DEPOT logging: add Telemt fleet monitoring via Zabbix

Install and persist Grafana Zabbix plugin 6.5.0, provision the internal Zabbix datasource, and add a fleet dashboard modeled on client 02 Telemt panels.

Add an active-agent Zabbix 7 template plus a 30-second sanitized collector for active IP count/list, connections, traffic, and uptime. Active checks avoid inbound polling of client-private Docker hosts.

The exact Zabbix host names and required ZABBIX_API_TOKEN Portainer variable are documented. Compose validation passed on 10.0.0.6; the live plugin registered successfully under Grafana 13.1.0.

logging/docker-compose.yaml

@@ -16,8 +16,29 @@ services:
     networks:
       - logging-nw
 
+  syslog-ng:
+    # DEPOT's RouterOS fleet includes senders that omit the PRI/header Alloy's
+    # strict parser requires. Keep the proven normalizer, pinned by digest,
+    # and relay canonical RFC5424 to Alloy.
+    image: balabit/syslog-ng@sha256:ce85e1af17daf888c72267b19f7f104bf329044257564b784ff8c00ce4fc01ef
+    container_name: syslog-ng
+    command: -edv
+    restart: unless-stopped
+    depends_on:
+      - alloy
+    volumes:
+      - /mnt/containers/logging/syslog-ng-config/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf:ro,Z
+    ports:
+      # Existing fleet target: 185.108.4.158:514/udp.
+      - "514:514/udp"
+      # Preserve the old stack's TCP syslog endpoint.
+      - "601:601/tcp"
+    networks:
+      - logging-nw
+
   alloy:
-    # Replaces the syslog-ng -> Promtail relay with one direct syslog receiver.
+    # Replaces Promtail. syslog-ng normalizes the mixed/raw fleet input into
+    # RFC5424 before sending it to Alloy on the private stack network.
     image: grafana/alloy:v1.16.1
     container_name: alloy
     command:
@@ -31,11 +52,6 @@ services:
     volumes:
       - /mnt/containers/logging/alloy-config/config.alloy:/etc/alloy/config.alloy:ro,Z
       - /mnt/containers/logging/alloy-data:/var/lib/alloy/data:Z
-    ports:
-      # Existing fleet target: 185.108.4.158:514/udp.
-      - "514:514/udp"
-      # Preserve the old stack's TCP syslog endpoint.
-      - "601:601/tcp"
     networks:
       - logging-nw
 
@@ -48,6 +64,11 @@ services:
     environment:
       GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
       GF_USERS_ALLOW_SIGN_UP: "false"
+      # Install the same Zabbix datasource version used by client 02.
+      GF_PLUGINS_PREINSTALL_SYNC: alexanderzobnin-zabbix-app@6.5.0
+      # Used only by the provisioned Zabbix datasource; set as a Portainer
+      # secret/environment value and never commit the token.
+      ZABBIX_API_TOKEN: ${ZABBIX_API_TOKEN}
     volumes:
       - /mnt/containers/logging/grafana-data:/var/lib/grafana:Z
       - /mnt/containers/logging/grafana-config/provisioning/datasources:/etc/grafana/provisioning/datasources:ro,Z