# blackbox_exporter config
# Deployed to: C:\Program Files\blackbox_exporter\blackbox.yml
#
# Modules defined here:
#   icmp_ipv4      — ICMP ping, forced IPv4 (primary use: cross-site latency probes)
#   http_2xx       — HTTP GET, expect any 2xx response
#   https_2xx      — HTTPS GET with TLS validation, expect any 2xx response
#   https_2xx_noverify — HTTPS GET, skip cert verification (self-signed / internal PKI)
#   tcp_connect    — Raw TCP connection test (port reachability)
#   dns_udp        — DNS query over UDP, expect NOERROR
#
# Prometheus scrape example:
#   metrics_path: /probe
#   params:
#     module: [icmp_ipv4]
#   static_configs:
#     - targets: [192.168.5.1, 192.168.5.10]
#   relabel_configs:
#     - source_labels: [__address__]
#       target_label: __param_target
#     - source_labels: [__param_target]
#       target_label: instance
#     - target_label: __address__
#       replacement: <blackbox-host>:9115

modules:

  # --------------------------------------------------------------------------
  # ICMP
  # --------------------------------------------------------------------------

  icmp_ipv4:
    prober: icmp
    timeout: 5s
    icmp:
      preferred_ip_protocol: ip4
      ip_protocol_fallback: false
      payload_size: 56        # standard ping payload (matches default Windows ping)
      ttl: 64

  # --------------------------------------------------------------------------
  # HTTP / HTTPS
  # --------------------------------------------------------------------------

  http_2xx:
    prober: http
    timeout: 10s
    http:
      method: GET
      preferred_ip_protocol: ip4
      valid_status_codes: []  # defaults to 2xx
      follow_redirects: true
      fail_if_ssl: false
      fail_if_not_ssl: false

  https_2xx:
    prober: http
    timeout: 10s
    http:
      method: GET
      preferred_ip_protocol: ip4
      valid_status_codes: []
      follow_redirects: true
      fail_if_not_ssl: true
      tls_config:
        insecure_skip_verify: false

  https_2xx_noverify:
    prober: http
    timeout: 10s
    http:
      method: GET
      preferred_ip_protocol: ip4
      valid_status_codes: []
      follow_redirects: true
      fail_if_not_ssl: true
      tls_config:
        insecure_skip_verify: true

  # --------------------------------------------------------------------------
  # TCP
  # --------------------------------------------------------------------------

  tcp_connect:
    prober: tcp
    timeout: 5s
    tcp:
      preferred_ip_protocol: ip4
      ip_protocol_fallback: false

  # --------------------------------------------------------------------------
  # DNS
  # --------------------------------------------------------------------------

  dns_udp:
    prober: dns
    timeout: 5s
    dns:
      transport_protocol: udp
      preferred_ip_protocol: ip4
      query_name: "." # root query — lightweight health check, works on any DNS server
      query_type: NS
      valid_rcodes:
        - NOERROR
