# Prometheus + Grafana for AgentHub's /api/metrics (docs/MONITORING.md).
#
#   DASHBOARD_ALLOWED_HOSTS=host.docker.internal agenthub start   # or npm start
#   GF_SECURITY_ADMIN_PASSWORD='<choose one>' docker compose -f docker-compose.monitoring.yml up -d
#   open http://127.0.0.1:3000   (user admin)
#
# The dashboard runs on the HOST; Prometheus reaches it via host.docker.internal
# (monitoring/prometheus/prometheus.yml). The Prometheus datasource and the three
# AgentHub boards are provisioned, so there is nothing to click. Both UIs bind
# loopback only.
services:
  prometheus:
    image: prom/prometheus:v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69
    container_name: agenthub-prometheus
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=90d
    volumes:
      - ./monitoring/prometheus:/etc/prometheus:ro
      - prometheus-data:/prometheus
    ports:
      - "127.0.0.1:9090:9090"
    # Linux needs the explicit mapping; Docker Desktop resolves it natively.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]

  grafana:
    image: grafana/grafana:13.1.2@sha256:d177053ab62253815f130d81504f77063baf5fd4ca93299d6048453bd31e047a
    container_name: agenthub-grafana
    restart: unless-stopped
    depends_on: [prometheus]
    environment:
      GF_SECURITY_ADMIN_USER: ${GF_SECURITY_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD:?set GF_SECURITY_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/agenthub-overview.json
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
    volumes:
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "127.0.0.1:3000:3000"
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]

volumes:
  prometheus-data:
  grafana-data: