memory/patterns/pve-notification-webhook.md

PAT-011 — PVE Webhook Notifications Pipeline Repair

Trigger: PVE notifications (esp. vzdump) reach Telegram not / test returns 500.

Signature diagnosis ladder:

1. pvesh create /cluster/notifications/targets/<name>/test — error taxonomy:
   • Connection refused → transport/down (check URL target alive)
   • failed to render webhook body → template broken (syntax/base64)
   • http status: 400 → bridge rejected payload (escaping!)
2. Listener-Sweep über VLAN: for ip in .xx…; do /dev/tcp/$ip/port probe; done
3. Byte-Level-Truth via temp mini-sniffer (redirect URL, capture, restore!).

Hard rules:

• Mutations an /etc/pve/notifications.cfg NUR via pvesh set (hand-edits poison global deserialization!). Vorher Snapshot.
• body/header-values/secrets = base64 blobs: printf '%s' tpl | base64 -w0.
• Handlebars helpers: {{escape title}} (Space!), NICHT {{escape:title}}.
• Immer {{escape title}}/{{escape message}} verwenden — rohe Interpolation bricht bei Apostrophen/Multiline (Backup-Reports!).
• Sniffer-Redirect URL IMMER restaurieren.

Reference: docs/solutions/bug-fixes/2026-09-30-pve-webhook-notifications-drift-base64-escape.md