docker-compose.monitoring.yml

x-logging: &default-logging
  driver: "local"
  options:
    max-size: "${LOG_MAX_SIZE:-150m}"
    max-file: "${LOG_MAX_FILE:-5}"

services:

  # Logging and monitoring stack
  dozzle:
    image: amir20/dozzle:v10.2.1
    restart: always
    logging: *default-logging
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      DOZZLE_BASE: /dozzle
      DOZZLE_AUTH_PROVIDER: forward-proxy
      DOZZLE_AUTH_HEADER_USER: X-WEBAUTH-USER
      DOZZLE_AUTH_HEADER_EMAIL: X-WEBAUTH-EMAIL
      DOZZLE_AUTH_HEADER_NAME: X-WEBAUTH-NAME
      # DOZZLE_ENABLE_SHELL: true
    deploy:
      resources:
        limits:
          memory: ${DOZZLE_MEM_LIMIT:-64m}
          cpus: "${DOZZLE_CPU_LIMIT:-0.25}"

  loki:
    image: grafana/loki:3.7.1
    restart: always
    logging: *default-logging
    command: -config.file=/etc/loki/local-config.yaml -log.level=warn
    volumes:
      - loki_data:/loki
      # Bind-mount tylko samego pliku config (nie calego /etc/loki) - w obrazie
      # moga byc inne pliki tam, ktorych nie chcemy nadpisac.
      - ${BPP_CONFIGS_DIR}/loki/local-config.yaml:/etc/loki/local-config.yaml:ro
    deploy:
      resources:
        limits:
          memory: ${LOKI_MEM_LIMIT:-192m}
          cpus: "${LOKI_CPU_LIMIT:-0.5}"

  grafana:
    image: grafana/grafana:12.4.2
    restart: always
    logging: *default-logging
    environment:
      - GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s/grafana/
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SERVER_SERVE_FROM_SUB_PATH=true
      - GF_AUTH_PROXY_ENABLED=true
      - GF_AUTH_PROXY_HEADER_NAME=X-WEBAUTH-USER
      - GF_AUTH_PROXY_HEADER_PROPERTY=username
      - GF_AUTH_PROXY_AUTO_SIGN_UP=true
      - GF_AUTH_PROXY_HEADERS=Email:X-WEBAUTH-EMAIL Name:X-WEBAUTH-NAME
      - GF_USERS_AUTO_ASSIGN_ORG_ROLE=Admin
      - GF_LOG_LEVEL=error # śmieci logami okrutnie
    volumes:
      - grafana_data:/var/lib/grafana
      - ${BPP_CONFIGS_DIR}/grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - loki
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: ${GRAFANA_MEM_LIMIT:-192m}
          cpus: "${GRAFANA_CPU_LIMIT:-1.0}"

  alloy:
    image: grafana/alloy:v1.15.0
    restart: always
    logging: *default-logging
    command: >
      run /etc/alloy/config.alloy
      --server.http.listen-addr=0.0.0.0:12345
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${BPP_CONFIGS_DIR}/alloy:/etc/alloy:ro
    depends_on:
      - loki
    deploy:
      resources:
        limits:
          memory: ${ALLOY_MEM_LIMIT:-192m}
          cpus: "${ALLOY_CPU_LIMIT:-0.5}"

  netdata:
    image: netdata/netdata:v2.10.3
    hostname: ${DJANGO_BPP_HOSTNAME:-bpp}
    restart: always
    logging: *default-logging
    pid: host
    cap_add:
      - SYS_PTRACE
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    environment:
      # NTFY_TOPIC eksportowany do agenta - health_alarm_notify.conf
      # interpoluje go w `DEFAULT_RECIPIENT_NTFY` (sourced as bash).
      - NTFY_TOPIC=${NTFY_TOPIC:-}
      - NTFY_SERVER=${DJANGO_BPP_NTFY_SERVER:-https://ntfy.sh}
      # Wylacz anonimowa telemetrie Netdaty do netdata.cloud.
      - DO_NOT_TRACK=1
      - DISABLE_TELEMETRY=1
      # Wylacz klienta Cloud calkowicie - bez tego dashboard pokazuje
      # dialog "please connect your agent" przy pierwszym wejsciu.
      - NETDATA_DISABLE_CLOUD=1
    volumes:
      # Configi (bind-mount z BPP_CONFIGS_DIR, RO).
      - ${BPP_CONFIGS_DIR}/netdata/netdata.conf:/etc/netdata/netdata.conf:ro
      - ${BPP_CONFIGS_DIR}/netdata/go.d:/etc/netdata/go.d:ro
      - ${BPP_CONFIGS_DIR}/netdata/health_alarm_notify.conf:/etc/netdata/health_alarm_notify.conf:ro
      - ${BPP_CONFIGS_DIR}/netdata/health.d:/etc/netdata/health.d:ro
      # Persistent state (named volumes).
      - netdata_lib:/var/lib/netdata
      - netdata_cache:/var/cache/netdata
      # Host visibility (RO).
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /etc/localtime:/etc/localtime:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /etc/os-release:/host/etc/os-release:ro
      - /var/log:/host/var/log:ro
      # Root filesystem hosta (RO) — kolektor diskspace.plugin liczy
      # zajetosc WSZYSTKICH partycji hosta (df: used/avail/% per mountpoint).
      # Bez tego netdata widzi tylko filesystemy kontenera (overlay + volumes).
      # `rslave` propaguje mounty pojawiajace sie po starcie kontenera.
      # NETDATA_HOST_PREFIX NIE ustawiamy — obraz zna konwencje /host/root.
      - /:/host/root:ro,rslave
      # Docker socket dla auto-discovery kontenerow + cgroup metryk.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Access log nginx (RO) dla kolektora web_log — patrz go.d/web_log.conf.
      # Wolumen zadeklarowany w docker-compose.infrastructure.yml (webserver
      # pisze, netdata czyta).
      - nginx_access_log:/var/log/nginx-shared:ro
    # Healthcheck: celowo NIE nadpisujemy — obraz ma wbudowany
    # HEALTHCHECK /usr/sbin/health.sh (utrzymywany przez netdate, zna
    # NETDATA_HEALTHCHECK_TARGET, uzywa curl). Poprzedni custom override
    # wolal `wget`, ktorego w obrazie NIE MA (jest tylko curl/nc) -> kontener
    # zawsze raportowal `unhealthy` mimo dzialajacej netdaty.
    deploy:
      resources:
        limits:
          memory: ${NETDATA_MEM_LIMIT:-320m}
          cpus: "${NETDATA_CPU_LIMIT:-1.0}"

volumes:
  grafana_data:
  loki_data:
  netdata_lib:
  netdata_cache: