---
version: "3.8"

services:
  app:
    image: grafana/alloy:v1.18.1
    hostname: "${DOMAIN}"
    configs:
      - source: config_alloy
        target: /etc/alloy/config.alloy
    volumes:
      - /:/rootfs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      # long-form avoids toolshed/abra#900
      - type: bind
        source: "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}"
        target: /run/containerd/containerd.sock
        read_only: true
      - alloy-data:/var/lib/alloy/data
    # runs through a shell so ALLOY_HTTP_LISTEN_ADDR (set by
    # compose.alloy-webui.yml) is resolved from the container's own
    # environment at startup, not by compose at deploy time.
    # $$ escapes it from compose's own interpolation
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >-
        exec alloy run
        --storage.path=/var/lib/alloy/data
        --server.http.listen-addr=$${ALLOY_HTTP_LISTEN_ADDR:-127.0.0.1}:12345
        /etc/alloy/config.alloy
    networks:
      - proxy
      - internal
    environment:
      - SCRAPE_BASIC_AUTH_USERNAME=${SCRAPE_BASIC_AUTH_USERNAME:-alloy}
      - WRITE_BASIC_AUTH_USERNAME=${WRITE_BASIC_AUTH_USERNAME:-admin}
      - LIVE_DEBUGGING=${LIVE_DEBUGGING:-false}
      - NODE_ID={{.Node.ID}}
    secrets:
      - basic_auth
    # no wget/curl in this image; bash's /dev/tcp is used instead. Works
    # against localhost regardless of ALLOY_HTTP_LISTEN_ADDR
    healthcheck:
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/localhost/12345 && printf 'GET /-/ready HTTP/1.0\r\nHost: localhost\r\n\r\n' >&3 && head -1 <&3 | grep -q 200"]
      interval: 5s
      timeout: 10s
      retries: 3
      start_period: 10s
    deploy:
      restart_policy:
        condition: on-failure
      labels:
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
        - "coop-cloud.${STACK_NAME}.version=2.0.0+v1.18.1"
configs:
  config_alloy:
    template_driver: golang
    name: ${STACK_NAME}_config_alloy_${CONFIG_ALLOY_VERSION}
    file: config.alloy.tmpl
networks:
  proxy:
    external: true
  internal:
volumes:
  alloy-data:
secrets:
  basic_auth:
    external: true
    name: ${STACK_NAME}_basic_auth_${SECRET_BASIC_AUTH_VERSION}