---
name: grafana
networks:
  loki:

services:
    grafana:
        ports:
            - 3007:3000
        container_name: grafana
        image: grafana/grafana:latest
        labels:
            - com.centurylinklabs.watchtower.enable=true
            - homepage.group=Smarthome
            - homepage.name=Grafana
            - homepage.weight=1
            - homepage.icon=grafana.png
            - homepage.href=https://g.sectorq.eu
            - homepage.description=Graphs
            - homepage.server=my-docker
            - homepage.container=grafana
            # - homepage.widget.type=grafana
            # - homepage.widget.url=https://g.sectorq.eu
            # - homepage.widget.key=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
            # environment:
            #   - GF_AUTH_DISABLE_LOGIN_FORM=true
            #   - GF_AUTH_ANONYMOUS_ENABLED=true
            #   - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
            #   - GF_SECURITY_ALLOW_EMBEDDING=true
        restart: unless-stopped
        volumes:
            - /share/docker_data/grafana/data:/var/lib/grafana
            - /share/docker_data/grafana/certs:/certs
        user: "0:0"
        environment:
            GF_LOG_FILTERS: rendering:debug
            GF_RENDERING_SERVER_URL: http://renderer:8092/render
            GF_RENDERING_CALLBACK_URL: http://grafana:3000/
            GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
            GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
            GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "xc8AKsYOvHFmYnRjfnvt2YfgR5pg8Mlfc9YEqd3T"
            GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "gb5ThPlyIUN2I8UPvIKAqQBoGFmTAb7tFxt5OiJQkAG6Ef2HDKksNOjWPJFfXiO22RuCnWuyzl6IMqPYO6QTa55EYfoN5N87enh5MOhTXjo2JTTnEL1eZhEI1Sw1vBO8"
            GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
            GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://auth.sectorq.eu/application/o/authorize/"
            GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://auth.sectorq.eu/application/o/token/"
            GF_AUTH_GENERIC_OAUTH_API_URL: "https://auth.sectorq.eu/application/o/userinfo/"
            GF_AUTH_SIGNOUT_REDIRECT_URL: "https://auth.sectorq.eu/application/o/grafana/end-session/"
            GF_SERVER_ROOT_URL: https://g.sectorq.eu/
            # Optionally enable auto-login (bypasses Grafana login screen)
            GF_AUTH_OAUTH_AUTO_LOGIN: "true"
            # Optionally map user groups to Grafana roles
            GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'"
            GF_INSTALL_PLUGINS: https://storage.googleapis.com/integration-artifacts/alexanderzobnin-zabbix-app/4.5.7/main/163fabf651b776bf70adc08fa41bec4f52645374/alexanderzobnin-zabbix-app-4.5.7%2B163fabf6.linux_amd64.zip;alexanderzobnin-zabbix-app
        entrypoint:
            - sh
            - -euc
            - |
                mkdir -p /etc/grafana/provisioning/datasources
                cat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml
                apiVersion: 1
                datasources:
                - name: Loki
                  type: loki
                  access: proxy
                  orgId: 1
                  url: http://loki:3100
                  basicAuth: false
                  isDefault: true
                  version: 1
                  editable: false
                EOF
                /run.sh
        networks:
          - loki


    loki:
        image: grafana/loki:latest
        ports:
            - "3100:3100"
        command: -config.file=/etc/loki/local-config.yaml
        networks:
            - loki

    promtail:
        image: grafana/promtail:latest
        volumes:
            - /var/log:/var/log
            - /share/docker_data/grafana/promtail/config.yml:/etc/promtail/config.yml
        command: -config.file=/etc/promtail/config.yml
        networks:
            - loki

    renderer:
        image: grafana/grafana-image-renderer:latest
        restart: unless-stopped
        ports:
            - 8092
        labels:
            - com.centurylinklabs.watchtower.enable=true
            - homepage.group=Smarthome
            - homepage.name=Music Assistant
            - homepage.weight=1
            - homepage.icon=music-assistant.png
            - homepage.href=http://192.168.77.101:8095
            - homepage.description=Music assistant
            - homepage.server=my-docker
            - homepage.container=music-assistant-server
        # espresense:
        #   image: espresense/espresense-companion
        #   ports:
        #     - 8267:8267
        #   volumes:
        #     - ./data/espresense:/config/espresense