thesabear
c05c7164c8
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
64 lines
2.2 KiB
YAML
64 lines
2.2 KiB
YAML
services:
|
|
loki:
|
|
image: grafana/loki:latest
|
|
container_name: loki
|
|
user: root
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_loki}:3100"
|
|
volumes:
|
|
- /path/to/monitoring-data/loki:/tmp/loki
|
|
- /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
|
|
command: -config.file=/etc/loki/loki-config.yaml
|
|
networks:
|
|
- monitoring-net
|
|
|
|
prometheus:
|
|
image: prom/prometheus:latest
|
|
container_name: prometheus
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_prometheus}:9090"
|
|
volumes:
|
|
- /path/to/monitoring-data/prometheus:/prometheus
|
|
- /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
command:
|
|
- '--config.file=/etc/prometheus/prometheus.yml'
|
|
- '--web.enable-remote-write-receiver'
|
|
- '--storage.tsdb.retention.size=900GB'
|
|
networks:
|
|
- monitoring-net
|
|
|
|
grafana:
|
|
image: grafana/grafana:latest
|
|
container_name: grafana
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HTTP_PORT_grafana}:3000"
|
|
env_file: .env
|
|
environment:
|
|
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
|
- GF_SERVER_ROOT_URL=${GRAFANA_URL}
|
|
- GF_AUTH_GENERIC_OAUTH_ENABLED=true
|
|
- GF_AUTH_GENERIC_OAUTH_NAME=authentik
|
|
- GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
|
|
- GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
|
|
- GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
|
|
- GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
|
|
- GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
|
|
- GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
|
|
- GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
|
|
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
|
|
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
|
|
- GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
|
|
- GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
|
|
- GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
|
|
volumes:
|
|
- /path/to/monitoring/grafana:/var/lib/grafana
|
|
networks:
|
|
- monitoring-net
|
|
|
|
networks:
|
|
monitoring-net:
|
|
external: true
|