homelab/docker-compose/monitoring-grafana-promethues-cadvisor-node-exporter/docker-compose.yml

services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    ports:
      - "9090:9090"                    # keep for now
    volumes:
      - ./prometheus:/etc/prometheus:ro
      - ./data/prometheus:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.enable-lifecycle"
    networks:
      - monitoring
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"
      - "traefik.http.routers.prometheus.rule=Host(`prometheus.home.server`)"
      - "traefik.http.routers.prometheus.entrypoints=websecure"
      - "traefik.http.routers.prometheus.tls=true"
      - "traefik.http.routers.prometheus.service=prometheus"
      - "traefik.http.routers.prometheus.middlewares=security-headers@file"
      - "traefik.http.routers.prometheus-http.rule=Host(`prometheus.home.server`)"
      - "traefik.http.routers.prometheus-http.entrypoints=web"
      - "traefik.http.routers.prometheus-http.middlewares=redirect-to-https@file"
      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "3000:3000"
    env_file:
      - .env
    environment:
      - GF_SMTP_ENABLED=true
      - GF_SMTP_HOST=smtp.gmail.com:587
      - GF_SMTP_USER=${GMAIL_SMTP_USER}
      - GF_SMTP_PASSWORD=${GMAIL_APP_PASSWORD}
      - GF_SMTP_FROM_ADDRESS=${GMAIL_SMTP_USER}
      - GF_SMTP_FROM_NAME=Grafana Alerts
    volumes:
      - ./grafana/data:/var/lib/grafana
      - ./grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./grafana/provisioning/alerting:/etc/grafana/provisioning/alerting:ro
    networks:
      - monitoring
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"
      - "traefik.http.routers.grafana.rule=Host(`grafana.home.server`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.routers.grafana.service=grafana"
      - "traefik.http.routers.grafana.middlewares=security-headers@file"
      - "traefik.http.routers.grafana-http.rule=Host(`grafana.home.server`)"
      - "traefik.http.routers.grafana-http.entrypoints=web"
      - "traefik.http.routers.grafana-http.middlewares=redirect-to-https@file"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

  node_exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - monitoring
    # no Traefik labels – no web UI needed

  cadvisor:
    image: ghcr.io/google/cadvisor:latest
    container_name: cadvisor
    restart: unless-stopped
    ports:
      - "8080:8080"                    # keep for now
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    networks:
      - monitoring
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"
      - "traefik.http.routers.cadvisor.rule=Host(`cadvisor.home.server`)"
      - "traefik.http.routers.cadvisor.entrypoints=websecure"
      - "traefik.http.routers.cadvisor.tls=true"
      - "traefik.http.routers.cadvisor.service=cadvisor"
      - "traefik.http.routers.cadvisor.middlewares=security-headers@file"
      - "traefik.http.routers.cadvisor-http.rule=Host(`cadvisor.home.server`)"
      - "traefik.http.routers.cadvisor-http.entrypoints=web"
      - "traefik.http.routers.cadvisor-http.middlewares=redirect-to-https@file"
      - "traefik.http.services.cadvisor.loadbalancer.server.port=8080"

  loki:
    image: grafana/loki:3.7.3
    container_name: loki
    restart: unless-stopped
    command: -config.file=/etc/loki/local-config.yaml
    ports:
      - "3100:3100"
    volumes:
      - ./loki/local-config.yaml:/etc/loki/local-config.yaml:ro
      - ./data/loki:/loki
    mem_limit: 400m
    cpus: 1
    networks:
      - monitoring
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"
      - "traefik.http.routers.loki.rule=Host(`loki.home.server`)"
      - "traefik.http.routers.loki.entrypoints=websecure"
      - "traefik.http.routers.loki.tls=true"
      - "traefik.http.routers.loki.service=loki"
      - "traefik.http.routers.loki.middlewares=security-headers@file"
      - "traefik.http.routers.loki-http.rule=Host(`loki.home.server`)"
      - "traefik.http.routers.loki-http.entrypoints=web"
      - "traefik.http.routers.loki-http.middlewares=redirect-to-https@file"
      - "traefik.http.services.loki.loadbalancer.server.port=3100"

  alloy:
    image: grafana/alloy:v1.17.1
    container_name: alloy
    restart: unless-stopped
    command:
      - "run"
      - "--server.http.listen-addr=0.0.0.0:12345"
      - "--storage.path=/var/lib/alloy/data"
      - "/etc/alloy/config.alloy"
    ports:
      - "12345:12345"
    volumes:
      - ./alloy/config.alloy:/etc/alloy/config.alloy:ro
      - ./alloy/k3s-token:/etc/alloy/k3s-token:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/alloy:/var/lib/alloy/data
    mem_limit: 300m
    cpus: 0.5
    depends_on:
      - loki
    networks:
      - monitoring
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"
      - "traefik.http.routers.alloy.rule=Host(`alloy.home.server`)"
      - "traefik.http.routers.alloy.entrypoints=websecure"
      - "traefik.http.routers.alloy.tls=true"
      - "traefik.http.routers.alloy.service=alloy"
      - "traefik.http.routers.alloy.middlewares=security-headers@file"
      - "traefik.http.routers.alloy-http.rule=Host(`alloy.home.server`)"
      - "traefik.http.routers.alloy-http.entrypoints=web"
      - "traefik.http.routers.alloy-http.middlewares=redirect-to-https@file"
      - "traefik.http.services.alloy.loadbalancer.server.port=12345"

networks:
  monitoring:
    driver: bridge
  web_net:
    external: true