[FIX] discord secret 파일 권한 수정

[eclipse021]

Closes #152

Summary

ObritDown alert가 firing 상태에 들어가도 Discord 알림이 가지 않음
-> Alertmanager가 secret 파일을 권한 부족으로 읽지 못함

Changes

discord_webhook_url 파일 권한 변경

Etc

Summary by CodeRabbit

Chores

• 모니터링 시스템의 Discord 알림 기능에 대한 웹훅 시크릿 마운트 방식을 개선했습니다. 파일 권한 설정과 소유자 관리를 최적화하여 구성의 안정성과 신뢰성을 향상시켰습니다.

[coderabbitai]

Warning

Review limit reached

@eclipse021, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 47 minutes and 56 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8335426d-f1f8-464a-baee-bb05180e1f0f

📥 Commits

Reviewing files that changed from the base of the PR and between 5fd8030 and eae4648.

📒 Files selected for processing (1)

• .github/workflows/ci-cd.yml

Walkthrough

alertmanager 서비스의 discord_webhook_url 시크릿 마운트 방식을 단순 참조에서 source/target 명시 구성으로 변경하고, mode: 0444로 권한을 고정했다. 호스트 파일 소유자와 컨테이너 내 nobody 사용자 간 읽기 호환성을 설명하는 주석도 추가되었다.

Changes

alertmanager 시크릿 마운트 권한 설정

Layer / File(s)	Summary
alertmanager 시크릿 마운트 권한 명시 infra/monitoring/docker-compose.yml	discord_webhook_url 시크릿을 source/target 형식으로 명시하고 mode: 0444로 읽기 전용 권한을 고정. 호스트 파일 소유자와 컨테이너 nobody 사용자 간 읽기 호환성 주석 추가.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 시크릿 파일 권한을 꽉 잡았네,
0444로 읽기만 허용!
nobody도 읽을 수 있게,
source와 target 명확히 써두고,
토끼가 주석도 달아줬다네 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	PR 목표(Discord 알림 권한 문제 해결)와 연결된 이슈(#152 영수증 분석 API 문서 개선)가 관련이 없습니다.	PR이 해결하는 Discord 알림 권한 문제와 관련된 이슈를 링크하거나, 이슈 #152 제거 후 올바른 이슈로 대체하기를 권장합니다.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목이 변경 내용과 일치합니다. Discord 시크릿 파일의 권한 수정이 정확히 반영되어 있습니다.
Out of Scope Changes check	✅ Passed	모든 변경사항이 Docker Compose에서 discord_webhook_url 시크릿 파일 권한 수정으로 명확하게 범위 내 변경입니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch junhyeon/fix/152/alertmanager-secret-perm

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@infra/monitoring/docker-compose.yml`:
- Around line 25-29: The mode: 0444 setting on line 29 of the
discord_webhook_url secret mount is ineffective in non-Swarm Docker Compose
environments and will not solve the permission issue preventing the nobody user
in alertmanager from reading the secret file. Remove the ineffective mode
directive from the secret configuration and instead fix the root cause by either
setting appropriate file permissions (644 or 444) when creating the secret file
in the CI workflow (.github/workflows/ci-cd.yml), or by modifying the
alertmanager container setup to handle the permission issue through an
entrypoint script that changes ownership or runs the service with appropriate
privileges.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5bcfeb53-1726-4ada-bc1d-32c6da2ce5ec

📥 Commits

Reviewing files that changed from the base of the PR and between 07d4836 and 5fd8030.

📒 Files selected for processing (1)

• infra/monitoring/docker-compose.yml