# =============================================================================
# Compose project environment for the node-01 monitoring stack
# =============================================================================
# This file is committed on purpose: it holds no credentials. Portainer loads it
# as the Compose project `.env` beside deploy/docker-compose.yml, which is how
# the stack gets its defaults without duplicating twenty values in the Portainer
# stack definition.
#
# Values that are NOT here, and where they live instead:
#
#   GRAFANA_ADMIN_PASSWORD  Portainer stack environment variable. Grafana runs as
#                           uid 472 and cannot traverse the 0750 secrets
#                           directory under the operator's home, so a file mount
#                           is not an option. Portainer redacts it on read.
#   TEMPO_S3_ACCESS_KEY     /home/mildgrim/monitoring/secrets/seaweedfs.env,
#   TEMPO_S3_SECRET_KEY     sourced by config-seed at seed time. Provisioned by
#                           scripts/provision-secrets.ps1.
#
# Precedence: a Portainer stack environment value overrides anything set here,
# because stack env reaches the compose process as process environment.
# =============================================================================

# --- identity -------------------------------------------------------------
# Baseline used by every series, log stream and alert. Keep business_service in
# step with the business_service values Gatus queries.
OBS_ENV=homelab
OBS_BUSINESS_SERVICE=platform-homelab
OBS_HOST_NAME=docker-node-01

# --- bind address ---------------------------------------------------------
# The LAN address of docker-node-01. Nothing is published on WireGuard or WAN:
# the only ingress is the Caddy edge, which reaches these ports over the tunnel.
# Three routes exist today, and only one of them accepts writes:
#   monitoring.mildgrim.com  Grafana, behind its own admin login
#   status.mildgrim.com      Gatus, anonymous, endpoints hide hostnames and URLs
#   otlp.mildgrim.com        OTLP/HTTP trace intake (port 4320, see below)
# Every other port stays unreachable from the internet.
MONITORING_BIND_IP=192.168.1.6
MONITORING_SUBNET=172.16.208.0/24

# --- published ports ------------------------------------------------------
# 3000 is Gitea on this host, so Grafana is 3002. The rest are free and were
# checked against the running estate.
GRAFANA_HOST_PORT=3002
GATUS_HOST_PORT=8080
VM_HOST_PORT=8428
VL_HOST_PORT=9428
TEMPO_HTTP_PORT=3200
TEMPO_OTLP_GRPC_PORT=4317
TEMPO_OTLP_HTTP_PORT=4318
ALERTMANAGER_HOST_PORT=9093
BLACKBOX_HOST_PORT=9115
ALLOY_HOST_PORT=12345
# The OTLP ingress of alloy-otlp-ingress. This is the only externally writable
# port in the stack: the Caddy edge proxies otlp.mildgrim.com to it, and
# OpenRouter Broadcast posts traces here. It is not anonymous — the receiver
# rejects any request without the bearer token in OPENROUTER_OTLP_TOKEN, which
# reaches the container through the seeded config volume, never through this
# file.
ALLOY_OTLP_HOST_PORT=4320

# --- retention ------------------------------------------------------------
# Right-sized for a 107G-free node: the NAS-backed store arrives with the
# Kubernetes cluster.
VM_RETENTION=1
VL_RETENTION=4w
VMALERT_METRICS_INTERVAL=30s
VMALERT_LOGS_INTERVAL=1m

# --- config image ---------------------------------------------------------
# Built and pushed by .gitea/workflows/build-config-image.yml. `latest` is the
# intended state; override with a commit-SHA tag to roll back without touching
# the compose file.
CONFIG_IMAGE=git.mildgrim.com/mildgrim/monitoring-by-fiwe:latest

# --- Grafana --------------------------------------------------------------
GRAFANA_ADMIN_USER=admin
# The canonical browser URL, served by the Caddy edge in ../vps-infrastructure.
# Grafana supports exactly one: it builds post-login redirects from it, so the
# LAN address only serves the login page and a session never lives there.
GRAFANA_PUBLIC_URL=https://monitoring.mildgrim.com/

# --- Tempo object storage (SeaweedFS on docker-node-02) --------------------
# Bare host:port without scheme; Tempo's S3 client pairs this with insecure=true.
# The access and secret keys are not here; see the header.
TEMPO_S3_ENDPOINT=docker.lan.mildgrim.com:10000
TEMPO_S3_BUCKET=observability-traces
TEMPO_S3_REGION=us-east-1

# --- Alerting -------------------------------------------------------------
# Where Alertmanager delivers. Empty means the compose default, a TEST-NET-1
# address: firing alerts stay visible in the UI and delivery failures are loud
# in the log instead of being silently swallowed. Set a real webhook (a Matrix
# bridge, a chat relay, the estate notify endpoint) when one exists.
ALERT_WEBHOOK_URL=

# --- misc -----------------------------------------------------------------
TZ=Europe/Stockholm

# --- how this file is applied ---------------------------------------------
# This is the Compose project environment for the Portainer stack `monitoring`
# (id 168, endpoint 3). A push that touches it fires deploy-monitoring.yml,
# which POSTs the stack webhook; Portainer re-clones the repository and
# re-applies deploy/docker-compose.yml. No shell access to the node is involved
# and nothing needs to be copied to /home/mildgrim/monitoring.
