docker-compose.infrastructure.yml

# docker-compose.infrastructure.yml - Infrastructure Administration
version: '3.8'

services:
  # Prometheus - Metrics Collection
  prometheus:
    image: prom/prometheus:v2.47.0
    container_name: prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus:/etc/prometheus
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
      - '--web.enable-admin-api'
    restart: unless-stopped
    networks:
      - media-vault-network

  # Grafana - Visualization & Dashboards
  grafana:
    image: grafana/grafana:10.1.0
    container_name: grafana
    ports:
      - "3333:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=grafana123
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_INSTALL_PLUGINS=grafana-piechart-panel,grafana-worldmap-panel
      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
      - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=grafana-secret
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://localhost:8443/realms/media-vault/protocol/openid_connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://keycloak:8080/realms/media-vault/protocol/openid_connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=http://keycloak:8080/realms/media-vault/protocol/openid_connect/userinfo
    depends_on:
      - prometheus
      - keycloak
    restart: unless-stopped
    networks:
      - media-vault-network

  # AlertManager - Alert Management
  alertmanager:
    image: prom/alertmanager:v0.26.0
    container_name: alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./monitoring/alertmanager:/etc/alertmanager
      - alertmanager_data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
      - '--web.external-url=http://localhost:9093'
    restart: unless-stopped
    networks:
      - media-vault-network

  # Node Exporter - Host Metrics
  node-exporter:
    image: prom/node-exporter:v1.6.1
    container_name: node-exporter
    ports:
      - "9100:9100"
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    restart: unless-stopped
    networks:
      - media-vault-network

  # cAdvisor - Container Metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.47.2
    container_name: cadvisor
    ports:
      - "8888:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    privileged: true
    devices:
      - /dev/kmsg
    restart: unless-stopped
    networks:
      - media-vault-network

  # Loki - Log Aggregation
  loki:
    image: grafana/loki:2.9.0
    container_name: loki
    ports:
      - "3100:3100"
    volumes:
      - ./monitoring/loki:/etc/loki
      - loki_data:/tmp/loki
    command: -config.file=/etc/loki/loki.yml
    restart: unless-stopped
    networks:
      - media-vault-network

  # Promtail - Log Shipper
  promtail:
    image: grafana/promtail:2.9.0
    container_name: promtail
    volumes:
      - ./monitoring/promtail:/etc/promtail
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    command: -config.file=/etc/promtail/promtail.yml
    depends_on:
      - loki
    restart: unless-stopped
    networks:
      - media-vault-network

  # Jaeger - Distributed Tracing
  jaeger:
    image: jaegertracing/all-in-one:1.49
    container_name: jaeger
    ports:
      - "16686:16686"  # UI
      - "14268:14268"  # HTTP collector
      - "14250:14250"  # gRPC collector
    environment:
      - COLLECTOR_OTLP_ENABLED=true
    volumes:
      - jaeger_data:/badger
    restart: unless-stopped
    networks:
      - media-vault-network

  # Portainer - Docker Management
  portainer:
    image: portainer/portainer-ce:2.19.1
    container_name: portainer
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    restart: unless-stopped
    networks:
      - media-vault-network

  # Traefik - Advanced Load Balancer (alternative to Caddy)
  traefik:
    image: traefik:v3.0
    container_name: traefik
    ports:
      - "8080:8080"  # Dashboard
      - "80:80"      # HTTP
      - "443:443"    # HTTPS
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik:/etc/traefik
      - traefik_data:/data
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.email=admin@mediavault.com
      - --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --metrics.prometheus=true
      - --tracing.jaeger=true
      - --tracing.jaeger.samplingServerURL=http://jaeger:14268/api/sampling
      - --tracing.jaeger.localAgentHostPort=jaeger:6831
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - traefik

  # Redis Commander - Redis Management
  redis-commander:
    image: rediscommander/redis-commander:latest
    container_name: redis-commander
    ports:
      - "8081:8081"
    environment:
      - REDIS_HOSTS=local:redis:6379
    depends_on:
      - redis
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - redis-tools

  # pgAdmin - PostgreSQL Management
  pgadmin:
    image: dpage/pgadmin4:7.6
    container_name: pgadmin
    ports:
      - "5050:80"
    environment:
      - PGADMIN_DEFAULT_EMAIL=admin@mediavault.com
      - PGADMIN_DEFAULT_PASSWORD=pgadmin123
      - PGADMIN_CONFIG_SERVER_MODE=False
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    depends_on:
      - keycloak-db
    restart: unless-stopped
    networks:
      - media-vault-network

  # Watchtower - Auto Updates
  watchtower:
    image: containrrr/watchtower:1.6.0
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_POLL_INTERVAL=86400  # 24 hours
      - WATCHTOWER_INCLUDE_RESTARTING=true
      - WATCHTOWER_NOTIFICATIONS=slack
      - WATCHTOWER_NOTIFICATION_SLACK_HOOK_URL=${SLACK_WEBHOOK_URL}
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - auto-update

  # Backup Service
  backup-service:
    image: alpine:3.18
    container_name: backup-service
    volumes:
      - ./data:/backup-source/data:ro
      - ./uploads:/backup-source/uploads:ro
      - ./backups:/backups
      - ./scripts:/scripts
    environment:
      - BACKUP_SCHEDULE=0 2 * * *  # Daily at 2 AM
      - RETENTION_DAYS=30
      - S3_BUCKET=${S3_BACKUP_BUCKET}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
    command: |
      sh -c "
        apk add --no-cache dcron aws-cli sqlite
        echo '$$BACKUP_SCHEDULE cd /scripts && ./backup.sh' | crontab -
        crond -f
      "
    restart: unless-stopped
    networks:
      - media-vault-network

  # Elasticsearch (for advanced logging)
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.9.1
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
      - "9200:9200"
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - elk

  # Kibana (for log visualization)
  kibana:
    image: docker.elastic.co/kibana/kibana:8.9.1
    container_name: kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - elk

  # FileBeat (log shipping to ELK)
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.9.1
    container_name: filebeat
    user: root
    volumes:
      - ./monitoring/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - elasticsearch
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - elk

  # Nginx Proxy Manager (alternative to Caddy/Traefik)
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:2.10.4
    container_name: nginx-proxy-manager
    ports:
      - "8080:80"    # Admin UI
      - "8443:443"   # HTTPS
      - "8181:81"    # Admin Panel
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt
    restart: unless-stopped
    networks:
      - media-vault-network
    profiles:
      - nginx-proxy

volumes:
  prometheus_data:
  grafana_data:
  alertmanager_data:
  loki_data:
  jaeger_data:
  portainer_data:
  traefik_data:
  pgadmin_data:
  elasticsearch_data:
  npm_data:
  npm_letsencrypt:

networks:
  media-vault-network:
    external: true

---

# monitoring/prometheus/prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "rules/*.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

scrape_configs:
  # Prometheus itself
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

  # Node Exporter
  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']

  # cAdvisor
  - job_name: 'cadvisor'
    static_configs:
      - targets: ['cadvisor:8080']

  # Media Vault API
  - job_name: 'media-vault-api'
    static_configs:
      - targets: ['media-vault-api:8080']
    metrics_path: '/metrics'

  # Keycloak
  - job_name: 'keycloak'
    static_configs:
      - targets: ['keycloak:8080']
    metrics_path: '/metrics'

  # PostgreSQL Exporter
  - job_name: 'postgres'
    static_configs:
      - targets: ['postgres-exporter:9187']

  # Traefik
  - job_name: 'traefik'
    static_configs:
      - targets: ['traefik:8080']

---