Fleet log aggregation: Grafana + Loki + Alloy over the WireGuard mesh
A central Grafana + Loki stack (on beta) fed by a Grafana Alloy agent on
every node, replacing the old SSH-tailed single-host scripts/dashboard.py.
- docker-compose.yml: central Loki (mesh-only :3100) + Grafana (Caddy-fronted)
- loki/config.yml: single-binary, filesystem storage, 30-day retention
- alloy/config.alloy + docker-compose.agent.yml: per-node collector — every
container's stdout/stderr via the Docker socket, Caddy host logs, and the
app's structured JSON logs (errors/access/audit), each line tagged by node
- grafana/: auto-provisioned Loki datasource + a fleet-logs dashboard
(volume by service, error rate, upstream 429s, Caddy 5xx, notifier liveness,
live tail), with a per-node selector
- caddy-grafana.conf, README, .env.example
2026-07-21 16:11:52 +00:00
|
|
|
# Copy to .env on the monitoring host (beta) before `docker compose up`.
|
|
|
|
|
# .env is gitignored — never commit real secrets.
|
|
|
|
|
|
2026-07-21 16:18:29 +00:00
|
|
|
# The public hostname beta's Caddy serves Grafana at (see caddy-grafana.conf).
|
|
|
|
|
GRAFANA_DOMAIN=dashboard.thermograph.org
|
|
|
|
|
|
|
|
|
|
# Break-glass local admin (Google SSO below is the primary login). Keep this
|
|
|
|
|
# strong; it's the fallback if OAuth ever breaks.
|
Fleet log aggregation: Grafana + Loki + Alloy over the WireGuard mesh
A central Grafana + Loki stack (on beta) fed by a Grafana Alloy agent on
every node, replacing the old SSH-tailed single-host scripts/dashboard.py.
- docker-compose.yml: central Loki (mesh-only :3100) + Grafana (Caddy-fronted)
- loki/config.yml: single-binary, filesystem storage, 30-day retention
- alloy/config.alloy + docker-compose.agent.yml: per-node collector — every
container's stdout/stderr via the Docker socket, Caddy host logs, and the
app's structured JSON logs (errors/access/audit), each line tagged by node
- grafana/: auto-provisioned Loki datasource + a fleet-logs dashboard
(volume by service, error rate, upstream 429s, Caddy 5xx, notifier liveness,
live tail), with a per-node selector
- caddy-grafana.conf, README, .env.example
2026-07-21 16:11:52 +00:00
|
|
|
GF_ADMIN_USER=admin
|
|
|
|
|
GF_SECURITY_ADMIN_PASSWORD=change-me-to-something-strong
|
|
|
|
|
|
2026-07-21 16:18:29 +00:00
|
|
|
# --- Google SSO ------------------------------------------------------------------
|
|
|
|
|
# Create a Google Cloud "OAuth 2.0 Client ID" (type: Web application) and set:
|
|
|
|
|
# Authorized redirect URI: https://dashboard.thermograph.org/login/google
|
|
|
|
|
# Then paste the client id/secret here and flip OAUTH_ENABLED=true.
|
|
|
|
|
# Login is locked to pre-provisioned accounts (allow_sign_up=false) — provision
|
|
|
|
|
# your email as an admin (see README) so only you can sign in.
|
|
|
|
|
OAUTH_ENABLED=false
|
|
|
|
|
GOOGLE_CLIENT_ID=
|
|
|
|
|
GOOGLE_CLIENT_SECRET=
|
