fix: shorter secret name toolshed/abra#867

.env.sample

@@ -9,18 +9,10 @@ SECRET_BASIC_AUTH_VERSION=v1
 # Enable this to send logs to a Loki server, adapt DOMAIN if server is
 # remote
 # LOKI_PUSH_URL=https://loki.$DOMAIN/loki/api/v1/push
-# Enable on systemd hosts to read logs from the journal
+# Enable this on SystemD hosts to read logs
 # JOURNALD=1
-#
-# Enable on non-systemd hosts (Alpine, older Debian/Ubuntu) to tail
-# /var/log/*log files (syslog, auth.log, kern.log, etc.) that a local
-# syslogd writes. No syslogd reconfiguration needed.
-# SYSLOG_FILES=1
-#
-# Enable to receive syslog messages over the network on port 514/tcp.
-# Use for remote devices that push syslog to this host, or for a 
-# local syslogd configured to forward over the network.
-# Not needed if you just want to read local log files — use SYSLOG_FILES instead.
+# Enable this on syslogd hosts and configure the syslogd to send logs to
+# Alloy on port 514/tcp
 # SYSLOG=1
 # COMPOSE_FILE="$COMPOSE_FILE:compose.syslog.yml"
 
@@ -96,3 +88,9 @@ SECRET_BASIC_AUTH_VERSION=v1
 #ALERT_BACKUP_NOT_SUCCESSFULL_ENABLED=true
 #ALERT_NODE_DISK_SPACE_ENABLED=true
 #ALERT_NODE_MEMORY_USAGE_ENABLED=true
+
+# Garage metrics
+# SECRET_GARAGE_METRICS_TOKEN_VERSION=v1
+# GARAGE_METRICS_HOSTNAME=
+# GARAGE_INSECURE_SKIP_VERIFY=false
+# COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"

compose.garage.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    secrets:
+      - garage_token
+secrets:
+  garage_token:
+    external: true
+    name: ${STACK_NAME}_garage_token_${SECRET_GARAGE_METRICS_TOKEN_VERSION}

compose.yml

@@ -10,14 +10,15 @@ services:
         target: /etc/alloy/config.alloy
     volumes:
       - /:/rootfs:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/run:/var/run:rw
+      - /var/run/docker.sock:/var/run/docker.sock
       - /sys:/sys:ro
       - /var/lib/docker:/var/lib/docker:ro
+      - /dev:/dev:ro
       - alloy-data:/var/lib/alloy/data
     command:
       - "run"
       - "--storage.path=/var/lib/alloy/data"
-      - "--server.http.listen-addr=127.0.0.1:12345"
       - "/etc/alloy/config.alloy"
     networks:
       - internal

config.alloy.tmpl

@@ -9,35 +9,19 @@ discovery.docker "linux" {
 
 {{ if ne (env "PROMETHEUS_REMOTE_WRITE_URL") "" }}
 prometheus.exporter.cadvisor "docker" {
-  docker_only = true
-  enabled_metrics = ["cpu", "cpuLoad", "disk", "diskIO", "memory", "network", "process"]
 }
 
 prometheus.exporter.unix "default" {
   include_exporter_metrics = true
   rootfs_path = "/rootfs"
-  procfs_path = "/rootfs/proc"
-  sysfs_path = "/rootfs/sys"
-
-  disable_collectors = ["ipvs"]
-
-  filesystem {
-    fs_types_exclude     = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|tmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
-    mount_points_exclude = "^/(sys|proc|dev|host|etc)($|/)"
-    mount_timeout        = "5s"
-  }
-
-  netclass { ignored_devices = "^(veth.*)$" }
-  netdev   { device_exclude  = "^(veth.*)$" }
 }
 
-prometheus.exporter.self "alloy" {}
-
 prometheus.scrape "default" {
-  scrape_interval = "120s"
-
   targets = array.concat(
-    prometheus.exporter.self.alloy.targets,
+    [{
+      job         = "alloy",
+      __address__ = "127.0.0.1:12345",
+    }],
     prometheus.exporter.unix.default.targets,
     prometheus.exporter.cadvisor.docker.targets,
   )
@@ -45,6 +29,21 @@ prometheus.scrape "default" {
   forward_to = [prometheus.remote_write.prometheus.receiver]
 }
 
+{{ if ne (env "GARAGE_METRICS_HOSTNAME") "" }}
+prometheus.scrape "garage" {
+  bearer_token = "{{ secret "garage_token" }}"
+  job_name = "garage"
+  scheme = "https"
+
+  targets = [{ __address__ = "{{ env "GARAGE_METRICS_HOSTNAME" }}:443" }]
+  forward_to = [prometheus.remote_write.prometheus.receiver]
+
+  tls_config {
+    insecure_skip_verify = {{ env "GARAGE_INSECURE_SKIP_VERIFY" }}
+  }
+}
+{{ end }}
+
 prometheus.remote_write "prometheus" {
   endpoint {
     url = "{{ env "PROMETHEUS_REMOTE_WRITE_URL" }}"
@@ -55,160 +54,24 @@ prometheus.remote_write "prometheus" {
     }
   }
 }
-
-// Scrape Prometheus metrics from other containers on this host.
-// Containers opt in via Docker labels:
-//   prometheus.io/scrape=true        required: enable scraping
-//   prometheus.io/port=9090          optional: port exposing /metrics (defaults to first exposed port)
-//   prometheus.io/path=/metrics      optional: path to metrics endpoint (default: /metrics)
-//   prometheus.io/auth=basic         optional: use basic auth with the shared basic_auth secret
-//
-// Uses docker_gwbridge — the host-local bridge network Docker attaches all
-// Swarm containers to for outbound connectivity. Alloy can reach any container
-// on the same host via this network without needing to join each stack's
-// overlay network.
-discovery.docker "containers" {
-  host                = "unix:///var/run/docker.sock"
-  match_first_network = false
-}
-
-discovery.relabel "metrics" {
-  targets = discovery.docker.containers.targets
-
-  rule {
-    source_labels = ["__meta_docker_network_name"]
-    regex         = "docker_gwbridge"
-    action        = "keep"
-  }
-
-  rule {
-    source_labels = ["__meta_docker_container_label_prometheus_io_scrape"]
-    regex         = "true"
-    action        = "keep"
-  }
-
-  rule {
-    source_labels = ["__address__", "__meta_docker_container_label_prometheus_io_port"]
-    regex         = `(.+):\d+;(\d+)`
-    target_label  = "__address__"
-    replacement   = "$1:$2"
-  }
-
-  rule {
-    source_labels = ["__meta_docker_container_label_prometheus_io_path"]
-    regex         = `(.+)`
-    target_label  = "__metrics_path__"
-  }
-
-  rule {
-    source_labels = ["__meta_docker_container_label_com_docker_swarm_service_name"]
-    target_label  = "job"
-  }
-}
-
-discovery.relabel "metrics_noauth" {
-  targets = discovery.relabel.metrics.output
-  rule {
-    source_labels = ["__meta_docker_container_label_prometheus_io_auth"]
-    regex         = "^$"
-    action        = "keep"
-  }
-}
-
-discovery.relabel "metrics_basicauth" {
-  targets = discovery.relabel.metrics.output
-  rule {
-    source_labels = ["__meta_docker_container_label_prometheus_io_auth"]
-    regex         = "basic"
-    action        = "keep"
-  }
-}
-
-prometheus.scrape "containers" {
-  scrape_interval = "120s"
-  targets         = discovery.relabel.metrics_noauth.output
-  forward_to      = [prometheus.remote_write.prometheus.receiver]
-}
-
-prometheus.scrape "containers_basicauth" {
-  scrape_interval = "120s"
-  targets         = discovery.relabel.metrics_basicauth.output
-  forward_to      = [prometheus.remote_write.prometheus.receiver]
-  basic_auth {
-    username = "admin"
-    password = "{{ secret "basic_auth" }}"
-  }
-}
 {{ end }}
 
 {{ if ne (env "LOKI_PUSH_URL") "" }}
-discovery.relabel "docker" {
-  targets = discovery.docker.linux.targets
-
-  rule {
-    source_labels = ["__meta_docker_container_name"]
-    target_label  = "container_name"
-  }
-  rule {
-    source_labels = ["__meta_docker_container_id"]
-    target_label  = "container_id"
-  }
-  rule {
-    source_labels = ["__meta_docker_container_label_com_docker_stack_namespace"]
-    target_label  = "stack_namespace"
-  }
-  rule {
-    source_labels = ["__meta_docker_container_label_com_docker_swarm_service_name"]
-    target_label  = "service_name"
-  }
-  rule {
-    source_labels = ["__meta_docker_container_log_stream"]
-    target_label  = "stream"
-  }
-}
-
 loki.source.docker "docker" {
   host       = "unix:///var/run/docker.sock"
-  targets    = discovery.relabel.docker.output
+  targets    = discovery.docker.linux.targets
   labels     = {"app" = "docker"}
   forward_to = [loki.write.loki.receiver]
 }
 
-// JOURNALD: reads the systemd journal binary log directly.
-// Use on systemd hosts (most modern Linux distros). Requires no syslogd.
 {{ if eq (env "JOURNALD") "1" }}
 loki.source.journal "journal" {
-  path = "/rootfs/var/log/journal"
+  path = "/var/log/journal"
   labels = { job = "{{ env "DOMAIN" }}" }
   forward_to = [loki.write.loki.receiver]
 }
 {{ end }}
 
-// SYSLOG_FILES: tails all /var/log/*log files (syslog, auth.log, kern.log, etc.).
-// Use on non-systemd hosts where a syslogd writes to /var/log.
-{{ if eq (env "SYSLOG_FILES") "1" }}
-local.file_match "syslog_files" {
-  path_targets = [{ __path__ = "/rootfs/var/log/*log" }]
-}
-
-loki.source.file "syslog_files" {
-  targets    = local.file_match.syslog_files.targets
-  forward_to = [loki.process.syslog_files.receiver]
-}
-
-loki.process "syslog_files" {
-  stage.static_labels {
-    values = { job = "syslog" }
-  }
-  forward_to = [loki.write.loki.receiver]
-}
-{{ end }}
-
-// SYSLOG: opens a network syslog listener on port 514.
-// Use when a remote device or a local syslogd configured to 
-// forward over the network sends logs to this host.
-// Requires compose.syslog.yml to publish port 514 to the host.
-// This is NOT needed for reading local log files — use SYSLOG_FILES instead.
 {{ if eq (env "SYSLOG") "1" }}
 loki.relabel "syslog" {
   rule {
@@ -221,7 +84,7 @@ loki.relabel "syslog" {
 
 loki.source.syslog "syslog" {
   listener {
-    address = "[::]:514"
+    address = "[::1]:514"
     label_structured_data = true
     labels = { component = "loki.source.syslog" }
   }
@@ -240,6 +103,5 @@ loki.write "loki" {
       password = "{{ secret "basic_auth" }}"
     }
   }
-  external_labels = { hostname = "{{ env "DOMAIN" }}" }
 }
 {{ end }}