docker-compose.yml

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "1m"
    max-file: "1"
    tag: "{{.Name}}"

x-common-labels: &default-labels
  logging: "promtail"
  logging_jobname: "containerlogs"
  stackname: "docker-monitoring-stack-gpnc"

services:
  traefik:
    image: traefik:3.0
    container_name: traefik
    ports:
      - 80:80 # HTTP port
      - 443:443 # HTTPS port
    restart: always
    labels:
      # Traefik configuration
      <<: *default-labels
      traefik.enable: true
      traefik.docker.network: traefik-public
      traefik.http.services.traefik-dashboard.loadbalancer.server.port: 8080

      # HTTP router configuration
      traefik.http.routers.traefik-dashboard-http.entrypoints: http
      traefik.http.routers.traefik-dashboard-http.rule: Host(`${TRAEFIK_DOMAIN?Variable not set}`)

      # HTTPS router configuration
      traefik.http.routers.traefik-dashboard-https.entrypoints: https
      traefik.http.routers.traefik-dashboard-https.rule: Host(`${TRAEFIK_DOMAIN?Variable not set}`)
      traefik.http.routers.traefik-dashboard-https.tls: true
      traefik.http.routers.traefik-dashboard-https.tls.certresolver: le
      traefik.http.routers.traefik-dashboard-https.service: api@internal

      # HTTPS redirect middleware
      traefik.http.middlewares.https-redirect.redirectscheme.scheme: https
      traefik.http.middlewares.https-redirect.redirectscheme.permanent: true
      traefik.http.routers.traefik-dashboard-http.middlewares: https-redirect

      # HTTP Basic Auth middleware
      traefik.http.middlewares.admin-auth.basicauth.users: ${TRAEFIK_USERNAME?Variable not set}:${TRAEFIK_HASHED_PASSWORD?Variable not set}
      traefik.http.routers.traefik-dashboard-https.middlewares: admin-auth
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Docker socket for reading service labels
      - traefik-public-certificates:/certificates # Certificate storage
    command:
      # Docker provider configuration
      - --providers.docker
      - --providers.docker.exposedbydefault=false

      # Entrypoints configuration
      - --entrypoints.http.address=:80
      - --entrypoints.https.address=:443

      # Let's Encrypt configuration
      - --certificatesresolvers.le.acme.email=${ACME_EMAIL?Variable not set}
      - --certificatesresolvers.le.acme.storage=/certificates/acme.json
      - --certificatesresolvers.le.acme.tlschallenge=true

      # Logging and API configuration
      - --accesslog
      - --log
      - --api
    networks:
      - traefik-public # Public network for Traefik and other services
    logging: *default-logging

  mt5:
    build:
      context: backend/mt5
      dockerfile: Dockerfile
    container_name: mt5
    volumes:
      - ./config:/config
    networks:
      - traefik-public
      - default
    env_file:
      - .env
    restart: unless-stopped
    labels:
      <<: *default-labels
      # Enable Traefik for this service
      traefik.enable: true
      traefik.docker.network: traefik-public

      # Router for vnc.mt5.${domain} (Port 3000)
      traefik.http.routers.vnc-mt5-http.rule: Host(`${VNC_DOMAIN}`)
      traefik.http.routers.vnc-mt5-http.entrypoints: http
      traefik.http.routers.vnc-mt5-http.middlewares: https-redirect

      traefik.http.routers.vnc-mt5-https.rule: Host(`${VNC_DOMAIN}`)
      traefik.http.routers.vnc-mt5-https.entrypoints: https
      traefik.http.routers.vnc-mt5-https.tls: true
      traefik.http.routers.vnc-mt5-https.tls.certresolver: le
      traefik.http.routers.vnc-mt5-https.service: vnc-mt5-service

      traefik.http.services.vnc-mt5-service.loadbalancer.server.port: 3000

      # Router for api.mt5.${domain} (Port 5001)
      traefik.http.routers.api-mt5-http.rule: Host(`${API_DOMAIN}`)
      traefik.http.routers.api-mt5-http.entrypoints: http
      traefik.http.routers.api-mt5-http.middlewares: https-redirect

      traefik.http.routers.api-mt5-https.rule: Host(`${API_DOMAIN}`)
      traefik.http.routers.api-mt5-https.entrypoints: https
      traefik.http.routers.api-mt5-https.tls: true
      traefik.http.routers.api-mt5-https.tls.certresolver: le
      traefik.http.routers.api-mt5-https.service: api-mt5-service

      traefik.http.services.api-mt5-service.loadbalancer.server.port: 5001
    logging: *default-logging
    depends_on:
      - traefik

  postgres:
    image: postgres:15-alpine
    container_name: postgres
    restart: unless-stopped
    env_file:
      - .env
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  django:
    build:
      context: backend/django
      dockerfile: Dockerfile
    container_name: django
    volumes:
      - static_volume:/app/staticfiles
    restart: unless-stopped
    ports:
      - 8000:8000
    env_file:
      - .env
    depends_on:
      - postgres
      - traefik
      - redis
    networks:
      - default
      - traefik-public
    labels:
      <<: *default-labels
      traefik.enable: true
      traefik.docker.network: traefik-public

      traefik.http.routers.django-http.rule: Host(`${DJANGO_DOMAIN}`)
      traefik.http.routers.django-http.entrypoints: http
      traefik.http.routers.django-http.middlewares: https-redirect
      traefik.http.routers.django-http.service: django-service

      traefik.http.routers.django-https.rule: Host(`${DJANGO_DOMAIN}`)
      traefik.http.routers.django-https.entrypoints: https
      traefik.http.routers.django-https.tls: true
      traefik.http.routers.django-https.tls.certresolver: le
      traefik.http.routers.django-https.service: django-service

      traefik.http.services.django-service.loadbalancer.server.port: 8000

      traefik.http.routers.django-static.rule: Host(`${DJANGO_DOMAIN}`) && PathPrefix(`/static/`)
      traefik.http.routers.django-static.service: django-service
      traefik.http.middlewares.static-stripprefix.stripprefix.prefixes: /static
      traefik.http.routers.django-static.middlewares: static-stripprefix@docker
    logging: *default-logging

  redis:
    image: redis:6
    container_name: redis
    ports:
      - 6379:6379
    cpus: 0.5
    mem_limit: 512m
    depends_on:
      - traefik
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  celery:
    build:
      context: backend/django
      dockerfile: Dockerfile
    container_name: celery
    command: celery -A app worker --loglevel=info --concurrency=3
    volumes:
      - static_volume:/app/staticfiles
    env_file:
      - .env
    depends_on:
      - django
      - redis
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  celery-beat:
    build:
      context: backend/django
      dockerfile: Dockerfile
    container_name: celery-beat
    command: celery -A app beat --loglevel=info
    volumes:
      - static_volume:/app/staticfiles
    env_file:
      - .env
    depends_on:
      - celery
      - redis
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  grafana:
    image: grafana/grafana:${GRAFANA_VERSION:-11.0.0}
    container_name: grafana
    restart: unless-stopped
    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
      - GF_USERS_DEFAULT_THEME=dark
      - GF_LOG_MODE=console
      - GF_LOG_LEVEL=critical
      - GF_PANELS_ENABLE_ALPHA=true
      - GF_FEATURE_TOGGLES_ENABLE=accessControlOnCall lokiLogsDataplane
      - GF_INSTALL_PLUGINS=grafana-polystat-panel,https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/grafana-lokiexplore-app-latest.zip;grafana-lokiexplore-app
    volumes:
      - ./monitoring/configs/grafana/provisioning/dashboards.yml:/etc/grafana/provisioning/dashboards/provisioning-dashboards.yaml:ro
      - ./monitoring/configs/grafana/provisioning/datasources.yml:/etc/grafana/provisioning/datasources/provisioning-datasources.yaml:ro
      - ./monitoring/configs/grafana/plugins/app.yaml:/etc/grafana/provisioning/plugins/app.yaml:ro
      - ./monitoring/dashboards/node-metrics.json:/var/lib/grafana/dashboards/node-metrics.json:ro
      - ./monitoring/dashboards/container-metrics.json:/var/lib/grafana/dashboards/container-metrics.json:ro
      - ./monitoring/dashboards/log-search.json:/var/lib/grafana/dashboards/log-search.json:ro
      - ./monitoring/dashboards/traefik_official.json:/var/lib/grafana/dashboards/traefik_official.json:ro
      - ./monitoring/dashboards/altertmanager-dashboard.json:/var/lib/grafana/dashboards/altertmanager-dashboard.json:ro
      - grafana-data:/var/lib/grafana
    depends_on:
      - prometheus
      - traefik
    ports:
      - 3000:3000
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
      - traefik-public
    labels:
      <<: *default-labels
      traefik.enable: true
      traefik.docker.network: traefik-public
      traefik.http.routers.grafana.rule: Host(`${GRAFANA_DOMAIN?Variable not set}`)
      traefik.http.routers.grafana.entrypoints: https
      traefik.http.routers.grafana.tls: true
      traefik.http.routers.grafana.tls.certresolver: le
      traefik.http.services.grafana.loadbalancer.server.port: 3000
    logging: *default-logging

  prometheus:
    image: prom/prometheus:${PROMETHEUS_VERSION:-v2.42.0}
    container_name: prometheus
    restart: unless-stopped
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--log.level=error"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=7d"
      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
      - "--web.console.templates=/usr/share/prometheus/consoles"
      - "--web.external-url=http://localhost:9090"
    volumes:
      - ./monitoring/configs/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./monitoring/configs/prometheus/recording-rules.yml:/etc/prometheus/recording-rules.yml
      - ./monitoring/configs/prometheus/alerting-rules.yml:/etc/prometheus/alerting-rules.yml
      - prometheus-data:/prometheus
    depends_on:
      - alertmanager
      - traefik
    ports:
      - 9090:9090
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:${CADVISOR_VERSION:-v0.46.0}
    container_name: cadvisor
    restart: unless-stopped
    privileged: true
    depends_on:
      - traefik
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
        # https://github.com/google/cadvisor/issues/1565#issuecomment-718812180
      - /var/run/docker.sock:/var/run/docker.sock
      #- /dev/disk:/dev/disk:ro
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  node-exporter:
    image: prom/node-exporter:${NODE_EXPORTER_VERSION:-v1.5.0}
    container_name: node-exporter
    restart: unless-stopped
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
      - "--collector.filesystem.ignored-mount-points"
      - "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
    depends_on:
      - traefik
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  alertmanager:
    image: prom/alertmanager:${ALERTMANAGER_VERSION:-v0.25.0}
    container_name: alertmanager
    command:
      - "--config.file=/etc/alertmanager/config.yml"
      - "--log.level=error"
      - "--storage.path=/alertmanager"
      - "--web.external-url=http://localhost:9093"
    volumes:
      - ./monitoring/configs/alertmanager/alertmanager-fallback-config.yml:/etc/alertmanager/config.yml
    ports:
      - 9093:9093
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    depends_on:
      - uncomplicated-alert-receiver
      - traefik
    labels:
      <<: *default-labels
    logging: *default-logging

  uncomplicated-alert-receiver:
    image: ghcr.io/jamesread/uncomplicated-alert-receiver
    container_name: uncomplicated-alert-receiver
    ports:
      - 9094:8080
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    depends_on:
      - traefik
    labels:
      <<: *default-labels
    logging: *default-logging

  loki:
    image: grafana/loki:3.0.0
    container_name: loki
    user: root
    ports:
      - 3100:3100
    command: -config.file=/etc/loki/loki.yaml
    volumes:
      - ./monitoring/configs/loki/loki.yaml:/etc/loki/loki.yaml
      - ./monitoring/configs/loki/rules.yaml:/etc/loki/rules/fake/loki-rules.yml
    depends_on:
      - traefik
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

  promtail:
    image: grafana/promtail:3.0.0
    container_name: promtail
    volumes:
      - ./monitoring/configs/promtail/promtail.yaml:/etc/promtail/docker-config.yaml
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock
    command: -config.file=/etc/promtail/docker-config.yaml
    depends_on:
      - loki
      - traefik
    cpus: 0.5
    mem_limit: 512m
    networks:
      - default
    labels:
      <<: *default-labels
    logging: *default-logging

volumes:
  traefik-public-certificates: # Persistent volume for certificates
  grafana-data: {}
  prometheus-data: {}
  postgres-data: {}
  static_volume: {}

networks:
  default:
    driver: bridge
  traefik-public:
    external: true