pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
87 lines
2.7 KiB
Django/Jinja
87 lines
2.7 KiB
Django/Jinja
services:
|
|
prometheus:
|
|
image: {{ prometheus_image }}
|
|
container_name: prometheus
|
|
restart: unless-stopped
|
|
command:
|
|
- --config.file=/etc/prometheus/prometheus.yml
|
|
- --storage.tsdb.path=/prometheus
|
|
- --storage.tsdb.retention.time={{ prometheus_retention }}
|
|
- --web.enable-lifecycle
|
|
volumes:
|
|
- {{ prometheus_data_dir }}/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
- {{ prometheus_data_dir }}/data:/prometheus
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.http.routers.prometheus.rule: "Host(`{{ prometheus_host }}`)"
|
|
traefik.http.routers.prometheus.entrypoints: websecure
|
|
traefik.http.routers.prometheus.tls.certresolver: cloudflare
|
|
traefik.http.services.prometheus.loadbalancer.server.port: "9090"
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
grafana:
|
|
image: {{ grafana_image }}
|
|
container_name: grafana
|
|
restart: unless-stopped
|
|
environment:
|
|
GF_SECURITY_ADMIN_PASSWORD: {{ grafana_admin_password }}
|
|
GF_SERVER_ROOT_URL: "https://{{ grafana_host }}"
|
|
GF_SERVER_DOMAIN: "{{ grafana_host }}"
|
|
volumes:
|
|
- {{ grafana_data_dir }}:/var/lib/grafana
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.http.routers.grafana.rule: "Host(`{{ grafana_host }}`)"
|
|
traefik.http.routers.grafana.entrypoints: websecure
|
|
traefik.http.routers.grafana.tls.certresolver: cloudflare
|
|
traefik.http.services.grafana.loadbalancer.server.port: "3000"
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
alertmanager:
|
|
image: {{ alertmanager_image }}
|
|
container_name: alertmanager
|
|
restart: unless-stopped
|
|
command:
|
|
- --config.file=/etc/alertmanager/alertmanager.yml
|
|
volumes:
|
|
- {{ alertmanager_data_dir }}/config/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.http.routers.alertmanager.rule: "Host(`{{ alertmanager_host }}`)"
|
|
traefik.http.routers.alertmanager.entrypoints: websecure
|
|
traefik.http.routers.alertmanager.tls.certresolver: cloudflare
|
|
traefik.http.services.alertmanager.loadbalancer.server.port: "9093"
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
node-exporter:
|
|
image: {{ node_exporter_image }}
|
|
container_name: node-exporter
|
|
restart: unless-stopped
|
|
command:
|
|
- --path.rootfs=/host
|
|
volumes:
|
|
- /:/host:ro,rslave
|
|
pid: host
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
cadvisor:
|
|
image: {{ cadvisor_image }}
|
|
container_name: cadvisor
|
|
restart: unless-stopped
|
|
privileged: true
|
|
volumes:
|
|
- /:/rootfs:ro
|
|
- /var/run:/var/run:ro
|
|
- /sys:/sys:ro
|
|
- /var/lib/docker:/var/lib/docker:ro
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
networks:
|
|
{{ docker_network_name }}:
|
|
external: true
|