services: prometheus: container_name: prometheus image: prom/prometheus:latest restart: unless-stopped labels: - "traefik.enable=true" - "traefik.http.routers.prom.rule=Host(`prometheus.bhasher.com`)" - "traefik.http.routers.prom.entrypoints=internalsecure" - "traefik.http.services.prom.loadbalancer.server.port=9090" - "traefik.http.routers.prom.tls=true" - "traefik.http.routers.prom.tls.certresolver=http" - "traefik.http.routers.prom.middlewares=authelia@docker" extra_hosts: - "host.docker.internal:host-gateway" volumes: - $CONFIG/monitoring/prometheus.yaml:/etc/prometheus/prometheus.yml:ro - $DATA/monitoring/prometheus:/prometheus networks: - monitoring - external grafana: container_name: grafana image: grafana/grafana restart: unless-stopped labels: - "traefik.enable=true" - "traefik.http.routers.grafana.rule=Host(`grafana.bhasher.com`)" - "traefik.http.routers.grafana.entrypoints=internalsecure" - "traefik.http.services.grafana.loadbalancer.server.port=3000" - "traefik.http.routers.grafana.tls=true" - "traefik.http.routers.grafana.tls.certresolver=http" environment: - GF_SERVER_ROOT_URL=https://grafana.bhasher.com - GF_SMTP_ENABLED=true - GF_SMTP_HOST=bdubois.io:465 - GF_SMTP_USER=${SMTP_USER} - GF_SMTP_PASSWORD=${SMTP_PASSWORD} - GF_SMTP_FROM_ADDRESS=grafana@bhasher.com - GF_AUTH_LOGIN_DISABLE_LOGIN_FORM=true - GF_AUTH_DISABLE_SIGNOUT_MENU=true - GF_AUTH_OAUTH_AUTO_LOGIN=true - GF_AUTH_GENERIC_OAUTH_ENABLED=true - GF_AUTH_GENERIC_OAUTH_ICON=signin - GF_AUTH_GENERIC_OAUTH_NAME=Authelia - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GRAFANA_OAUTH} - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email groups - GF_AUTH_GENERIC_OAUTH_EMPTY_SCOPES=false - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://idp.bhasher.com/api/oidc/authorization - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://idp.bhasher.com/api/oidc/token - GF_AUTH_GENERIC_OAUTH_API_URL=https://idp.bhasher.com/api/oidc/userinfo - GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username - GF_AUTH_GENERIC_OAUTH_GROUPS_ATTRIBUTE_PATH=groups - GF_AUTH_GENERIC_OAUTH_NAME_ATTRIBUTE_PATH=name - GF_AUTH_GENERIC_OAUTH_USE_PKCE=false - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || 'Viewer' - GF_AUTH_GENERIC_OAUTH_GROUPS_PATH=groups - GF_AUTH_GENERIC_OAUTH_ALLOWED_GROUPS=admin volumes: - $DATA/monitoring/grafana:/var/lib/grafana networks: - external - monitoring cadvisor: container_name: cadvisor image: gcr.io/cadvisor/cadvisor:v0.47.1 volumes: - /:/rootfs:ro - /var/run:/var/run:rw - /sys:/sys:ro - /var/lib/docker/:/var/lib/docker:ro restart: always networks: - monitoring node-exporter: container_name: node-exporter image: quay.io/prometheus/node-exporter:latest volumes: - /proc:/host/proc:ro - /sys:/host/sys:ro - /:/rootfs:ro - /:/host:ro,rslave command: - '--path.rootfs=/host' - '--path.procfs=/host/proc' - '--path.sysfs=/host/sys' - --collector.filesystem.ignored-mount-points - "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)" restart: always networks: - monitoring networks: monitoring: external: external: true