docker-compose.yml

version: "3.9"

services:
    prometheus:
        image: prom/prometheus:v2.55.0
        user: "65534:998"
        networks:
            - traefik-public
        volumes:
            - prometheus_data:/prometheus
            - /var/run/docker.sock:/var/run/docker.sock:ro
        configs:
            - source: prometheus_config_v8
              target: /etc/prometheus/prometheus.yml
            - source: prometheus_alert_rules_v1
              target: /etc/prometheus/alert-rules.yml
            - source: minio_targets
              target: /etc/prometheus/targets/minio-targets.json
        secrets:
            - status_pipeline_minio_token
        deploy:
            # dnsrr bypasses Swarm's default VIP/IPVS load balancing, which fails to
            # program kernel IPVS rules correctly on this host, making the VIP unreachable.
            endpoint_mode: dnsrr
            placement:
                constraints:
                    - node.role == manager
            labels:
                - "traefik.enable=true"
                - "traefik.http.routers.prometheus.rule=Host(`prometheus.${BASE_DOMAIN}`)"
                - "traefik.http.routers.prometheus.entrypoints=websecure"
                - "traefik.http.routers.prometheus.tls.certresolver=dns"
                - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
                - "traefik.swarm.network=traefik-public"
                - homepage.group=Monitoring
                - homepage.name=Prometheus
                - homepage.icon=prometheus.png
                - homepage.href=https://prometheus.${BASE_DOMAIN}/
                - homepage.description=Metrics Collection

    grafana:
        image: grafana/grafana:11.1.4
        user: "1000:1000"
        networks:
            - traefik-public
        volumes:
            - grafana_data:/var/lib/grafana
            - grafana_dashboards:/etc/grafana/provisioning/dashboards
        configs:
            - source: prometheus_datasource
              target: /etc/grafana/provisioning/datasources/prometheus.yml
            - source: loki_datasource
              target: /etc/grafana/provisioning/datasources/loki.yml
            - source: grafana_dashboards_provisioning
              target: /etc/grafana/provisioning/dashboards/dashboards.yml
            - source: dashboard_homelab_health_v11
              target: /etc/grafana/provisioning/dashboards-local/homelab-health.json
            - source: dashboard_cluster_diagnostics_v4
              target: /etc/grafana/provisioning/dashboards-local/cluster-health.json
            - source: dashboard_inter_node_bandwidth_v3
              target: /etc/grafana/provisioning/dashboards-local/inter-node-bandwidth.json
            - source: dashboard_node_resources_v3
              target: /etc/grafana/provisioning/dashboards-local/node-resources.json
            - source: dashboard_warden_v7
              target: /etc/grafana/provisioning/dashboards-local/warden.json
        environment:
            - GF_SECURITY_ADMIN_USER=admin
            - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
            # Authentik OIDC Configuration
            - GF_AUTH_GENERIC_OAUTH_ENABLED=true
            - GF_AUTH_GENERIC_OAUTH_NAME=Authentik
            - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GRAFANA_OAUTH_CLIENT_ID}
            - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GRAFANA_OAUTH_CLIENT_SECRET}
            - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
            - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://auth.${BASE_DOMAIN}/application/o/authorize/
            - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://auth.${BASE_DOMAIN}/application/o/token/
            - GF_AUTH_GENERIC_OAUTH_API_URL=https://auth.${BASE_DOMAIN}/application/o/userinfo/
            - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
            - GF_AUTH_SIGNOUT_REDIRECT_URL=https://auth.${BASE_DOMAIN}/application/o/grafana/end-session/
            - GF_SERVER_ROOT_URL=https://grafana.${BASE_DOMAIN}
        deploy:
            placement:
                constraints:
                    - node.role == manager
            labels:
                - "traefik.enable=true"
                - "traefik.http.routers.grafana.rule=Host(`grafana.${BASE_DOMAIN}`)"
                - "traefik.http.routers.grafana.entrypoints=websecure"
                - "traefik.http.routers.grafana.tls.certresolver=dns"
                - "traefik.http.services.grafana.loadbalancer.server.port=3000"
                - "traefik.swarm.network=traefik-public"
                - homepage.group=Monitoring
                - homepage.name=Grafana
                - homepage.icon=grafana.png
                - homepage.href=https://grafana.${BASE_DOMAIN}/
                - homepage.description=Metrics & Dashboards

    cadvisor:
        image: gcr.io/cadvisor/cadvisor:v0.49.1
        ports:
            - target: 8080
              published: 8080
              mode: host
        networks:
            - traefik-public
        volumes:
            - /:/rootfs:ro
            - /var/run:/var/run:ro
            - /sys:/sys:ro
            - /var/lib/docker/:/var/lib/docker:ro
            - /dev/disk/:/dev/disk:ro
        deploy:
            mode: global
            labels:
                - "traefik.enable=false"
        command:
            - '--docker_only=true'
            - '--housekeeping_interval=30s'

    node-exporter:
        image: prom/node-exporter:v1.8.2
        ports:
            - target: 9100
              published: 9100
              mode: host
        networks:
            - traefik-public
        volumes:
            - /proc:/host/proc:ro
            - /sys:/host/sys:ro
            - /:/rootfs:ro
        command:
            - '--path.procfs=/host/proc'
            - '--path.sysfs=/host/sys'
            - '--path.rootfs=/rootfs'
            - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$$$|/)'
        deploy:
            mode: global
            labels:
                - "traefik.enable=false"

    loki:
        image: grafana/loki:3.0.0
        command: -config.file=/etc/loki/config.yml
        networks:
            - traefik-public
        volumes:
            - loki_data:/loki
        configs:
            - source: loki_config
              target: /etc/loki/config.yml
        deploy:
            # dnsrr bypasses Swarm's default VIP/IPVS load balancing, which fails to
            # program kernel IPVS rules correctly on this host, making the VIP unreachable.
            endpoint_mode: dnsrr
            placement:
                constraints:
                    - node.role == manager
            labels:
                - "traefik.enable=false"

    promtail:
        image: grafana/promtail:3.0.0
        command: -config.file=/etc/promtail/config.yml
        user: "0:0" # Run as root to read /var/log/journal
        volumes:
            - /var/lib/docker/containers:/var/lib/docker/containers:ro
            - /var/run/docker.sock:/var/run/docker.sock:ro
            - /var/log/journal:/var/log/journal:ro
            - /run/log/journal:/run/log/journal:ro # Handle volatile journals
            - /etc/machine-id:/etc/machine-id:ro
            - promtail_positions:/run/promtail # Persist position data
        configs:
            - source: promtail_config
              target: /etc/promtail/config.yml
        networks:
            - traefik-public
        deploy:
            mode: global
            labels:
                - "traefik.enable=false"

    nvidia-gpu-exporter:
        image: nvcr.io/nvidia/k8s/dcgm-exporter:3.3.8-3.6.0-ubuntu22.04
        environment:
            - NVIDIA_VISIBLE_DEVICES=all
            - NVIDIA_DRIVER_CAPABILITIES=compute,utility
        ports:
            - target: 9400
              published: 9400
              mode: host
        networks:
            - traefik-public
        deploy:
            mode: global
            placement:
                constraints:
                    - node.labels.gpu == true
            labels:
                - "traefik.enable=false"

    speedtest-exporter:
        image: miguelndecarvalho/speedtest-exporter:latest
        environment:
            - SPEEDTEST_INTERVAL=1800
        ports:
            - target: 9798
              published: 9798
              mode: host
        networks:
            - traefik-public
        healthcheck:
            test: ["CMD-SHELL", "ps | grep python | grep exporter.py"]
            interval: 30s
            timeout: 10s
            retries: 3
            start_period: 60s
        deploy:
            replicas: 1
            placement:
                constraints:
                    - node.role == manager
            resources:
                limits:
                    memory: 128M
            labels:
                - "traefik.enable=false"

    iperf3-server:
        image: ${REGISTRY:-ghcr.io}/${REGISTRY_NAMESPACE:-chutch3}/iperf3-server:${IMAGE_TAG:-3.20.0}
        build:
            context: .
            dockerfile: Dockerfile.iperf3-server
        x-homelab:
            watch:
                - stacks/monitoring/Dockerfile.iperf3-server
        ports:
            - target: 5201
              published: 5201
              mode: host
        networks:
            - traefik-public
        deploy:
            mode: global
            labels:
                - "traefik.enable=false"

    iperf3-exporter:
        image: ${REGISTRY:-ghcr.io}/${REGISTRY_NAMESPACE:-chutch3}/iperf3-exporter:${IMAGE_TAG:-3.20.0}
        build:
            context: custom-exporter
            dockerfile: Dockerfile
        x-homelab:
            watch:
                - stacks/monitoring/custom-exporter/**
        ports:
            - target: 9579
              published: 9579
              protocol: tcp
              mode: host
        deploy:
            mode: global
            labels:
                - "traefik.enable=false"

networks:
    traefik-public:
        external: true

volumes:
    prometheus_data:
    grafana_data:
    loki_data:
    promtail_positions:
    grafana_dashboards:
        driver: local
        driver_opts:
            type: "cifs"
            o: "username=${SMB_USERNAME},password=${SMB_PASSWORD},domain=${SMB_DOMAIN},vers=3.0,uid=1000,gid=1000,file_mode=0644,dir_mode=0755,soft,actimeo=30"
            device: "//${NAS_SERVER}/grafana_dashboards"

configs:
    prometheus_config_v8:
        file: ./prometheus.yml
    prometheus_alert_rules_v1:
        file: ./alert-rules.yml
    minio_targets:
        file: ./minio-targets.json
    grafana_dashboards_provisioning:
        file: ./dashboards/dashboards.yml
    dashboard_homelab_health_v11:
        file: ./dashboards/local/homelab-health.json
    dashboard_cluster_diagnostics_v4:
        file: ./dashboards/local/cluster-health.json
    dashboard_inter_node_bandwidth_v3:
        file: ./dashboards/local/inter-node-bandwidth.json
    dashboard_node_resources_v3:
        file: ./dashboards/local/node-resources.json
    dashboard_warden_v7:
        file: ./dashboards/local/warden.json
    prometheus_datasource:
        file: ./datasources/prometheus.yml
    loki_datasource:
        file: ./datasources/loki.yml
    loki_config:
        file: ./loki-config.yml
    promtail_config:
        file: ./promtail-config.yml

secrets:
    status_pipeline_minio_token:
        external: true