GoAlert - Secure Self-Hosted On-Call Alerting

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

GoAlert is an open source on-call scheduling, escalation and alerting platform maintained by Target. It routes incidents to the right responder through on-call schedules, rotations and escalation policies, so the right person is paged at the right time. This AMI delivers GoAlert fully installed and secured, backed by a local PostgreSQL database, and exposed through a browser-based web interface you run and control in your own AWS account. A working on-call platform is operational within minutes of launch.

## Why This Image vs a Manual Install

This image eliminates the manual binary download and verification, PostgreSQL provisioning, database migration, systemd unit authoring, reverse-proxy configuration, and credential hardening that a manual install requires. GoAlert ships no administrator account at all, so a manual deployment is unusable until an admin is created by hand. This image creates a unique administrator on each instance's first boot, generates a per-instance database password and data-encryption key, and applies the schema automatically. Launch the instance, read your unique credential, sign in, and start building on-call schedules.

## Application Stack

GoAlert is a single self-contained Go binary installed from the official upstream release (sha256 pinned), running as an unprivileged system user under a hardened systemd unit. It is bound to the loopback interface only and fronted by an nginx reverse proxy on port 80. A local PostgreSQL server holds all scheduling and alerting data on a dedicated data volume, independently resizable and separate from the OS disk. systemd starts PostgreSQL, GoAlert and nginx on boot and restarts them on failure.

## Security Hardening

This image follows a defence-in-depth approach:

• No default or shared credentials: GoAlert ships no administrator account; a cryptographically random administrator password is generated on each instance's first boot and written only to a root-only file
• Per-instance secrets: the PostgreSQL role password and the GoAlert data-encryption key are unique to each instance and generated on first boot, never baked into the image
• Network isolation: the application and the database bind exclusively to the loopback interface; only the nginx reverse proxy is exposed
• Least privilege: the application runs as an unprivileged system user with NoNewPrivileges set
• Dedicated data volume: the on-call database lives on its own disk, surviving OS-disk changes and resizable independently
• Automatic restart: systemd monitors PostgreSQL, GoAlert and nginx and restarts them on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Engineering on-call rotations: A platform team running follow-the-sun on-call rotations for their production services, with escalation policies that page the next responder automatically when an alert is not acknowledged
• Self-hosted PagerDuty alternative: An organisation that wants incident paging and escalation kept entirely inside its own AWS account for data-residency or cost reasons, rather than a third-party SaaS
• NOC and infrastructure alerting: An operations centre wiring monitoring systems into GoAlert via its generic and webhook integrations so infrastructure alerts reach the on-call engineer through their configured notification provider

## AWS Integration

Deploy on any EC2 instance type. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring. Back up your scheduling and alerting data using EBS snapshots or AWS Backup of the dedicated database volume. Resize the database volume independently of the OS disk as your alert history grows. To deliver alerts by SMS and voice, add your own Twilio account in the GoAlert admin console; email, Slack and webhook notifications are also configured post-launch.

## Getting Started

Read your credential from the root-only file, open the web interface in your browser, sign in as the administrator, and create your first on-call schedule, rotation and escalation policy. Configure a notification provider (Twilio for SMS and voice, or SMTP, Slack and webhooks) in the admin console to start delivering alerts.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, reverse-proxy termination with your own domain and certificate, configuring notification providers, integrating monitoring systems, and backup planning for your on-call database.