---
version: "3.8"

services:
  app:
    image: grafana/alloy:v1.16.1
    hostname: "${DOMAIN}"
    configs:
      - source: config_alloy
        target: /etc/alloy/config.alloy
    volumes:
      - /:/rootfs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
      - alloy-data:/var/lib/alloy/data
    command:
      - "run"
      - "--storage.path=/var/lib/alloy/data"
      - "--server.http.listen-addr=0.0.0.0:12345"
      - "/etc/alloy/config.alloy"
    networks:
      - proxy
      - internal
    secrets:
      - basic_auth
    deploy:
      restart_policy:
        condition: on-failure
      labels:
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
        - "coop-cloud.${STACK_NAME}.version=1.6.0+v1.8.1"
        - "traefik.enable=true"
        - "traefik.swarm.network=proxy"
        - "traefik.http.services.${STACK_NAME}-alloy.loadbalancer.server.port=12345"
        - "traefik.http.routers.${STACK_NAME}-alloy.rule=Host(`alloy.${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}-alloy.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}-alloy.tls=true"
        - "traefik.http.routers.${STACK_NAME}-alloy.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}-alloy.middlewares=basicauth@file"
configs:
  config_alloy:
    template_driver: golang
    name: ${STACK_NAME}_config_alloy_${CONFIG_ALLOY_VERSION}
    file: config.alloy.tmpl
networks:
  proxy:
    external: true
  internal:
volumes:
  alloy-data:
secrets:
  basic_auth:
    external: true
    name: ${STACK_NAME}_basic_auth_${SECRET_BASIC_AUTH_VERSION}