goes down).
NUT integration: point HA at your NUT server. Automate UPS-on-battery → graceful shutdown ordering: HA calls shutdown on non-critical VMs first (Proxmox API), monitoring VMs last.
Wazuh active response handles the security side (block IP on brute force etc.) — configure in the manager’s ossec.conf; keep network-level remediation there rather than duplicating it in Node-RED.