ceph: SMART-Audit rehabilitiert Kingston NVMe (kein Austausch); mgr-union scraping

patterns/pve-notification-webhook.md

@@ -0,0 +1,22 @@
+# PAT-011 — PVE Webhook Notifications Pipeline Repair
+
+**Trigger**: PVE notifications (esp. vzdump) reach Telegram not / test returns 500.
+
+**Signature diagnosis ladder**:
+1. `pvesh create /cluster/notifications/targets/<name>/test` — error taxonomy:
+   - `Connection refused` → transport/down (check URL target alive)
+   - `failed to render webhook body` → template broken (syntax/base64)
+   - `http status: 400` → bridge rejected payload (escaping!)
+2. Listener-Sweep über VLAN: `for ip in .xx…; do /dev/tcp/$ip/port probe; done`
+3. Byte-Level-Truth via temp mini-sniffer (redirect URL, capture, restore!).
+
+**Hard rules**:
+- Mutations an `/etc/pve/notifications.cfg` NUR via `pvesh set` (hand-edits poison
+  global deserialization!). Vorher Snapshot.
+- `body`/header-values/secrets = **base64 blobs**: `printf '%s' tpl | base64 -w0`.
+- Handlebars helpers: `{{escape title}}` (Space!), NICHT `{{escape:title}}`.
+- Immer `{{escape title}}`/`{{escape message}}` verwenden — rohe Interpolation bricht
+  bei Apostrophen/Multiline (Backup-Reports!).
+- Sniffer-Redirect URL IMMER restaurieren.
+
+Reference: `docs/solutions/bug-fixes/2026-09-30-pve-webhook-notifications-drift-base64-escape.md`