services:
  loki:
    image: grafana/loki:latest
    container_name: loki
    user: root
    restart: unless-stopped
    ports:
      - "${HTTP_PORT_loki}:3100"
    volumes:
      - /path/to/monitoring-data/loki:/tmp/loki
      - /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
    command: -config.file=/etc/loki/loki-config.yaml
    networks:
      - monitoring-net

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    ports:
      - "${HTTP_PORT_prometheus}:9090"
    volumes:
      - /path/to/monitoring-data/prometheus:/prometheus
      - /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--web.enable-remote-write-receiver'
      - '--storage.tsdb.retention.size=900GB'
    networks:
      - monitoring-net

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "${HTTP_PORT_grafana}:3000"
    env_file: .env
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_SERVER_ROOT_URL=${GRAFANA_URL}
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=authentik
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
      - GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
      - GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
      - GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
      - GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
      - GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
    volumes:
      - /path/to/monitoring/grafana:/var/lib/grafana
    networks:
      - monitoring-net

networks:
  monitoring-net:
    external: true