docker-compose.monitoring.yml

# docker-compose.monitoring.yml - Media Vault Monitoring Stack
version: '3.8'

services:
  # Prometheus - Metrics Collection
  prometheus:
    image: prom/prometheus:v2.47.0
    container_name: prometheus
    ports:
      - "${PROMETHEUS_PORT:-9090}:9090"
    volumes:
      - ./monitoring/prometheus:/etc/prometheus
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
      - '--web.external-url=http://localhost:9090'
    restart: unless-stopped
    networks:
      - media-vault-network
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Grafana - Visualization & Dashboards
  grafana:
    image: grafana/grafana:10.1.0
    container_name: grafana
    ports:
      - "${GRAFANA_PORT:-3333}:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards
    environment:
      # Admin Configuration
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-grafana123}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_USERS_DEFAULT_THEME=dark

      # Organization
      - GF_USERS_AUTO_ASSIGN_ORG=true
      - GF_USERS_AUTO_ASSIGN_ORG_ROLE=Viewer

      # Plugins
      - GF_INSTALL_PLUGINS=grafana-piechart-panel,grafana-worldmap-panel,grafana-clock-panel

      # Keycloak OAuth Integration
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GRAFANA_OAUTH_SECRET:-grafana-secret}
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email roles
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://localhost:8443/realms/media-vault/protocol/openid_connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://keycloak:8080/realms/media-vault/protocol/openid_connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=http://keycloak:8080/realms/media-vault/protocol/openid_connect/userinfo
      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(realm_access.roles[*], 'vault-admin') && 'Admin' || 'Viewer'

      # Database
      - GF_DATABASE_TYPE=sqlite3
      - GF_DATABASE_PATH=/var/lib/grafana/grafana.db

      # Security
      - GF_SECURITY_SECRET_KEY=${GRAFANA_SECRET_KEY:-SW2YcwTIb9zpOOhoPsMm}
      - GF_SECURITY_COOKIE_SECURE=false
      - GF_SECURITY_COOKIE_SAMESITE=lax

      # Analytics
      - GF_ANALYTICS_REPORTING_ENABLED=false
      - GF_ANALYTICS_CHECK_FOR_UPDATES=false

      # Alerting
      - GF_ALERTING_ENABLED=true
      - GF_UNIFIED_ALERTING_ENABLED=true

      # Rendering
      - GF_RENDERING_SERVER_URL=http://renderer:8081/render
      - GF_RENDERING_CALLBACK_URL=http://grafana:3000/

      # Paths
      - GF_PATHS_PLUGINS=/var/lib/grafana/plugins
      - GF_PATHS_PROVISIONING=/etc/grafana/provisioning
    depends_on:
      - prometheus
    restart: unless-stopped
    networks:
      - media-vault-network
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Grafana Image Renderer
  renderer:
    image: grafana/grafana-image-renderer:latest
    container_name: grafana-renderer
    ports:
      - "8081:8081"
    environment:
      ENABLE_METRICS: 'true'
      RENDERING_MODE: default
      RENDERING_CLUSTERING_MODE: default
      BROWSER_TZ: UTC
    restart: unless-stopped
    networks:
      - media-vault-network

  # AlertManager - Alert Management
  alertmanager:
    image: prom/alertmanager:v0.26.0
    container_name: alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./monitoring/alertmanager:/etc/alertmanager
      - alertmanager_data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
      - '--web.route-prefix=/'
    environment:
      - SLACK_WEBHOOK_URL=${SLACK_WEBHOOK_URL}
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - ADMIN_EMAIL=${ADMIN_EMAIL}
    restart: unless-stopped
    networks:
      - media-vault-network

  # Node Exporter - Host Metrics
  node-exporter:
    image: prom/node-exporter:v1.6.1
    container_name: node-exporter
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
      - /run/systemd/private:/run/systemd/private:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
      - '--collector.systemd'
      - '--collector.processes'
    restart: unless-stopped
    networks:
      - media-vault-network
    pid: host

  # cAdvisor - Container Metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.47.2
    container_name: cadvisor
    ports:
      - "8888:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    restart: unless-stopped
    networks:
      - media-vault-network
    command:
      - '--housekeeping_interval=30s'
      - '--max_housekeeping_interval=35s'
      - '--event_storage_event_limit=default=0'
      - '--event_storage_age_limit=default=0'
      - '--disable_metrics=percpu,sched,tcp,udp,disk,diskIO,accelerator'
      - '--docker_only'

  # Postgres Exporter - Database Metrics
  postgres-exporter:
    image: prometheuscommunity/postgres-exporter:v0.13.2
    container_name: postgres-exporter
    ports:
      - "9187:9187"
    environment:
      DATA_SOURCE_NAME: "postgresql://keycloak:${KEYCLOAK_DB_PASSWORD:-keycloak_password}@keycloak-db:5432/keycloak?sslmode=disable"
      PG_EXPORTER_EXCLUDE_DATABASES: "template0,template1"
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - full

  # Redis Exporter - Redis Metrics
  redis-exporter:
    image: oliver006/redis_exporter:v1.53.0
    container_name: redis-exporter
    ports:
      - "9121:9121"
    environment:
      REDIS_ADDR: "redis://redis:6379"
      REDIS_EXPORTER_LOG_FORMAT: "json"
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - full

  # Blackbox Exporter - External Monitoring
  blackbox-exporter:
    image: prom/blackbox-exporter:v0.24.0
    container_name: blackbox-exporter
    ports:
      - "9115:9115"
    volumes:
      - ./monitoring/blackbox:/etc/blackbox_exporter
    command:
      - '--config.file=/etc/blackbox_exporter/blackbox.yml'
    restart: unless-stopped
    networks:
      - media-vault-network

  # Loki - Log Aggregation
  loki:
    image: grafana/loki:2.9.0
    container_name: loki
    ports:
      - "3100:3100"
    volumes:
      - ./monitoring/loki:/etc/loki
      - loki_data:/tmp/loki
    command: -config.file=/etc/loki/loki.yml
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - logs

  # Promtail - Log Shipper
  promtail:
    image: grafana/promtail:2.9.0
    container_name: promtail
    volumes:
      - ./monitoring/promtail:/etc/promtail
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: -config.file=/etc/promtail/promtail.yml
    depends_on:
      - loki
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - logs

  # Jaeger - Distributed Tracing
  jaeger:
    image: jaegertracing/all-in-one:1.49
    container_name: jaeger
    ports:
      - "5775:5775/udp"
      - "6831:6831/udp"
      - "6832:6832/udp"
      - "5778:5778"
      - "16686:16686"
      - "14250:14250"
      - "14268:14268"
      - "14269:14269"
      - "9411:9411"
    environment:
      - COLLECTOR_OTLP_ENABLED=true
      - COLLECTOR_ZIPKIN_HOST_PORT=:9411
    volumes:
      - jaeger_data:/badger
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - tracing

volumes:
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  alertmanager_data:
    driver: local
  loki_data:
    driver: local
  jaeger_data:
    driver: local

networks:
  media-vault-network:
    external: true