feat(observability): add Prometheus/Grafana/Loki/Alertmanager/Alloy stack and remove legacy Monitoring UI

2026-06-16 11:08:32 +00:00
parent 615e02e970
commit e2ad731b5f
80 changed files with 5020 additions and 3665 deletions
@@ -1,46 +1,66 @@
-# Optional backend logging level.
-LOG_LEVEL=INFO
+# App
+APP_VERSION=0.1.0
+APP_BUILD_INFO=dev

-# Optional SMTP settings for the Users -> message popup.
+# Hosts
+BACKEND_APP_HOST=api.manage.example.com
+FRONTEND_APP_HOST=manage.example.com
+GRAFANA_APP_HOST=grafana.example.com
+BACKEND_APP_PORT=8000
+FRONTEND_APP_PORT=80
+GRAFANA_APP_PORT=3000
+BACKEND_APP_NAME=manage-backend
+FRONTEND_APP_NAME=manage-frontend
+GRAFANA_APP_NAME=grafana
+
+# Traefik / certificates
+CERT_RESOLVER=letsencrypt
+
+# Backend
+LOG_LEVEL=INFO
+LOG_FORMAT=json
+PROMETHEUS_ENABLED=true
+PROMETHEUS_FILE_SD_DIR=/app/backend/.cache/prometheus-file-sd
+ALERTMANAGER_URL=http://alertmanager:9093
+ALERTMANAGER_WEBHOOK_URL=
+BACKEND_CACHE_DIR=./backend-cache
+
+# Auth
+AUTH_ENABLED=true
+OIDC_ISSUER_URL=https://auth.example.com/application/o/manage/
+OIDC_AUDIENCE=manage
+OIDC_JWKS_URL=https://auth.example.com/application/o/manage/jwks/
+OIDC_CLOCK_SKEW_SECONDS=30
+
+# Frontend OIDC
+VITE_API_URL=/api
+VITE_OIDC_ENABLED=true
+VITE_OIDC_ISSUER=https://auth.example.com/application/o/manage/
+VITE_OIDC_CLIENT_ID=manage
+VITE_OIDC_SCOPE=openid profile email
+VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback
+VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/
+VITE_DEV_API_PROXY_TARGET=http://backend:8000
+
+# SMTP
 SMTP_HOST=smtp.example.com
 SMTP_PORT=587
-SMTP_USERNAME=your-smtp-username
-SMTP_PASSWORD=your-smtp-password
+SMTP_USERNAME=
+SMTP_PASSWORD=
 SMTP_FROM_ADDRESS=no-reply@example.com
 SMTP_FROM_NAME=Manage
 SMTP_USE_TLS=true
 SMTP_USE_SSL=false
 SMTP_TIMEOUT=30

-# Machine/service configuration now lives in the app's Settings tab.
-# The built-in local machine is seeded automatically.
-#
-# Remote SSH machines can store their private key and optional passphrase directly in Settings,
-# so no SSH key mount is required for normal use.
+# Grafana admin / OAuth
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=change-me
+GF_AUTH_GENERIC_OAUTH_CLIENT_ID=manage
+GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=
+GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://auth.example.com/application/o/manage/authorize/
+GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://auth.example.com/application/o/manage/token/
+GF_AUTH_GENERIC_OAUTH_API_URL=https://auth.example.com/application/o/manage/userinfo/

-# For deployment with traefik
-FRONTEND_APP_NAME=manage
-FRONTEND_APP_HOST=manage.example.com
-FRONTEND_APP_PORT=5173
-
-BACKEND_APP_NAME=management-api
-BACKEND_APP_HOST=management-api.example.com
-BACKEND_APP_PORT=8000
-
-CERT_RESOLVER=lets-encrypt
-
-# Authentik / OIDC
-# Backend validates every API request with a Bearer JWT.
-AUTH_ENABLED=true
-OIDC_ISSUER_URL=https://authentik.example/application/o/media-library-viewer/
-OIDC_AUDIENCE=media-library-viewer
-OIDC_JWKS_URL=
-OIDC_CLOCK_SKEW_SECONDS=30
-
-# Frontend OIDC settings (Vite build/runtime env)
-VITE_OIDC_ENABLED=true
-VITE_OIDC_ISSUER=https://authentik.example/application/o/media-library-viewer/
-VITE_OIDC_CLIENT_ID=media-library-viewer
-VITE_OIDC_SCOPE=openid profile email
-VITE_OIDC_REDIRECT_URI=http://localhost:8080/
-VITE_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:8080/
+# Alerting
+ALERT_EMAIL_TO=admin@example.com