test(blackbox): probe the wiki over the scheme it actually serves

[Gerrrt]

The blackbox alert fixtures built every case around instance="https://lemmiwinks.matrix.elysium" and instance="https://10.0.99.30".

The real targets are plain HTTP, and targets/blackbox.yaml:8-12 says so at some length:

The wiki is served over PLAIN HTTP, not https, and these targets say so. Verified against the running container on 2026-08-30: only port 3000 listens inside it, nothing is on 3443, and TLS is off. The host maps 443 anyway, so an https probe is refused instantly — which is exactly what the first deploy of this file did, reporting the wiki down while it was serving fine.

So the fixtures asserted the one scheme that file exists to warn against.

It wasn't only a label

I expected this to be cosmetic — instance is just a label and the tests passed. It isn't. EndpointUnreachable's summary is templated from {{ $labels.instance }} (blackbox.rules.yaml:44), so lines 45 and 63 were pinning the alert text an on-call reads to a URL that refuses instantly.

Verified the fixtures genuinely assert the scheme rather than passing regardless — a negative control leaving the summary at https while the instance says http fails the run:

FAILED:
  alertname: EndpointUnreachable, time: 11m
    exp: … summary="wiki is not reachable at https://10.0.99.30"
    got: … summary="wiki is not reachable at http://10.0.99.30"

Verification

• promtool test rules stacks/observability/prometheus/tests/blackbox.test.yaml → SUCCESS
• make validate → all checks pass
• Negative control above confirms the assertion is real

Purely a fixture change — no rule, target, or probe config is touched.

Context: found while fixing #74 (stale TLS documentation claims), deliberately left out of #196 to keep that PR scoped to TLS wording.

🤖 Generated with Claude Code