checkId: check.notify.slack.connectivity plugin: stellaops.doctor.notify severity: warn tags: [notify, slack, connectivity, network, air-gap]

Slack Connectivity

This Doctor check confirms that Stella Ops can actually reach the configured Slack incoming-webhook endpoint over the network. It is the transport companion to check.notify.slack.configured(which only validates local settings) and is air-gap aware for sealed deployments.

What It Checks

Verifies that the configured Slack webhook endpoint is reachable. The check:

• Sends an empty-text POST payload to the webhook URL with a 10-second timeout.
• Slack returns no_text for empty messages, which proves the endpoint is alive without posting a visible message.
• Passes if the response is successful or contains no_text.
• Warns if an unexpected HTTP status is returned (e.g., invalid or revoked webhook).
• Fails on connection timeout or HTTP request exceptions.

The check only runs when Notify:Channels:Slack:WebhookUrl is set and is a valid absolute URL.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, this check returns Skip with airGapSealed=true instead of posting to Slack. check.notify.slack.configured still runs because it only validates local configuration.

Use an internal notification bridge, queue export, or offline operator workflow for sealed deployments. Public Slack webhooks require egress and should remain disabled unless policy explicitly allows them.

Why It Matters

A configured but unreachable Slack webhook means notifications are silently dropped. Teams relying on Slack for release alerts and security findings will miss critical events.

Common Causes

• Invalid or expired webhook URL
• Slack workspace configuration changed
• Webhook URL revoked or regenerated
• Rate limiting by Slack
• Firewall blocking outbound HTTPS to hooks.slack.com
• Proxy configuration required but not set

How to Fix

Docker Compose

Test connectivity from the container:

docker exec <notify-container> curl -v https://hooks.slack.com/

If behind a proxy:

environment:
  HTTPS_PROXY: "http://proxy.example.com:8080"

Bare Metal / systemd

curl -v https://hooks.slack.com/
curl -X POST -H 'Content-type: application/json' \
  --data '{"text":"Doctor test"}' \
  'https://hooks.slack.com/services/YOUR/WEBHOOK/URL'

Kubernetes / Helm

kubectl exec -it <notify-pod> -- curl -v https://hooks.slack.com/

If the webhook URL has been revoked, create a new one in the Slack App settings under Incoming Webhooks and update the configuration.

Verification

stella doctor run --check check.notify.slack.connectivity

Related Checks

• check.notify.slack.configured — verifies Slack webhook URL is set
• check.notify.queue.health — verifies the notification delivery queue is healthy