metrics.yml

networks:
  monitor:
  proxy:

volumes:
  grafana-config:
  grafana-data:
  prometheus-data:

configs:
  grafana.ini:
    content: |
      instance_name = selfhosted

      [server]
      domain = grafana.${PROXY_PUBLIC_DOMAIN}
      root_url = https://grafana.${PROXY_PUBLIC_DOMAIN}

      [security]
      admin_user=${MONITOR_GRAFANA_SECURITY_ADMIN_USER}
      admin_password=${MONITOR_GRAFANA_SECURITY_ADMIN_PASSWORD}
      cookie_secure = true
      cookie_samesite = strict
      disable_gravatar = true

      [analytics]
      reporting_enabled = false
      check_for_updates = false
      feedback_links_enabled = false

      [secretscan]
      enabled = false

      [users]
      allow_sign_up = false

      [auth]
      disable_login_form = true

      [auth.generic_oauth]
      enabled = true
      name = Authelia
      ; create new grafana users when using oauth
      allow_sign_up = true
      ; bypass login screen and jump to oauth instead
      ; auto_login = true
      client_id = ${AUTH_GRAFANA_CLIENT_ID}
      client_secret = ${AUTH_GRAFANA_CLIENT_SECRET}
      scopes = openid profile email groups
      empty_scopes = false
      auth_url = https://auth.${PROXY_PUBLIC_DOMAIN}/api/oidc/authorization
      token_url = https://auth.${PROXY_PUBLIC_DOMAIN}/api/oidc/token
      api_url = https://auth.${PROXY_PUBLIC_DOMAIN}/api/oidc/userinfo
      login_attribute_path = preferred_username
      name_attribute_path = name
      email_attribute_path = email
      role_attribute_path = contains(groups[*], 'grafana_admin') && 'GrafanaAdmin'
      ; groups_attribute_path = groups
      allow_assign_grafana_admin = true
      use_pkce = true

services:
  grafana:
    image: docker.io/grafana/grafana:12.4.0
    configs:
      - source: grafana.ini
        target: /etc/grafana/grafana.ini
    extends:
      file: common.yml
      service: log-to-json
    environment:
      - TZ=${TIMEZONE}
    expose:
      - 3000 # webui
    networks:
      - proxy
      - monitor
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - grafana-data:/var/lib/grafana
      - grafana-config:/etc/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./grafana/datasources:/etc/grafana/provisioning/datasources

  prometheus:
    image: docker.io/prom/prometheus:v3.10.0
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=30d"
      - "--storage.tsdb.retention.size=10GB"
      - "--web.console.templates=/usr/share/prometheus/consoles"
      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
      - "--web.enable-lifecycle" # reload config on /-/reload POST
    environment:
      - TZ=${TIMEZONE}
    expose:
      - 9090 # metrics
    extra_hosts:
      - host.docker.internal:host-gateway
    extends:
      file: common.yml
      service: log-to-json
    networks:
      - monitor
    restart: unless-stopped
    volumes:
      - prometheus-data:/prometheus
      - ./prometheus/rules:/etc/prometheus/rules
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - /etc/localtime:/etc/localtime:ro

  node-exporter:
    image: docker.io/prom/node-exporter:v1.10.2
    command:
      - "--path.rootfs=/rootfs"
      - "--path.sysfs=/host/sys"
      - "--path.procfs=/host/proc"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker)($$|/)"
      - "--collector.netclass.ignored-devices=^(veth.+|br-.+|docker[0-9])$"
      - "--collector.netdev.device-exclude=^(veth.+|br-.+|docker[0-9])$"
      - "--collector.textfile.directory=/rootfs/home/restic/textfile_collector"
    expose:
      - 9100 # metrics
    extends:
      file: common.yml
      service: log-to-json
    network_mode: host
    pid: host
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /sys:/host/sys:ro
      - /proc:/host/proc:ro
      - /etc/localtime:/etc/localtime:ro

  smartctl-exporter:
    image: docker.io/prometheuscommunity/smartctl-exporter:v0.14.0
    expose:
      - 9633 # metrics
    extends:
      file: common.yml
      service: log-to-json
    networks:
      - monitor
    privileged: true
    restart: unless-stopped
    user: root

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.55.1
    command:
      - "--port=9250"
      - "--docker_only=true"
      - "--disable_root_cgroup_stats=true"
      - "--enable_metrics=cpu,memory,network"
      - "--store_container_labels=false"
      - "--housekeeping_interval=10s"
      - "--max_housekeeping_interval=15s"
    devices:
      - /dev/kmsg
    environment:
      - CADVISOR_HEALTHCHECK_URL=http://localhost:9250/healthz
    expose:
      - 9250 # metrics
    extends:
      file: common.yml
      service: log-to-json
    networks:
      - monitor
    privileged: true
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /dev/disk:/dev/disk:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      - /var/run:/var/run:ro
      - /etc/localtime:/etc/localtime:ro