compose.yml

name: monitoring

services:
  # VictoriaMetrics single-node: stores metrics
  victoriametrics:
    image: docker.io/victoriametrics/victoria-metrics:v1.139.0
    container_name: victoriametrics
    restart: unless-stopped
    volumes:
      - vmdata:/storage
    command:
      - "--storageDataPath=/storage"
      - "--httpListenAddr=:8428"
      - "--vmalert.proxyURL=http://vmalert:8880"
      - "--retentionPeriod=12"  # 12 months retention
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8428/-/healthy"]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "pangolin.public-resources.victoriametrics.name=VictoriaMetrics"
      - "pangolin.public-resources.victoriametrics.protocol=http"
      - "pangolin.public-resources.victoriametrics.full-domain=victoriametrics.afges.eu"
      - "pangolin.public-resources.victoriametrics.targets[0].method=http"
      - "pangolin.public-resources.victoriametrics.targets[0].hostname=victoriametrics"
      - "pangolin.public-resources.victoriametrics.targets[0].port=8428"
      - "pangolin.public-resources.victoriametrics.targets[0].healthcheck.hostname=victoriametrics"
      - "pangolin.public-resources.victoriametrics.targets[0].healthcheck.port=8428"
      - "pangolin.public-resources.victoriametrics.targets[0].healthcheck.path=/-/healthy"
      - "pangolin.public-resources.victoriametrics.targets[0].healthcheck.status=200"

  # VMAgent: lightweight scraping agent
  vmagent:
    image: docker.io/victoriametrics/vmagent:v1.139.0
    container_name: vmagent
    restart: unless-stopped
    depends_on:
      victoriametrics:
        condition: service_healthy
    volumes:
      - vmagentdata:/vmagentdata
      - ./config/vmagent/scrape.yml:/etc/prometheus/prometheus.yml:z,ro
    command:
      - "--promscrape.config=/etc/prometheus/prometheus.yml"
      - "--remoteWrite.url=http://victoriametrics:8428/api/v1/write"

  # VMAlert: evaluates alerting & recording rules
  vmalert:
    image: docker.io/victoriametrics/vmalert:v1.139.0
    container_name: vmalert
    restart: unless-stopped
    depends_on:
      victoriametrics:
        condition: service_healthy
    volumes:
      - ./config/vmalert/rules:/etc/alerts:z,ro
    command:
      - "--datasource.url=http://victoriametrics:8428/"
      - "--remoteRead.url=http://victoriametrics:8428/"
      - "--remoteWrite.url=http://vmagent:8429/"
      - "--notifier.url=http://alertmanager:9093/"
      - "--rule=/etc/alerts/*.yml"
      - "--external.url=http://grafana:3000"
      - '--external.alert.source=explore?orgId=1&left={"datasource":"VictoriaMetrics","queries":[{"expr":{{.Expr|jsonEscape|queryEscape}},"refId":"A"}],"range":{"from":"{{ .ActiveAt.UnixMilli }}","to":"now"}}'

  # Alertmanager: receives notifications from vmalert
  alertmanager:
    image: docker.io/prom/alertmanager:v0.28.1
    container_name: alertmanager
    restart: unless-stopped
    volumes:
      - ./config/alertmanager/alertmanager.yml:/config/alertmanager.yml:z,ro
      - alertmanagerdata:/alertmanager
    command:
      - "--config.file=/config/alertmanager.yml"
      - "--storage.path=/alertmanager"
    labels:
      - "pangolin.public-resources.alertmanager.name=Alertmanager"
      - "pangolin.public-resources.alertmanager.protocol=http"
      - "pangolin.public-resources.alertmanager.full-domain=alertmanager.afges.eu"
      - "pangolin.public-resources.alertmanager.targets[0].method=http"
      - "pangolin.public-resources.alertmanager.targets[0].hostname=alertmanager"
      - "pangolin.public-resources.alertmanager.targets[0].port=9093"
      - "pangolin.public-resources.alertmanager.targets[0].healthcheck.hostname=alertmanager"
      - "pangolin.public-resources.alertmanager.targets[0].healthcheck.port=9093"
      - "pangolin.public-resources.alertmanager.targets[0].healthcheck.path=/-/healthy"
      - "pangolin.public-resources.alertmanager.targets[0].healthcheck.status=200"

  # PVE Exporter: Proxmox-specific metrics (VM/CT status, storage, etc.)
  pve-exporter:
    image: docker.io/prompve/prometheus-pve-exporter:latest
    container_name: pve-exporter
    restart: unless-stopped
    env_file:
      - env/pve.env

  # Grafana: dashboards and visualization
  grafana:
    image: docker.io/grafana/grafana:12.2.0
    container_name: grafana
    restart: unless-stopped
    depends_on:
      victoriametrics:
        condition: service_healthy
    env_file:
      - env/grafana.env
    volumes:
      - grafanadata:/var/lib/grafana
      - ./config/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:z,ro
      - ./config/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:z,ro
    labels:
      - "pangolin.public-resources.grafana.name=Grafana"
      - "pangolin.public-resources.grafana.protocol=http"
      - "pangolin.public-resources.grafana.full-domain=grafana.afges.eu"
      - "pangolin.public-resources.grafana.targets[0].method=http"
      - "pangolin.public-resources.grafana.targets[0].hostname=grafana"
      - "pangolin.public-resources.grafana.targets[0].port=3000"
      - "pangolin.public-resources.grafana.targets[0].healthcheck.hostname=grafana"
      - "pangolin.public-resources.grafana.targets[0].healthcheck.port=3000"
      - "pangolin.public-resources.grafana.targets[0].healthcheck.path=/api/health"
      - "pangolin.public-resources.grafana.targets[0].healthcheck.status=200"

  # Socket proxy: limits Docker API access for Newt (read-only, CONTAINERS+EVENTS only)
  socket-proxy:
    image: docker.io/tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1
      EVENTS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - socket-proxy

  # Newt: Pangolin tunnel client – exposes services through the Pangolin reverse proxy
  newt:
    image: docker.io/fosrl/newt:latest
    container_name: newt
    restart: unless-stopped
    depends_on:
      - socket-proxy
    env_file:
      - env/newt.env
    environment:
      DOCKER_SOCKET: tcp://socket-proxy:2375
    networks:
      - default
      - socket-proxy

volumes:
  vmdata: {}
  vmagentdata: {}
  grafanadata: {}
  alertmanagerdata: {}

networks:
  default:
    driver: bridge
    name: monitoring
  socket-proxy:
    driver: bridge
    name: monitoring-socket-proxy
    internal: true