thesabear
bebcd714af
Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/ with a single stacks/ tree grouped by function (identity-and-security, platform, media, productivity, dev-tools) - 55 stacks total, every one a real directory in the private repos today. Resolves all outstanding drift: adds Wazuh (previously entirely missing), Firefly III and Postiz (never mirrored), the internal-zone Caddy instance and the Cron Scheduler's separate NocoDB instance (both previously conflated with their counterparts under one shared folder); renames Calibre-Web to calibre-web-automated and splits Kodi-MariaDB into kodi + mariadb-latest to match what the private repos actually run now; drops the decommissioned NetBox stack. Also removes automation/iac/old-content/ and automation/ansible/old-playbooks/ in the same pass - both folders were entirely stale content describing a superseded architecture (GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.
64 lines
2.2 KiB
YAML
64 lines
2.2 KiB
YAML
services:
|
|
loki:
|
|
image: grafana/loki:latest
|
|
container_name: loki
|
|
user: root
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_loki}:3100"
|
|
volumes:
|
|
- /path/to/monitoring-data/loki:/tmp/loki
|
|
- /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
|
|
command: -config.file=/etc/loki/loki-config.yaml
|
|
networks:
|
|
- monitoring-net
|
|
|
|
prometheus:
|
|
image: prom/prometheus:latest
|
|
container_name: prometheus
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_prometheus}:9090"
|
|
volumes:
|
|
- /path/to/monitoring-data/prometheus:/prometheus
|
|
- /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
command:
|
|
- '--config.file=/etc/prometheus/prometheus.yml'
|
|
- '--web.enable-remote-write-receiver'
|
|
- '--storage.tsdb.retention.size=900GB'
|
|
networks:
|
|
- monitoring-net
|
|
|
|
grafana:
|
|
image: grafana/grafana:latest
|
|
container_name: grafana
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_grafana}:3000"
|
|
env_file: .env
|
|
environment:
|
|
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
|
- GF_SERVER_ROOT_URL=${GRAFANA_URL}
|
|
- GF_AUTH_GENERIC_OAUTH_ENABLED=true
|
|
- GF_AUTH_GENERIC_OAUTH_NAME=authentik
|
|
- GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
|
|
- GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
|
|
- GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
|
|
- GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
|
|
- GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
|
|
- GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
|
|
- GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
|
|
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
|
|
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
|
|
- GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
|
|
- GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
|
|
- GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
|
|
volumes:
|
|
- /path/to/monitoring/grafana:/var/lib/grafana
|
|
networks:
|
|
- monitoring-net
|
|
|
|
networks:
|
|
monitoring-net:
|
|
external: true
|