configure prometheus for ubiquiti and proxmox cluster

boilerplates/monitoring/compose.yaml

@@ -1,105 +1,138 @@
----
 # ------------------------------------------------------------------------------
 # FILE: boilerplates/monitoring/compose.yaml
-# DESCRIPTION: Combined Prometheus + Grafana + Alertmanager + Node Exporter
-#              stack for cinderella-castle (10.1.71.31)
-#
-# Generated from:
-#   boilerplates/prometheus/compose.yaml (prom/prometheus:v3.9.1)
-#   boilerplates/grafana/compose.yaml    (grafana/grafana-oss:12.3.3)
-#
-# Prometheus TSDB on dedicated second disk mounted at /var/lib/prometheus.
-# Grafana data on named Docker volume.
+# DESCRIPTION: Monitoring stack — Prometheus, Grafana, Alertmanager,
+#              Node Exporter, PVE Exporter, Pure FA Exporter
 # ------------------------------------------------------------------------------
 
-services:
-
-  prometheus:
-    image: docker.io/prom/prometheus:v3.9.1
-    container_name: prometheus
-    restart: unless-stopped
-    user: "65534:65534"
-    command:
-      - --config.file=/etc/prometheus/prometheus.yaml
-      - --storage.tsdb.path=/prometheus
-      - --storage.tsdb.retention.time=${PROMETHEUS_RETENTION_TIME:-15d}
-      - --storage.tsdb.retention.size=${PROMETHEUS_RETENTION_SIZE:-58GB}
-      - --web.enable-lifecycle
-    ports:
-      - "127.0.0.1:9090:9090"
-    volumes:
-      - /opt/docker/monitoring/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
-      - /var/lib/prometheus:/prometheus
-    networks:
-      - monitoring
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-
-  grafana:
-    image: docker.io/grafana/grafana-oss:12.3.3
-    container_name: grafana
-    restart: unless-stopped
-    environment:
-      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
-      - GF_SERVER_ROOT_URL=https://grafana.local.mk-labs.cloud
-    ports:
-      - "3000:3000"
-    volumes:
-      - grafana_data:/var/lib/grafana
-      - /opt/docker/monitoring/grafana/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml:ro
-    networks:
-      - monitoring
-    depends_on:
-      prometheus:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
-
-  alertmanager:
-    image: docker.io/prom/alertmanager:latest
-    container_name: alertmanager
-    restart: unless-stopped
-    command:
-      - --config.file=/etc/alertmanager/alertmanager.yml
-      - --storage.path=/alertmanager
-    ports:
-      - "127.0.0.1:9093:9093"
-    volumes:
-      - /opt/docker/monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
-      - alertmanager_data:/alertmanager
-    networks:
-      - monitoring
-
-  node-exporter:
-    image: docker.io/prom/node-exporter:latest
-    container_name: node-exporter
-    restart: unless-stopped
-    pid: host
-    command:
-      - --path.rootfs=/host
-    ports:
-      - "9100:9100"
-    volumes:
-      - /:/host:ro,rslave
-    networks:
-      - monitoring
-
 networks:
   monitoring:
     driver: bridge
-    name: monitoring
 
 volumes:
+  prometheus_data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: /var/lib/prometheus
   grafana_data:
     driver: local
   alertmanager_data:
     driver: local
+
+services:
+
+  # ----------------------------------------------------------------------------
+  # Prometheus
+  # ----------------------------------------------------------------------------
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    restart: unless-stopped
+    command:
+      - --config.file=/etc/prometheus/prometheus.yaml
+      - --storage.tsdb.path=/prometheus
+      - --storage.tsdb.retention.time=30d
+      - --web.enable-lifecycle
+    volumes:
+      - /opt/docker/monitoring/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
+      - prometheus_data:/prometheus
+    ports:
+      - "9090:9090"
+    networks:
+      - monitoring
+
+  # ----------------------------------------------------------------------------
+  # Grafana
+  # ----------------------------------------------------------------------------
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    environment:
+      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
+      - GF_USERS_ALLOW_SIGN_UP=false
+      - GF_SERVER_ROOT_URL=https://grafana.local.mk-labs.cloud
+      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
+      - TRUSTED_PROXIES=10.1.71.35
+    volumes:
+      - grafana_data:/var/lib/grafana
+    ports:
+      - "3000:3000"
+    networks:
+      - monitoring
+    depends_on:
+      - prometheus
+
+  # ----------------------------------------------------------------------------
+  # Alertmanager
+  # ----------------------------------------------------------------------------
+  alertmanager:
+    image: prom/alertmanager:latest
+    container_name: alertmanager
+    restart: unless-stopped
+    volumes:
+      - /opt/docker/monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
+      - alertmanager_data:/alertmanager
+    ports:
+      - "9093:9093"
+    networks:
+      - monitoring
+
+  # ----------------------------------------------------------------------------
+  # Node Exporter
+  # ----------------------------------------------------------------------------
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: node-exporter
+    restart: unless-stopped
+    command:
+      - --path.rootfs=/host
+    pid: host
+    volumes:
+      - /:/host:ro,rslave
+    ports:
+      - "9100:9100"
+    networks:
+      - monitoring
+
+  # ----------------------------------------------------------------------------
+  # Proxmox VE Exporter
+  # Scrapes the Proxmox API and exposes cluster/node/VM metrics for Prometheus.
+  # Credentials are mounted from pve.yml (rendered from vault).
+  # ----------------------------------------------------------------------------
+  pve-exporter:
+    image: prompve/prometheus-pve-exporter:latest
+    container_name: pve-exporter
+    restart: unless-stopped
+    volumes:
+      - /opt/docker/monitoring/pve-exporter/pve.yml:/etc/prometheus/pve.yml:ro
+    ports:
+      - "9221:9221"
+    networks:
+      - monitoring
+
+
+  # ----------------------------------------------------------------------------
+  # SNMP Exporter
+  # Scrapes UniFi switches and UPS Tower via SNMP v2c.
+  # snmp.yml is rendered from vault and mounted read-only.
+  # ----------------------------------------------------------------------------
+  snmp-exporter:
+    image: prom/snmp-exporter:latest
+    container_name: snmp-exporter
+    restart: unless-stopped
+    volumes:
+      - /opt/docker/monitoring/snmp-exporter/snmp.yml:/etc/snmp_exporter/snmp.yml:ro
+    # network_mode: host is required so the container can route to VLANs
+    # (192.168.1.0/24) that are reachable from the host but not the Docker bridge.
+    # Port mapping and networks are incompatible with host networking.
+    network_mode: host
+  # ----------------------------------------------------------------------------
+  # Pure Storage FlashArray Exporter -- DEFERRED
+  # utilidor is on Purity 6.5.x; legacy exporter image is no longer publicly
+  # available on Quay. Once utilidor reaches Purity 6.7+, no container is
+  # needed -- Prometheus scrapes the native OpenMetrics endpoint directly.
+  # See prometheus.yaml.j2 for the commented-out scrape job to re-enable.
+  # ----------------------------------------------------------------------------