name: roster-observability

services:
  otel-collector:
    image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-contrib:0.156.0
    command: ["--config=/etc/otelcol/config.yaml"]
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    tmpfs: [/tmp]
    volumes:
      - ./otel-collector.local.yaml:/etc/otelcol/config.yaml:ro
    ports:
      - "127.0.0.1:4317:4317"
      - "127.0.0.1:4318:4318"
    depends_on:
      - tempo
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:v3.12.0-distroless
    command:
      - --config.file=/etc/prometheus/prometheus.yaml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=7d
      - --web.enable-lifecycle
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    volumes:
      - ./prometheus.local.yaml:/etc/prometheus/prometheus.yaml:ro
      - ./prometheus-recording-rules.yaml:/etc/prometheus/rules/roster-recording-rules.yaml:ro
      - prometheus-data:/prometheus
    ports:
      - "127.0.0.1:9090:9090"
    depends_on:
      - otel-collector
    restart: unless-stopped

  tempo:
    image: grafana/tempo:2.10.5
    command: ["-config.file=/etc/tempo/config.yaml"]
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    volumes:
      - ./tempo.local.yaml:/etc/tempo/config.yaml:ro
      - tempo-data:/var/tempo
    ports:
      - "127.0.0.1:3200:3200"
    restart: unless-stopped

  grafana:
    image: grafana/grafana:13.1.0
    environment:
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SECURITY_ADMIN_PASSWORD: ${ROSTER_GRAFANA_ADMIN_PASSWORD:-roster-local-only}
      GF_SECURITY_ADMIN_USER: admin
      GF_USERS_ALLOW_SIGN_UP: "false"
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    volumes:
      - ./grafana-dashboard.json:/var/lib/grafana/dashboards/roster.json:ro
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "127.0.0.1:3001:3000"
    depends_on:
      - prometheus
      - tempo
    restart: unless-stopped

volumes:
  grafana-data:
  prometheus-data:
  tempo-data: