b0faa0e019
housekeeping 30s, docker_only, отключены дорогие метрики, init:true для reaping healthcheck-wget. На fr1 дало 231%→14% CPU. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
103 lines
3.3 KiB
YAML
103 lines
3.3 KiB
YAML
name: monitoring
|
||
|
||
services:
|
||
prometheus:
|
||
image: prom/prometheus:latest
|
||
container_name: prometheus
|
||
restart: unless-stopped
|
||
command:
|
||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||
- '--storage.tsdb.path=/prometheus'
|
||
- '--storage.tsdb.retention.time=90d'
|
||
- '--web.enable-lifecycle'
|
||
volumes:
|
||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
||
- ./prometheus/targets:/etc/prometheus/targets:ro
|
||
- ./prometheus/rules:/etc/prometheus/rules:ro
|
||
- prometheus_data:/prometheus
|
||
extra_hosts:
|
||
- "host.docker.internal:host-gateway"
|
||
ports:
|
||
- '127.0.0.1:9090:9090'
|
||
networks: [monitoring]
|
||
|
||
alertmanager:
|
||
image: prom/alertmanager:latest
|
||
container_name: alertmanager
|
||
restart: unless-stopped
|
||
volumes:
|
||
- ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
|
||
- ./alertmanager/telegram_token:/etc/alertmanager/telegram_token:ro
|
||
- alertmanager_data:/alertmanager
|
||
ports:
|
||
- '127.0.0.1:9093:9093'
|
||
networks: [monitoring]
|
||
|
||
grafana:
|
||
image: grafana/grafana:latest
|
||
container_name: grafana
|
||
restart: unless-stopped
|
||
environment:
|
||
GF_SECURITY_ADMIN_USER: admin
|
||
GF_SECURITY_ADMIN_PASSWORD: ${GF_ADMIN_PASSWORD:-admin}
|
||
GF_USERS_ALLOW_SIGN_UP: 'false'
|
||
GF_SERVER_ROOT_URL: https://mon.ruzzy.dev
|
||
volumes:
|
||
- grafana_data:/var/lib/grafana
|
||
- ./grafana/provisioning:/etc/grafana/provisioning:ro
|
||
ports:
|
||
- '127.0.0.1:3000:3000'
|
||
networks: [monitoring]
|
||
depends_on: [prometheus]
|
||
|
||
# node-exporter в host-network: видит реальные интерфейсы хоста (eth0, wg0, tun…).
|
||
# Слушает host:9100; доступ ограничен ufw (только docker-сети). Скрейпится через host.docker.internal.
|
||
node-exporter:
|
||
image: prom/node-exporter:latest
|
||
container_name: node-exporter
|
||
network_mode: host
|
||
pid: host
|
||
restart: unless-stopped
|
||
command:
|
||
- '--path.procfs=/host/proc'
|
||
- '--path.sysfs=/host/sys'
|
||
- '--path.rootfs=/rootfs'
|
||
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
|
||
volumes:
|
||
- /proc:/host/proc:ro
|
||
- /sys:/host/sys:ro
|
||
- /:/rootfs:ro
|
||
|
||
cadvisor:
|
||
image: gcr.io/cadvisor/cadvisor:latest
|
||
container_name: cadvisor
|
||
restart: unless-stopped
|
||
# init: true — pid1-reaper, иначе healthcheck-wget копятся зомбями (образ без init)
|
||
init: true
|
||
# Дефолт cadvisor: housekeeping 1s + все метрики → ~2 ядра на 8-ядерном хабе.
|
||
# Реже опрос + только docker-контейнеры + отключены дорогие/ненужные метрики.
|
||
command:
|
||
- '--housekeeping_interval=30s'
|
||
- '--docker_only=true'
|
||
- '--store_container_labels=false'
|
||
- '--disable_metrics=percpu,disk,diskIO,tcp,udp,advtcp,sched,process,hugetlb,referenced_memory,cpu_topology,resctrl'
|
||
privileged: true
|
||
devices:
|
||
- /dev/kmsg
|
||
volumes:
|
||
- /:/rootfs:ro
|
||
- /var/run:/var/run:ro
|
||
- /sys:/sys:ro
|
||
- /var/lib/docker/:/var/lib/docker:ro
|
||
- /dev/disk/:/dev/disk:ro
|
||
networks: [monitoring]
|
||
|
||
volumes:
|
||
prometheus_data:
|
||
grafana_data:
|
||
alertmanager_data:
|
||
|
||
networks:
|
||
monitoring:
|
||
driver: bridge
|