docker-compose.monitoring.yaml

# Docker Compose override for Prometheus + Grafana monitoring stack
# Use with: docker compose -f docker-compose.yaml -f docker-compose.monitoring.yaml up -d

services:
  prometheus:
    image: "prom/prometheus:latest"
    container_name: nexusgate-prometheus
    volumes:
      - "./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro"
      - "prometheus_data:/prometheus"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.enable-lifecycle'
      - '--storage.tsdb.retention.time=15d'
    ports:
      - "${PROMETHEUS_PORT:-9090}:9090"
    restart: on-failure
    depends_on:
      - nexusgate

  grafana:
    image: "grafana/grafana:latest"
    container_name: nexusgate-grafana
    environment:
      - "GF_SECURITY_ADMIN_USER=${GRAFANA_USER:-admin}"
      - "GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}"
      - "GF_USERS_ALLOW_SIGN_UP=false"
      - "GF_SERVER_ROOT_URL=http://localhost:${GRAFANA_PORT:-3001}"
      # ============================================================
      # SECURITY NOTE: The following settings enable anonymous access
      # and iframe embedding for local development convenience.
      # For production, consider using Grafana's Public Dashboard
      # feature or an auth proxy instead of anonymous access.
      # ============================================================
      # Enable anonymous access for iframe embedding (read-only Viewer role)
      - "GF_AUTH_ANONYMOUS_ENABLED=true"
      - "GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer"
      # Allow embedding in iframes (disables X-Frame-Options: deny)
      - "GF_SECURITY_ALLOW_EMBEDDING=true"
    volumes:
      - "grafana_data:/var/lib/grafana"
      - "./grafana/provisioning:/etc/grafana/provisioning:ro"
    ports:
      - "${GRAFANA_PORT:-3001}:3000"
    restart: on-failure
    depends_on:
      - prometheus

volumes:
  prometheus_data:
  grafana_data: