Notifications

Notifications decides which events go where. It has four tabs:

• Channels: where messages go (a Slack channel, a Teams channel, an email list, a webhook).
• Rules: which events go to which channels, from which severity.
• Summaries: scheduled daily, weekly or monthly digest cards.
• Delivery history: every message sent, with its delivery status.

Nothing is sent until there is at least one channel and one enabled rule that sends events to it.

#Channel types

Webhook URLs, SMTP credentials and signing secrets are stored in the secret store and never shown again. Any of these fields can also point to a saved credential from Secrets & variables, so rotating the credential updates the channel.

#Add a channel

You need modify access to Notifications.

1. Open Notifications. The Channels tab is open.
2. Click Add Slack, Add Microsoft Teams, Add Google Chat, Add Email or Add Webhook.
3. Choose where the channel is available:
   • This project: only this project's events can use it.
   • Shared with all projects: organization-wide. Needs the matching access to Notifications in your organization role.
4. Enter a Name and the connection fields.
5. For Slack, Teams and Google Chat, adjust Look & feel if you like. The Preview shows roughly how a build message will look.
6. Click Save channel.
7. On the channel card, pick a message (Test message, or a sample build started, succeeded or failed message) and click Send. The card shows whether delivery worked.

Use Customize to change a channel later, the On/Off switch to pause it, and Delete to remove it (needs full access).

#Look & feel (chat channels)

#Email

Port 465 uses TLS. Any other port uses STARTTLS. Typical values are smtp.office365.com or smtp.gmail.com on port 587. Subjects start with [OpsNexus], and messages include an HTML card and a plain-text part.

#Webhook payload

The webhook channel posts JSON like this:

{
  "event": "build.failed",
  "severity": "high",
  "status": "failed",
  "title": "payments-api #128 failed",
  "body": "",
  "facts": { "Pipeline": "payments-api", "Branch": "main" },
  "sections": [],
  "url": null,
  "app_url": "https://opsnexus.example.com/cicd/runs/...",
  "sent_at": "2026-11-14T09:30:00+00:00"
}

If you set a Signing secret, each request carries an X-OpsNexus-Signature: sha256=<hex> header. The value is the HMAC-SHA256 of the raw request body with the secret as key. Verify it before trusting the request:

import hashlib, hmac

def is_valid(body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

#Private addresses

Webhook URLs and SMTP hosts that resolve to private, loopback or link-local addresses are refused, to protect against server-side request forgery. To send to internal services, an admin sets this in .env:

ALLOW_PRIVATE_TARGETS=true

#Rules

A rule picks events, a minimum severity, an optional environment and one or more channels.

1. Open Notifications > Rules and click New rule.
2. Choose This project or Shared with all projects.
3. Enter a Rule name.
4. Set Minimum severity: info, low, medium, high or critical. Only events at or above it are sent.
5. Set Environment: All, prod, staging or dev.
6. Under Send to, tick the channels.
7. Tick the events. Each group has Select all.
8. Click Save rule.

A new rule starts with build failed, deployment failed, server or agent unreachable, and domain down ticked, and minimum severity medium.

#Per-project routing

Every event belongs to the project it happened in. When an event fires, OpsNexus looks at:

• the enabled rules of that project, and
• the enabled rules shared with all projects.

Each matching rule adds its channels, and each channel gets one message even if several rules match. A project rule may only send to its own project's channels and to shared channels. A shared rule may only send to shared channels.

Shared rules also receive organization events that don't belong to a project, such as a failed scheduled backup.

So, to send one team's alerts to its own Slack channel, add the channel and a rule in that team's project. To send every critical event to an on-call email list, add a shared channel and a shared rule with Minimum severity critical.

#Events

Each event has a default severity. Events raised by alert rules use the rule's severity instead.

#Builds & deployments

#Monitoring alerts

#Kubernetes

Kubernetes events are sent for clusters with alerts turned on. See Kubernetes.

#Websites & domains

#Build agents

#Cloud, security & integrations

cost.alert is sent when a budget crosses one of its thresholds, at high severity from 100%. See Cost & budgets. integration.error is also used when a scheduled backup fails.

#Summaries

A summary is a scheduled card sent straight to the channels you choose. It doesn't use rules.

1. Open Notifications > Summaries and click New summary. You need at least one channel first.
2. Choose This project (covers only this project) or Shared with all projects (covers the whole organization).
3. Set Name, How often (Daily, Weekly or Monthly), Day or Day of month (1 to 28), Time and Time zone.
4. Under Include, tick the sections: Builds & deployments, Monitoring alerts, Website uptime, Cloud cost, Security findings and Website traffic.
5. Under Send to, tick the channels.
6. Click Save summary.

Each card covers the period since the previous one. Click Send now to send one for the period ending now. Website traffic comes from the Traffic tab of Domains & SEO.

#Delivery history

Delivery history lists every message with its event, channel, severity, when it was sent, its delivery status and who acknowledged it. Filter by delivered, retrying or failed.

• A failed send is retried, up to 3 attempts in total. After that the delivery is marked failed and the error is shown.
• Click Retry to try a failed delivery again (needs modify access).
• Click Acknowledge to mark a message as seen.

Each channel card also shows the result of its last delivery.

#Permissions

Notifications use the Notifications module in roles.

Items shared with all projects belong to the organization. Changing them needs that access level on Notifications in your organization role. Channel, rule and summary changes are written to the audit log.