services:
  grafana:
    image: grafana/grafana:12.4.3@sha256:2e986801428cd689c2358605289c90ab37d2b39e24808874971f54c99bcdc412
    container_name: grafana
    restart: unless-stopped
    user: "0"
    environment:
      GF_SERVER_ROOT_URL: https://grafana.kaleschke.info/
      GF_SECURITY_ADMIN_PASSWORD__FILE: /run/secrets/grafana_admin_password
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
    dns:
      - 1.1.1.1
      - 8.8.8.8
    entrypoint:
      - /bin/sh
      - -c
      - |
        export GRAFANA_INFLUXDB_TOKEN="$$(cat /run/secrets/grafana_influxdb_token)"
        exec /run.sh
    volumes:
      - /mnt/user/appdata/grafana:/var/lib/grafana
      - /mnt/user/appdata/grafana/provisioning:/etc/grafana/provisioning:ro
    secrets:
      - grafana_admin_password
      - grafana_influxdb_token
    networks:
      - frontend_net
      - backend_net
      - grafana_influx_internal
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.grafana.rule=Host(`grafana.kaleschke.info`)
      - traefik.http.routers.grafana.entrypoints=websecure
      - traefik.http.routers.grafana.tls=true
      - traefik.http.routers.grafana.tls.certresolver=le
      - traefik.http.routers.grafana.middlewares=authelia@file,secure-headers@file
      - traefik.http.services.grafana.loadbalancer.server.port=3000

  influxdb3-core:
    image: influxdb:3.9.1-core@sha256:1d58c8b9ac90153ae3a020ede2810c8284933dda50ac71e7573389ab6f012128
    container_name: influxdb3-core
    restart: unless-stopped
    user: "0"
    ports:
      - "${INFLUXDB_BIND_IP:-127.0.0.1}:8181:8181"
    command:
      - influxdb3
      - serve
      - --node-id=kallilabcore
      - --object-store=file
      - --data-dir=/var/lib/influxdb3/data
      - --plugin-dir=/var/lib/influxdb3/plugins
      - --admin-token-file=/run/secrets/influxdb3_admin_token
    volumes:
      - /mnt/user/appdata/influxdb3/data:/var/lib/influxdb3/data
      - /mnt/user/appdata/influxdb3/plugins:/var/lib/influxdb3/plugins
    secrets:
      - influxdb3_admin_token
    networks:
      - grafana_influx_lan
      - grafana_influx_internal
    security_opt:
      - no-new-privileges:true

secrets:
  grafana_admin_password:
    file: /mnt/user/appdata/secrets/grafana_admin_password.txt
  influxdb3_admin_token:
    file: /mnt/user/appdata/secrets/influxdb3_admin_token.json
  grafana_influxdb_token:
    file: /mnt/user/appdata/secrets/grafana_influxdb_token.txt

networks:
  frontend_net:
    external: true
  backend_net:
    external: true
  grafana_influx_lan:
    driver: bridge
  grafana_influx_internal:
    internal: true