TYPE=monitoring-ng
LETS_ENCRYPT_ENV=production
COMPOSE_FILE=compose.yml
DOMAIN=monitoring-ng.example.com
#TIMEOUT=120
ENABLE_BACKUPS=true

# Secret Alloy authenticates with when writing metrics/logs to Prometheus/
# Loki and what Traefik's basicauth middleware expects for that
SECRET_BASIC_AUTH_VERSION=v1
# Username sent along with SECRET_BASIC_AUTH_VERSION above (default: admin)
# WRITE_BASIC_AUTH_USERNAME=admin

# Expose Alloy's web UI publicly (behind basic-auth) at alloy.$DOMAIN.
# COMPOSE_FILE="$COMPOSE_FILE:compose.alloy-webui.yml"
# Enable Live Debugging in web ui
# LIVE_DEBUGGING=false

# Enable this to send metrics to a Prometheus server, adapt DOMAIN if
# server is remote
# PROMETHEUS_REMOTE_WRITE_URL=https://prometheus.$DOMAIN/api/v1/write

# Enable container filesystem usage metrics (expensive du-scan, ~30% CPU on large hosts)
# CADVISOR_DISK_USAGE=1

# Enable authenticated scraping of containers that opt in via
# prometheus.io/auth=basic or prometheus.io/auth=bearer labels (used as
# password/bearer token respectively). Insert it with:
# abra app secret insert <domain> scrape_auth v1 <password>
# COMPOSE_FILE="$COMPOSE_FILE:compose.scrape-auth.yml"
# SECRET_SCRAPE_AUTH_VERSION=v1
#
# Username sent along with it (default: alloy)
# SCRAPE_BASIC_AUTH_USERNAME=alloy

# Edit this if your distribution sets this socket to another location
# CONTAINERD_SOCKET=/var/run/containerd/containerd.sock

# Enable this to send logs to a Loki server, adapt DOMAIN if server is
# remote
# LOKI_PUSH_URL=https://loki.$DOMAIN/loki/api/v1/push
# Enable on systemd hosts to read logs from the journal
# JOURNALD=1
#
# Enable on non-systemd hosts (Alpine, older Debian/Ubuntu) to tail
# /var/log/*log files (syslog, auth.log, kern.log, etc.) that a local
# syslogd writes. No syslogd reconfiguration needed.
# SYSLOG_FILES=1
#
# Enable to receive syslog messages over the network on port 514/tcp.
# Use for remote devices that push syslog to this host, or for a 
# local syslogd configured to forward over the network.
# Not needed if you just want to read local log files — use SYSLOG_FILES instead.
# SYSLOG=1
# COMPOSE_FILE="$COMPOSE_FILE:compose.syslog.yml"
#
# Scrape Docker-Events via official docker-cli image using docker socket
# COMPOSE_FILE="$COMPOSE_FILE:compose.docker-events.yml"


# Monitoring Server
#
## Prometheus
# COMPOSE_FILE="$COMPOSE_FILE:compose.prometheus.yml"
# PROMETHEUS_RETENTION_TIME=1y
#
## Prometheus Pushgateway
# COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
#
## Loki
# Loki Server
#
# COMPOSE_FILE="$COMPOSE_FILE:compose.loki.yml"
#
# LOKI_LOG_LEVEL=warn
#
# Set to 0 to disable retention
# LOKI_RETENTION_PERIOD=744h
# LOKI_STORAGE_FILESYSTEM=1
#
## S3 Storage
# LOKI_STORAGE_S3=1
# LOKI_AWS_ENDPOINT=https://minio.autonomic.zone
# LOKI_AWS_REGION=eu-west-1
# LOKI_ACCESS_KEY_ID=bush-debrief-approval-robust-scraggly-molecule
# LOKI_BUCKET_NAMES=loki
# SECRET_LOKI_AWS_KEY_VERSION=v1
#
## Grafana
#
# COMPOSE_FILE="$COMPOSE_FILE:compose.grafana.yml"
# GF_SERVER_ROOT_URL=https://monitoring.example.com
# SECRET_GF_ADMINPASSWD_VERSION=v1
## Grafana's own domain. Defaults to $DOMAIN
## Change the value if you want Grafana on another domain.
# GRAFANA_DOMAIN=$DOMAIN
#
## Single-Sign-On with OIDC
# COMPOSE_FILE="$COMPOSE_FILE:compose.grafana-oidc.yml"
# OIDC_ENABLED=1
# SECRET_GF_OIDC_SECRET_VERSION=v1
# OIDC_CLIENT_ID=grafana
# OIDC_AUTH_URL="https://authentik.example.com/application/o/authorize/"
# OIDC_API_URL="https://authentik.example.com/application/o/userinfo/"
# OIDC_TOKEN_URL="https://authentik.example.com/application/o/token/"
#
## Additional grafana settings (unlikely to require editing)
# GF_SECURITY_ALLOW_EMBEDDING=1
# GF_INSTALL_PLUGINS=grafana-piechart-panel
#
## grafana SMTP configuration (optional)
# COMPOSE_FILE="$COMPOSE_FILE:compose.grafana-smtp.yml"
# GF_SMTP_HOST=changeme
# GF_SMTP_USER=changme
# GF_SMTP_ENABLED=true
# GF_SMTP_FROM_ADDRESS=grafana@example.com
# GF_SMTP_SKIP_VERIFY=false
# SECRET_GF_SMTP_PASS_VERSION=v1
#

## Grafana Matrix Contact Point (optional)
#COMPOSE_FILE="$COMPOSE_FILE:compose.matrix-alertmanager-receiver.yml"
#SECRET_MATRIX_TOKEN_VERSION=v1
#GF_MATRIX_USER_ID="<user-id>"
#GF_MATRIX_ROOM_ID="<room-id>"
#GF_MATRIX_HOMESERVER_URL="<homeserver-url>"

## ALerts

# Node disk space alert will trigger when free disk space left is below the given number in percent
#ALERT_NODE_DISK_SPACE_LEFT=10

# Node memory usage alert will trigger when memory usage is above the given number in percent
#ALERT_NODE_MEMORY_USAGE=85

# Loki ingestion alert will trigger when a host ships fewer than the given number of log entries per second
#ALERT_LOKI_INGESTION_STALLED=0.01

# Loki write error alert will trigger when log pushes fail at more than the given rate per second
#ALERT_LOKI_WRITE_ERRORS=0

# Loki WAL disk alert will trigger when the filesystem holding the WAL is above the given number in percent. Loki throttles all writes at 90
#ALERT_LOKI_WAL_DISK_USAGE=85