# ------------------------------------------------------------------------------
# FILE: boilerplates/monitoring/compose.yaml
# DESCRIPTION: Monitoring stack — Prometheus, Grafana, Alertmanager,
#              Node Exporter, PVE Exporter, Pure FA Exporter
# ------------------------------------------------------------------------------

networks:
  monitoring:
    driver: bridge

volumes:
  prometheus_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /var/lib/prometheus
  grafana_data:
    driver: local
  alertmanager_data:
    driver: local

services:

  # ----------------------------------------------------------------------------
  # Prometheus
  # ----------------------------------------------------------------------------
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yaml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=30d
      - --web.enable-lifecycle
    volumes:
      - /opt/docker/monitoring/prometheus/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - monitoring

  # ----------------------------------------------------------------------------
  # Grafana
  # ----------------------------------------------------------------------------
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=https://grafana.local.mk-labs.cloud
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - TRUSTED_PROXIES=10.1.71.35
    volumes:
      - grafana_data:/var/lib/grafana
    ports:
      - "3000:3000"
    networks:
      - monitoring
    depends_on:
      - prometheus

  # ----------------------------------------------------------------------------
  # Alertmanager
  # ----------------------------------------------------------------------------
  alertmanager:
    image: prom/alertmanager:latest
    container_name: alertmanager
    restart: unless-stopped
    volumes:
      - /opt/docker/monitoring/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - alertmanager_data:/alertmanager
    ports:
      - "9093:9093"
    networks:
      - monitoring

  # ----------------------------------------------------------------------------
  # Node Exporter
  # ----------------------------------------------------------------------------
  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    command:
      - --path.rootfs=/host
    pid: host
    volumes:
      - /:/host:ro,rslave
    ports:
      - "9100:9100"
    networks:
      - monitoring

  # ----------------------------------------------------------------------------
  # Proxmox VE Exporter
  # Scrapes the Proxmox API and exposes cluster/node/VM metrics for Prometheus.
  # Credentials are mounted from pve.yml (rendered from vault).
  # ----------------------------------------------------------------------------
  pve-exporter:
    image: prompve/prometheus-pve-exporter:latest
    container_name: pve-exporter
    restart: unless-stopped
    volumes:
      - /opt/docker/monitoring/pve-exporter/pve.yml:/etc/prometheus/pve.yml:ro
    ports:
      - "9221:9221"
    networks:
      - monitoring


  # ----------------------------------------------------------------------------
  # SNMP Exporter
  # Scrapes UniFi switches and UPS Tower via SNMP v2c.
  # snmp.yml is rendered from vault and mounted read-only.
  # ----------------------------------------------------------------------------
  snmp-exporter:
    image: prom/snmp-exporter:latest
    container_name: snmp-exporter
    restart: unless-stopped
    volumes:
      - /opt/docker/monitoring/snmp-exporter/snmp.yml:/etc/snmp_exporter/snmp.yml:ro
    # network_mode: host is required so the container can route to VLANs
    # (192.168.1.0/24) that are reachable from the host but not the Docker bridge.
    # Port mapping and networks are incompatible with host networking.
    network_mode: host
  # ----------------------------------------------------------------------------
  # Pure Storage FlashArray Exporter -- DEFERRED
  # utilidor is on Purity 6.5.x; legacy exporter image is no longer publicly
  # available on Quay. Once utilidor reaches Purity 6.7+, no container is
  # needed -- Prometheus scrapes the native OpenMetrics endpoint directly.
  # See prometheus.yaml.j2 for the commented-out scrape job to re-enable.
  # ----------------------------------------------------------------------------