- Add Authentik service stack to infrastructure.yml
- Includes Authentik server, worker, PostgreSQL database, and Redis
- Alternative SSO with web UI for user management
- Access at authentik.${DOMAIN}
- Protected by Authelia SSO (comment out to use standalone)
- Fix Uptime Kuma duplicate listing
- Remove from utilities.yml
- Keep only in monitoring.yml where it belongs
- Add Traefik labels and SSO protection to monitoring instance
- Enable SSO on Jellyseerr by default
- Changed from bypass to protected (security-first approach)
- Users can comment out SSO if needed for public access
- Update SSO toggling documentation
- Emphasize commenting out (not removing) middleware line
- Add docker command examples for running from outside stack folder
- Show both "cd to directory" and "full path" methods
- Add examples for starting and stopping services multiple ways
- Enhance security-first methodology
- Update copilot instructions to default SSO to enabled
- Only Plex and Jellyfin bypass SSO by default
- All other services start secured, expose gradually
- Emphasize commenting (not removing) for easier re-enable
- Update services-reference.md
- Add Authentik to infrastructure section (12 services)
- Move Uptime Kuma to monitoring section (8 services)
- Remove from utilities (now 6 services)
- Update Jellyseerr SSO status from ✗ to ✓
- Improve Authentik documentation with deployment guidance
- Add Authentik environment variables to .env.example
- AUTHENTIK_SECRET_KEY, DB credentials
- Generation instructions included
All changes align with security-first principle: start secure, expose services only when ready for deployment.
Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>
182 lines
5.2 KiB
YAML
182 lines
5.2 KiB
YAML
# Monitoring and Observability Services
|
|
# Services for monitoring your homelab infrastructure
|
|
|
|
services:
|
|
# Prometheus - Metrics collection and storage
|
|
# Access at: http://server-ip:9090
|
|
prometheus:
|
|
image: prom/prometheus:v2.48.1
|
|
container_name: prometheus
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
- homelab-network
|
|
ports:
|
|
- "9090:9090"
|
|
volumes:
|
|
- ./config/prometheus:/etc/prometheus
|
|
- prometheus-data:/prometheus
|
|
command:
|
|
- '--config.file=/etc/prometheus/prometheus.yml'
|
|
- '--storage.tsdb.path=/prometheus'
|
|
- '--storage.tsdb.retention.time=30d'
|
|
- '--web.console.libraries=/etc/prometheus/console_libraries'
|
|
- '--web.console.templates=/etc/prometheus/consoles'
|
|
- '--web.enable-lifecycle'
|
|
user: "${PUID:-1000}:${PGID:-1000}"
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Metrics collection and time-series database"
|
|
|
|
# Grafana - Metrics visualization
|
|
# Access at: http://server-ip:3000
|
|
# Default credentials: admin / admin (change on first login)
|
|
grafana:
|
|
image: grafana/grafana:10.2.3
|
|
container_name: grafana
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
- homelab-network
|
|
ports:
|
|
- "3000:3000"
|
|
volumes:
|
|
- grafana-data:/var/lib/grafana
|
|
- ./config/grafana/provisioning:/etc/grafana/provisioning
|
|
environment:
|
|
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
|
|
- GF_USERS_ALLOW_SIGN_UP=false
|
|
- GF_SERVER_ROOT_URL=http://${SERVER_IP}:3000
|
|
- GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource,grafana-piechart-panel
|
|
user: "${PUID:-1000}:${PGID:-1000}"
|
|
depends_on:
|
|
- prometheus
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Metrics visualization and dashboards"
|
|
|
|
# Node Exporter - Host metrics exporter
|
|
# Metrics at: http://server-ip:9100/metrics
|
|
node-exporter:
|
|
image: prom/node-exporter:v1.7.0
|
|
container_name: node-exporter
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
ports:
|
|
- "9100:9100"
|
|
volumes:
|
|
- /proc:/host/proc:ro
|
|
- /sys:/host/sys:ro
|
|
- /:/rootfs:ro
|
|
command:
|
|
- '--path.procfs=/host/proc'
|
|
- '--path.rootfs=/rootfs'
|
|
- '--path.sysfs=/host/sys'
|
|
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Hardware and OS metrics exporter"
|
|
|
|
# cAdvisor - Container metrics exporter
|
|
# Access at: http://server-ip:8082
|
|
cadvisor:
|
|
image: gcr.io/cadvisor/cadvisor:v0.47.2
|
|
container_name: cadvisor
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
ports:
|
|
- "8082:8080"
|
|
volumes:
|
|
- /:/rootfs:ro
|
|
- /var/run:/var/run:ro
|
|
- /sys:/sys:ro
|
|
- /var/lib/docker:/var/lib/docker:ro
|
|
- /dev/disk:/dev/disk:ro
|
|
privileged: true
|
|
devices:
|
|
- /dev/kmsg
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Container metrics and performance monitoring"
|
|
|
|
# Uptime Kuma - Uptime monitoring
|
|
# Access at: https://status.${DOMAIN}
|
|
uptime-kuma:
|
|
image: louislam/uptime-kuma:1
|
|
container_name: uptime-kuma
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- uptime-kuma-data:/app/data
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Service uptime monitoring and alerts"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.uptime-kuma.rule=Host(`status.${DOMAIN}`)"
|
|
- "traefik.http.routers.uptime-kuma.entrypoints=websecure"
|
|
- "traefik.http.routers.uptime-kuma.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.uptime-kuma.middlewares=authelia@docker"
|
|
- "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
|
|
|
|
# Loki - Log aggregation
|
|
# Access at: http://server-ip:3100
|
|
loki:
|
|
image: grafana/loki:2.9.3
|
|
container_name: loki
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
ports:
|
|
- "3100:3100"
|
|
volumes:
|
|
- ./config/loki:/etc/loki
|
|
- loki-data:/loki
|
|
command: -config.file=/etc/loki/loki-config.yml
|
|
user: "${PUID:-1000}:${PGID:-1000}"
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Log aggregation system"
|
|
|
|
# Promtail - Log shipper for Loki
|
|
# Ships Docker container logs to Loki
|
|
promtail:
|
|
image: grafana/promtail:2.9.3
|
|
container_name: promtail
|
|
restart: unless-stopped
|
|
networks:
|
|
- monitoring-network
|
|
volumes:
|
|
- ./config/promtail:/etc/promtail
|
|
- /var/log:/var/log:ro
|
|
- /var/lib/docker/containers:/var/lib/docker/containers:ro
|
|
command: -config.file=/etc/promtail/promtail-config.yml
|
|
depends_on:
|
|
- loki
|
|
labels:
|
|
- "homelab.category=monitoring"
|
|
- "homelab.description=Log collector for Loki"
|
|
|
|
volumes:
|
|
prometheus-data:
|
|
driver: local
|
|
grafana-data:
|
|
driver: local
|
|
uptime-kuma-data:
|
|
driver: local
|
|
loki-data:
|
|
driver: local
|
|
|
|
networks:
|
|
monitoring-network:
|
|
driver: bridge
|
|
homelab-network:
|
|
external: true
|
|
traefik-network:
|
|
external: true
|