services:
  loki:
    # This pin and the TSDB v13 on-disk format were validated on Fedora 44 in
    # the 02-tekhnohim logging stack. Do not replace it with :latest during
    # the data migration.
    image: grafana/loki:3.7.2
    container_name: loki
    command: -config.file=/etc/loki/config.yaml
    restart: unless-stopped
    volumes:
      - /mnt/containers/logging/loki-config/config.yaml:/etc/loki/config.yaml:ro,Z
      - /mnt/containers/logging/loki-data:/loki:Z
    ports:
      # Retained for the existing operator query path.
      - "3100:3100/tcp"
    networks:
      - logging-nw

  syslog-ng:
    # DEPOT's RouterOS fleet includes senders that omit the PRI/header Alloy's
    # strict parser requires. Keep the proven normalizer, pinned by digest,
    # and relay canonical RFC5424 to Alloy.
    image: balabit/syslog-ng@sha256:ce85e1af17daf888c72267b19f7f104bf329044257564b784ff8c00ce4fc01ef
    container_name: syslog-ng
    command: -edv
    restart: unless-stopped
    depends_on:
      - alloy
    volumes:
      - /mnt/containers/logging/syslog-ng-config/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf:ro,Z
    ports:
      # Existing fleet target: 185.108.4.158:514/udp.
      - "514:514/udp"
      # Preserve the old stack's TCP syslog endpoint.
      - "601:601/tcp"
    networks:
      - logging-nw

  alloy:
    # Replaces Promtail. syslog-ng normalizes the mixed/raw fleet input into
    # RFC5424 before sending it to Alloy on the private stack network.
    image: grafana/alloy:v1.16.1
    container_name: alloy
    command:
      - run
      - --server.http.listen-addr=0.0.0.0:12345
      - --storage.path=/var/lib/alloy/data
      - /etc/alloy/config.alloy
    restart: unless-stopped
    depends_on:
      - loki
    volumes:
      - /mnt/containers/logging/alloy-config/config.alloy:/etc/alloy/config.alloy:ro,Z
      - /mnt/containers/logging/alloy-data:/var/lib/alloy/data:Z
    networks:
      - logging-nw

  grafana:
    image: grafana/grafana:13.1.0
    container_name: grafana
    restart: unless-stopped
    depends_on:
      - loki
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      # Install the same Zabbix datasource version used by client 02.
      GF_PLUGINS_PREINSTALL_SYNC: alexanderzobnin-zabbix-app@6.5.0
      # Used only by the provisioned Zabbix datasource; set as a Portainer
      # secret/environment value and never commit the token.
      ZABBIX_API_TOKEN: ${ZABBIX_API_TOKEN}
    volumes:
      - /mnt/containers/logging/grafana-data:/var/lib/grafana:Z
      - /mnt/containers/logging/grafana-config/provisioning/datasources:/etc/grafana/provisioning/datasources:ro,Z
      - /mnt/containers/logging/grafana-config/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro,Z
      - /mnt/containers/logging/grafana-config/dashboards:/var/lib/grafana/dashboards:ro,Z
    ports:
      # Retained for the current LAN/operator access path.
      - "3000:3000/tcp"
    networks:
      - logging-nw

networks:
  logging-nw: