services:
  rendezvous:
    environment:
      Rendezvous__Metrics__Enabled: "true"
    volumes:
      - ../observability/secrets/rendezvous-metrics-token:/run/secrets/rendezvous-metrics-token:ro

  prometheus:
    image: prom/prometheus:v3.13.1@sha256:3c42b892cf723fa54d2f262c37a0e1f80aa8c8ddb1da7b9b0df9455a35a7f893
    user: "65534:65534"
    read_only: true
    init: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 512m
    cpus: 1.0
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=15d
    volumes:
      - ../observability/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ../observability/secrets/rendezvous-metrics-token:/run/secrets/rendezvous-metrics-token:ro
      - prometheus-data:/prometheus
    depends_on:
      - rendezvous

  grafana:
    image: grafana/grafana:13.1.0@sha256:121a7a9ece6dc10b969f1f96eed64b4f07dfac0d0b8abc070f7cb83bbde86f63
    user: "472:472"
    read_only: true
    init: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 512m
    cpus: 1.0
    restart: unless-stopped
    environment:
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_PLUGINS_PREINSTALL_DISABLED: "true"
      GF_PLUGINS_PREINSTALL_AUTO_UPDATE: "false"
      GF_SECURITY_ADMIN_USER: "rendezvous-admin"
      GF_SECURITY_ADMIN_PASSWORD__FILE: /run/secrets/grafana-admin-password
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_SERVER_DOMAIN: localhost
      GF_SERVER_ROOT_URL: http://localhost:3000
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=32m,uid=472,gid=472,mode=0700
    volumes:
      - ../observability/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ../observability/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ../observability/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - ../observability/secrets/grafana-admin-password:/run/secrets/grafana-admin-password:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "127.0.0.1:3000:3000/tcp"
    depends_on:
      - prometheus

volumes:
  prometheus-data:
  grafana-data: