Developer
2d1674cb08
- Make OBSERVABILITY_DATA_ROOT required in docker-compose.observability.yml so Portainer deployments must set an absolute host path. - Add Traefik labels and the web external network to Grafana, Prometheus, and Alertmanager with env-driven hostnames, router/service names, internal ports, entrypoint, and cert resolver. - Keep direct host ports as a fallback for local debugging. - Update docs/observability-runbooks.md with required variables, Traefik hostname column, and a .env.observability example.
253 lines
8.3 KiB
YAML
253 lines
8.3 KiB
YAML
# Standalone observability stack.
|
|
#
|
|
# Run this on a host where you want Grafana, Prometheus, Loki, Alertmanager,
|
|
# Alloy and Node Exporter without the rest of Manage.
|
|
#
|
|
# Required environment variables:
|
|
# - OBSERVABILITY_DATA_ROOT (absolute path, e.g. /var/lib/manage/observability)
|
|
# - CERT_RESOLVER (Traefik cert resolver name)
|
|
# - GRAFANA_APP_HOST, PROMETHEUS_APP_HOST, ALERTMANAGER_APP_HOST
|
|
#
|
|
# Optional environment variables:
|
|
# - TRAEFIK_ENTRYPOINT (default: websecure)
|
|
# - *_APP_NAME router/service names (defaults below)
|
|
# - all *_PORT variables for direct host ports
|
|
#
|
|
# Deploy:
|
|
# docker compose -f docker-compose.observability.yml up -d
|
|
#
|
|
# Then open Grafana at the configured host (default admin / admin).
|
|
#
|
|
# To scrape a Manage backend as well, edit monitoring/prometheus/prometheus.standalone.yml
|
|
# and add a static target for it, or drop a file-SD JSON file into
|
|
# monitoring/prometheus/file-sd/.
|
|
|
|
services:
|
|
prometheus:
|
|
image: prom/prometheus:v2.55.1
|
|
container_name: prometheus
|
|
command:
|
|
- "--config.file=/etc/prometheus/prometheus.yml"
|
|
- "--storage.tsdb.path=/prometheus"
|
|
- "--storage.tsdb.retention.time=30d"
|
|
- "--web.console.libraries=/usr/share/prometheus/console_libraries"
|
|
- "--web.console.templates=/usr/share/prometheus/consoles"
|
|
- "--web.enable-lifecycle"
|
|
volumes:
|
|
- ./monitoring/prometheus/prometheus.standalone.yml:/etc/prometheus/prometheus.yml:ro
|
|
- ./monitoring/prometheus/rules:/etc/prometheus/rules:ro
|
|
- ./monitoring/prometheus/file-sd:/etc/prometheus/file-sd:ro
|
|
- ${OBSERVABILITY_DATA_ROOT:?set OBSERVABILITY_DATA_ROOT}/prometheus:/prometheus
|
|
ports:
|
|
- "${PROMETHEUS_PORT:-9090}:9090"
|
|
networks:
|
|
- monitoring
|
|
- web
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9090/-/healthy"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.rule=Host(`${PROMETHEUS_APP_HOST:?set PROMETHEUS_APP_HOST}`)"
|
|
- "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
- "traefik.http.routers.${PROMETHEUS_APP_NAME:-prometheus}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
|
|
- "traefik.http.services.${PROMETHEUS_APP_NAME:-prometheus}.loadbalancer.server.port=${PROMETHEUS_APP_PORT:-9090}"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1.00"
|
|
memory: 1G
|
|
reservations:
|
|
cpus: "0.25"
|
|
memory: 256M
|
|
|
|
loki:
|
|
image: grafana/loki:3.1.1
|
|
container_name: loki
|
|
command: -config.file=/etc/loki/loki.yml
|
|
volumes:
|
|
- ./monitoring/loki/loki.yml:/etc/loki/loki.yml:ro
|
|
- ${OBSERVABILITY_DATA_ROOT:?set OBSERVABILITY_DATA_ROOT}/loki:/loki
|
|
ports:
|
|
- "${LOKI_PORT:-3100}:3100"
|
|
networks:
|
|
- monitoring
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3100/ready"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1.00"
|
|
memory: 1G
|
|
reservations:
|
|
cpus: "0.25"
|
|
memory: 256M
|
|
|
|
alloy:
|
|
image: grafana/alloy:v1.5.0
|
|
container_name: alloy
|
|
command:
|
|
- run
|
|
- /etc/alloy/config.alloy
|
|
- --storage.path=/var/lib/alloy
|
|
volumes:
|
|
- ./monitoring/alloy/config.alloy:/etc/alloy/config.alloy:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /var/lib/docker/containers:/var/lib/docker/containers:ro
|
|
- ${OBSERVABILITY_DATA_ROOT:?set OBSERVABILITY_DATA_ROOT}/alloy:/var/lib/alloy
|
|
ports:
|
|
- "${ALLOY_PORT:-12345}:12345"
|
|
networks:
|
|
- monitoring
|
|
depends_on:
|
|
loki:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
user: root
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:12345/-/healthy"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "0.50"
|
|
memory: 512M
|
|
reservations:
|
|
cpus: "0.10"
|
|
memory: 128M
|
|
|
|
grafana:
|
|
image: grafana/grafana:11.3.1
|
|
container_name: grafana
|
|
environment:
|
|
GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
|
|
GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GF_AUTH_GENERIC_OAUTH_CLIENT_ID:-}
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:-}
|
|
GF_AUTH_GENERIC_OAUTH_AUTH_URL: ${GF_AUTH_GENERIC_OAUTH_AUTH_URL:-}
|
|
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ${GF_AUTH_GENERIC_OAUTH_TOKEN_URL:-}
|
|
GF_AUTH_GENERIC_OAUTH_API_URL: ${GF_AUTH_GENERIC_OAUTH_API_URL:-}
|
|
LOG_LEVEL: ${LOG_LEVEL:-INFO}
|
|
volumes:
|
|
- ./monitoring/grafana/grafana.ini:/etc/grafana/grafana.ini:ro
|
|
- ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
|
|
- ${OBSERVABILITY_DATA_ROOT:?set OBSERVABILITY_DATA_ROOT}/grafana:/var/lib/grafana
|
|
ports:
|
|
- "${GRAFANA_PORT:-3000}:3000"
|
|
networks:
|
|
- monitoring
|
|
- web
|
|
depends_on:
|
|
prometheus:
|
|
condition: service_healthy
|
|
loki:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.rule=Host(`${GRAFANA_APP_HOST:?set GRAFANA_APP_HOST}`)"
|
|
- "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
- "traefik.http.routers.${GRAFANA_APP_NAME:-grafana}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
|
|
- "traefik.http.services.${GRAFANA_APP_NAME:-grafana}.loadbalancer.server.port=${GRAFANA_APP_PORT:-3000}"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1.00"
|
|
memory: 512M
|
|
reservations:
|
|
cpus: "0.25"
|
|
memory: 128M
|
|
|
|
alertmanager:
|
|
image: prom/alertmanager:v0.27.0
|
|
container_name: alertmanager
|
|
command:
|
|
- "--config.file=/etc/alertmanager/alertmanager.yml"
|
|
- "--storage.path=/alertmanager"
|
|
environment:
|
|
SMTP_HOST: ${SMTP_HOST:-smtp.example.com}
|
|
SMTP_PORT: ${SMTP_PORT:-587}
|
|
SMTP_USERNAME: ${SMTP_USERNAME:-}
|
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-}
|
|
SMTP_FROM_ADDRESS: ${SMTP_FROM_ADDRESS:-no-reply@example.com}
|
|
ALERT_EMAIL_TO: ${ALERT_EMAIL_TO:-admin@example.com}
|
|
volumes:
|
|
- ./monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
|
|
- ${OBSERVABILITY_DATA_ROOT:?set OBSERVABILITY_DATA_ROOT}/alertmanager:/alertmanager
|
|
ports:
|
|
- "${ALERTMANAGER_PORT:-9093}:9093"
|
|
networks:
|
|
- monitoring
|
|
- web
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9093/-/healthy"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.rule=Host(`${ALERTMANAGER_APP_HOST:?set ALERTMANAGER_APP_HOST}`)"
|
|
- "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
- "traefik.http.routers.${ALERTMANAGER_APP_NAME:-alertmanager}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
|
|
- "traefik.http.services.${ALERTMANAGER_APP_NAME:-alertmanager}.loadbalancer.server.port=${ALERTMANAGER_APP_PORT:-9093}"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "0.50"
|
|
memory: 256M
|
|
reservations:
|
|
cpus: "0.10"
|
|
memory: 64M
|
|
|
|
node-exporter:
|
|
image: prom/node-exporter:v1.8.2
|
|
container_name: node-exporter
|
|
command:
|
|
- "--path.rootfs=/host"
|
|
volumes:
|
|
- /:/host:ro,rslave
|
|
ports:
|
|
- "${NODE_EXPORTER_PORT:-9100}:9100"
|
|
networks:
|
|
- monitoring
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9100/"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "0.25"
|
|
memory: 128M
|
|
reservations:
|
|
cpus: "0.05"
|
|
memory: 32M
|
|
|
|
networks:
|
|
monitoring:
|
|
web:
|
|
external: true
|