# Standalone observability stack.
#
# Run this on a host where you want Grafana, Prometheus, Loki, Alertmanager,
# Alloy and Node Exporter without the rest of Manage.
#
# Required environment variables:
#   - *_ROOT directories (absolute paths) for services you want to persist
#   - CERT_RESOLVER (Traefik cert resolver name)
#   - GRAFANA_APP_HOST, PROMETHEUS_APP_HOST, ALERTMANAGER_APP_HOST
#
# Each service root should contain a config/ and data/ subdirectory, e.g.:
#
#   /var/lib/manage/observability/prometheus/
#   ├── config/
#   │   ├── prometheus.yml
#   │   ├── rules/
#   │   └── file-sd/
#   └── data/
#
# Optional environment variables:
#   - TRAEFIK_ENTRYPOINT (default: websecure)
#   - *_APP_NAME router/service names (defaults below)
#   - all *_PORT variables for direct host ports
#
# Deploy:
#   docker compose -f docker-compose.observability.yml up -d
#
# Then open Grafana at the configured host (default admin / admin).

services:
  prometheus:
    image: prom/prometheus:v2.55.1
    container_name: prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=30d"
      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
      - "--web.console.templates=/usr/share/prometheus/consoles"
      - "--web.enable-lifecycle"
    volumes:
      - ${PROMETHEUS_ROOT:?set PROMETHEUS_ROOT}/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ${PROMETHEUS_ROOT:?set PROMETHEUS_ROOT}/config/rules:/etc/prometheus/rules:ro
      - ${PROMETHEUS_ROOT:?set PROMETHEUS_ROOT}/config/file-sd:/etc/prometheus/file-sd:ro
      - ${PROMETHEUS_ROOT:?set PROMETHEUS_ROOT}/data:/prometheus
    ports:
      - "${PROMETHEUS_PORT:-9090}:9090"
    networks:
      - monitoring
      - web
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9090/-/healthy"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.rule=Host(`${PROMETHEUS_APP_HOST:?set PROMETHEUS_APP_HOST}`)"
      - "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
      - "traefik.http.services.${PROMETHEUS_APP_NAME:-prometheus}.loadbalancer.server.port=${PROMETHEUS_APP_PORT:-9090}"
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 256M

  loki:
    image: grafana/loki:3.1.1
    container_name: loki
    command: -config.file=/etc/loki/loki.yml
    volumes:
      - ${LOKI_ROOT:?set LOKI_ROOT}/config/loki.yml:/etc/loki/loki.yml:ro
      - ${LOKI_ROOT:?set LOKI_ROOT}/data:/loki
    ports:
      - "${LOKI_PORT:-3100}:3100"
    networks:
      - monitoring
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3100/ready"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 256M

  alloy:
    image: grafana/alloy:v1.5.0
    container_name: alloy
    command:
      - run
      - /etc/alloy/config.alloy
      - --storage.path=/var/lib/alloy
    volumes:
      - ${ALLOY_ROOT:?set ALLOY_ROOT}/config/config.alloy:/etc/alloy/config.alloy:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ${ALLOY_ROOT:?set ALLOY_ROOT}/data:/var/lib/alloy
    ports:
      - "${ALLOY_PORT:-12345}:12345"
    networks:
      - monitoring
    depends_on:
      loki:
        condition: service_healthy
    restart: unless-stopped
    user: root
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:12345/-/healthy"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
        reservations:
          cpus: "0.10"
          memory: 128M

  grafana:
    image: grafana/grafana:11.3.1
    container_name: grafana
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GF_AUTH_GENERIC_OAUTH_CLIENT_ID:-}
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:-}
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: ${GF_AUTH_GENERIC_OAUTH_AUTH_URL:-}
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ${GF_AUTH_GENERIC_OAUTH_TOKEN_URL:-}
      GF_AUTH_GENERIC_OAUTH_API_URL: ${GF_AUTH_GENERIC_OAUTH_API_URL:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    volumes:
      - ${GRAFANA_ROOT:?set GRAFANA_ROOT}/config/grafana.ini:/etc/grafana/grafana.ini:ro
      - ${GRAFANA_ROOT:?set GRAFANA_ROOT}/config/provisioning:/etc/grafana/provisioning:ro
      - ${GRAFANA_ROOT:?set GRAFANA_ROOT}/data:/var/lib/grafana
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    networks:
      - monitoring
      - web
    depends_on:
      prometheus:
        condition: service_healthy
      loki:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.rule=Host(`${GRAFANA_APP_HOST:?set GRAFANA_APP_HOST}`)"
      - "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
      - "traefik.http.services.${GRAFANA_APP_NAME:-grafana}.loadbalancer.server.port=${GRAFANA_APP_PORT:-3000}"
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M

  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: alertmanager
    command:
      - "--config.file=/etc/alertmanager/alertmanager.yml"
      - "--storage.path=/alertmanager"
    environment:
      SMTP_HOST: ${SMTP_HOST:-smtp.example.com}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_ADDRESS: ${SMTP_FROM_ADDRESS:-no-reply@example.com}
      ALERT_EMAIL_TO: ${ALERT_EMAIL_TO:-admin@example.com}
    volumes:
      - ${ALERTMANAGER_ROOT:?set ALERTMANAGER_ROOT}/config/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - ${ALERTMANAGER_ROOT:?set ALERTMANAGER_ROOT}/data:/alertmanager
    ports:
      - "${ALERTMANAGER_PORT:-9093}:9093"
    networks:
      - monitoring
      - web
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9093/-/healthy"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.rule=Host(`${ALERTMANAGER_APP_HOST:?set ALERTMANAGER_APP_HOST}`)"
      - "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
      - "traefik.http.services.${ALERTMANAGER_APP_NAME:-alertmanager}.loadbalancer.server.port=${ALERTMANAGER_APP_PORT:-9093}"
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
        reservations:
          cpus: "0.10"
          memory: 64M

  node-exporter:
    image: prom/node-exporter:v1.8.2
    container_name: node-exporter
    command:
      - "--path.rootfs=/host"
    volumes:
      - /:/host:ro,rslave
    ports:
      - "${NODE_EXPORTER_PORT:-9100}:9100"
    networks:
      - monitoring
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9100/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 128M
        reservations:
          cpus: "0.05"
          memory: 32M

networks:
  monitoring:
  web:
    external: true