docker-compose-prod.yml

services:
    prometheus:
        image: prom/prometheus
        command:
            - '--config.file=/etc/prometheus/prometheus.yml'
            - '--storage.tsdb.retention.time=30d'
        volumes:
            - prom_data:/prometheus
        configs:
            - source: obs_prometheus_cfg
              target: /etc/prometheus/prometheus.yml
        deploy:
            replicas: 1
            update_config:
                order: stop-first
            labels:
                - traefik.enable=true

                - traefik.http.services.obs_prometheus.loadbalancer.server.port=9090

                - traefik.http.routers.obs_prometheus.rule=Host(`prometheus.barlito.fr`)
                - traefik.http.routers.obs_prometheus.entrypoints=http
                - traefik.http.routers.obs_prometheus.middlewares=redirect-to-https@file

                - traefik.http.routers.obs_prometheus-secure.rule=Host(`prometheus.barlito.fr`)
                - traefik.http.routers.obs_prometheus-secure.entrypoints=https
                - traefik.http.routers.obs_prometheus-secure.tls=true
                - traefik.http.routers.obs_prometheus-secure.tls.certresolver=letsencrypt
                - traefik.http.routers.obs_prometheus-secure.middlewares=authelia-auth@file,security-headers@file
        networks:
            - obs_internal
            - traefik_traefik_proxy

    grafana:
        image: grafana/grafana
        environment:
            GF_SERVER_ROOT_URL: https://grafana.barlito.fr
            # Built-in admin account named after the Authelia user, so the auth
            # proxy login (Remote-User: barlito) lands on the server admin account
            GF_SECURITY_ADMIN_USER: barlito
            GF_AUTH_PROXY_ENABLED: "true"
            GF_AUTH_PROXY_HEADER_NAME: Remote-User
            GF_AUTH_PROXY_HEADER_PROPERTY: username
            GF_AUTH_PROXY_AUTO_SIGN_UP: "true"
            GF_AUTH_PROXY_HEADERS: "Email:Remote-Email Name:Remote-Name"
            GF_AUTH_BASIC_ENABLED: "false"
            GF_AUTH_DISABLE_LOGIN_FORM: "true"
            GF_USERS_ALLOW_SIGN_UP: "false"
            GF_SECURITY_COOKIE_SECURE: "true"
            GF_SECURITY_STRICT_TRANSPORT_SECURITY: "true"
        volumes:
            - grafana_data:/var/lib/grafana
        configs:
            - source: obs_gf_datasources
              target: /etc/grafana/provisioning/datasources/datasources.yml
            - source: obs_gf_dashprovider
              target: /etc/grafana/provisioning/dashboards/dashboards.yml
            - source: obs_gf_dash_node
              target: /var/lib/grafana/dashboards/node-exporter-full.json
            - source: obs_gf_dash_cadvisor
              target: /var/lib/grafana/dashboards/cadvisor.json
            - source: obs_gf_dash_prom
              target: /var/lib/grafana/dashboards/prometheus-overview.json
            - source: obs_gf_dash_loki
              target: /var/lib/grafana/dashboards/loki-logs.json
            - source: obs_gf_dash_traefik
              target: /var/lib/grafana/dashboards/traefik.json
        deploy:
            replicas: 1
            update_config:
                order: stop-first
            labels:
                - traefik.enable=true

                - traefik.http.services.obs_grafana.loadbalancer.server.port=3000

                - traefik.http.routers.obs_grafana.rule=Host(`grafana.barlito.fr`)
                - traefik.http.routers.obs_grafana.entrypoints=http
                - traefik.http.routers.obs_grafana.middlewares=redirect-to-https@file

                - traefik.http.routers.obs_grafana-secure.rule=Host(`grafana.barlito.fr`)
                - traefik.http.routers.obs_grafana-secure.entrypoints=https
                - traefik.http.routers.obs_grafana-secure.tls=true
                - traefik.http.routers.obs_grafana-secure.tls.certresolver=letsencrypt
                - traefik.http.routers.obs_grafana-secure.middlewares=authelia-auth@file,security-headers@file
        networks:
            - obs_internal
            - traefik_traefik_proxy

    loki:
        image: grafana/loki:3.4
        command: -config.file=/etc/loki/loki.yml
        volumes:
            - loki_data:/loki
        configs:
            - source: obs_loki_cfg
              target: /etc/loki/loki.yml
        deploy:
            replicas: 1
            update_config:
                order: stop-first
        networks:
            - obs_internal

    tempo:
        image: grafana/tempo:latest
        command: -config.file=/etc/tempo/tempo.yml
        volumes:
            - tempo_data:/var/tempo
        configs:
            - source: obs_tempo_cfg
              target: /etc/tempo/tempo.yml
        deploy:
            replicas: 1
            update_config:
                order: stop-first
        # obs_ingest is the ONLY obs network application stacks join: it exposes
        # Tempo (OTLP 4317/4318) to them and nothing else — apps never see
        # Prometheus/Grafana/Loki, which stay on the private obs_internal network.
        networks:
            - obs_internal
            - obs_ingest

    alloy:
        image: grafana/alloy:latest
        # 0.0.0.0 so Traefik can reach the debug UI; storage.path persists read
        # positions across restarts (avoids re-ingesting logs into Loki)
        command: run --server.http.listen-addr=0.0.0.0:12345 --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy
        volumes:
            - alloy_data:/var/lib/alloy/data
        configs:
            - source: obs_alloy_cfg
              target: /etc/alloy/config.alloy
        deploy:
            # One agent per node: collects logs of all local containers via the
            # Docker API and pushes them to Loki over the overlay network
            mode: global
            update_config:
                order: stop-first
            labels:
                - traefik.enable=true

                - traefik.http.services.obs_alloy.loadbalancer.server.port=12345

                - traefik.http.routers.obs_alloy.rule=Host(`alloy.barlito.fr`)
                - traefik.http.routers.obs_alloy.entrypoints=http
                - traefik.http.routers.obs_alloy.middlewares=redirect-to-https@file

                - traefik.http.routers.obs_alloy-secure.rule=Host(`alloy.barlito.fr`)
                - traefik.http.routers.obs_alloy-secure.entrypoints=https
                - traefik.http.routers.obs_alloy-secure.tls=true
                - traefik.http.routers.obs_alloy-secure.tls.certresolver=letsencrypt
                - traefik.http.routers.obs_alloy-secure.middlewares=authelia-auth@file,security-headers@file
        networks:
            - obs_internal
            - traefik_traefik_proxy

    dozzle:
        image: amir20/dozzle:latest
        environment:
            # Reads Remote-User/Remote-Email/Remote-Name headers set by Authelia
            DOZZLE_AUTH_PROVIDER: forward-proxy
            # Talk to the Docker API through the read-only docker-socket-proxy
            # instead of bind-mounting the raw socket (which :ro does NOT secure).
            DOZZLE_REMOTE_HOST: tcp://dockerproxy:2375
        deploy:
            replicas: 1
            update_config:
                order: stop-first
            labels:
                - traefik.enable=true

                - traefik.http.services.obs_dozzle.loadbalancer.server.port=8080

                - traefik.http.routers.obs_dozzle.rule=Host(`dozzle.barlito.fr`)
                - traefik.http.routers.obs_dozzle.entrypoints=http
                - traefik.http.routers.obs_dozzle.middlewares=redirect-to-https@file

                - traefik.http.routers.obs_dozzle-secure.rule=Host(`dozzle.barlito.fr`)
                - traefik.http.routers.obs_dozzle-secure.entrypoints=https
                - traefik.http.routers.obs_dozzle-secure.tls=true
                - traefik.http.routers.obs_dozzle-secure.tls.certresolver=letsencrypt
                - traefik.http.routers.obs_dozzle-secure.middlewares=authelia-auth@file,security-headers@file
        networks:
            # obs_internal added so Dozzle can reach the docker-socket-proxy
            - obs_internal
            - traefik_traefik_proxy

    node-exporter:
        image: prom/node-exporter:latest
        # Host metrics (CPU, RAM, disk, network). Mounts host fs read-only.
        command:
            - '--path.rootfs=/host'
            - '--path.procfs=/host/proc'
            - '--path.sysfs=/host/sys'
            - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
        volumes:
            - /proc:/host/proc:ro
            - /sys:/host/sys:ro
            - /:/host:ro,rslave
        deploy:
            mode: global
        networks:
            - obs_internal

    cadvisor:
        image: gcr.io/cadvisor/cadvisor:latest
        # Per-container metrics (CPU, RAM, net, fs) from the Docker engine
        command:
            - '--docker_only=true'
            - '--housekeeping_interval=30s'
        volumes:
            - /:/rootfs:ro
            # DOCUMENTED EXCEPTION: cAdvisor keeps its direct read-only socket.
            # It is deeply host-coupled (reads cgroups and /var/lib/docker from
            # the host) and cannot practically go through the TCP socket-proxy.
            # It is not network-exposed (obs_internal only, no Traefik labels).
            - /var/run/docker.sock:/var/run/docker.sock:ro
            - /sys:/sys:ro
            - /var/lib/docker/:/var/lib/docker:ro
            - /dev/disk/:/dev/disk:ro
        deploy:
            mode: global
        networks:
            - obs_internal

    # Read-only Docker API proxy in front of the raw socket. alloy and dozzle
    # talk to this over TCP instead of bind-mounting /var/run/docker.sock
    # (a :ro socket mount does NOT restrict API calls). Only CONTAINERS/EVENTS/
    # INFO are whitelisted and every write is refused (POST=0). Pinned to a
    # manager node; it is the only service here that touches the real socket.
    # Env-only config, so no Swarm config object is needed.
    dockerproxy:
        image: ghcr.io/tecnativa/docker-socket-proxy:latest
        environment:
            CONTAINERS: 1   # /containers/json + per-container log streaming
            NETWORKS: 1     # /networks — alloy's discovery.docker reads it for network labels
            EVENTS: 1       # Docker event stream (container start/stop)
            INFO: 1         # /info (engine metadata)
            POST: 0         # reject every write/mutating call
            LOG_LEVEL: warning
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        deploy:
            replicas: 1
            update_config:
                order: stop-first
            placement:
                constraints:
                    - node.role == manager
        networks:
            - obs_internal

# Config files shipped inside the Swarm (raft store) at deploy time — nothing
# lives on the server filesystem. Names are suffixed with CONFIG_VERSION (a hash
# of the files, computed in `make deploy.prod`): any content change yields a new
# config object, so Swarm does a rolling update instead of hitting the
# "only updates to Labels are allowed" immutability error.
configs:
    obs_prometheus_cfg:
        file: ./prometheus/prometheus.yml
        name: obs_prometheus_cfg_${CONFIG_VERSION:-dev}
    obs_loki_cfg:
        file: ./loki/loki.yml
        name: obs_loki_cfg_${CONFIG_VERSION:-dev}
    obs_tempo_cfg:
        file: ./tempo/tempo.yml
        name: obs_tempo_cfg_${CONFIG_VERSION:-dev}
    obs_alloy_cfg:
        file: ./alloy/config.alloy
        name: obs_alloy_cfg_${CONFIG_VERSION:-dev}
    obs_gf_datasources:
        file: ./grafana/provisioning/datasources/datasources.yml
        name: obs_gf_datasources_${CONFIG_VERSION:-dev}
    obs_gf_dashprovider:
        file: ./grafana/provisioning/dashboards/dashboards.yml
        name: obs_gf_dashprovider_${CONFIG_VERSION:-dev}
    obs_gf_dash_node:
        file: ./grafana/dashboards/node-exporter-full.json
        name: obs_gf_dash_node_${CONFIG_VERSION:-dev}
    obs_gf_dash_cadvisor:
        file: ./grafana/dashboards/cadvisor.json
        name: obs_gf_dash_cadvisor_${CONFIG_VERSION:-dev}
    obs_gf_dash_prom:
        file: ./grafana/dashboards/prometheus-overview.json
        name: obs_gf_dash_prom_${CONFIG_VERSION:-dev}
    obs_gf_dash_loki:
        file: ./grafana/dashboards/loki-logs.json
        name: obs_gf_dash_loki_${CONFIG_VERSION:-dev}
    obs_gf_dash_traefik:
        file: ./grafana/dashboards/traefik.json
        name: obs_gf_dash_traefik_${CONFIG_VERSION:-dev}

volumes:
    prom_data:
    grafana_data:
    loki_data:
    tempo_data:
    alloy_data:

networks:
    traefik_traefik_proxy:
        external: true
    # Private stack network: Prometheus, Grafana, Loki, Tempo, exporters. Not
    # reachable from application stacks.
    obs_internal:
        driver: overlay
    # Trace-ingestion network shared with application stacks. Only Tempo is
    # attached to it, so apps that join it can reach Tempo and nothing else.
    obs_ingest:
        driver: overlay
        attachable: true