From 9a3dae67be08066536fb18fe6e31f74ab0504b70 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:50:42 +0000
Subject: [PATCH 1/2] chore(deps): update grafana/loki docker tag to v3.7.6

---
 observability/loki/docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/observability/loki/docker-compose.yml b/observability/loki/docker-compose.yml
index a17260e..a0c59a6 100644
--- a/observability/loki/docker-compose.yml
+++ b/observability/loki/docker-compose.yml
@@ -8,7 +8,7 @@ volumes:
 services:
   loki:
     container_name: loki
-    image: grafana/loki:3.7.5
+    image: grafana/loki:3.7.6
     command: -config.file=/etc/loki/config.yaml
     volumes:
       - ./config.yaml:/etc/loki/config.yaml

From b1789870002942a93cd62a2f189299548282fb79 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:50:57 +0000
Subject: [PATCH 2/2] chore(stacks): sync generated stacks for renovate update

---
 stacks/infrastructure.yml | 282 +++++++++++++++++++-------------------
 stacks/observability.yml  | 266 +++++++++++++++++------------------
 stacks/platform.yml       | 156 ++++++++++-----------
 3 files changed, 352 insertions(+), 352 deletions(-)

diff --git a/stacks/infrastructure.yml b/stacks/infrastructure.yml
index 46ec962..26fba0b 100644
--- a/stacks/infrastructure.yml
+++ b/stacks/infrastructure.yml
@@ -1,5 +1,96 @@
 # Generated by stackctl generate — do not edit manually.
 services:
+  mongo:
+    image: 'mongo:8.3.7'
+    networks:
+      default:
+        aliases:
+          - mongo
+    env_file:
+      - ./mongo/.env
+    environment:
+      - GLIBC_TUNABLES=glibc.pthread.rseq=1
+    volumes:
+      - 'mongo-data:/data/db'
+      - 'mongo-data:/data/configdb'
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.tcp.routers.mongo.rule=HostSNI(`${HOST}`)'
+      - traefik.tcp.routers.mongo.entrypoints=websecure
+      - traefik.tcp.routers.mongo.service=mongo
+      - traefik.tcp.routers.mongo.tls=true
+      - 'traefik.tcp.routers.mongo.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.tcp.services.mongo.loadbalancer.server.port=${PORT}'
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - 'mongosh --quiet --eval "db.runCommand({ping:1}).ok ? quit(0) : quit(1)"'
+      interval: 10s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    deploy:
+      resources:
+        reservations:
+          memory: 256M
+        limits:
+          memory: 800M
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+        max_attempts: 0
+        window: 120s
+    logging:
+      driver: local
+      options:
+        max-size: 10m
+        max-file: 3
+  traefik:
+    image: 'traefik:v3.7'
+    networks:
+      default:
+        aliases:
+          - traefik
+    ports:
+      - '80:80'
+      - '443:443'
+    env_file: ./traefik/.env
+    volumes:
+      - 'traefik-ssl-certs:/etc/traefik/certs'
+      - './traefik/auth/htpasswd:/etc/htpasswd:ro'
+      - './traefik/config/traefik.yml:/etc/traefik/traefik.yml:ro'
+      - './traefik/config/dynamic.yml:/etc/traefik/dynamic.yml:ro'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.http.routers.traefik-ui.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.traefik-ui.entrypoints=web,websecure'
+      - traefik.http.routers.traefik-ui.service=api@internal
+      - traefik.http.routers.traefik-ui.middlewares=sso
+      - traefik.http.routers.traefik-ui.tls=true
+      - 'traefik.http.routers.traefik-ui.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.middlewares.sso.plugin.trauth.domain=${TRUEAUTH_DOMAIN}'
+      - 'traefik.http.middlewares.sso.plugin.trauth.cookiename=${TRUEAUTH_COOKIE}'
+      - 'traefik.http.middlewares.sso.plugin.trauth.users=${SSO_CREDENTIALS}'
+      - 'traefik.http.services.traefik-ui.loadbalancer.server.port=${PORT}'
+    logging:
+      options:
+        max-size: 10m
+        max-file: 3
+    deploy:
+      mode: global
+      placement:
+        constraints:
+          - node.role == manager
+      restart_policy:
+        condition: any
+      resources:
+        reservations:
+          memory: 128M
+          cpus: '0.10'
+        limits:
+          memory: 512M
+          cpus: '0.50'
   apisix_dashboard:
     image: 'apache/apisix-dashboard:3.0.1-alpine'
     networks:
@@ -48,53 +139,6 @@ services:
         delay: 10s
         max_attempts: 10
         window: 180s
-  apisix_gateway:
-    image: 'apache/apisix:3.17.0-debian'
-    networks:
-      default:
-        aliases:
-          - apisix-gateway
-    env_file:
-      - ./apisix/api-gateway/.env
-    volumes:
-      - './apisix/api-gateway/config/apisix.yaml:/usr/local/apisix/conf/config.yaml:ro'
-      - 'cache:/tmp/apisix-cache/'
-    healthcheck:
-      test:
-        - CMD-SHELL
-        - test -s /usr/local/apisix/logs/nginx.pid
-      interval: 20s
-      timeout: 5s
-      retries: 3
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.apisix.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.apisix.entrypoints=web,websecure'
-      - traefik.http.routers.apisix.service=apisix
-      - traefik.http.routers.apisix.tls=true
-      - 'traefik.http.routers.apisix.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.http.services.apisix.loadbalancer.server.port=${PORT}'
-    logging:
-      options:
-        max-size: 10m
-        max-file: 3
-    deploy:
-      mode: global
-      placement:
-        constraints:
-          - node.role == manager
-      resources:
-        reservations:
-          memory: 128M
-          cpus: '0.10'
-        limits:
-          memory: 384M
-          cpus: '0.40'
-      restart_policy:
-        condition: on-failure
-        delay: 10s
-        max_attempts: 10
-        window: 180s
   etcd:
     image: 'bitnamilegacy/etcd:3.6.4'
     networks:
@@ -128,45 +172,53 @@ services:
         delay: 5s
         max_attempts: 0
         window: 120s
-  redis:
-    image: 'redis:8.10-alpine'
+  apisix_gateway:
+    image: 'apache/apisix:3.17.0-debian'
     networks:
       default:
         aliases:
-          - redis
-    command: redis-server --appendonly yes
-    env_file: ./redis/.env
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.tcp.routers.redis.rule=HostSNI(`${HOST}`)'
-      - traefik.tcp.routers.redis.entrypoints=websecure
-      - traefik.tcp.routers.redis.service=redis
-      - traefik.tcp.routers.redis.tls=true
-      - 'traefik.tcp.routers.redis.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.tcp.services.redis.loadbalancer.server.port=${PORT}'
+          - apisix-gateway
+    env_file:
+      - ./apisix/api-gateway/.env
+    volumes:
+      - './apisix/api-gateway/config/apisix.yaml:/usr/local/apisix/conf/config.yaml:ro'
+      - 'cache:/tmp/apisix-cache/'
     healthcheck:
       test:
         - CMD-SHELL
-        - redis-cli ping | grep -q PONG
-      interval: 10s
+        - test -s /usr/local/apisix/logs/nginx.pid
+      interval: 20s
       timeout: 5s
       retries: 3
-      start_period: 20s
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.http.routers.apisix.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.apisix.entrypoints=web,websecure'
+      - traefik.http.routers.apisix.service=apisix
+      - traefik.http.routers.apisix.tls=true
+      - 'traefik.http.routers.apisix.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.services.apisix.loadbalancer.server.port=${PORT}'
     logging:
       options:
         max-size: 10m
         max-file: 3
     deploy:
+      mode: global
+      placement:
+        constraints:
+          - node.role == manager
       resources:
         reservations:
-          memory: 32M
-        limits:
           memory: 128M
+          cpus: '0.10'
+        limits:
+          memory: 384M
+          cpus: '0.40'
       restart_policy:
         condition: on-failure
-        delay: 5s
-        max_attempts: 0
-        window: 120s
+        delay: 10s
+        max_attempts: 10
+        window: 180s
   portainer:
     image: 'portainer/portainer-ce:2.44.0'
     volumes:
@@ -203,97 +255,45 @@ services:
         limits:
           memory: 512M
           cpus: '0.50'
-  mongo:
-    image: 'mongo:8.3.7'
+  redis:
+    image: 'redis:8.10-alpine'
     networks:
       default:
         aliases:
-          - mongo
-    env_file:
-      - ./mongo/.env
-    environment:
-      - GLIBC_TUNABLES=glibc.pthread.rseq=1
-    volumes:
-      - 'mongo-data:/data/db'
-      - 'mongo-data:/data/configdb'
+          - redis
+    command: redis-server --appendonly yes
+    env_file: ./redis/.env
     labels:
       - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.tcp.routers.mongo.rule=HostSNI(`${HOST}`)'
-      - traefik.tcp.routers.mongo.entrypoints=websecure
-      - traefik.tcp.routers.mongo.service=mongo
-      - traefik.tcp.routers.mongo.tls=true
-      - 'traefik.tcp.routers.mongo.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.tcp.services.mongo.loadbalancer.server.port=${PORT}'
+      - 'traefik.tcp.routers.redis.rule=HostSNI(`${HOST}`)'
+      - traefik.tcp.routers.redis.entrypoints=websecure
+      - traefik.tcp.routers.redis.service=redis
+      - traefik.tcp.routers.redis.tls=true
+      - 'traefik.tcp.routers.redis.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.tcp.services.redis.loadbalancer.server.port=${PORT}'
     healthcheck:
       test:
         - CMD-SHELL
-        - 'mongosh --quiet --eval "db.runCommand({ping:1}).ok ? quit(0) : quit(1)"'
+        - redis-cli ping | grep -q PONG
       interval: 10s
-      timeout: 10s
-      retries: 5
-      start_period: 60s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    logging:
+      options:
+        max-size: 10m
+        max-file: 3
     deploy:
       resources:
         reservations:
-          memory: 256M
+          memory: 32M
         limits:
-          memory: 800M
+          memory: 128M
       restart_policy:
         condition: on-failure
         delay: 5s
         max_attempts: 0
         window: 120s
-    logging:
-      driver: local
-      options:
-        max-size: 10m
-        max-file: 3
-  traefik:
-    image: 'traefik:v3.7'
-    networks:
-      default:
-        aliases:
-          - traefik
-    ports:
-      - '80:80'
-      - '443:443'
-    env_file: ./traefik/.env
-    volumes:
-      - 'traefik-ssl-certs:/etc/traefik/certs'
-      - './traefik/auth/htpasswd:/etc/htpasswd:ro'
-      - './traefik/config/traefik.yml:/etc/traefik/traefik.yml:ro'
-      - './traefik/config/dynamic.yml:/etc/traefik/dynamic.yml:ro'
-      - '/var/run/docker.sock:/var/run/docker.sock:ro'
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.traefik-ui.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.traefik-ui.entrypoints=web,websecure'
-      - traefik.http.routers.traefik-ui.service=api@internal
-      - traefik.http.routers.traefik-ui.middlewares=sso
-      - traefik.http.routers.traefik-ui.tls=true
-      - 'traefik.http.routers.traefik-ui.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.http.middlewares.sso.plugin.trauth.domain=${TRUEAUTH_DOMAIN}'
-      - 'traefik.http.middlewares.sso.plugin.trauth.cookiename=${TRUEAUTH_COOKIE}'
-      - 'traefik.http.middlewares.sso.plugin.trauth.users=${SSO_CREDENTIALS}'
-      - 'traefik.http.services.traefik-ui.loadbalancer.server.port=${PORT}'
-    logging:
-      options:
-        max-size: 10m
-        max-file: 3
-    deploy:
-      mode: global
-      placement:
-        constraints:
-          - node.role == manager
-      restart_policy:
-        condition: any
-      resources:
-        reservations:
-          memory: 128M
-          cpus: '0.10'
-        limits:
-          memory: 512M
-          cpus: '0.50'
 networks:
   default:
     name: traefik-public
diff --git a/stacks/observability.yml b/stacks/observability.yml
index f66ad56..02153d9 100644
--- a/stacks/observability.yml
+++ b/stacks/observability.yml
@@ -1,16 +1,24 @@
 # Generated by stackctl generate — do not edit manually.
 services:
-  loki:
-    image: 'grafana/loki:3.7.5'
-    command: '-config.file=/etc/loki/config.yaml'
-    volumes:
-      - './observability/loki/config.yaml:/etc/loki/config.yaml'
-      - 'loki-data:/loki'
-    env_file: ./observability/loki/.env
+  beszel:
+    image: 'henrygd/beszel:0.18.7'
     networks:
       default:
         aliases:
-          - loki
+          - beszel
+    volumes:
+      - 'beszel-data:/beszel_data'
+      - 'beszel-socket:/beszel_socket'
+    env_file:
+      - ./beszel/.env
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.http.routers.beszel.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.beszel.entrypoints=web,websecure'
+      - 'traefik.http.services.beszel.loadbalancer.server.port=${PORT}'
+      - traefik.http.routers.beszel.service=beszel
+      - traefik.http.routers.beszel.tls=true
+      - 'traefik.http.routers.beszel.tls.certresolver=${CERT_RESOLVER}'
     logging:
       options:
         max-size: 10m
@@ -21,31 +29,22 @@ services:
       placement:
         constraints:
           - node.role == manager
-      restart_policy:
-        condition: any
       resources:
         reservations:
-          memory: 256M
+          memory: 64M
         limits:
-          memory: 800M
-  grafana:
-    image: 'grafana/grafana-oss:13.0.2'
-    volumes:
-      - 'grafana-data:/var/lib/grafana'
-      - './observability/grafana/config/provisioning:/etc/grafana/provisioning/'
-    env_file: ./observability/grafana/.env
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.grafana.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.grafana.entrypoints=web,websecure'
-      - traefik.http.routers.grafana.service=grafana
-      - traefik.http.routers.grafana.tls=true
-      - 'traefik.http.routers.grafana.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.http.services.grafana.loadbalancer.server.port=${PORT}'
+          memory: 256M
+  beszel-agent:
+    image: 'henrygd/beszel-agent:0.18.7'
     networks:
       default:
         aliases:
-          - grafana
+          - beszel-agent
+    volumes:
+      - 'beszel-socket:/beszel_socket'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'
+    env_file:
+      - ./beszel/.env
     logging:
       options:
         max-size: 10m
@@ -56,32 +55,45 @@ services:
       placement:
         constraints:
           - node.role == manager
-      restart_policy:
-        condition: any
       resources:
         reservations:
-          memory: 128M
+          memory: 32M
         limits:
-          memory: 512M
-  otel-collector:
-    image: 'otel/opentelemetry-collector-contrib:0.156.0'
+          memory: 96M
+  prometheus:
+    image: 'prom/prometheus:v3.13.2'
     command:
-      - '--config=/etc/otel-collector/config.yaml'
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--storage.tsdb.retention.size=512MB'
+    env_file: ./observability/prometheus/.env
     volumes:
-      - './observability/otel/config.yaml:/etc/otel-collector/config.yaml'
-    env_file: ./observability/otel/.env
+      - './observability/prometheus/config:/etc/prometheus/'
+      - 'prometheus-data:/prometheus'
     labels:
       - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.tcp.routers.otel.rule=HostSNI(`${HOST}`)'
-      - 'traefik.tcp.routers.otel.entrypoints=web,websecure'
-      - traefik.tcp.routers.otel.service=otel
-      - traefik.tcp.routers.otel.tls=true
-      - 'traefik.tcp.routers.otel.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.tcp.services.otel.loadbalancer.server.port=${PORT}'
+      - 'traefik.http.routers.prometheus.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.prometheus.entrypoints=web,websecure'
+      - traefik.http.routers.prometheus.service=prometheus
+      - traefik.http.routers.prometheus.middlewares=sso@docker
+      - traefik.http.routers.prometheus.tls=true
+      - 'traefik.http.routers.prometheus.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.services.prometheus.loadbalancer.server.port=${PORT}'
     networks:
       default:
         aliases:
-          - otel-collector
+          - prometheus
+    healthcheck:
+      test:
+        - CMD
+        - wget
+        - '--no-verbose'
+        - '--tries=1'
+        - '--spider'
+        - 'http://localhost:9090/-/ready'
+      interval: 30s
+      timeout: 5s
+      retries: 3
     logging:
       options:
         max-size: 10m
@@ -96,46 +108,26 @@ services:
         condition: any
       resources:
         reservations:
-          memory: 128M
-          cpus: '0.10'
+          memory: 512M
+          cpus: '0.25'
         limits:
-          memory: 384M
-          cpus: '0.40'
-  memcached:
-    image: 'memcached:1.6.45'
-    environment:
-      - MEMCACHED_MAX_MEMORY=64m
-      - MEMCACHED_THREADS=2
-    networks:
-      default:
-        aliases:
-          - memcached
-    logging:
-      options:
-        max-size: 10m
-        max-file: 3
-  tempo:
-    image: 'grafana/tempo:3.0.2'
-    user: tempo
-    command:
-      - '-config.file=/etc/tempo/config.yaml'
+          memory: 1200M
+          cpus: '0.80'
+  loki:
+    image: 'grafana/loki:3.7.6'
+    command: '-config.file=/etc/loki/config.yaml'
     volumes:
-      - './observability/tempo/tempo.yaml:/etc/tempo/config.yaml'
-      - 'tempo-data:/var/tempo'
-    environment:
-      - TEMPO_GID=10001
-      - TEMPO_UID=10001
-    env_file: ./observability/tempo/.env
+      - './observability/loki/config.yaml:/etc/loki/config.yaml'
+      - 'loki-data:/loki'
+    env_file: ./observability/loki/.env
     networks:
       default:
         aliases:
-          - tempo
+          - loki
     logging:
       options:
         max-size: 10m
         max-file: 3
-    depends_on:
-      - memcached
     deploy:
       mode: replicated
       replicas: 1
@@ -148,41 +140,26 @@ services:
         reservations:
           memory: 256M
         limits:
-          memory: 600M
-  prometheus:
-    image: 'prom/prometheus:v3.13.2'
+          memory: 800M
+  otel-collector:
+    image: 'otel/opentelemetry-collector-contrib:0.156.0'
     command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
-      - '--storage.tsdb.path=/prometheus'
-      - '--storage.tsdb.retention.size=512MB'
-    env_file: ./observability/prometheus/.env
+      - '--config=/etc/otel-collector/config.yaml'
     volumes:
-      - './observability/prometheus/config:/etc/prometheus/'
-      - 'prometheus-data:/prometheus'
+      - './observability/otel/config.yaml:/etc/otel-collector/config.yaml'
+    env_file: ./observability/otel/.env
     labels:
       - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.prometheus.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.prometheus.entrypoints=web,websecure'
-      - traefik.http.routers.prometheus.service=prometheus
-      - traefik.http.routers.prometheus.middlewares=sso@docker
-      - traefik.http.routers.prometheus.tls=true
-      - 'traefik.http.routers.prometheus.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.http.services.prometheus.loadbalancer.server.port=${PORT}'
+      - 'traefik.tcp.routers.otel.rule=HostSNI(`${HOST}`)'
+      - 'traefik.tcp.routers.otel.entrypoints=web,websecure'
+      - traefik.tcp.routers.otel.service=otel
+      - traefik.tcp.routers.otel.tls=true
+      - 'traefik.tcp.routers.otel.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.tcp.services.otel.loadbalancer.server.port=${PORT}'
     networks:
       default:
         aliases:
-          - prometheus
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - '--no-verbose'
-        - '--tries=1'
-        - '--spider'
-        - 'http://localhost:9090/-/ready'
-      interval: 30s
-      timeout: 5s
-      retries: 3
+          - otel-collector
     logging:
       options:
         max-size: 10m
@@ -197,30 +174,29 @@ services:
         condition: any
       resources:
         reservations:
-          memory: 512M
-          cpus: '0.25'
+          memory: 128M
+          cpus: '0.10'
         limits:
-          memory: 1200M
-          cpus: '0.80'
-  beszel:
-    image: 'henrygd/beszel:0.18.7'
-    networks:
-      default:
-        aliases:
-          - beszel
+          memory: 384M
+          cpus: '0.40'
+  grafana:
+    image: 'grafana/grafana-oss:13.0.2'
     volumes:
-      - 'beszel-data:/beszel_data'
-      - 'beszel-socket:/beszel_socket'
-    env_file:
-      - ./beszel/.env
+      - 'grafana-data:/var/lib/grafana'
+      - './observability/grafana/config/provisioning:/etc/grafana/provisioning/'
+    env_file: ./observability/grafana/.env
     labels:
       - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.beszel.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.beszel.entrypoints=web,websecure'
-      - 'traefik.http.services.beszel.loadbalancer.server.port=${PORT}'
-      - traefik.http.routers.beszel.service=beszel
-      - traefik.http.routers.beszel.tls=true
-      - 'traefik.http.routers.beszel.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.routers.grafana.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.grafana.entrypoints=web,websecure'
+      - traefik.http.routers.grafana.service=grafana
+      - traefik.http.routers.grafana.tls=true
+      - 'traefik.http.routers.grafana.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.services.grafana.loadbalancer.server.port=${PORT}'
+    networks:
+      default:
+        aliases:
+          - grafana
     logging:
       options:
         max-size: 10m
@@ -231,37 +207,61 @@ services:
       placement:
         constraints:
           - node.role == manager
+      restart_policy:
+        condition: any
       resources:
         reservations:
-          memory: 64M
+          memory: 128M
         limits:
-          memory: 256M
-  beszel-agent:
-    image: 'henrygd/beszel-agent:0.18.7'
+          memory: 512M
+  memcached:
+    image: 'memcached:1.6.45'
+    environment:
+      - MEMCACHED_MAX_MEMORY=64m
+      - MEMCACHED_THREADS=2
     networks:
       default:
         aliases:
-          - beszel-agent
+          - memcached
+    logging:
+      options:
+        max-size: 10m
+        max-file: 3
+  tempo:
+    image: 'grafana/tempo:3.0.2'
+    user: tempo
+    command:
+      - '-config.file=/etc/tempo/config.yaml'
     volumes:
-      - 'beszel-socket:/beszel_socket'
-      - '/var/run/docker.sock:/var/run/docker.sock:ro'
-    env_file:
-      - ./beszel/.env
+      - './observability/tempo/tempo.yaml:/etc/tempo/config.yaml'
+      - 'tempo-data:/var/tempo'
+    environment:
+      - TEMPO_GID=10001
+      - TEMPO_UID=10001
+    env_file: ./observability/tempo/.env
+    networks:
+      default:
+        aliases:
+          - tempo
     logging:
       options:
         max-size: 10m
         max-file: 3
+    depends_on:
+      - memcached
     deploy:
       mode: replicated
       replicas: 1
       placement:
         constraints:
           - node.role == manager
+      restart_policy:
+        condition: any
       resources:
         reservations:
-          memory: 32M
+          memory: 256M
         limits:
-          memory: 96M
+          memory: 600M
 networks:
   default:
     name: traefik-public
diff --git a/stacks/platform.yml b/stacks/platform.yml
index 1958095..e1de06d 100644
--- a/stacks/platform.yml
+++ b/stacks/platform.yml
@@ -39,84 +39,6 @@ services:
         delay: 10s
         max_attempts: 10
         window: 180s
-  website:
-    image: 'ghcr.io/anitrend/website:0.4.2'
-    networks:
-      default:
-        aliases:
-          - website
-    env_file: ./website/.env
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.website.rule=Host(`${HOST}`)'
-      - 'traefik.http.routers.website.entrypoints=web,websecure'
-      - traefik.http.routers.website.service=website
-      - traefik.http.routers.website.tls=true
-      - 'traefik.http.routers.website.tls.certresolver=${CERT_RESOLVER}'
-      - 'traefik.http.services.website.loadbalancer.server.port=${PORT}'
-    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints:
-          - node.role == manager
-      resources:
-        reservations:
-          memory: 64M
-        limits:
-          memory: 256M
-    logging:
-      driver: local
-      options:
-        max-size: 10m
-        max-file: 3
-  growthbook_proxy:
-    image: 'growthbook/proxy:v1.3.5'
-    env_file: ./growthbook/proxy/.env
-    networks:
-      default:
-        aliases:
-          - growthbook-proxy
-    labels:
-      - 'traefik.enable=${TRAEFIK_ENABLE}'
-      - 'traefik.http.routers.growth-proxy.rule=Host(`${HOST}`)'
-      - 'traefik.http.services.growth-proxy.loadbalancer.server.port=${PORT}'
-      - 'traefik.http.routers.growth-proxy.entrypoints=web,websecure'
-      - traefik.http.routers.growth-proxy.service=growth-proxy
-      - traefik.http.routers.growth-proxy.tls=true
-      - 'traefik.http.routers.growth-proxy.tls.certresolver=${CERT_RESOLVER}'
-    logging:
-      options:
-        max-size: 10m
-        max-file: 3
-    healthcheck:
-      test:
-        - CMD-SHELL
-        - |-
-          node -e "fetch('http://127.0.0.1:3300/healthcheck')
-            .then(r => r.json())
-            .then(d => process.exit(d.ok ? 0 : 1))
-            .catch(() => process.exit(1))"
-      interval: 20s
-      timeout: 10s
-      retries: 3
-      start_period: 20s
-    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints:
-          - node.role == manager
-      resources:
-        reservations:
-          memory: 64M
-        limits:
-          memory: 256M
-      restart_policy:
-        condition: on-failure
-        delay: 10s
-        max_attempts: 10
-        window: 180s
   growthbook:
     command:
       - yarn
@@ -176,6 +98,53 @@ services:
         delay: 10s
         max_attempts: 10
         window: 180s
+  growthbook_proxy:
+    image: 'growthbook/proxy:v1.3.5'
+    env_file: ./growthbook/proxy/.env
+    networks:
+      default:
+        aliases:
+          - growthbook-proxy
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.http.routers.growth-proxy.rule=Host(`${HOST}`)'
+      - 'traefik.http.services.growth-proxy.loadbalancer.server.port=${PORT}'
+      - 'traefik.http.routers.growth-proxy.entrypoints=web,websecure'
+      - traefik.http.routers.growth-proxy.service=growth-proxy
+      - traefik.http.routers.growth-proxy.tls=true
+      - 'traefik.http.routers.growth-proxy.tls.certresolver=${CERT_RESOLVER}'
+    logging:
+      options:
+        max-size: 10m
+        max-file: 3
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - |-
+          node -e "fetch('http://127.0.0.1:3300/healthcheck')
+            .then(r => r.json())
+            .then(d => process.exit(d.ok ? 0 : 1))
+            .catch(() => process.exit(1))"
+      interval: 20s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+      resources:
+        reservations:
+          memory: 64M
+        limits:
+          memory: 256M
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 10
+        window: 180s
   anitrend-edge:
     image: 'ghcr.io/anitrend/on-the-edge:1.6.5'
     networks:
@@ -213,6 +182,37 @@ services:
         delay: 10s
         max_attempts: 10
         window: 180s
+  website:
+    image: 'ghcr.io/anitrend/website:0.4.2'
+    networks:
+      default:
+        aliases:
+          - website
+    env_file: ./website/.env
+    labels:
+      - 'traefik.enable=${TRAEFIK_ENABLE}'
+      - 'traefik.http.routers.website.rule=Host(`${HOST}`)'
+      - 'traefik.http.routers.website.entrypoints=web,websecure'
+      - traefik.http.routers.website.service=website
+      - traefik.http.routers.website.tls=true
+      - 'traefik.http.routers.website.tls.certresolver=${CERT_RESOLVER}'
+      - 'traefik.http.services.website.loadbalancer.server.port=${PORT}'
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+      resources:
+        reservations:
+          memory: 64M
+        limits:
+          memory: 256M
+    logging:
+      driver: local
+      options:
+        max-size: 10m
+        max-file: 3
 networks:
   default:
     name: traefik-public