Watch, recognize, shout.

01 · Watch

Reading the journal without owning it

On a systemd host, watch.rs follows journalctl on both ssh and sshd — following the unit that does not exist costs nothing, which is why the default works on every mainstream distribution without edits.

With kind = "file" it tails a log file and follows logrotate, so there is nothing to restart after a rotation. kind = "stdin" reads a pipe, which is what makes the pipeline testable.

Lines go into a bounded channel. The reader never waits on a webhook.

// main.rs — one channel, one flush tick, one stop future
let (tx, mut rx) = mpsc::channel(4096);
let src = tokio::spawn(watch::run(source, tx));

let mut tick = tokio::time::interval(Duration::from_secs(5));
tick.set_missed_tick_behavior(MissedTickBehavior::Delay);

loop {
    tokio::select! {
        line = rx.recv() => match line {
            Some(l) => n.line(&l).await,
            None => { warn!("la source s'est arrêtée"); break }
        },
        _ = tick.tick() => n.tick().await,
        _ = &mut stop => { info!("arrêt demandé"); break }
    }
}

n.flush().await;   // pending burst summaries go out before we exit

$ sudo -u gabier gabier check
config    /etc/gabier/config.toml
serveur   vps-prod-1
source    journald (ssh, sshd)
évènements accepted=true failed=true invalid_user=true closed=false
anti-spam 1 échec(s) par IP, puis résumé toutes les 300s
geoip     false
discord   https://discord.com/api/webhooks/123/abcd…
          joignable

Tout est prêt.

03 · Shout

One POST per destination, with retries

discord.rs and slack.rs only build a payload; everything else — the request, the retries, the size limits, the clamping of mentions — lives once in hook.rs. Configure both destinations and a Discord outage never costs you the Slack message.

That shared layer is also why gabier check can probe every webhook without publishing anything, and report all the broken ones rather than the first.