docker-compose.community.yml

# =============================================================================
# Acropolis — Community Edition Services
# =============================================================================
# Includes: Portainer CE, pgAdmin 4, Grafana OSS, Prometheus, Loki, Alloy,
#           cAdvisor, node-exporter
# =============================================================================

services:

  # ── Portainer CE — Container Management ───────────────────────────────────
  portainer:
    container_name: acropolis-portainer
    image: portainer/portainer-ce:2.25.1
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    networks:
      - acropolis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAIN:-acumenus.net}`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
      - "traefik.http.services.portainer.loadbalancer.serversTransport=insecureTransport@file"
    healthcheck:
      test: ["CMD", "/docker", "container", "top", "acropolis-portainer"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ── pgAdmin 4 — Database Administration ──────────────────────────────────
  pgadmin:
    container_name: acropolis-pgadmin
    image: dpage/pgadmin4:9
    restart: unless-stopped
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@acumenus.net}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:-changeme}
      PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION: "True"
      PGADMIN_SERVER_JSON_FILE: /pgadmin4/servers.json
    volumes:
      - pgadmin_data:/var/lib/pgadmin
      - ./config/pgadmin/servers.json:/pgadmin4/servers.json:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - acropolis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin.rule=Host(`pgadmin.${DOMAIN:-acumenus.net}`)"
      - "traefik.http.routers.pgadmin.entrypoints=websecure"
      - "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
      - "traefik.http.services.pgadmin.loadbalancer.server.port=80"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/misc/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ── Grafana OSS — Dashboards & Visualization ─────────────────────────────
  grafana:
    container_name: acropolis-grafana
    image: grafana/grafana:11.4.0
    restart: unless-stopped
    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=${GRAFANA_ANONYMOUS:-false}
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer
      - GF_SERVER_ROOT_URL=https://grafana.${DOMAIN:-acumenus.net}
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
      - GF_INSTALL_PLUGINS=${GRAFANA_PLUGINS:-}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
    networks:
      - acropolis
    depends_on:
      - prometheus
      - loki
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN:-acumenus.net}`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ── Prometheus — Metrics Collection ──────────────────────────────────────
  prometheus:
    container_name: acropolis-prometheus
    image: prom/prometheus:v3.1.0
    restart: unless-stopped
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-15d}'
      - '--web.enable-lifecycle'
    volumes:
      - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - acropolis
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:9090/-/healthy || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ── Loki — Log Aggregation ───────────────────────────────────────────────
  loki:
    container_name: acropolis-loki
    image: grafana/loki:3.0.0
    restart: unless-stopped
    command: -config.file=/etc/loki/loki-config.yml
    volumes:
      - ./monitoring/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
      - loki_data:/loki
    networks:
      - acropolis
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3100/ready || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ── Alloy — Log Collector (Grafana Agent successor) ──────────────────────
  alloy:
    container_name: acropolis-alloy
    image: grafana/alloy:v1.8.0
    restart: unless-stopped
    command:
      - run
      - /etc/alloy/config.alloy
      - --server.http.listen-addr=0.0.0.0:12345
      - --storage.path=/var/lib/alloy/data
    volumes:
      - ./monitoring/alloy/config.alloy:/etc/alloy/config.alloy:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log/apache2:/var/log/apache2:ro
      - /var/log/postgresql:/var/log/postgresql:ro
      - alloy_data:/var/lib/alloy/data
    networks:
      - acropolis
    depends_on:
      - loki
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/12345 && printf \"GET /ready HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n\" >&3 && timeout 5 cat <&3 | head -1 | grep -q 200'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # ── cAdvisor — Container Metrics ─────────────────────────────────────────
  cadvisor:
    container_name: acropolis-cadvisor
    image: gcr.io/cadvisor/cadvisor:v0.51.0
    restart: unless-stopped
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - acropolis
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/healthz || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ── Node Exporter — Host Metrics ─────────────────────────────────────────
  node-exporter:
    container_name: acropolis-node-exporter
    image: prom/node-exporter:v1.8.2
    restart: unless-stopped
    network_mode: host
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:9100/metrics || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

volumes:
  portainer_data:
  pgadmin_data:
  grafana_data:
  prometheus_data:
  loki_data:
  alloy_data:

networks:
  acropolis:
    external: true
    name: acropolis_network