version: '3.8'

services:
  loki:
    # Keep a fixed release for reproducible Portainer redeploys. The 2.9.8 ->
    # 3.7.2 upgrade was validated against a copy of this stack's TSDB v13 data.
    image: grafana/loki:3.7.2
    container_name: loki
    command: -config.file=/etc/loki/config.yaml
    restart: unless-stopped
    volumes:
      - /mnt/containers/logging/loki-config/config.yaml:/etc/loki/config.yaml:Z
      - /mnt/containers/logging/loki-data:/loki:Z
    networks:
      - logging-nw

  alloy:
    # Keep a fixed release for reproducible Portainer redeploys. The current
    # RFC3164 config and an end-to-end Alloy -> Loki probe passed on v1.16.1.
    image: grafana/alloy:v1.16.1
    container_name: alloy
    command:
      - run
      - --server.http.listen-addr=0.0.0.0:12345
      - --storage.path=/var/lib/alloy/data
      - /etc/alloy/config.alloy
    restart: unless-stopped
    depends_on:
      - loki
    volumes:
      - /mnt/containers/logging/alloy-config/config.alloy:/etc/alloy/config.alloy:Z
      - /mnt/containers/logging/alloy-data:/var/lib/alloy/data:Z
    ports:
      # syslog intake for routers/switches/phones (UDP, RFC3164/5424)
      - '514:514/udp'
      # optional TCP syslog for devices that don't do UDP
      - '1514:1514/tcp'
    networks:
      - logging-nw

  grafana:
    # Keep a fixed release for reproducible Portainer redeploys. Grafana 13.1.0
    # is supported by the host's Fedora 44 / kernel 7.1 runtime; the old 10.4.2
    # pin was only required by the retired Fedora 35 / kernel 5.16 host.
    image: grafana/grafana:13.1.0
    container_name: grafana
    restart: unless-stopped
    depends_on:
      - loki
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - /mnt/containers/logging/grafana-data:/var/lib/grafana:Z
      - /mnt/containers/logging/grafana-config/provisioning/datasources:/etc/grafana/provisioning/datasources:Z
      # Dashboard provisioning: the provider config below points at the dashboards
      # dir; both are file-provisioned, so UI edits are not persisted — edit the
      # JSON in git and redeploy.
      - /mnt/containers/logging/grafana-config/provisioning/dashboards:/etc/grafana/provisioning/dashboards:Z
      - /mnt/containers/logging/grafana-config/dashboards:/var/lib/grafana/dashboards:Z
    networks:
      - logging-nw
      - reverseproxy-nw

networks:
  logging-nw:
  reverseproxy-nw:
    external: true