feat: add Prometheus + Grafana + Portainer, remove Netdata

- Replace Netdata with Prometheus + Node Exporter + cAdvisor + Grafana
- Add Portainer CE for container management
- metrics.carloselugo.com now serves Grafana
- portainer.carloselugo.com added behind internal_only snippet
- Prometheus internal only, no public port exposed
- Retention: 15d
- Dashboards: Node Exporter Full (1860), cAdvisor (14282)

Caddyfile

@@ -1,6 +1,9 @@
 # ── Global options ─────────────────────────────────────────────────────────────
 {
 	debug
+	servers {
+		protocols h1 h2
+	}
 }
 
 # ── Snippets reutilizables ─────────────────────────────────────────────────────
@@ -18,7 +21,7 @@
 	basic_auth {
 		carlos $2a$14$6MgHKR/jLD..MFkuNo0i1OBs.wwZOntIDiYsYpsyyH./OCKa8SoGS
 	}
-	@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+	@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18
 	abort @blocked
 }
 
@@ -45,12 +48,12 @@ uptime.carloselugo.com {
 	}
 }
 
-# ── Netdata — protegido, info sensible ────────────────────────────────────────
+# ── Grafana — metrics.carloselugo.com ─────────────────────────────────────────
 metrics.carloselugo.com {
 	import internal_only
 	import security_headers
 	header X-Frame-Options "SAMEORIGIN"
-	reverse_proxy netdata:19999
+	reverse_proxy grafana:3000
 	encode gzip
 	log {
 		output file /var/log/caddy/metrics.log
@@ -58,6 +61,19 @@ metrics.carloselugo.com {
 	}
 }
 
+# ── Portainer — portainer.carloselugo.com ─────────────────────────────────────
+portainer.carloselugo.com {
+	import internal_only
+	import security_headers
+	header X-Frame-Options "SAMEORIGIN"
+	reverse_proxy portainer:9000
+	encode gzip
+	log {
+		output file /var/log/caddy/portainer.log
+		format json
+	}
+}
+
 # ── Umami Analytics ───────────────────────────────────────────────────────────
 analytics.carloselugo.com {
 	import security_headers
@@ -73,7 +89,7 @@ analytics.carloselugo.com {
 	}
 
 	handle {
-		@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+		@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32 165.225.192.0/18
 		abort @blocked
 		reverse_proxy umami:3000
 	}

docker-compose.yml

@@ -12,12 +12,14 @@ services:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy_data:/data
       - caddy_config:/config
+      - caddy_logs:/var/log/caddy
     networks:
       - web-net
     depends_on:
       - frontend
       - ntfy
       - gitea
+      - portainer
 
   # ─── Frontend ─────────────────────────────────────────────────────────────
   frontend:
@@ -41,73 +43,8 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     networks:
       - web-net
-    cpuset: "0,1"
 
-  # ─── Netdata — metrics.carloselugo.com ────────────────────────────────────
+  # ─── ntfy — ntfy.carloselugo.com ──────────────────────────────────────────
-  netdata:
-    image: netdata/netdata:stable
-    container_name: netdata
-    restart: unless-stopped
-    pid: host
-    cap_add:
-      - SYS_PTRACE
-      - SYS_ADMIN
-    security_opt:
-      - apparmor:unconfined
-    environment:
-      - NETDATA_COLLECTOR_UPDATE_EVERY=5   # reduce polling de 1s → 5s
-    volumes:
-      - netdata_config:/etc/netdata
-      - netdata_lib:/var/lib/netdata
-      - netdata_cache:/var/cache/netdata
-      - /etc/passwd:/host/etc/passwd:ro
-      - /etc/group:/host/etc/group:ro
-      - /etc/localtime:/etc/localtime:ro
-      - /proc:/host/proc:ro
-      - /sys:/host/sys:ro
-      - /etc/os-release:/host/etc/os-release:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - web-net
-    cpuset: "0,1"
-    cpu_shares: 256   # baja prioridad relativa
-
-  # ─── Umami — DESACTIVADO (liberar RAM/CPU para enshrouded) ────────────────
-  # Para reactivar: descomentar umami, umami-db, y el volumen umami_db_data
-  # umami:
-  #   image: ghcr.io/umami-software/umami:postgresql-latest
-  #   container_name: umami
-  #   restart: unless-stopped
-  #   environment:
-  #     DATABASE_URL: postgresql://umami:umami_password@umami-db:5432/umami
-  #     APP_SECRET: change_this_to_a_random_string_32chars
-  #   depends_on:
-  #     umami-db:
-  #       condition: service_healthy
-  #   networks:
-  #     - web-net
-
-  # umami-db:
-  #   image: postgres:15-alpine
-  #   container_name: umami-db
-  #   restart: unless-stopped
-  #   environment:
-  #     POSTGRES_DB: umami
-  #     POSTGRES_USER: umami
-  #     POSTGRES_PASSWORD: umami_password
-  #   volumes:
-  #     - umami_db_data:/var/lib/postgresql/data
-  #   networks:
-  #     - web-net
-  #   healthcheck:
-  #     test: ["CMD-SHELL", "pg_isready -U umami -d umami"]
-  #     interval: 10s
-  #     timeout: 5s
-  #     retries: 5
-  #   sysctls:
-  #     - net.ipv6.conf.all.disable_ipv6=1
-
-  # ─── ntfy — ntfy.carloselugo.com ─────────────────────────────────────────────
   ntfy:
     image: binwiederhier/ntfy
     container_name: ntfy
@@ -159,16 +96,129 @@ services:
     networks:
       - web-net
 
+  # ─── Portainer — portainer.carloselugo.com ────────────────────────────────
+  portainer:
+    image: portainer/portainer-ce:latest
+    container_name: portainer
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - portainer_data:/data
+    networks:
+      - web-net
+
+  # ─── Prometheus — interno, scrape de métricas ─────────────────────────────
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yml"
+      - "--storage.tsdb.path=/prometheus"
+      - "--storage.tsdb.retention.time=15d"
+      - "--web.enable-lifecycle"
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus_data:/prometheus
+    networks:
+      - web-net
+    depends_on:
+      - node-exporter
+      - cadvisor
+
+  # ─── Node Exporter — métricas del host ────────────────────────────────────
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: node-exporter
+    restart: unless-stopped
+    pid: host
+    command:
+      - "--path.rootfs=/host"
+    volumes:
+      - /:/host:ro,rslave
+    networks:
+      - web-net
+
+  # ─── cAdvisor — métricas de contenedores ──────────────────────────────────
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: cadvisor
+    restart: unless-stopped
+    privileged: true
+    devices:
+      - /dev/kmsg
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker:/var/lib/docker:ro
+      - /dev/disk:/dev/disk:ro
+    networks:
+      - web-net
+
+  # ─── Grafana — metrics.carloselugo.com ────────────────────────────────────
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    environment:
+      - GF_SECURITY_ADMIN_USER=carlos
+      - GF_SECURITY_ADMIN_PASSWORD=L1b3rty@1
+      - GF_USERS_ALLOW_SIGN_UP=false
+      - GF_SERVER_ROOT_URL=https://metrics.carloselugo.com
+    volumes:
+      - grafana_data:/var/lib/grafana
+    networks:
+      - web-net
+    depends_on:
+      - prometheus
+
+  # ─── Umami Analytics — DESACTIVADO ────────────────────────────────────────
+  # Para reactivar: descomentar umami, umami-db, y el volumen umami_db_data
+  # umami:
+  #   image: ghcr.io/umami-software/umami:postgresql-latest
+  #   container_name: umami
+  #   restart: unless-stopped
+  #   environment:
+  #     DATABASE_URL: postgresql://umami:umami_password@umami-db:5432/umami
+  #     APP_SECRET: change_this_to_a_random_string_32chars
+  #   depends_on:
+  #     umami-db:
+  #       condition: service_healthy
+  #   networks:
+  #     - web-net
+
+  # umami-db:
+  #   image: postgres:15-alpine
+  #   container_name: umami-db
+  #   restart: unless-stopped
+  #   environment:
+  #     POSTGRES_DB: umami
+  #     POSTGRES_USER: umami
+  #     POSTGRES_PASSWORD: umami_password
+  #   volumes:
+  #     - umami_db_data:/var/lib/postgresql/data
+  #   networks:
+  #     - web-net
+  #   healthcheck:
+  #     test: ["CMD-SHELL", "pg_isready -U umami -d umami"]
+  #     interval: 10s
+  #     timeout: 5s
+  #     retries: 5
+  #   sysctls:
+  #     - net.ipv6.conf.all.disable_ipv6=1
+
 volumes:
   caddy_data:
   caddy_config:
+  caddy_logs:
   uptime_data:
-  netdata_config:
-  netdata_lib:
-  netdata_cache:
-  # umami_db_data:   # descomentar si reactivas umami
   ntfy_cache:
   gitea_data:
+  portainer_data:
+  prometheus_data:
+  grafana_data:
+  # umami_db_data:
 
 networks:
   web-net:

prometheus/prometheus.yml

@@ -0,0 +1,16 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: "prometheus"
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  - job_name: "node-exporter"
+    static_configs:
+      - targets: ["node-exporter:9100"]
+
+  - job_name: "cadvisor"
+    static_configs:
+      - targets: ["cadvisor:8080"]