Add logging stack: Loki + Alloy + Grafana for router/switch/phone syslog

Alloy receives syslog on 514/udp and 1514/tcp from network devices, forwards to a local Loki instance; Grafana provisioned with Loki as default datasource. Compose bind-mounts config from /mnt/containers/logging/... on the host (staged separately) since Portainer's GitOps pull only fetches the compose file, not the repo's other files.
2026-07-15 11:41:00 +03:00
parent c3589732f2
commit 22dfb732d3
4 changed files with 176 additions and 0 deletions
@@ -0,0 +1,56 @@
+version: '3.8'
+
+services:
+  loki:
+    image: grafana/loki:latest
+    container_name: loki
+    command: -config.file=/etc/loki/config.yaml
+    restart: unless-stopped
+    volumes:
+      - /mnt/containers/logging/loki-config/config.yaml:/etc/loki/config.yaml:Z
+      - /mnt/containers/logging/loki-data:/loki:Z
+    networks:
+      - logging-nw
+
+  alloy:
+    image: grafana/alloy:latest
+    container_name: alloy
+    command:
+      - run
+      - --server.http.listen-addr=0.0.0.0:12345
+      - --storage.path=/var/lib/alloy/data
+      - /etc/alloy/config.alloy
+    restart: unless-stopped
+    depends_on:
+      - loki
+    volumes:
+      - /mnt/containers/logging/alloy-config/config.alloy:/etc/alloy/config.alloy:Z
+      - /mnt/containers/logging/alloy-data:/var/lib/alloy/data:Z
+    ports:
+      # syslog intake for routers/switches/phones (UDP, RFC3164/5424)
+      - '514:514/udp'
+      # optional TCP syslog for devices that don't do UDP
+      - '1514:1514/tcp'
+    networks:
+      - logging-nw
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    depends_on:
+      - loki
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
+      - GF_USERS_ALLOW_SIGN_UP=false
+    volumes:
+      - /mnt/containers/logging/grafana-data:/var/lib/grafana:Z
+      - /mnt/containers/logging/grafana-config/provisioning/datasources:/etc/grafana/provisioning/datasources:Z
+    networks:
+      - logging-nw
+      - reverseproxy-nw
+
+networks:
+  logging-nw:
+  reverseproxy-nw:
+    external: true