# Working docker-compose.yml for monitoring stack on CT 141
# Deployed 2026-07-05. Contains fixes for all pitfalls encountered.
#
# Fixes applied vs. initial draft:
# - prometheus: user: root (avoids permission denied on config files)
# - pve-exporter: config mounted to /etc/prometheus/pve.yml (hardcoded path)
# - telegram-bridge: custom Flask app, not third-party image (none reliable found)
# - All config dirs: chmod 644 on host before compose up

services:
  prometheus:
    image: prom/prometheus:v3.2.1
    container_name: prometheus
    restart: unless-stopped
    user: root                          # FIX: avoid permission denied on config
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./prometheus/rules:/etc/prometheus/rules:ro
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana-oss:11.5.2
    container_name: grafana
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=changeme
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    ports:
      - "3000:3000"

  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: alertmanager
    restart: unless-stopped
    volumes:
      - ./alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
    ports:
      - "9093:9093"

  blackbox:
    image: prom/blackbox-exporter:v0.26.0
    container_name: blackbox
    restart: unless-stopped
    volumes:
      - ./blackbox/blackbox.yml:/etc/blackbox_exporter/config.yml:ro
    ports:
      - "9115:9115"

  pve-exporter:
    image: prompve/prometheus-pve-exporter:latest
    container_name: pve-exporter
    restart: unless-stopped
    environment:
      - PVE_EXPORTER_CONFIG=/etc/prometheus/pve.yml
    volumes:
      # FIX: mount to /etc/prometheus/pve.yml — binary hardcodes this path
      - ./pve-exporter/pve-exporter.yml:/etc/prometheus/pve.yml:ro
    ports:
      - "9221:9221"

  telegram-bridge:
    build: ./telegram-bridge
    container_name: telegram-bridge
    restart: unless-stopped
    env_file: .env
    # ⚠️ .env must contain TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID.
    # If using inline environment: instead, do NOT leave values empty —
    # the bridge will accept webhooks (HTTP 200) but silently fail to
    # send to Telegram. Check `docker logs telegram-bridge` for
    # "Chat ID:" showing empty if misconfigured.
    ports:
      - "9099:9099"

volumes:
  prometheus-data:
  grafana-data: