diff --git a/Caddyfile b/Caddyfile index fd237bd..878fcf4 100644 --- a/Caddyfile +++ b/Caddyfile @@ -1,6 +1,9 @@ # ── Global options ───────────────────────────────────────────────────────────── { debug + servers { + protocols h1 h2 + } } # ── Snippets reutilizables ───────────────────────────────────────────────────── @@ -18,7 +21,7 @@ basic_auth { carlos $2a$14$6MgHKR/jLD..MFkuNo0i1OBs.wwZOntIDiYsYpsyyH./OCKa8SoGS } - @blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 + @blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18 abort @blocked } @@ -45,12 +48,12 @@ uptime.carloselugo.com { } } -# ── Netdata — protegido, info sensible ──────────────────────────────────────── +# ── Grafana — metrics.carloselugo.com ───────────────────────────────────────── metrics.carloselugo.com { import internal_only import security_headers header X-Frame-Options "SAMEORIGIN" - reverse_proxy netdata:19999 + reverse_proxy grafana:3000 encode gzip log { output file /var/log/caddy/metrics.log @@ -58,6 +61,19 @@ metrics.carloselugo.com { } } +# ── Portainer — portainer.carloselugo.com ───────────────────────────────────── +portainer.carloselugo.com { + import internal_only + import security_headers + header X-Frame-Options "SAMEORIGIN" + reverse_proxy portainer:9000 + encode gzip + log { + output file /var/log/caddy/portainer.log + format json + } +} + # ── Umami Analytics ─────────────────────────────────────────────────────────── analytics.carloselugo.com { import security_headers @@ -73,7 +89,7 @@ analytics.carloselugo.com { } handle { - @blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 + @blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18 abort @blocked reverse_proxy umami:3000 } diff --git a/docker-compose.yml b/docker-compose.yml index 6be5343..e861527 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,12 +12,14 @@ services: - ./Caddyfile:/etc/caddy/Caddyfile:ro - caddy_data:/data - caddy_config:/config + - caddy_logs:/var/log/caddy networks: - web-net depends_on: - frontend - ntfy - gitea + - portainer # ─── Frontend ───────────────────────────────────────────────────────────── frontend: @@ -41,73 +43,8 @@ services: - /var/run/docker.sock:/var/run/docker.sock:ro networks: - web-net - cpuset: "0,1" - # ─── Netdata — metrics.carloselugo.com ──────────────────────────────────── - netdata: - image: netdata/netdata:stable - container_name: netdata - restart: unless-stopped - pid: host - cap_add: - - SYS_PTRACE - - SYS_ADMIN - security_opt: - - apparmor:unconfined - environment: - - NETDATA_COLLECTOR_UPDATE_EVERY=5 # reduce polling de 1s → 5s - volumes: - - netdata_config:/etc/netdata - - netdata_lib:/var/lib/netdata - - netdata_cache:/var/cache/netdata - - /etc/passwd:/host/etc/passwd:ro - - /etc/group:/host/etc/group:ro - - /etc/localtime:/etc/localtime:ro - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /etc/os-release:/host/etc/os-release:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - networks: - - web-net - cpuset: "0,1" - cpu_shares: 256 # baja prioridad relativa - - # ─── Umami — DESACTIVADO (liberar RAM/CPU para enshrouded) ──────────────── - # Para reactivar: descomentar umami, umami-db, y el volumen umami_db_data - # umami: - # image: ghcr.io/umami-software/umami:postgresql-latest - # container_name: umami - # restart: unless-stopped - # environment: - # DATABASE_URL: postgresql://umami:umami_password@umami-db:5432/umami - # APP_SECRET: change_this_to_a_random_string_32chars - # depends_on: - # umami-db: - # condition: service_healthy - # networks: - # - web-net - - # umami-db: - # image: postgres:15-alpine - # container_name: umami-db - # restart: unless-stopped - # environment: - # POSTGRES_DB: umami - # POSTGRES_USER: umami - # POSTGRES_PASSWORD: umami_password - # volumes: - # - umami_db_data:/var/lib/postgresql/data - # networks: - # - web-net - # healthcheck: - # test: ["CMD-SHELL", "pg_isready -U umami -d umami"] - # interval: 10s - # timeout: 5s - # retries: 5 - # sysctls: - # - net.ipv6.conf.all.disable_ipv6=1 - - # ─── ntfy — ntfy.carloselugo.com ───────────────────────────────────────────── + # ─── ntfy — ntfy.carloselugo.com ────────────────────────────────────────── ntfy: image: binwiederhier/ntfy container_name: ntfy @@ -159,17 +96,130 @@ services: networks: - web-net + # ─── Portainer — portainer.carloselugo.com ──────────────────────────────── + portainer: + image: portainer/portainer-ce:latest + container_name: portainer + restart: unless-stopped + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + - portainer_data:/data + networks: + - web-net + + # ─── Prometheus — interno, scrape de métricas ───────────────────────────── + prometheus: + image: prom/prometheus:latest + container_name: prometheus + restart: unless-stopped + command: + - "--config.file=/etc/prometheus/prometheus.yml" + - "--storage.tsdb.path=/prometheus" + - "--storage.tsdb.retention.time=15d" + - "--web.enable-lifecycle" + volumes: + - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro + - prometheus_data:/prometheus + networks: + - web-net + depends_on: + - node-exporter + - cadvisor + + # ─── Node Exporter — métricas del host ──────────────────────────────────── + node-exporter: + image: prom/node-exporter:latest + container_name: node-exporter + restart: unless-stopped + pid: host + command: + - "--path.rootfs=/host" + volumes: + - /:/host:ro,rslave + networks: + - web-net + + # ─── cAdvisor — métricas de contenedores ────────────────────────────────── + cadvisor: + image: gcr.io/cadvisor/cadvisor:latest + container_name: cadvisor + restart: unless-stopped + privileged: true + devices: + - /dev/kmsg + volumes: + - /:/rootfs:ro + - /var/run:/var/run:ro + - /sys:/sys:ro + - /var/lib/docker:/var/lib/docker:ro + - /dev/disk:/dev/disk:ro + networks: + - web-net + + # ─── Grafana — metrics.carloselugo.com ──────────────────────────────────── + grafana: + image: grafana/grafana:latest + container_name: grafana + restart: unless-stopped + environment: + - GF_SECURITY_ADMIN_USER=carlos + - GF_SECURITY_ADMIN_PASSWORD=L1b3rty@1 + - GF_USERS_ALLOW_SIGN_UP=false + - GF_SERVER_ROOT_URL=https://metrics.carloselugo.com + volumes: + - grafana_data:/var/lib/grafana + networks: + - web-net + depends_on: + - prometheus + + # ─── Umami Analytics — DESACTIVADO ──────────────────────────────────────── + # Para reactivar: descomentar umami, umami-db, y el volumen umami_db_data + # umami: + # image: ghcr.io/umami-software/umami:postgresql-latest + # container_name: umami + # restart: unless-stopped + # environment: + # DATABASE_URL: postgresql://umami:umami_password@umami-db:5432/umami + # APP_SECRET: change_this_to_a_random_string_32chars + # depends_on: + # umami-db: + # condition: service_healthy + # networks: + # - web-net + + # umami-db: + # image: postgres:15-alpine + # container_name: umami-db + # restart: unless-stopped + # environment: + # POSTGRES_DB: umami + # POSTGRES_USER: umami + # POSTGRES_PASSWORD: umami_password + # volumes: + # - umami_db_data:/var/lib/postgresql/data + # networks: + # - web-net + # healthcheck: + # test: ["CMD-SHELL", "pg_isready -U umami -d umami"] + # interval: 10s + # timeout: 5s + # retries: 5 + # sysctls: + # - net.ipv6.conf.all.disable_ipv6=1 + volumes: caddy_data: caddy_config: + caddy_logs: uptime_data: - netdata_config: - netdata_lib: - netdata_cache: - # umami_db_data: # descomentar si reactivas umami ntfy_cache: gitea_data: + portainer_data: + prometheus_data: + grafana_data: + # umami_db_data: networks: web-net: - driver: bridge + driver: bridge \ No newline at end of file diff --git a/prometheus/prometheus.yml b/prometheus/prometheus.yml new file mode 100644 index 0000000..5e76f24 --- /dev/null +++ b/prometheus/prometheus.yml @@ -0,0 +1,16 @@ +global: + scrape_interval: 15s + evaluation_interval: 15s + +scrape_configs: + - job_name: "prometheus" + static_configs: + - targets: ["localhost:9090"] + + - job_name: "node-exporter" + static_configs: + - targets: ["node-exporter:9100"] + + - job_name: "cadvisor" + static_configs: + - targets: ["cadvisor:8080"]