fix: read only access

Reviewed-on: #50
Reviewed-by: fauno <fauno@sutty.coop.ar>

.env.sample

@@ -153,10 +153,3 @@ SECRET_BASIC_AUTH_VERSION=v1
 
 # Traefik apdex alert will trigger when the apdex score of a service drops below the given number. Services receiving fewer than 10 requests per 10m are ignored
 #ALERT_TRAEFIK_APDEX=0.5
-
-# Tell Traefik to keep access logs (could be very verbose). See Access
-# logs on Traefik recipe.
-#ALLOY_ACCESS_LOGS=true
-#PROMETHEUS_ACCESS_LOGS=true
-#LOKI_ACCESS_LOGS=true
-#GRAFANA_ACCESS_LOGS=true

abra.sh

@@ -10,9 +10,8 @@ export PROMETHEUS_YML_VERSION=v2
 export MATRIX_ALERTMANAGER_CONFIG_VERSION=v1
 export MATRIX_ALERTMANAGER_ENTRYPOINT_VERSION=v1
 export GF_ALERTS_NODE_VERSION=v5
-export GF_ALERTS_TRAEFIK_VERSION=v1
 export GF_ALERTS_LOKI_VERSION=v5
-export CONFIG_ALLOY_VERSION=v11
+export CONFIG_ALLOY_VERSION=v3
 
 # migrates secrets from old names to new names by reading values from the
 # running containers on the server and re-inserting them under the new names.

compose.alloy-webui.yml

@@ -14,4 +14,3 @@ services:
         - "traefik.http.routers.${STACK_NAME}-alloy.tls=true"
         - "traefik.http.routers.${STACK_NAME}-alloy.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}-alloy.middlewares=basicauth@file"
-        - "traefik.http.routers.${STACK_NAME}-alloy.observability.accesslogs=${ALLOY_ACCESS_LOGS:-false}"

compose.grafana.yml

@@ -47,11 +47,10 @@ services:
         - "traefik.enable=true"
         - "traefik.swarm.network=proxy"
         - "traefik.http.services.${STACK_NAME}-grafana.loadbalancer.server.port=3000"
-        - "traefik.http.routers.${STACK_NAME}-grafana.rule=Host(`${DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}-grafana.rule=Host(`${GRAFANA_DOMAIN:-$DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}-grafana.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}-grafana.tls=true"
         - "traefik.http.routers.${STACK_NAME}-grafana.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.http.routers.${STACK_NAME}-grafana.observability.accesslogs=${GRAFANA_ACCESS_LOGS:-false}"
     healthcheck:
       test: "wget -q http://localhost:3000/healthz -O/dev/null"
       interval: 5s

compose.loki.yml

@@ -42,7 +42,6 @@ services:
         - "traefik.http.routers.${STACK_NAME}-loki.tls=true"
         - "traefik.http.routers.${STACK_NAME}-loki.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}-loki.middlewares=basicauth@file"
-        - "traefik.http.routers.${STACK_NAME}-loki.observability.accesslogs=${LOKI_ACCESS_LOGS:-false}"
         - "prometheus.io/scrape=true"
         - "prometheus.io/port=3100"
 

compose.prometheus.yml

@@ -28,7 +28,7 @@ services:
       start_period: 30s
     deploy:
       restart_policy:
-        condition: unless-stopped
+        condition: any
       labels:
         - "traefik.enable=true"
         - "traefik.swarm.network=proxy"
@@ -38,7 +38,6 @@ services:
         - "traefik.http.routers.${STACK_NAME}-prometheus.tls=true"
         - "traefik.http.routers.${STACK_NAME}-prometheus.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}-prometheus.middlewares=basicauth@file"
-        - "traefik.http.routers.${STACK_NAME}-prometheus.observability.accesslogs=${PROMETHEUS_ACCESS_LOGS:-false}"
 
 configs:
   prometheus_yml:

compose.smartctl.yml

@@ -5,9 +5,9 @@ services:
     image: "prometheuscommunity/smartctl-exporter:v0.15.0"
     volumes:
     - "/var/lib/smartmontools/json:/debug"
+    - "/dev:/dev:ro"
     command:
     - "--smartctl.fake-data"
-    - "--smartctl.interval=1h"
     networks:
     - "proxy"
     deploy:

compose.yml

@@ -50,10 +50,10 @@ services:
       start_period: 30s
     deploy:
       restart_policy:
-        condition: unless-stopped
+        condition: any
       labels:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
-        - "coop-cloud.${STACK_NAME}.version=2.3.0+v1.20.1"
+        - "coop-cloud.${STACK_NAME}.version=2.3.0+v1.21.3"
 configs:
   config_alloy:
     template_driver: golang

release/2.3.0+v1.21.3

@@ -1,2 +1,2 @@
 - opt-in migration of Loki's index store from deprecated boltdb-shipper to TSDB via LOKI_TSDB_FROM_DATE
-- alloy and prometheus containers restart policy from on-failure to unless-stopped
+- alloy and prometheus containers restart policy from on-failure to any