swarmprom.yml

version: "3.3"

networks:
  # the dedicated network of this stack
  net:
    driver: overlay
    attachable: true
  # the network of the global traefik proxy
  traefik-public:
    external: true

volumes:
    prometheus: {}
    grafana: {}
    alertmanager: {}

configs:
  dockerd_config:
    file: ./swarmprom/dockerd-exporter/Caddyfile
  node_rules:
    file: ./swarmprom/prometheus/rules/swarm_node.rules.yml
  task_rules:
    file: ./swarmprom/prometheus/rules/swarm_task.rules.yml

services:

  # dockerd-exporter (Docker daemon metrics collector, requires Docker experimental metrics-addr to be enabled)
  dockerd-exporter:
    image: stefanprodan/caddy
    networks:
      - net
    environment:
      - DOCKER_GWBRIDGE_IP=172.18.0.1
    configs:
      - source: dockerd_config
        target: /etc/caddy/Caddyfile
    deploy:
      mode: global
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M

  # cadvisor (containers metrics collector)
  cadvisor:
    image: google/cadvisor
    networks:
      - net
    command: -logtostderr -docker_only
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /:/rootfs:ro
      - /var/run:/var/run
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    deploy:
      mode: global
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M

  # grafana (visualize metrics) http://<swarm-ip>:3000
  grafana:
    image: stefanprodan/swarmprom-grafana:5.3.4
    networks:
      - default
      - net
      - $TRAEFIK_NETWORK
    environment:
      - GF_SECURITY_ADMIN_USER=${ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=https://grafana.${UI_DOMAIN}
      - GF_SMTP_ENABLED=${GF_SMTP_ENABLED:-true}
      - GF_SMTP_HOST=${GF_SMTP_HOST:-smtp:25}
      #- GF_SMTP_FROM_ADDRESS=${GF_SMTP_FROM_ADDRESS:-grafana@test.com}
      #- GF_SMTP_FROM_NAME=${GF_SMTP_FROM_NAME:-Grafana}
      #- GF_SMTP_USER=${GF_SMTP_USER}
      #- GF_SMTP_PASSWORD=${GF_SMTP_PASSWORD}
    volumes:
      - grafana:/var/lib/grafana
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=${TRAEFIK_NETWORK}"
        - "traefik.http.routers.grafana.rule=Host(`grafana.${UI_DOMAIN?Variable UI_DOMAIN not set}`)"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"
        - "traefik.http.routers.grafana.entryPoints=web, websecure"
        - "traefik.http.routers.grafana.tls=true"
        - "traefik.http.routers.grafana.middlewares=IpWhiteList"
        - "traefik.http.middlewares.IpWhiteList.ipwhitelist.sourcerange=${COMMON_IP_WHITELIST}"
        #- "traefik.http.middlewares.auth.basicauth.users=${USERNAME?Variable USERNAME not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}"

  smtp:
    image: namshi/smtp
    networks:
      - default

  # alertmanager (alerts dispatcher) http://<swarm-ip>:9093
  alertmanager:
    image: stefanprodan/swarmprom-alertmanager:v0.14.0
    networks:
      - default
      - net
      - $TRAEFIK_NETWORK
    environment:
      - SLACK_URL=${SLACK_URL:-https://hooks.slack.com/services/TOKEN}
      - SLACK_CHANNEL=${SLACK_CHANNEL:-general}
      - SLACK_USER=${SLACK_USER:-alertmanager}
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    volumes:
      - alertmanager:/alertmanager
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=${TRAEFIK_NETWORK}"
        - "traefik.http.routers.alertmanager.rule=Host(`alertmanager.${UI_DOMAIN?Variable UI_DOMAIN not set}`)"
        - "traefik.http.services.alertmanager.loadbalancer.server.port=9093"
        - "traefik.http.routers.alertmanager.entryPoints=web, websecure"
        - "traefik.http.routers.alertmanager.tls=true"
        - "traefik.http.routers.alertmanager.middlewares=IpWhiteList, auth"
        - "traefik.http.middlewares.IpWhiteList.ipwhitelist.sourcerange=${COMMON_IP_WHITELIST}"
        - "traefik.http.middlewares.auth.basicauth.users=${USERNAME?Variable USERNAME not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}"

  # unsee (alert manager dashboard) http://<swarm-ip>:9094
  unsee:
    image: cloudflare/unsee:v0.8.0
    networks:
      - default
      - net
      - $TRAEFIK_NETWORK
    environment:
      - "ALERTMANAGER_URIS=default:http://alertmanager:9093"
    deploy:
      mode: replicated
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=${TRAEFIK_NETWORK}"
        - "traefik.http.routers.unsee.rule=Host(`unsee.${UI_DOMAIN?Variable UI_DOMAIN not set}`)"
        - "traefik.http.services.unsee.loadbalancer.server.port=8080"
        - "traefik.http.routers.unsee.entryPoints=web, websecure"
        - "traefik.http.routers.unsee.tls=true"
        - "traefik.http.routers.unsee.middlewares=IpWhiteList, auth"
        - "traefik.http.middlewares.IpWhiteList.ipwhitelist.sourcerange=${COMMON_IP_WHITELIST}"
        - "traefik.http.middlewares.auth.basicauth.users=${USERNAME?Variable USERNAME not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}"

  # node-exporter (host metrics collector)
  node-exporter:
    image: stefanprodan/swarmprom-node-exporter:v0.16.0
    networks:
      - net
    environment:
      - NODE_ID={{.Node.ID}}
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
      - /etc/hostname:/etc/nodename
    command:
      - '--path.sysfs=/host/sys'
      - '--path.procfs=/host/proc'
      - '--collector.textfile.directory=/etc/node-exporter/'
      - '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)'
      - '--no-collector.ipvs'
    deploy:
      mode: global
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M

  # prometheus (metrics database) http://<swarm-ip>:9090
  prometheus:
    image: stefanprodan/swarmprom-prometheus:v2.5.0
    networks:
      - default
      - net
      - $TRAEFIK_NETWORK
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention=${PROMETHEUS_RETENTION:-24h}'
    volumes:
      - prometheus:/prometheus
    configs:
      - source: node_rules
        target: /etc/prometheus/swarm_node.rules.yml
      - source: task_rules
        target: /etc/prometheus/swarm_task.rules.yml
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          memory: 2048M
        reservations:
          memory: 128M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=${TRAEFIK_NETWORK}"
        - "traefik.http.routers.prometheus.rule=Host(`prometheus.${UI_DOMAIN?Variable UI_DOMAIN not set}`)"
        - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
        - "traefik.http.routers.prometheus.entryPoints=web, websecure"
        - "traefik.http.routers.prometheus.tls=true"
        - "traefik.http.routers.prometheus.middlewares=IpWhiteList, auth"
        - "traefik.http.middlewares.IpWhiteList.ipwhitelist.sourcerange=${COMMON_IP_WHITELIST}"
        - "traefik.http.middlewares.auth.basicauth.users=${USERNAME?Variable USERNAME not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}"