version: '3.8'

services:
  prometheus:
    image: prom/prometheus:latest
    networks:
      - monitoring
      - traefik-public
    volumes:
      - prometheus-data:/prometheus
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'
      - '--storage.tsdb.retention.time=30d'
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.monitoring == true
      resources:
        limits:
          memory: 1G
          cpus: '1'
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.prometheus.rule=Host(`prometheus.${DOMAIN}`)"
        - "traefik.http.routers.prometheus.entrypoints=https"
        - "traefik.http.routers.prometheus.tls=true"
        - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
        - "traefik.http.routers.prometheus.middlewares=admin-auth"
        - "traefik.http.services.prometheus.loadbalancer.server.port=9090"

  grafana:
    image: grafana/grafana:latest
    networks:
      - monitoring
      - traefik-public
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=https://grafana.${DOMAIN}
      - GF_SMTP_ENABLED=true
      - GF_SMTP_HOST=${SMTP_HOST}:${SMTP_PORT}
      - GF_SMTP_USER=${SMTP_USER}
      - GF_SMTP_PASSWORD=${SMTP_PASS}
      - GF_SMTP_FROM_ADDRESS=${EMAIL_FROM}
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.monitoring == true
      resources:
        limits:
          memory: 512M
          cpus: '0.5'
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN}`)"
        - "traefik.http.routers.grafana.entrypoints=https"
        - "traefik.http.routers.grafana.tls=true"
        - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"

  loki:
    image: grafana/loki:latest
    networks:
      - monitoring
    volumes:
      - loki-data:/loki
      - ./loki-config.yml:/etc/loki/config.yml:ro
    command: -config.file=/etc/loki/config.yml
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.monitoring == true
      resources:
        limits:
          memory: 1G
          cpus: '1'

  promtail:
    image: grafana/promtail:latest
    networks:
      - monitoring
    volumes:
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./promtail-config.yml:/etc/promtail/config.yml:ro
    command: -config.file=/etc/promtail/config.yml
    deploy:
      mode: global
      resources:
        limits:
          memory: 256M
          cpus: '0.25'

  node-exporter:
    image: prom/node-exporter:latest
    networks:
      - monitoring
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    deploy:
      mode: global
      resources:
        limits:
          memory: 128M
          cpus: '0.1'

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    networks:
      - monitoring
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    privileged: true
    deploy:
      mode: global
      resources:
        limits:
          memory: 256M
          cpus: '0.25'

  alertmanager:
    image: prom/alertmanager:latest
    networks:
      - monitoring
      - traefik-public
    volumes:
      - alertmanager-data:/alertmanager
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.monitoring == true
      resources:
        limits:
          memory: 256M
          cpus: '0.25'
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.alertmanager.rule=Host(`alerts.${DOMAIN}`)"
        - "traefik.http.routers.alertmanager.entrypoints=https"
        - "traefik.http.routers.alertmanager.tls=true"
        - "traefik.http.routers.alertmanager.tls.certresolver=letsencrypt"
        - "traefik.http.routers.alertmanager.middlewares=admin-auth"
        - "traefik.http.services.alertmanager.loadbalancer.server.port=9093"

networks:
  monitoring:
    external: true
  traefik-public:
    external: true

volumes:
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  loki-data:
    driver: local
  alertmanager-data:
    driver: local